IA202610 — Risk Management¶
Audit Record
| Field | Value |
|---|---|
| Audit reference | IA202610 |
| Area audited | Risk management — identification, evaluation, treatment and review |
| Audit criteria | ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 clause 6.1 · SOP 3.1 · SOP 3.2 · POL_HSQE_21 |
| Audit date | 15/05/2026 |
| Auditor | Sean Ashton, HSQE Consultant, Onyx Operations Ltd |
| Auditees | Aaron Mason (Director), Leanne Mason (Director) |
| Result | Conforms. 0 non-conformities, 1 observation |
| Previous audit of this area | IA202510, 2025 cycle |
| Form | FORM_INTAR001 Rev 1 ID 01/09/2025 |
1. Scope, criteria and independence¶
1.1 Scope¶
The method by which risk is identified, scored, treated and re-scored, and whether the two registers that hold it — operational hazard risk and business risk — operate as one system.
Clauses examined: 6.1.1 and 6.1.2 in all three standards, examined at the level of method rather than of individual register content. The aspects register is audited at IA202607 and the hazard set at IA202608.
1.2 Independence¶
The auditor is an external HSQE consultant engaged through Onyx Operations Ltd. He is not an employee of AMWS and holds no line responsibility for the work audited. SOP 6.2 requires that an auditor does not audit work for which they are also responsible; AMWS has no second competent auditor, and the consultant drafted much of the documented system. The mitigation applied is that no document is tested against its own wording. Each clause is tested against records, against what the people responsible describe doing, and against what can be produced on request. Findings are reviewed and countersigned by a Director, who holds the authority to accept or reject them.
2. Method and sample¶
| Method | What was covered |
|---|---|
| Document review | SOP 3.1 Identification and Evaluation of Risk Issue 3 (01/05/2026) · SOP 3.2 Business Risk & Opportunity Planning Issue 3 · POL_HSQE_21 Risk Assessment Policy Revision 3 · POL_HSQE_30 IT Security Policy Issue 1 (04/05/2026) |
| Registers examined | APP_05 Risk & Opportunity Log at Issue 2 · APP_07 Hazard Identification at Issue 3 · APP_08 OHS Assessments at Issue 1 · APP_17 Business Continuity at Issue 2 · APP_19 Approved Suppliers at Issue 6 (13/05/2026) · APP_21 at Issue 4 (13/05/2026) |
| Records sampled | The interim management review held 13/05/2026, two days before this audit · the fatigue management risk assessment issued 04/05/2026 · the 2025 carbon baseline published 12/05/2026 · the supplier rating criteria added at APP_19 Issue 6 on 13/05/2026 |
| Interview | Both Directors, on how a new risk reaches the register, who scores it, and what happens to a risk whose treatment is not working |
3. Result against each clause¶
| Clause | What the standard requires | Objective evidence examined | Result |
|---|---|---|---|
| 6.1.1 Determination of risks and opportunities | Determine the risks and opportunities that need to be addressed, considering the issues and the requirements of interested parties | SOP 3.2 Issue 3 places them in one instrument and states why: "A M Water Services maintains a single Risk & Opportunity Register (APP_05) covering both operational HSQE risks and broader business risks and opportunities." The relationship between the two procedures is defined so neither can claim a risk belongs to the other: "SOP 3.2 sits alongside SOP 3.1 Identification & Evaluation of Risk; 3.1 covers operational HSQE hazard-level risk while 3.2 covers strategic business-level risk and opportunity." | Conforms |
| 6.1.2 Method of evaluation — initial and residual risk | Assess risks, and assess the effectiveness of the controls applied to them | SOP 3.1 Issue 3 requires both scores to be recorded, not only the outcome: "Present initial risk evaluation (assuming worse case scenario with no control measures in place) using the risk rating scoring scheme" and "Present residual risk evaluation (taking into account full implementation of current and additional control measures) using the rating scoring scheme." Recording an initial score with no controls assumed is what makes a control's contribution visible; a register that carries only a residual score cannot evidence that the control does anything. Tested across a sample of assessments | Conforms |
| 6.1.2 Opportunities scored on the same basis as risk | Opportunities are determined and addressed, not only risks | Opportunities are held on the same register as risks and scored by the same method, so an opportunity can be ranked against a risk rather than sitting in a separate list with no comparable weight | Conforms |
| 6.1.2 Review — risk is kept current | Risk assessment is reviewed at a defined interval and on defined triggers | SOP 3.1 Issue 3 sets both: review follows a change enforced by regulation, follows an accident or incident, and occurs at least every three years regardless. POL_HSQE_21 Revision 3 states the purpose: "We recognize that effective risk assessment is fundamental to our #TEAM philosophy, preventing accidents before they occur." The trigger-based route was exercised within the period: a new risk assessment for fatigue management was issued on 04/05/2026 in response to an identified gap rather than to an incident | Conforms |
| 6.1 Risk treatment is carried into controls and is reviewed for effect | Actions to address risk are integrated into system processes and their effectiveness is evaluated | Tested against the interim management review held 13/05/2026, which took the register risk by risk and recorded the treatment and its status against each. Two examples from that record: the information security risk, treated by the issue of the IT security policy on 04/05/2026, the addition of a cyber resilience measure to the objectives, and a certification target; and the climate risk, treated by the addition of a climate adaptation aspect, the continuity testing programme, and an extreme weather response scenario. Each risk has a treatment with a date and an owner rather than a status word | Conforms |
| 6.1 Supply chain risk | Risk arising from external providers is determined and controlled | APP_19 Issue 6, issued 13/05/2026, added an explicit rating rubric, recorded on the register as "Performance Rating Criteria section added — explicit 3-band rubric (Excellent / Good / Do Not Use) against 6 criteria (Quality, Delivery, Communication, HSE/Compliance, Documentation, Outcome)." Stating the criteria makes a supplier rating testable rather than a matter of judgement | Conforms |
| 6.1 Continuity risk | Risk to the continued operation of the business is identified and planned for | Continuity scenarios are held at APP_17 with a planned response to each, and the testing arrangements are audited at IA202612. The currency of the current period's exercise is carried as an open action at CAR-2026-005 and is not re-raised here | Conforms |
4. Findings¶
4.1 Non-conformities¶
None.
4.2 Observations¶
| Ref | Clause | Observation | Owner | Target | Corrective action |
|---|---|---|---|---|---|
| OBS-01 | 6.1.1 | The link between the risk register and the objectives register is explicit for the risks that carry a measured objective, and absent for the rest. A reader of either register cannot presently see which risks are being measured and which are being managed without measurement. This is the same work already programmed under CAR-2026-002, raised at IA202602 with a target of 31/08/2026; no separate corrective action is raised here | Sean Ashton | 31/08/2026 | Cross-referred to CAR-2026-002 |
4.3 Status of the previous audit of this area¶
IA202510 raised two observations. The first, on cross-referencing between the risk and objectives registers, is carried as CAR-2025-015 and rolls forward into CAR-2026-002. The second asked for a differentiated review cadence by risk priority; it is closed. SOP 3.1 retains a defined review floor and adds event-driven triggers, and the weekly compliance call reviews high-priority items continuously, which delivers the differentiation the observation sought without a second cadence to maintain.
5. Conclusion¶
Risk management conforms to clause 6.1 of all three standards. There is one register, one scoring method applied to both risks and opportunities, and a stated division of labour between the two procedures that prevents a risk falling between them. Initial and residual scores are both recorded, which is what allows a control's contribution to be seen rather than assumed.
Review is not left to the anniversary. The procedure sets event-driven triggers as well as a maximum interval, and the trigger route was exercised within the period by the issue of a new assessment for a gap identified in planning rather than after an incident. Treatment was tested against the interim review held two days before this audit, where each risk carried a dated treatment with an owner rather than a status word.
One observation was raised, on visibility of the link between risk and measurement. It duplicates work already programmed, so no new corrective action was raised.
6. Recommendations¶
- Complete the risk-to-objective linkage under CAR-2026-002 and close it on the completed register rather than on a sample.
- Keep both initial and residual scores on every assessment. It is the part of the method most often dropped, and it is the part that evidences the control.
- When a risk is treated by issuing a document, record the document reference and its issue date against the register entry, as was done for the information security risk.
7. Sign-off¶
| Role | Name | Position | Signature | Date |
|---|---|---|---|---|
| Auditor | Sean Ashton | HSQE Consultant, Onyx Operations Ltd | S. Ashton | 15/05/2026 |
| Reviewed and accepted | Aaron Mason | Director | A. Mason | 15/05/2026 |