Internal Audit Report¶

Audit Identification: IA202604
Area: Operations
Audit Date: 1st May 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 1st May 2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clauses 8.1–8.7
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202504 (23/09/2025) — 0 NC, 0 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary¶

This audit re-examined Operations processes one year on from IA202504. The 2025 audit was clean (0 NC, 0 OBS). The 2025–26 cycle has further strengthened the Operations evidence picture through three substantial additions:

FORM_PTW_01 Generic Permit-to-Work template (issued 04/05/2026) — single template covering excavation, hot work and confined space, including the statutory 60-minute hot-work fire-watch and confined-space atmospheric-test thresholds (O₂ 19.5–23.5%, LEL <10%, CO <30 ppm, H₂S <10 ppm).
APP_19 Approved Supplier Register — 2026 SAR completed 16/04/2026 (Issue 4 — Leanne Mason); proportionality review during the IA cycle migrated the register to its current HTML format at Issue 7 / 19/05/2026 with Active / Inactive split confirmed (18 Active rated Excellent / 13 Inactive / 1 Merged); year-on-year evidence preserved through the 2025 SAR archive.
APP_17 BCP testing log backfilled — 2024 actual-incident records plus quarterly desktop programme through to Q2 2026 (key-person absence — Site Supervisor — scheduled 28/05/2026); Section 10 cross-reference errors fixed (APP_20 → APP_16; APP_21 → APP_17).

A single 2026 observation captures one residual programme item: the Q2 2026 BCP desktop is scheduled but not yet held — needs to be delivered before the 3–4 June 2026 audit. Owner: Sean Ashton + Aaron Mason + Leanne Mason.

Year-on-year follow-up — IA202504 outcomes¶

2025 ref	2025 finding (summary)	Status in 2026 audit
(none)	IA202504 was clean — 0 NC, 0 OBS	No 2025 follow-ups required.

Introduction¶

This audit examined Operations processes (clauses 8.1–8.7) one year on from IA202504. The audit re-tested the operational-control framework after substantial 2025–26 additions: the new PTW template, the APP_19 SAR refresh, the BCP testing-log backfill, the APP_06 Aspects 1+9 simplification, and the Sustainability Note 2025.

Aims & Objectives¶

Verify continued compliance with operational planning and control (8.1)
Assess the new FORM_PTW_01 PTW template against clause 8.1 high-risk-activity controls
Review the APP_19 SAR-2026 refresh and confirm supplier-control framework remains effective (8.4 control of externally provided processes)
Confirm the APP_17 BCP testing log addresses 8.1 contingency planning and the Q2 2026 desktop is scheduled
Examine emergency preparedness arrangements (8.2) including the new RA_HO_18 Fatigue Management
Confirm post-delivery activities continue to meet client (Anglian, Severn Trent) requirements

Audit Method¶

Document Review: SOP 5.1 Production/Issue/Briefing of RAMS Rev 3 HTML, SOP 5.2 Management of Change Rev 3 HTML, SOP 5.3 Supplier Evaluation & Approval Rev 3 HTML, SOP 5.4 Emergency Preparedness Rev 3 HTML, FORM_PTW_01 Generic PTW Template (new 04/05/2026), APP_17 Disaster Recovery & BCP Rev 3 (with backfilled testing log), APP_19 Approved Supplier Register Issue 4 (16/04/2026), 31 × SAR-2026 pages (sar-2026/) plus the 32 retained sar-2025/ pages, RA_HO_18 Fatigue (new 04/05/2026).
Interviews Conducted: Directors (Aaron Mason, Leanne Mason), Site Supervisor (Jason May), 2 operatives, framework subcontractor on Westleigh Road site.
Observations: Westleigh Road site visit (28/04/2026 — concurrent with IA202601 audit); RAMS briefing review; supplier-evaluation file walkthrough (Boughton Loam Limited, Lapwing UK, Speedy Hire); APP_17 testing-log entries reviewed in detail.
Sampling: 5 recent jobs (Westleigh Road repair + 4 framework jobs Jan–Apr 2026); RAMS for each; 3 supplier files spanning Aggregates / PPE / Plant Hire categories; APP_17 testing-log entries 2024–2026.

Non-conformities¶

No non-conformities identified.

Observations¶

Ref	Observation	Clause	Priority	Ref
OBS-01	Q2 2026 BCP desktop exercise (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3) is scheduled for 28/05/2026 but not yet held. The exercise is a P1 gap-closure item from the audit-readiness tracker; scenario briefs ready; participants confirmed. The exercise must be held and documented before the 3–4 June 2026 surveillance audit to close the contingency-planning evidence under clause 8.1.	8.1	Medium	CAR-2026-005

Corrective Action Summary¶

CAR-2026-005 — Owner: Sean Ashton (HSQE Consultant) + Aaron Mason + Leanne Mason. Target close: 31/05/2026. 2-hour desktop exercise on 28/05/2026; output captured as appendix to APP_17.

Conclusions¶

Operations continues to demonstrate strong compliance, materially strengthened by the 2025–26 additions:

Areas Meeting Requirements (sustained from IA202504):

Operational planning continues to address customer requirements through documented work schedules
RAMS production and briefing continues to be reliable — pre-start checks and weekly compliance audits operate
Emergency preparedness arrangements continue to operate via SOP 5.4 / APP_16 / APP_18
Management of change continues to operate (and is now demonstrably exercised — see IA202602)
Integration across quality, environmental and safety remains evident in operational procedures

New strengths since IA202504:

FORM_PTW_01 Generic PTW template — covers AMWS's three permit-controlled activities with concrete thresholds (10 m hot-work radius, 60-min fire-watch, atmospheric-test gates, 600 mm hand-dig zone). Audit-defensible single-template approach.
APP_19 Approved Supplier Register — 2026 SAR completed Leanne Mason 16/04/2026 (Issue 4); IA cycle proportionality review migrated the register to its HTML format at Issue 7 / 19/05/2026, with Leanne's confirmed Active / Inactive split (18 Active rated Excellent / 13 Inactive / 1 Merged) and the 8-point Supplier Self-Assessment per supplier. No complaints logged in the review period; year-on-year evidence preserved via the 2025 SAR archive. Supplier monitoring is the single largest risk that the auditor will probe; the gap is now closed.
APP_17 BCP testing log — 2024 actuals + 2025–26 quarterly programme on the page; Section 10 cross-reference errors fixed; cyber and climate-physical risk scenarios added.
RA_HO_18 Fatigue Management — concrete controls (max 9-hr driving day, 1-in-4 on-call cap, HAVS-fatigue trigger cap) for an aspect that IA202504 did not separately consider.
Sustainability Note 2025 — 1-pager showing AMWS's customer-aligned (not unilateral) net-zero position; honest framing for the audit.

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations¶

Hold and document the Q2 2026 BCP desktop on 28/05/2026 — close CAR-2026-005 by 31/05/2026.
Continue the SAR cycle on the new April cadence (refresh complete, year-on-year archive will accumulate naturally).
Use FORM_PTW_01 for the next excavation / hot-work / confined-space job and capture the close-out as the first reference example.
Carbon baseline (data with Leanne, baseline drafted by 30/06/2026) — once landed, the APP_06 Aspect 1 + Aspect 9 framing matures from "measure-and-report" to a quantified intensity baseline.

Feedback & Acknowledgments¶

Full cooperation. The Westleigh Road site visit was informative; team morale high, PPE compliance strong, RAMS briefing complete and signed before shift start.

Post-audit IMS evolution (12-13 May 2026)¶

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
18 × .docx companions generated and linked from each RA page
APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
All previously-stale docs Excel copies resynced from masters
Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
22 orphan .docx files removed from assets/local-docs/appendices/
Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By¶

Name	Position	Signature	Date
Sean Ashton	HSQE Consultant	S. Ashton	01/05/2026
Aaron Mason	Director	A. Mason	01/05/2026

Corrective Action Close Out¶

CAR-2026-005 status — Closed 26/05/2026. Q2 2026 BCP desktop exercise held 26/05/2026, conducted by Leanne Mason remotely with Sean Ashton's support. Scenario walked through: Site Supervisor (Jason May) unavailable for 5+ working days (APP_17 §4 Scenario #3). Aaron Mason deputised as Site Supervisor for morning briefings, site visits and RAMS approvals; operatives confirmed manageable reporting line direct to Aaron; Sean (Onyx) confirmed cover for scheduled TBT delivery. Outcome: no issues or actions raised — deputising arrangement confirmed effective. Recorded in the APP_17 testing log §6.2 and mirrored in APP_16 §4; logged in APP_21. Verified by Sean Ashton, 26/05/2026. (Original 13/05/2026 status: Open P1, exercise scheduled 28/05/2026.)