How to prepare for a health and safety audit.

Not as such: the law requires monitoring and review, and an audit is one way to do it. Every employer must have arrangements for the effective planning, organisation, control, monitoring and review of their health and safety measures, and must record them if they employ five or more people (regulation 5 of the Management of Health and Safety at Work Regulations 1999). HSE says formal audits may be useful in some circumstances (HSG65).

Both your paperwork and how the work is really done. HSE says paperwork on its own is not a good measure of performance: you need to check that your plans have been put into practice and how well the risks are controlled (HSG65). Expect the auditor to read your policy, risk assessments and records, walk the site and talk to supervisors and workers.

Someone competent, and ideally independent of the work being audited. HSE says someone independent, perhaps from another part of the business, can add value when you review your performance (HSG65). If you have a competent person in your own workforce, HSE says use them in preference to an outside adviser. Either way, your legal duties stay with your business.

In Check, and its findings feed Act. HSE's approach is to plan how you will manage health and safety, do it, check how well your controls are working, then act on what you find. Checking includes workplace checks, investigating incidents and, where useful, formal audits. Acting means updating your policy and risk assessments and following through on audit findings (HSE, HSG65).

Active monitoring checks your controls before things go wrong; reactive monitoring learns from things that have already gone wrong (HSG65). Active examples include routine inspections of premises, plant and equipment, and health surveillance. Reactive examples include investigating accidents and incidents, and monitoring ill health and sickness absence. The measures are also called leading and lagging indicators, and HSE says to look beyond accident figures.

Yes. HSE says some organisations win greater support for health and safety by involving workers in monitoring, and HSG65 lists issues raised by workers among the information to gather when you review performance. Ask the people doing the job what really happens and what worries them. They often know where the real risks are.

No, the law does not require it. HSE says ISO 45001 may help you show you comply with health and safety law, but in some respects it goes beyond what the law requires, so consider carefully whether to adopt it. Some clients ask for it, but HSE says they should consider whether a supplier can show competence in other ways.

Act on them, starting with the most serious risks. Give every action an owner and a date, tell the people affected what was found, and check that completed actions have really changed things on site. HSE says it is crucial to report review findings across the organisation, and to make sure remedial actions have been carried out and work (HSG65).