Skip to content

Internal Audit Report

Audit Identification: IA202602
Area: Planning
Audit Date: 29th April 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 29th April 2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clauses 6.1–6.3
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202502 (22/09/2025) — 0 NC, 2 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary

This audit re-examined Planning compliance one year on from IA202502. Both 2025 observations are now closed by substantive evidence rather than rhetorical commitment:

  • CAR-2025-002 (Management of Change documentation) — closed. The 2025–26 cycle generated multiple major changes that have been formally recorded in change-log entries on each affected document: SOP HTML migration (44 SOPs rebuilt to standalone HTML format), retirement of 16 generic role labels across 7 docs, KPI simplifications (APP_11 E3 + B2; APP_06 Aspects 1 + 9), two new policies (POL_HSQE_29 Mental Health, POL_HSQE_30 IT Security), one new RA (RA_HO_18 Fatigue), restructured Suppliers section with year-on-year SAR archive, BCP testing log backfilled, Section 10 cross-reference errors fixed in APP_17. SOP 5.2 Management of Change has been demonstrably exercised.
  • CAR-2025-003 (cross-referencing APP_06 aspects ↔ APP_05 risks) — Open — rolled forward as CAR-2026-002. APP_06 Aspect 1 (Emissions) and Aspect 9 (Energy Use) have been re-issued with explicit alignment to APP_11 KPI E3 and to the customer (Anglian / Severn Trent) PR24 supply-chain net-zero programmes. The remaining 12 aspects in APP_06 (now 14 aspects total including the two [NEW 2026] additions) carry forward as IA202602 OBS-01.

One new observation captures a programme-level item: 5 of the 15 P1 gap-closure tracker items remain open ahead of the 3–4 June 2026 audit (BCP desktop, carbon baseline, training cert replacements, PPE register consolidation, EAP decision). All have named owners and target dates within May 2026; this is being managed within the planning framework but warrants a Director-level rather than HSQE-level focus.

Year-on-year follow-up — IA202502 outcomes

2025 ref 2025 finding (summary) Status in 2026 audit
OBS-01 / CAR-2025-002 Management of Change formal change assessments could be strengthened Closed. Multiple major changes since 04/2025 documented in formal change-log entries on each affected appendix, policy and SOP. SOP 5.2 demonstrated through use, not just written.
OBS-02 / CAR-2025-003 Cross-referencing APP_06 aspects ↔ APP_05 risks Open — rolled forward as CAR-2026-002. Aspects 1 (Emissions) + 9 (Energy) cross-referenced; remainder rolled forward as IA202602 OBS-01.

Introduction

This audit examined Planning processes — risks/opportunities (6.1), HSQE objectives (6.2), management of change (6.3) — one year on from IA202502 and after a substantial IMS refresh in April–May 2026. The audit assessed whether the 2025 OBSes were closed, whether the IMS rebuild has introduced any planning-clause regressions, and whether the simplified KPI framing (E3, B2) holds together as a coherent objectives set.

Aims & Objectives

  1. Confirm closure or progress on IA202502 OBS-01 and OBS-02
  2. Assess whether the simplified KPI framing (post-04/05/2026) remains compliant with 6.2 SMARTER requirements
  3. Review APP_05 Risk & Opportunity Log for currency and coverage of new 2026 risks (cyber, climate-physical, supplier-IT)
  4. Verify SOP 5.2 has been applied to the 2025–26 IMS rebuild events
  5. Confirm legal compliance obligations (APP_10) remain identified and addressed
  6. Spot-check the 5 still-open P1 gap-closure items have named owners and dates

Audit Method

  • Document Review: APP_05 Risk & Opportunity Log Rev 3 (1 June 2026), APP_06 Aspect Identification Log Rev 3 (with 04/05/2026 simplification entry), APP_11 Register of HSQE Objectives & KPIs Rev 3 (with 04/05/2026 E3 + B2 simplifications), APP_15 Life-cycle Analysis Rev 3, SOP 3.2 Business Risk & Opportunity Planning Rev 3 HTML (rebuilt to SOP 3.4 standard), SOP 3.4 Setting & Reviewing HSQE Objectives Rev 3 HTML, SOP 5.2 Management of Change Rev 3 HTML.
  • Interviews Conducted: Director (Aaron Mason — KPI owner for Q1, Q2, E3, H1, B3); HSQE Consultant (Sean Ashton — KPI owner for Q3, E1, B2; methodology owner); Site Supervisor (Jason May — KPI owner for E2, H2, B1).
  • Observations: Review of change-log entries on APP_06, APP_11, APP_17, APP_19, MAN_01, multiple policies and SOPs; gap-closure tracker review; APP_19 SAR refresh (Issue 4, 16/04/2026).
  • Sampling: 6 substantive change events from the 2025–26 cycle (SOP HTML migration; role-label retirement; APP_19 SAR refresh; APP_17 testing-log backfill; POL_HSQE_29 issue; POL_HSQE_30 issue) — each traced through the change-log entries.

Non-conformities

No non-conformities identified.

Observations

Ref Finding Clause Priority Ref
OBS-01 The 2025–26 cycle has begun the cross-referencing improvement called for in IA202502 OBS-02 — APP_06 Aspects 1 and 9 are now explicitly linked to APP_11 KPI E3 and to the customer net-zero programmes. The remaining 12 aspects in APP_06 (Waste, Spillages, Noise, Dust, Water Use, Chemical Use, Habitat Disturbance, Material Storage, Traffic Impact, Asbestos) have not yet received the same treatment. 6.1.2 Low CAR-2026-002

(Optional note for the auditor — not a formal observation: 5 of the 15 P1 gap-closure tracker items remain open. All have named owners and target dates within May 2026; tracking is via the standing weekly Director / HSQE compliance call. This is programme management within the planning framework, not a planning-clause finding.)

Corrective Action Summary

CAR-2026-002 raised. Owner: Sean Ashton (HSQE Consultant). Target close: 31/08/2026 — completing the APP_06 ↔ APP_05 cross-reference exercise across all 14 aspects.

Conclusions

The Planning processes have matured significantly in the 2025–26 cycle:

Areas Meeting Requirements (sustained from IA202502):

  • A+B+C×D aspect significance methodology continues to apply consistently
  • APP_05 Risk & Opportunity Log maintained with bi-annual review cycle; new 2026 risk categories (cyber, climate-physical) added to APP_17 BCP scenario set
  • APP_11 KPIs continue to address all three ISO standards with named owners and named evaluation methods
  • APP_10 Legal & Compliance Register maintained; 72 items at Rev 3

New strengths since IA202502:

  • Demonstrated SOP 5.2 use. Multiple substantive changes formally captured — the auditor can read the change-log entries and trace the management-of-change pathway.
  • Simplified objectives that pass SMARTER honestly. E3 reframed from logically-incoherent "5% reduction against unestablished baseline" to "measure-and-report; align with customer programmes". B2 reframed from arbitrary "≥3 improvements/quarter" count to "active programme reviewed quarterly with documented outcomes". Both rationalised in their change-log entries.
  • Aspects-to-KPIs alignment — APP_06 Aspect 1 and Aspect 9 now explicitly land on APP_11 E3.
  • 5 still-open P1 items have named owners + target dates — programme is being actively managed.

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations

  1. Close CAR-2026-002 by completing APP_06 cross-references to APP_05 across the remaining 12 aspects (target 31/08/2026 — post-audit).
  2. Continue the standing weekly Director / HSQE compliance call as the active planning forum.
  3. Once the carbon baseline lands (currently in train), update APP_06 Aspect 1 from "measure-and-report" to a quantified intensity-based reduction objective for 2027.
  4. Confirm the APP_05 Risk & Opportunity Log adds the 5 P1 gap-closure items as a programme-level risk through May 2026.

Feedback & Acknowledgments

Full cooperation throughout. The audit was significantly easier than IA202502 because the IMS portal restructure (April–May 2026) made navigation and cross-referencing materially better. The change-log entries acted as the audit trail expected.

Post-audit IMS evolution (12-13 May 2026)

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

  • APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
  • APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
  • APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
  • APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
  • APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
  • APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
  • APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
  • APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
  • APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
  • APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
  • APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
  • APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
  • APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
  • APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
  • APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

  • All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
  • 4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
  • 18 × .docx companions generated and linked from each RA page
  • APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

  • POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

  • Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
  • Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

  • APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
  • All previously-stale docs Excel copies resynced from masters
  • Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

  • All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
  • 22 orphan .docx files removed from assets/local-docs/appendices/
  • Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

  • e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
  • AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
  • ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
  • 28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By

Name Position Signature Date
Sean Ashton HSQE Consultant S. Ashton 29/04/2026
Aaron Mason Director A. Mason 29/04/2026

Corrective Action Close Out

CAR-2026-002 status (as of 13/05/2026): Open. Target close 31/08/2026 (~110 days). Action — extend APP_06 ↔ APP_05 cross-referencing across all 14 aspects (Aspects 1 + 9 already done; 12 remaining, including the two [NEW 2026] additions Climate Adaptation and PFAS). Owner Sean Ashton.