Signs Your WHS System Is Failing Before an Audit
Actions with no owner, out of date documents and incident workflows that stop at the report stage are the kinds of gaps safety managers often discover too late. Here is what to look for before an auditor finds them first.
Why do most WHS audit failures come as a surprise?
Because the gaps are usually process gaps, not missing documents. Auditors rarely fail organisations for having no policy; they fail them for policies no one follows, actions with no due date and no owner, and dashboards that have not moved in months. The documentation existed. The system was not working.
ISO 45001 (the international standard for occupational health and safety management) is built around continual improvement, not just intent. If your actions are closed on the same day they are opened, or never closed at all, that pattern shows up fast under audit scrutiny.
What does an incomplete corrective action look like to an auditor?
An incomplete action has no assigned owner, no due date, or is marked closed without evidence that the root cause was addressed. Auditors look for all three: who, when, and proof it changed something.
This is a common failure point in many industries. A finding raised from an incident or an internal audit turns into an email thread, gets forwarded once or twice, and then sits. Under a compliant system, every finding becomes a tracked action with an owner and a due date, and closing it requires evidence. If your current system does not enforce that sequence, the loop is open.
How can I tell if our incident reporting is actually working?
Pull your recent incidents and check whether each one has a completed investigation, at least one linked action, and a close out record. If a significant portion are sitting at the report stage only, reporting has become a box ticking exercise rather than a management tool.
Near misses are the sharper test. In organisations with mature safety cultures, workers tend to report near misses far more frequently than formal incidents because they trust the process and see value in it. If near miss reports are rare or zero, that is a culture signal as much as a system signal, and it is the kind of pattern an auditor may ask about.
Is scattered documentation a real audit risk or just a housekeeping problem?
It is a real audit risk. If your policies, procedures, SWMS and registers live in different folders, SharePoint libraries or email attachments, version control breaks down and an auditor can find workers operating from a superseded procedure.
ISO management system standards generally expect documented information to be available and controlled. That means one place, with version history, and a process for reviewing and updating documents on a defined cycle. Scattered spreadsheets fail that test even when the content is accurate. The problem is not that the information does not exist; it is that there is no evidence it is current and no proof the right people have seen it.
What do audit ready dashboards actually need to show?
Audit ready dashboards show live status across incidents, open actions, upcoming and overdue audits, and inspection completion rates, filtered by site or role so the right leader sees what is relevant to them rather than a wall of data.
If your reporting requires someone to manually compile a spreadsheet before a management review, that is a risk. A compiled report reflects a point in time, and findings can move or age before the next meeting. Both ISO 45001 and ISO 9001 (quality management) include performance monitoring, and an auditor may ask how leaders are actually using the information.
Can a WHS system that was set up correctly drift out of compliance?
Yes, and it typically happens gradually as the business changes. New sites open, contractors rotate, or processes shift without the system being updated to reflect them.
The tell tale signs include inspection templates that no longer match current work areas, contractor induction records that do not reflect the actual contractor base, and workflows that staff have learned to work around because they no longer match how the job is done. For organisations already running Donesafe, KIS Group lists a system review among its services, which is one way to look for this kind of drift. KIS Group is an HSI Donesafe Platinum Partner with 10+ years working with Donesafe, serving clients from local businesses to multi-billion-dollar global companies across Australia, New Zealand, Singapore, South Africa and Ireland. Their WHSEQ and ISO Systems service builds WHSEQ systems designed around how the business operates, not a template.
What should I check first if I think our WHS system is at risk?
Start with open actions: how many are outstanding, how old is the oldest, and do they all have named owners and due dates. That single check tells you more about system health than a document review.
Then look at your last internal audit findings and ask whether they resulted in tracked actions or reports that were filed and forgotten. Finally, check whether your documentation has a defined review cycle and a named person responsible for keeping it current.
Walter Scremin, CEO of Ontime Delivery Solutions, describes what a functioning system looks like at scale: "Since then we've integrated Donesafe into everyday working life, not just as a COR tool, but for QM compliance, CRM and managing over 600 contractors and staff. We couldn't imagine the day we could do without KIS Group as one of our critical business partners." Getting that foundation right requires the system to reflect how the business actually operates, not how it operated when the platform was first configured.
How do I know when the problem is the system design rather than how people use it?
When the same findings reappear across successive audits, the system is usually the problem, not the people. Recurring gaps in the same area, whether that is contractor records, inspection completion or action close out, point to a workflow that does not match the reality of the work.
With almost 100 Donesafe modules available across health and safety, injury and claims, quality and supplier management, risk and compliance, and environmental and sustainability categories, there is often a configuration solution to a recurring gap. If your current build does not include the modules your obligations actually require, process discipline alone is unlikely to close it. That is a configuration problem, and it needs a configuration solution. If you would like to see how the right modules could be applied to your system, KIS Group offers a free Donesafe demonstration, a live online session of 45 to 60 minutes.
Sources
This article draws on the following pages.