Skip to content

Internal Audit Report

Audit Identification: IA202603
Area: Support
Audit Date: 30th April 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 30th April 2026
Findings: 0 Non-conformities, 2 Observations
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clauses 7.1–7.5
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202503 (23/09/2025) — 0 NC, 2 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary

This audit re-examined Support processes (resources, competence, awareness, communication, documented information) one year on from IA202503. The 2025–26 cycle has materially strengthened the Support evidence picture:

  • Documented information (clause 7.5) has been transformed by the 44-SOP HTML migration completed 04/05/2026, embedding hand-built standalone HTML pages with named roles, regulatory thresholds and functional swimlane diagrams in place of the legacy drawio SVGs.
  • Communication (clause 7.4) is now anchored by the new 12-month Toolbox-Talk Programme (TBT_PROG_01) issued 04/05/2026, with 3 priority pre-audit briefs ready for delivery in May 2026.
  • Competence (clause 7.2) is supported by the new Right-to-Work Procedure (PROC_R2W_01) and the recovered SOP 6.3 Site Inspections & Tours which had been missing from the 2025 nav.

The 2025 observation about TBT attendance recording is partially addressed by the new programme's embedded attendance template. The combined operator-equipment competency matrix observation remains open and is rolled forward.

A new 2026 observation captures three expired statutory training certificates that Leanne Mason is rebooking — a documented operational gap with named owner and a clear closure path.

Year-on-year follow-up — IA202503 outcomes

2025 ref 2025 finding (summary) Status in 2026 audit
OBS-03-01 / CAR-2025-004 TBT attendance recording — could be enhanced (digital sign-in / QR code) Closed. TBT_PROG_01 (May 2026) embeds an attendance template per session — pen-and-paper sign-in sufficient for B2.7.6 evidence. Further digital improvement (sign-in / QR code) deferred to 2027 as IMS roadmap item.
OBS-03-02 / CAR-2025-005 Combined operator-equipment competency matrix Open — rolled forward. APP_12 Training Matrix and APP_14 Calibration Log remain separate registers. Rolled forward as IA202603 OBS-02.

Introduction

This audit examined the Support processes (clauses 7.1–7.5) one year on from IA202503 and after the substantial IMS document-control refresh of April–May 2026. The audit assessed whether the 2025 OBSes were closed, evaluated the SOP HTML migration's impact on documented-information control (clause 7.5), and reviewed the new Toolbox-Talk Programme's effect on communication and awareness.

Aims & Objectives

  1. Verify continued effectiveness of resources, competence, awareness, communication and documented-information processes
  2. Confirm the SOP HTML migration meets clause 7.5 documented-information requirements (currency, accessibility, integrity, change control)
  3. Assess the new TBT Programme against clauses 7.3 (awareness) and 7.4 (communication)
  4. Confirm closure or progress on IA202503 OBS-03-01 and OBS-03-02
  5. Review training currency including the 3 expired statutory certificates
  6. Evaluate the new PROC_R2W_01 Right-to-Work Procedure against clause 7.2 competence

Audit Method

  • Document Review: SOP 4.1 Device Calibration Rev 3 HTML, SOP 4.2 Competencies & Training Rev 3 HTML, SOP 4.4 Safety Bulletins & Briefings Rev 3 HTML, SOP 4.6 Document Control Rev 3 HTML, SOP 4.7 Control of Records Rev 3 HTML, SOP 6.3 Site Inspections & Tours Rev 3 HTML (recovered May 2026), APP_12 Training Matrix, APP_13 Tickets & Qualifications, APP_14 Calibration & Equipment Maintenance Log, POL_HSQE_24 Training Policy, PROC_R2W_01 Right-to-Work Procedure (new 04/05/2026), TBT_PROG_01 Toolbox-Talk Programme (new 04/05/2026).
  • Interviews Conducted: Directors (Aaron Mason, Leanne Mason), Site Supervisor (Jason May), 2 operatives.
  • Observations: SOP HTML pages reviewed for completeness, formatting and cross-references; APP_12 cross-checked against expired-certificate list; new policy POL_HSQE_30 IT Security and POL_HSQE_29 Mental Health reviewed.
  • Sampling: 5 SOPs randomly sampled from the 44 migrated HTML files (3.4, 6.3, 8.10, 9.4, 9.5); 3 toolbox-talk briefs from the new programme; the 3 expired certs against the rebooking schedule held by Leanne; PROC_R2W_01 against the live worker register on APP_12 (Excel held by Leanne).

Non-conformities

No non-conformities identified.

Observations

Ref Observation Clause Priority Ref
OBS-01 Three statutory training certificates have expired and are awaiting rebooking by Leanne Mason: Jason May Fire Marshal (EXP 15/08/2025), Leanne Mason Fire Marshal (EXP 19/09/2025), Leanne Mason Emergency First Aid (EXP 30/10/2025). AMWS retains cover on each role through other named individuals so there is no immediate operational gap, but the certificates need to land before the surveillance audit. 7.2 Medium CAR-2026-003
OBS-02 Operator-equipment competency matrix (rolled forward from CAR-2025-005). APP_12 Training Matrix and APP_14 Calibration & Equipment Log remain separate. A combined view linking specific operator qualifications to specific equipment authorisations would strengthen 7.2 evidence. Lower priority for B2 audit; 2026–27 IMS improvement candidate. 7.2 Low CAR-2026-004

Corrective Action Summary

CAR-2026-003 — Owner: Leanne Mason. Target close: 31/05/2026 (before audit). All three certs to be rebooked with external providers.

CAR-2026-004 — Owner: Sean Ashton (HSQE Consultant). Target close: 30/09/2026. Combined competency matrix as 2026–27 IMS improvement.

Conclusions

Support processes have matured strongly in the 2025–26 cycle:

Areas Meeting Requirements (sustained from IA202503):

  • Resources continue to be effectively determined and provided
  • Competence management continues to operate through APP_12 and APP_13 as the canonical registers
  • Communication continues to flow through morning toolbox talks, weekly compliance calls and the WhatsApp Works group
  • Document control continues to operate with the IMS portal as master and Word/Excel snapshots as offline working copies

New strengths since IA202503:

  • 44-SOP HTML migration (04/05/2026) — every SOP now hand-built to the SOP 3.4 standard with functional swimlanes, named roles (no more "HSQE Manager / SLT / Department Manager" generics), and concrete regulatory thresholds embedded in warning admonitions. Document-information control (clause 7.5) is materially stronger than at IA202503.
  • Toolbox-Talk Programme (TBT_PROG_01) — 12-month rolling schedule of monthly TBTs covering AMWS's highest-priority operational risks. Three priority pre-audit briefs (excavation safety + buried services / HAVS / COSHH fuels) ready to deliver weeks of 12/05, 19/05, 26/05 2026.
  • Right-to-Work Procedure (PROC_R2W_01) — operational steps for manual passport check + online share-code check + retention DofE+2yr + annual sweep documented (April 2026 — Leanne — no exceptions).
  • SOP 6.3 Site Inspections & Tours — recovered into the nav. (Note: the Director Site-Tour Programme that briefly mapped onto SOP 6.3 has been retired; SOP 6.3 continues to underpin Aaron's informal operational site presence and will be referenced by the AMWS H&S Culture Survey (Onyx Operations) rollout in Q3 2026.)
  • APP_07 hazards register expanded with HO-18 Fatigue (linked to RA_HO_18 issued 04/05/2026) — improved competence-relevant hazard coverage.

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations

  1. Close CAR-2026-003 (3 expired certs) by 31/05/2026 — Leanne to confirm bookings.
  2. Deliver the 3 May 2026 priority TBTs and capture attendance using the new template — first proof point that TBT_PROG_01 operates as documented.
  3. Implement the PROC_R2W_01 annual sweep date in the standing weekly compliance-call calendar — first sweep already completed April 2026.
  4. Plan CAR-2026-004 (combined competency matrix) for autumn 2026 IMS improvement window.

Feedback & Acknowledgments

Full cooperation. The SOP HTML migration was a substantial piece of document-control work and has materially improved the audit experience — pages load fast, content is consistent, named roles eliminate the previous ambiguity around "HSQE Manager" vs "SLT".

Post-audit IMS evolution (12-13 May 2026)

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

  • APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
  • APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
  • APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
  • APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
  • APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
  • APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
  • APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
  • APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
  • APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
  • APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
  • APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
  • APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
  • APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
  • APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
  • APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

  • All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
  • 4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
  • 18 × .docx companions generated and linked from each RA page
  • APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

  • POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

  • Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
  • Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

  • APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
  • All previously-stale docs Excel copies resynced from masters
  • Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

  • All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
  • 22 orphan .docx files removed from assets/local-docs/appendices/
  • Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

  • e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
  • AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
  • ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
  • 28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By

Name Position Signature Date
Sean Ashton HSQE Consultant S. Ashton 30/04/2026
Aaron Mason Director A. Mason 30/04/2026

Corrective Action Close Out

CAR-2026-003 status — Closed 26/05/2026. Corrective action (rebook the three expired statutory certificates) complete. Evidenced: Jason May Fire Marshal — completed 24/07/2025, expiry 24/07/2026 (Citation); Leanne Mason Fire Marshal — completed 15/11/2025, expiry 15/11/2026 (VitalSkills / HSQE Ltd, cert fMQmPvJqAl). Residual item flagged on close: Leanne Mason Emergency First Aid at Work rebooked, scheduled ~31/05/2026 — certificate to be filed on completion (still ahead of the 3-4 June audit). Operational cover maintained throughout via other named marshals/first-aiders, so no immediate operational gap at any point. Verified by Sean Ashton, 26/05/2026. Recorded in APP_21 NC & CAR Register. (Original 13/05/2026 status: Open P1, certs awaiting rebooking.)

CAR-2026-004 status (as of 13/05/2026): Open. Target close 30/09/2026 (~140 days). Action — combined operator-equipment competency matrix as 2026-27 IMS improvement. Owner Sean Ashton.