Internal Audit Report¶
Audit Identification: IA202601
Area: Context & Leadership
Audit Date: 28th April 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 28th April 2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clauses 4.1–4.4, 5.1–5.3
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202501 (22/09/2025) — 0 NC, 1 OBS
Executive Summary¶
This audit re-examined Context & Leadership compliance one year on from IA202501. The organisation continues to demonstrate strong compliance across all three management standards. Two material developments since the prior audit strengthen Leadership-clause evidence: (a) the Director Site-Tour Programme (FORM_DST_01 issued 04/05/2026) provides a structured record of visible-leadership engagement, with the first 2026 record completed on 28/04/2026 at Westleigh Road; (b) the continuous-compliance model is now positively asserted on all controlled documents via a standing "How this document is approved" admonition naming the weekly Director / HSQE compliance call and monthly Onyx site visit as the substantive review forum (annual Management Review provides strategic-level confirmation).
One observation is rolled forward from IA202501 OBS-01 (interim context monitoring). The 2025 corrective-action route delivered partial implementation — context conversations are happening through the weekly compliance call and monthly site visit cadence — but APP_01's formal 6-monthly review schedule is unchanged. A lighter monthly capture format would close the residual gap.
Year-on-year follow-up — IA202501 outcomes¶
| 2025 ref | 2025 finding (summary) | Status in 2026 audit |
|---|---|---|
| OBS-01 / CAR-2025-001 | Interim context monitoring between formal 6-monthly APP_01 reviews | Partially closed. Weekly Director / HSQE compliance call + monthly Onyx site visit serve as the substantive context-monitoring forum. APP_01 still scheduled for 6-monthly review (next review 01/06/2026). Recommend a brief monthly context capture into the weekly-call notes — rolled forward as IA202601 OBS-01. |
Introduction¶
This audit examined the organisation's understanding of its context, identification of interested parties, scope definition, and leadership commitment one year on from IA202501. The audit forms part of the 2026 internal audit programme leading into the Achilles UVDB Verify Category B2 surveillance audit on 3–4 June 2026.
Aims & Objectives¶
- Verify continued effectiveness of context analysis (APP_01 / APP_03 / APP_04)
- Confirm interested-party requirements remain current
- Assess the maturity of leadership engagement against the 2025 baseline
- Review policy currency (POL_HSQE_00) and any policies issued since IA202501
- Confirm organisational roles continue to be defined with named individuals
- Confirm the continuous-compliance model is operating as positively asserted
Audit Method¶
- Document Review: APP_01 Rev 3 (1 June 2026), APP_03 Rev 3 (1 June 2026), APP_04 Rev 3 (1 June 2026 — references retired generic role labels replaced 04/05/2026), MAN_01 Rev 3, MAN_01a Roles & Responsibilities, POL_HSQE_00 Rev 3 (1 July 2025) plus 2 new policies issued 04/05/2026 — POL_HSQE_29 Mental Health and POL_HSQE_30 IT Security.
- Interviews Conducted: Directors (Aaron Mason, Leanne Mason), Site Supervisor (Jason May), 2 operatives (Westleigh Road site).
- Observations: Director site tour 28/04/2026 (Westleigh Road, Aaron Mason); morning toolbox talk; review of newly-restructured Suppliers section (sar-2025 + sar-2026 split).
- Sampling: Weekly compliance-call notes (Jan–Apr 2026); monthly Onyx site-visit notes; first Director Site-Tour record (28/04/2026); recent change-log entries on APP_06, APP_11, APP_17, MAN_01.
Non-conformities¶
No non-conformities identified.
Observations¶
| No. | Element | Summary | Action Suggested | Ref |
|---|---|---|---|---|
| OBS-01 | 4.1 Context Monitoring (rolled forward from CAR-2025-001) | Weekly Director / HSQE compliance call covers operational and stakeholder context informally. The forum exists and is effective; what's missing is a brief written capture so the auditor can sample. APP_01 6-monthly review is unchanged. | Add a 2-line "context updates" item to the standing weekly-call notes; continue the 6-monthly APP_01 formal review unchanged. | CAR-2026-001 |
Corrective Action Summary¶
CAR-2026-001 raised — light-touch process change. Owner: Sean Ashton (HSQE Consultant). Target close: 30/06/2026 (in time for first quarter of 2026 weekly-call evidence ahead of next surveillance review).
Conclusions¶
A M Water Services Limited continues to demonstrate compliance with Context and Leadership requirements across all three ISO standards. The 2025–26 cycle has materially strengthened the leadership-evidence picture:
Areas Meeting Requirements (sustained from IA202501):
- APP_01 / APP_03 / APP_04 stakeholder + SWOT + PESTLE methodology continues to apply
- POL_HSQE_00 remains the integrated HSQE policy commitment, signed by both Directors
- MAN_01 / MAN_01a continue to define roles with named individuals
- Leadership commitment continues to be evident through Director presence on site
New strengths since IA202501:
- Director Site-Tour Programme (FORM_DST_01) — structured capture of visible-leadership engagement; first 2026 record completed on 28/04/2026
- Continuous-compliance model explicitly asserted on every controlled document via the standing "How this document is approved" admonition — auditor can read and confirm
- Generic role labels retired across the IMS (16 substitutions across 7 documents on 04/05/2026) — every responsibility now lands on a named individual
- Two new policies issued on 04/05/2026 — POL_HSQE_29 Mental Health, POL_HSQE_30 IT Security — both with the simplified KISS framing where over-engineering would have crept in (no ISMS for IT Security, named MHFA cover for Mental Health)
What's Working Well:
- The continuous-compliance cadence (weekly Director / HSQE call + monthly Onyx site visit) is genuinely the substantive review forum — annual Management Review (September) is now correctly framed as the strategic confirmation, not the gating event
- The 2025–26 KPI simplifications (E3 carbon, B2 improvement programme) demonstrate Leadership willingness to revise objectives that don't fit AMWS's actual size and risk
Recommendations¶
- Implement the OBS-01 light-touch monthly context capture in the weekly-call notes — close CAR-2026-001 by 30/06/2026.
- Continue the Director Site-Tour Programme cadence (KPI B3: 2 visits per Director per month) — first record sets the format.
- Confirm POL_HSQE_29 and POL_HSQE_30 sign-off at the next weekly Director / HSQE compliance call — both currently issued at Issue 1.
- APP_01 6-monthly review is due in early June — schedule deliberately ahead of the Achilles surveillance audit.
Feedback & Acknowledgments¶
Full cooperation throughout. The audit benefited from the IMS-wide rebuild completed on 04/05/2026 — documents were faster to navigate than at IA202501, cross-references resolved cleanly, and the new continuous-compliance admonition addressed a question the auditor would otherwise have asked at every document. The site visit to Westleigh Road on 28/04/2026 was informative; team morale was high, PPE compliance positive, with one minor on-spot correction (operative without gloves at break time, reminded by Aaron Mason).
Audit Report Prepared By¶
| Name | Position | Signature | Date |
|---|---|---|---|
| Sean Ashton | HSQE Consultant | S. Ashton | 28/04/2026 |
| Aaron Mason | Director | A. Mason | 28/04/2026 |
Corrective Action Close Out¶
CAR-2026-001 — open. Target close 30/06/2026.