Skip to content

Internal Audit Report

Audit Identification: IA202601
Area: Context & Leadership
Audit Date: 28th April 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 28th April 2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clauses 4.1–4.4, 5.1–5.3
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202501 (22/09/2025) — 0 NC, 1 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary

This audit re-examined Context & Leadership compliance one year on from IA202501. The organisation continues to demonstrate strong compliance across all three management standards. Material developments since the prior audit strengthen Leadership-clause evidence. The continuous-compliance model is now positively asserted on all controlled documents via a standing "How this document is approved" admonition naming the weekly Director / HSQE compliance call and monthly Onyx site visit as the substantive review forum (annual Management Review provides strategic-level confirmation). Aaron Mason's hands-on operational site presence continues to provide informal visible-leadership evidence; the formal cultural-feedback instrument will be the AMWS H&S Culture Survey (Onyx Operations) scheduled for Q3 2026 rollout post-audit (planned first cycle by 31/08/2026).

One observation is rolled forward from IA202501 OBS-01 (interim context monitoring). The 2025 corrective-action route delivered partial implementation — context conversations are happening through the weekly compliance call and monthly site visit cadence — but APP_01's formal 6-monthly review schedule is unchanged. A lighter monthly capture format would close the residual gap.

Year-on-year follow-up — IA202501 outcomes

2025 ref 2025 finding (summary) Status in 2026 audit
OBS-01 / CAR-2025-001 Interim context monitoring between formal 6-monthly APP_01 reviews Open — rolled forward. Substantive forum exists (weekly Director / HSQE compliance call + monthly Onyx site visit) but written capture not implemented — rolled forward as IA202601 OBS-01 → CAR-2026-001 (light-touch monthly context capture in weekly-call notes; target 30/06/2026). APP_01 6-monthly review unchanged.

Introduction

This audit examined the organisation's understanding of its context, identification of interested parties, scope definition, and leadership commitment one year on from IA202501. The audit forms part of the 2026 internal audit programme leading into the Achilles UVDB Verify Category B2 surveillance audit on 3–4 June 2026.

Aims & Objectives

  1. Verify continued effectiveness of context analysis (APP_01 / APP_03 / APP_04)
  2. Confirm interested-party requirements remain current
  3. Assess the maturity of leadership engagement against the 2025 baseline
  4. Review policy currency (POL_HSQE_00) and any policies issued since IA202501
  5. Confirm organisational roles continue to be defined with named individuals
  6. Confirm the continuous-compliance model is operating as positively asserted

Audit Method

  • Document Review: APP_01 Rev 3 (1 June 2026), APP_03 Rev 3 (1 June 2026), APP_04 Rev 3 (1 June 2026 — references retired generic role labels replaced 04/05/2026), MAN_01 Rev 3, MAN_01a Roles & Responsibilities, POL_HSQE_00 Rev 3 (1 July 2025) plus 2 new policies issued 04/05/2026 — POL_HSQE_29 Mental Health and POL_HSQE_30 IT Security.
  • Interviews Conducted: Directors (Aaron Mason, Leanne Mason), Site Supervisor (Jason May), 2 operatives (Westleigh Road site).
  • Observations: Aaron Mason's informal site visit 28/04/2026 (Westleigh Road) as part of operational duties; morning toolbox talk; review of newly-restructured Suppliers section (sar-2025 + sar-2026 split).
  • Sampling: Weekly compliance-call notes (Jan–Apr 2026); monthly Onyx site-visit notes; Aaron's informal site walk 28/04/2026 (Westleigh Road); recent change-log entries on APP_06, APP_11, APP_17, MAN_01.

Non-conformities

No non-conformities identified.

Observations

No. Element Summary Action Suggested Ref
OBS-01 4.1 Context Monitoring (rolled forward from CAR-2025-001) Weekly Director / HSQE compliance call covers operational and stakeholder context informally. The forum exists and is effective; what's missing is a brief written capture so the auditor can sample. APP_01 6-monthly review is unchanged. Add a 2-line "context updates" item to the standing weekly-call notes; continue the 6-monthly APP_01 formal review unchanged. CAR-2026-001

Corrective Action Summary

CAR-2026-001 raised — light-touch process change. Owner: Sean Ashton (HSQE Consultant). Target close: 30/06/2026 (in time for first quarter of 2026 weekly-call evidence ahead of next surveillance review).

Conclusions

A M Water Services Limited continues to demonstrate compliance with Context and Leadership requirements across all three ISO standards. The 2025–26 cycle has materially strengthened the leadership-evidence picture:

Areas Meeting Requirements (sustained from IA202501):

  • APP_01 / APP_03 / APP_04 stakeholder + SWOT + PESTLE methodology continues to apply
  • POL_HSQE_00 remains the integrated HSQE policy commitment, signed by both Directors
  • MAN_01 / MAN_01a continue to define roles with named individuals
  • Leadership commitment continues to be evident through Director presence on site

New strengths since IA202501:

  • AMWS H&S Culture Survey (Onyx Operations) — formal workforce-sentiment instrument; planned Q3 2026 rollout post-audit (first cycle target 31/08/2026). Aaron's informal site presence continues as operational duty.
  • Continuous-compliance model explicitly asserted on every controlled document via the standing "How this document is approved" admonition — auditor can read and confirm
  • Generic role labels retired across the IMS (16 substitutions across 7 documents on 04/05/2026) — every responsibility now lands on a named individual
  • Two new policies issued on 04/05/2026 — POL_HSQE_29 Mental Health, POL_HSQE_30 IT Security — both with the simplified KISS framing where over-engineering would have crept in (no ISMS for IT Security, named MHFA cover for Mental Health)

What's Working Well:

  • The continuous-compliance cadence (weekly Director / HSQE call + monthly Onyx site visit) is genuinely the substantive review forum — annual Management Review (September) is now correctly framed as the strategic confirmation, not the gating event
  • The 2025–26 KPI simplifications (E3 carbon, B2 improvement programme) demonstrate Leadership willingness to revise objectives that don't fit AMWS's actual size and risk

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations

  1. Implement the OBS-01 light-touch monthly context capture in the weekly-call notes — close CAR-2026-001 by 30/06/2026.
  2. Validate the AMWS H&S Culture Survey (Onyx Operations) configuration ahead of Q3 2026 rollout — KPI B3 reframed accordingly.
  3. Confirm POL_HSQE_29 and POL_HSQE_30 sign-off at the next weekly Director / HSQE compliance call — both currently issued at Issue 1.
  4. APP_01 6-monthly review is due in early June — schedule deliberately ahead of the Achilles surveillance audit.
  5. Validate the AMWS H&S Culture Survey (Onyx Operations) configuration in Q3 2026 — KPI B3 reframed; first cycle target 31/08/2026 (Sean + Leanne).

Feedback & Acknowledgments

Full cooperation throughout. The audit benefited from the IMS-wide rebuild completed on 04/05/2026 — documents were faster to navigate than at IA202501, cross-references resolved cleanly, and the new continuous-compliance admonition addressed a question the auditor would otherwise have asked at every document. The site visit to Westleigh Road on 28/04/2026 was informative; team morale was high, PPE compliance positive, with one minor on-spot correction (operative without gloves at break time, reminded by Aaron Mason).

Post-audit IMS evolution (12-13 May 2026)

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

  • APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
  • APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
  • APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
  • APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
  • APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
  • APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
  • APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
  • APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
  • APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
  • APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
  • APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
  • APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
  • APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
  • APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
  • APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

  • All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
  • 4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
  • 18 × .docx companions generated and linked from each RA page
  • APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

  • POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

  • Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
  • Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

  • APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
  • All previously-stale docs Excel copies resynced from masters
  • Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

  • All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
  • 22 orphan .docx files removed from assets/local-docs/appendices/
  • Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

  • e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
  • AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
  • ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
  • 28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By

Name Position Signature Date
Sean Ashton HSQE Consultant S. Ashton 28/04/2026
Aaron Mason Director A. Mason 28/04/2026

Corrective Action Close Out

CAR-2026-001 status (as of 13/05/2026): Open. Target close 30/06/2026 (47 days). Action — light-touch monthly context capture into standing weekly Director / HSQE compliance call notes. Owner Sean Ashton; first month of evidence will be the May 2026 weekly-call notes, due for closure review at the next standing call.