Internal SG-SST audits: managing the programme, findings and verified closure with software
An internal SG-SST audit provides greater value when it follows an entire process, from the identified risk to verification of the control. Checking that a document exists is only part of the work. Establishing whether it describes actual operations and whether its measures function requires comparison of records, observation of activities and conversations with people.
Software can support that journey when it organises the programme, evidence and findings coherently. The team first needs to define audit criteria and responsibilities. A collection of completed forms does not, by itself, explain whether the management system is effective in everyday use.
Plan the audit and protect independence
Colombia’s Decree 1072 of 2015, article 2.2.4.6.29, provides for an annual audit planned with participation from the COPASST or safety representative. Internal auditors must be independent of the activity audited. Digital permissions and auditor assignments should reflect this separation of responsibilities.
Define the scope, criteria, processes, sites and period under examination. Record the competencies required, resources and dates as well. The Explore entry on OSH audits supplies the conceptual framework; the programme should specify how it applies to the company and its particular risks.
Choose samples that reveal how work happens
A useful sample includes completed and open cases, sites with different operations and recent changes. Explain the selection rationale. Choosing only the best-prepared records can produce a tidy report while providing a very incomplete picture of normal working practices and unresolved difficulties.
For example, to audit contractor management, follow a service from procurement to its final assessment. Compare the plan with actual conditions, communications during delivery and the handling of incidents. Retain stable references to each piece of evidence, its date and the version examined, without downloading unnecessary personal information.
Write findings that people can understand and address
A finding should allow someone who did not attend the interview to understand what was checked. Separate the criterion, the observed evidence and the conclusion. Phrases such as “improve training” are too open-ended to support a clear response or subsequent verification of the result.
A more useful statement would explain that the sample of job changes lacked evidence of the competency checks required by the internal procedure. Identify the specific records and the sample’s boundaries. Classify the finding according to the audit’s established criteria, rather than automatically assigning severity from a keyword appearing in its description.
- The requirement or criterion being audited.
- An objective account of the evidence and its location.
- The process, site and people responsible for responding.
- Any immediate action needed.
- The date and method for verifying the response.
Example: attendance recorded, competence unverified
Imagine a company with attendance records for a session on work equipment, but no practical competency check in the sample, despite its own procedure requiring one. Uploading the attendance list again does not address the cause. Analysis may reveal that nobody was responsible for recording the assessment following a shift change.
The response could include reviewing responsibilities, completing outstanding checks and examining a later sample. This example is illustrative. The appropriate measure depends on the actual finding and professional assessment; repeating a course will not resolve every training-related problem or every gap in competence records.
Verify closure and examine recurrence
The action owner implements the measure and provides evidence. The verifier assesses whether that evidence is sufficient and whether it addresses the identified cause. Separate “implemented” and “verified” states help avoid premature administrative closure. Corrective measures need to remain connected to the problem they are intended to resolve.
If the same finding recurs, retrieve the previous response and examine which assumption failed. Review postponed actions too: a revised deadline should include an explanation and the arrangements for managing risk while a solution is pending. The article on overdue actions and verified closure develops this follow-up approach.
Test the entire journey in a demonstration
Before procurement, ask to run an example from programme planning through the report and verification. Check whether the reviewed version is retained, how a change of auditor is handled and what access remains when the assignment ends. Connect results with senior management review, where resources and priorities will be decided.
Explore Sabentis for organising OSH management against these requirements. The demonstration should reveal the process’s traceability and the clarity of everyday work, alongside the visual presentation of the final audit report.
Quality checks for an audit case file
Before finalising the report, choose one finding and ask another person to reconstruct how it was reached. This exercise reveals conclusions that seem clear to the auditor but leave questions for the people responsible for addressing them.
- Check that each cited item corresponds to the version and period actually examined during the audit work.
- Confirm that recurring findings retain a reference to the earlier case and the response provided at that time.
- Locate discarded samples and document why they did not provide sufficient information for the intended check.
- Separate disagreements about facts from disagreements about interpretation and record how they were resolved before reporting.
- Test that an action owner can consult the necessary context without gaining access to unrelated interview records.
Frequently asked questions
Does a completed checklist demonstrate that an audit was effective?
On its own, it does not establish the depth of the examination. Check whether answers have identifiable supporting evidence and whether the sample reflects the audited activity. A positive checkbox may conceal a review of procedure availability without any examination of actual implementation.
What if two sites have the same finding?
Investigate whether they share a cause or merely look similar. A corporate action with local verification may be appropriate, but each site needs its own supporting evidence. Avoid closing both cases simply because one location has demonstrated that the measure works there.
Can the person implementing an action also confirm its effectiveness?
Distinguish a declaration of completion from subsequent verification and allocate that review according to competence, risk and the internal procedure. Even if software permits an immediate status change, closure rules should specify which evidence is examined and who decides it is sufficient.
How should a finding disputed by the audited department be handled?
Retain the criterion, the facts and the department’s response. Request information that can clarify the disagreement and document the conclusion. The case should show how the objection was assessed, without removing evidence merely because it makes agreement on the report more difficult.
Legislation and sources consulted
- Decree 1072 of 2015: Colombia: articles 2.2.4.6.29 and 2.2.4.6.30 address SG-SST audits.
- ILO: ILO-OSH 2001 audit matrix: International methodology for examining strengths, weaknesses and opportunities for improvement; it does not replace Colombian requirements.
Sources consulted on 6 October 2026. The practical checklist proposes management checks; its application should reflect each organisation’s scope.
