Skip to content

Internal Audit Report

Audit Identification: IA202613
Area: Management Review
Audit Date: 6th May 2026
Auditor: Sean Ashton (HSQE Consultant, Onyx Operations)
Date Completed: 6th May 2026
Findings: 0 Non-conformities, 1 Observation
Scope: ISO 9001:2015 / 14001:2015 / 45001:2018 — Clause 9.3
Document Number: FORM_INTAR001 Rev 1 ID 01/09/2025
Builds on prior audit: IA202513 (01/10/2025) — 0 NC, 2 OBS

Audit cycle context

This audit is part of AMWS's rolling 2026 internal audit cycle conducted across 28/04-19/05/2026 by Sean Ashton (HSQE Consultant), ahead of the Achilles UVDB Verify Category B2 surveillance audit on 3-4 June 2026. Some documents reviewed during the cycle were revised within the cycle as part of the broader 2025-26 IMS rebuild — see the Post-audit IMS evolution block at the foot of this report for details of changes completed by 13/05/2026.

Executive Summary

This audit re-examined Management Review compliance one year on from IA202513. The audit was timed deliberately ahead of the September 2026 Annual Management Review so that the inputs being prepared can be assessed against clause 9.3 requirements before the meeting itself.

The 2025 observations are addressed by the 2025–26 IMS rebuild and the new continuous-compliance framing:

  • CAR-2025-017 (Management Review minutes lacking formal structure to demonstrate clause 9.3 input coverage) — closed. The continuous-compliance model now positively asserts that the standing weekly Director / HSQE compliance call is the substantive review forum, with the September Management Review providing the strategic-level confirmation. The MR-26 agenda (in preparation) maps explicitly to clause 9.3 inputs.
  • CAR-2025-018 (worker consultation as MR input) — Open — rolled forward as CAR-2026-007. The TBT Programme attendance template and Aaron's informal site presence capture worker consultation in real time. The roll-up template for the September MR pack is the remaining action — rolled forward as IA202613 OBS-01 → CAR-2026-007 (target 31/08/2026).

One new 2026 observation: the September 2026 Management Review pack format should be drafted before mid-August so the Directors can review and the auditor surveillance can sample the inputs trail.

Year-on-year follow-up — IA202513 outcomes

2025 ref 2025 finding (summary) Status in 2026 audit
OBS-13-01 / CAR-2025-017 MR minutes lacking formal structure to show clause 9.3 input coverage Closed. Continuous-compliance model now positively asserts the standing weekly call as the substantive forum; MR-26 agenda being prepared with explicit clause 9.3 mapping.
OBS-13-02 / CAR-2025-018 Worker consultation as MR input not systematically captured Open — rolled forward as CAR-2026-007. TBT records and Aaron's informal site presence capture worker input in real time; roll-up template for September MR pack target 31/08/2026.

Introduction

This audit examined preparation for the September 2026 Annual Management Review against clause 9.3. The audit was deliberately timed in May (4 months before the meeting itself) so that any gaps in input preparation can be addressed in time.

Aims & Objectives

  1. Confirm closure or progress on IA202513 OBS-13-01 and OBS-13-02
  2. Verify clause 9.3 input categories are being prepared with named source documents:
  3. 9.3.2 a) status of actions from previous review
  4. 9.3.2 b) changes in external/internal issues relevant to the IMS (incl. compliance obligations, risks/opportunities)
  5. 9.3.2 c) information on QMS/EMS/OHS performance (including KPIs, NC trends, audit results, compliance evaluation, monitoring/measurement results)
  6. 9.3.2 d) adequacy of resources
  7. 9.3.2 e) effectiveness of actions to address risks and opportunities
  8. 9.3.2 f) opportunities for improvement
  9. For ISO 14001 + 45001 specifically: consultation/participation of workers
  10. Confirm the September 2026 MR has a date scheduled

Audit Method

  • Document Review: SOP 6.4 Management Review Rev 3 HTML, APP_11 HSQE KPIs Rev 3 (post-simplification), APP_21 NC Register, APP_22 Accident Statistics, APP_05 Risk & Opportunity Log, APP_10 Legal & Compliance Register, the 2025 Management Review minutes (September 2025), gap-closure tracker (the source of "actions from previous review").
  • Interviews Conducted: Directors (Aaron + Leanne Mason — MR participants), HSQE Consultant (Sean Ashton — MR preparation lead).
  • Observations: 2025 MR minutes structure; weekly Director / HSQE compliance call notes (Jan–Apr 2026) as the running input record.
  • Sampling: Mapping of clause 9.3.2 a–f input categories against currently-existing IMS evidence.

Non-conformities

No non-conformities identified.

Observations

No. Element Summary Action Suggested Ref
OBS-01 9.3 Worker consultation roll-up for September 2026 MR Worker consultation evidence (TBT attendance template, operative questions captured during Aaron's informal site visits, planned AMWS H&S Culture Survey (Onyx Operations) rollout Q3 2026) is generated continuously but no roll-up format is yet defined for inclusion in the September 2026 MR pack. The auditor reviewing the MR will expect to see this input category explicitly captured. Define a 1-page worker-consultation summary template; populate from May–August 2026 TBT and DST records; include in the September MR pack. CAR-2026-007

Corrective Action Summary

CAR-2026-007 — Owner: Sean Ashton (HSQE Consultant). Target close: 31/08/2026 — in time for the September 2026 Management Review. The 1-page worker-consultation summary will be populated from the May 2026 TBT attendance records (excavation / HAVS / COSHH-fuels), operative-raised actions captured into APP_21 from Aaron's informal site presence, and (from Q3 2026 onwards) the AMWS H&S Culture Survey (Onyx Operations) results.

Conclusions

Management Review preparation is on a sound footing for the September 2026 meeting:

Areas Meeting Requirements (sustained from IA202513):

  • Annual Management Review continues to be scheduled (September 2026)
  • SOP 6.4 continues to define the methodology
  • 2025 MR minutes captured the inputs and produced action-tracked outputs

New strengths since IA202513:

  • Continuous-compliance positively framed. The standing weekly Director / HSQE compliance call is now the substantive review forum, with the September MR as the strategic confirmation. This addresses the IA202513 OBS-13-01 minutes-structure concern by reframing what the MR is for.
  • Clause 9.3.2 a) status of previous actions — directly evidenced by the gap-closure tracker, with 10 of 15 P1 items closed in the year and the remaining 5 with named owners + target dates.
  • Simplified KPIs ready for MR-26 adoption — E3 carbon (measure-and-report), B2 improvement (active programme), APP_06 Aspects 1 + 9 (customer-aligned).
  • Substantive improvement portfolio (clause 9.3.2 e/f) — the 2025–26 IMS rebuild itself is the year's improvement evidence.

Position as at 13/05/2026: The findings above remain the formal record. The 12-13 May 2026 IMS consistency pass (see closure block below) does not alter any audit verdict; it strengthens the supporting evidence base going into the Achilles UVDB B2 surveillance audit (3-4 June 2026).

Recommendations

  1. Close CAR-2026-007 with the worker-consultation roll-up template by 31/08/2026.
  2. Schedule the September 2026 MR explicitly in the calendar — Aaron + Leanne + Sean — and circulate the input pack 1 week ahead.
  3. Use MR-26 to formally adopt the simplified KPI set as the 2026–27 baseline.
  4. Capture MR-26 outputs as Issue 2 of MAN_01 if material strategic changes land.

Feedback & Acknowledgments

Full cooperation. The 2025–26 cycle has done much of the substantive thinking that previously had to be done at the MR itself; the September 2026 MR can therefore focus on strategic confirmation rather than catch-up.

Post-audit IMS evolution (12-13 May 2026)

The findings above stand as a point-in-time record at audit date. Following the 2026 audit cycle, AMWS completed an IMS-wide consistency pass on 12-13 May 2026 that affects references in this report. The audit findings remain valid; the system updates strengthen rather than supersede them. Material changes the auditor should be aware of:

Appendix-level changes

  • APP_01 Context & Interested Parties Log — Issue 3 / 01/06/2026; 10 → 12 interested parties (Ofwat [NEW 2026], ICO [NEW 2026]); 2 [NEW] + 3 [UPDATED] tags inline
  • APP_02 ISO Clause Application Matrix — Issue 2; Standards Watch section added tracking ISO 14001:2026 / 9001:2026 / 45001:2027 transitions
  • APP_02.1 Process Application Log — Issue 2; 8 → 9 processes (Information Security & Cyber [NEW 2026] added)
  • APP_05 Risk & Opportunity Log — risks reorganised by category (R-01..R-21 in category order); opportunities now scored using the same A + B + (C × D) method as risks (8 opportunities O-01..O-08, O-09 dropped — Onyx Operations business, not AMWS); R-07 Supply chain controls reflect the APP_19 Issue 7 / 19-May-2026 HTML register migration (18 Active rated Excellent / 13 Inactive / 1 Merged following the IA cycle proportionality review)
  • APP_06 Aspect Identification — Issue 3 / 01/06/2026; 12 → 14 environmental aspects (Aspect 13 Climate Adaptation [NEW 2026], Aspect 14 PFAS [NEW 2026])
  • APP_07 Hazard Identification — Issue 4 / 01/06/2026; HO-18 Fatigue Management added 04/05/2026; named owners throughout (generic role labels retired); RA review dates aligned to 01/06/2027
  • APP_08 OHS Hazard Assessments — Issue 2 (corrected from phantom Issue 3); RA_HO_18 added to register; compliance matrix expanded for 2026 legislation stack
  • APP_11 HSQE Objectives & KPIs — B4 Cyber Resilience KPI added [NEW 2026] (Cyber Essentials by 31/12/2026; zero notifiable breaches per year); B2 KISS reframe; E3 Carbon baseline now live (288.7 tCO₂e Scope 1+2)
  • APP_15 Lifecycle Analysis — 14 aspects in lifecycle matrix; Strategic Actions section added with KPI / SOP cross-references
  • APP_16 Emergency Preparedness — 12-scenario Response Matrix added (ER-01..ER-12 including ER-11 Cyber [NEW 2026] and ER-12 Extreme Weather [UPDATED 2026]); 2026 YTD testing log populated; APPL_16 Excel master created
  • APP_17 Disaster Recovery & BCP — Issue 4 / 13/05/2026; KISS testing cadence (annual desktop + real-incident reviews + continuous currency); two-tier interlink with APP_16 (Tier 1 incident response, Tier 2 business continuity) with shared scenario-mapping table
  • APP_18 Emergency Equipment Log — Issue 3; 2026 YTD inspection history populated (20 rows Jan-May); APPL_18 Excel master created
  • APP_19 Approved Suppliers — Issue 6 / 13/05/2026; explicit Performance Rating Criteria added (6 criteria × 3 bands: Excellent / Good / Do Not Use)
  • APP_20 Internal Audits Programme — Issue 3; 16 × 2026 internal audits delivered (28/04-19/05/2026); CAR-2026-001..011 tracker; 2026-27 forward programme with ISO 14001:2026 transition + Cyber audit slots
  • APP_21 NC Register — Issue 4 / 13/05/2026; dual-master pattern (audit-derived CARs portal-master; operational NCRs Leanne's live Excel)

Risk Assessments

  • All 18 RAs (RA_HO_01..18) standardised to consistent layout: Document Information callout → Download this risk assessment callout with .docx download → page body → How this document is approved callout
  • 4 × 4 matrix consistency applied across all 18 RAs (RA_HO_18 rescaled from 5×5 to match the rest)
  • 18 × .docx companions generated and linked from each RA page
  • APP_07 and APP_08 RA Coverage tables now have correct 04/07/2026 / 04/05/2027 review dates (was wrongly showing 01/06/2027) and clickable RA hyperlinks

Policies and procedures

  • POL_HSQE_29 Mental Health Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_30 IT Security Policy (issued 04/05/2026 — Issue 1) — in operation
  • POL_HSQE_29 and POL_HSQE_30 cross-referenced from new APP_11 B4 KPI, APP_16 ER-11 Cyber scenario, APP_17 §3.1 Technology Disruption

Carbon Baseline 2025

  • Published 12/05/2026: 288.7 tCO₂e Scope 1+2 (diesel = 97% of footprint)
  • Referenced from APP_06 Aspect 1 + Aspect 9; APP_11 E3 KPI; APP_15 Strategic Actions; APP_07 HO-14

Excel companion consistency

  • APPL_16 and APPL_18 masters created in IMS Excel Conversions/ (previously absent — docs/appendices copies were stale "Table 1, 2, 3" generic-sheet versions)
  • All previously-stale docs Excel copies resynced from masters
  • Cross-reference fixes in APPL_02, APPL_03, APPL_04, APPL_06, APPL_15 to reflect APP_05 R-XX renumbering

Pattern consistency

  • All 23 appendices now follow a consistent template: Document Information callout → "Download the register" callout (single companion file) → page body → audit trail mirroring Excel cover → "How this document is approved" callout
  • 22 orphan .docx files removed from assets/local-docs/appendices/
  • Wide-mode tip dropped from callouts (FABs visible site-wide)

Looking ahead

  • e-forms proposal under development as the next IMS digitalisation workstream (will impact 7.5 documented information evidence and 9.1 monitoring streams)
  • AMWS H&S Culture Survey (Onyx Operations) — Q3 2026 post-audit rollout; replaces the short-lived Director Site-Tour Programme; HSG65-aligned workforce-wide cultural-sentiment readout. Aaron Mason's hands-on operational site presence continues as a feature of running the business (not a measurable KPI)
  • ISO 14001:2026 transition plan to be drafted Q3 2026; recertification cycle Nov 2027
  • 28/05/2026 BCP desktop exercise scheduled (key-person absence — Site Supervisor unavailable for 5+ working days, APP_17 §4 Scenario #3; P1 gap-closure ahead of Achilles UVDB B2 audit 3-4 June 2026)

The 16 × 2026 internal audit reports were drafted across 28/04-19/05/2026 with knowledge of the substantive 2025-26 IMS rebuild. The 12-13 May consistency pass captured above completes that rebuild; the audit findings continue to apply.

Audit Report Prepared By

Name Position Signature Date
Sean Ashton HSQE Consultant S. Ashton 06/05/2026
Aaron Mason Director A. Mason 06/05/2026

Corrective Action Close Out

CAR-2026-007 status (as of 13/05/2026): Open. Target close 31/08/2026 (~110 days). Action — worker-consultation roll-up template for September 2026 Management Review pack; will be populated from TBT_PROG_01 attendance records, operative-raised actions captured into APP_21, and (from Q3 2026) the AMWS H&S Culture Survey (Onyx Operations) results. Owner Sean Ashton.