Skip to content

Internal Audit Report

Audit Identification: IA202608
Area: Health & Safety Management
Audit Date: 11/05/2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 11/05/2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 45001:2018 Specific Requirements
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202508 (25/09/2025) — 0 NC, 2 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary

This audit re-examined Health & Safety Management one year on from IA202508. Both 2025 observations are progressed:

  • CAR-2025-012 (near-miss reporting rate below 10/month KPI) — open / under review. Near-miss capture remains lighter than the 2025 target. The 2025–26 IMS rebuild has provided several new capture mechanisms (TBT attendance template, Aaron's informal site presence, weekly compliance call notes) that should improve the reporting rate organically. Rolled forward as IA202608 OBS-01 with refreshed action.
  • CAR-2025-013 (HAVS monitoring formal schedule) — Closed. RA_HO_18 Fatigue Management (issued 04/05/2026) addresses the HAVS-fatigue interaction with concrete trigger-time caps (75% of EAV on >10-hour days; mandatory rotation after 60 minutes continuous breaker work). Toolbox-talk TBT-2026-06 (week of 19/05/2026) covers HAVS in detail with EAV/ELV thresholds. Formal exposure-monitoring app deployment is a 2026-27 IMS roadmap item — substantive controls are in place.

Material H&S wins this cycle: SOP 8.15 Fire issued with concrete thresholds (10 m hot-work radius, 60-min fire-watch); FORM_PTW_01 Generic Permit-to-Work (single template covering excavation / hot work / confined space); POL_HSQE_29 Mental Health Policy issued; APP_07 Hazards Register expanded with HO-18 Fatigue. Zero RIDDOR incidents and zero LTIs sustained 2025–26 (APP_11 H1).

Year-on-year follow-up — IA202508 outcomes

2025 ref 2025 finding (summary) Status in 2026 audit
OBS-01 / CAR-2025-012 Near-miss reporting rate below target Open — refreshed. Multiple capture mechanisms now in place: TBT attendance template, Aaron's informal site presence, the new HO-18 Fatigue RA (04/05/2026), 18 RAs standardised to 4×4 matrix consistency with .docx companions. AMWS H&S Culture Survey (Onyx Operations) rollout Q3 2026 will provide formal workforce-sentiment instrument. Rolled forward as IA202608 OBS-01.
OBS-02 / CAR-2025-013 HAVS monitoring schedule informal Closed. RA_HO_18 controls explicit; TBT-2026-06 covers HAVS thresholds. Formal exposure-monitoring app a 2026-27 IMS roadmap item — substantive controls in place.

Introduction

This audit examined ISO 45001-specific health & safety management requirements one year on from IA202508 and after substantial 2026 H&S additions: SOP 8.15 Fire, FORM_PTW_01, POL_HSQE_29 Mental Health, RA_HO_18 Fatigue.

Aims & Objectives

  1. Confirm closure or progress on IA202508 OBS-01 and OBS-02
  2. Assess the new 2026 H&S documents against ISO 45001 clause 6/8 requirements
  3. Verify zero RIDDOR / zero LTI sustained
  4. Review worker consultation evidence (TBT, Director Site Tours, weekly call)
  5. Sample one PTW under the new FORM_PTW_01 template

Audit Method

  • Document Review: POL_HSQE_16 H&S Policy Statement Rev 3, POL_HSQE_29 Mental Health Policy (new 04/05/2026), POL_HSQE_30 IT Security Policy (new 04/05/2026), 15 × SOP 8.x H&S SOPs Rev 3 HTML (8.1–8.15), APP_07 Hazards Register Rev 3 (with HO-18 Fatigue added), APP_08 OHS Hazard Assessments, APP_22 Accident Statistics, RA_HO_01–18 (with RA_HO_18 new 04/05/2026), FORM_PTW_01 Generic Permit-to-Work template (new 04/05/2026), TBT_PROG_01 Toolbox-Talk Programme (new 04/05/2026).
  • Interviews Conducted: Director (Aaron Mason — APP_11 H1 owner), Site Supervisor (Jason May — APP_11 H2 owner), 2 operatives, MHFA (Leanne Mason).
  • Observations: Westleigh Road site (28/04/2026); spot-checks of PPE compliance and RAMS briefing; Mental Health First Aid certs (Jason + Leanne both current to Nov 2026); Fire Risk Assessment (March 2025) on file in 7 Workplace Safety folder.
  • Sampling: 5 recent RAMS; 3 monthly HSQE bulletins; APP_22 incident classifications 2025–26; Aaron's 28/04/2026 Westleigh Road site walk.

Non-conformities

No non-conformities identified.

Observations

Ref Finding Clause Priority Ref
OBS-01 Near-miss reporting rate (rolled forward from CAR-2025-012). The new TBT attendance template + Aaron's informal site presence provide capture mechanisms; the 28/04/2026 site tour produced one captured action. The next 90 days will indicate whether the rate increases as the new mechanisms bed in. 8.2 (ISO 45001) Medium CAR-2026-009

Corrective Action Summary

CAR-2026-009 — Owner: Jason May (Site Supervisor). Target close: 31/07/2026 (90 days from this audit). Use the TBT attendance template explicitly; report monthly count to weekly compliance call; review whether the rate trends up.

Conclusions

Health & Safety Management is the area with the largest substantive improvement portfolio in the 2025–26 cycle:

Areas Meeting Requirements (sustained from IA202508):

  • Zero RIDDOR / zero LTI sustained for the second consecutive year (APP_11 H1)
  • 100% RAMS-with-job rate sustained (APP_11 H2)
  • Training Matrix maintained (APP_12) with the 3 expired certs being rebooked (CAR-2026-003)
  • POL_HSQE_16 H&S Policy continues to apply

New strengths since IA202508:

  • 15 × Section 8 SOPs rebuilt (8.1–8.15) into HTML format with concrete regulatory thresholds. Particularly notable: SOP 8.15 Fire with 10 m hot-work radius and 60-min fire-watch; SOP 8.10 HAVS with EAV 2.5 / ELV 5.0 m/s² A(8); SOP 8.12 Confined Space with O₂ 19.5–23.5%, LEL <10%, CO <30 ppm, H₂S <10 ppm thresholds.
  • FORM_PTW_01 Generic Permit-to-Work (new 04/05/2026) — single template covering AMWS's three permit-controlled activities.
  • RA_HO_18 Fatigue Management (new 04/05/2026) — addresses HAVS-fatigue interaction explicitly.
  • POL_HSQE_29 Mental Health Policy (new 04/05/2026) — codifies MHFA cover (Jason + Leanne, both current), signposting routes including Samaritans 116 123, EAP-decision pathway.
  • APP_07 Hazards Register expanded HO-01..17 → HO-01..18.

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations

  1. Close CAR-2026-009 (near-miss rate) by 31/07/2026 — first 90 days of the new capture mechanisms.
  2. Deliver TBT-2026-05 / 06 / 07 (excavation, HAVS, COSHH-fuels) on schedule — first proof point of the new TBT programme operating.
  3. Track HO-18 Fatigue residual risk through the standing weekly compliance call.

Feedback & Acknowledgments

Full cooperation. The H&S evidence base is materially stronger than at IA202508; the SOP rebuild + 4 new H&S documents have addressed multiple smaller items that would have been gaps at audit.

Post-audit IMS evolution (12-13 May 2026)

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

  • APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
  • APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
  • APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
  • APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
  • APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
  • APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
  • APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
  • APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
  • APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
  • APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
  • APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
  • APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
  • APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
  • APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
  • APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

  • All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
  • 4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
  • 18 × .docx companions generated and linked from each RA page
  • APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

  • POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

  • Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
  • Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

  • APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
  • All previously-stale docs Excel copies resynced from masters
  • Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

  • All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
  • 22 orphan .docx files removed from assets/local-docs/appendices/
  • Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

  • e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
  • AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
  • ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
  • 28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By

Name Position Signature Date
Sean Ashton HSQE Consultant S. Ashton 11/05/2026
Aaron Mason Director A. Mason 11/05/2026

Corrective Action Close Out

CAR-2026-009 status (as of 13/05/2026): Open. Target close 31/07/2026 (~80 days). Action — 90-day near-miss reporting rate review. New capture mechanisms in place since Q1 2026: TBT_PROG_01 attendance template (operative engagement column), Aaron Mason's informal site presence, RA_HO_18 Fatigue cross-link to near-miss reporting, AMWS H&S Culture Survey (Onyx Operations) Q3 2026 rollout. Owner Jason May.