In the context of a Safety Management System (SMS), auditing is the systematic, independent, and documented process for obtaining objective evidence and evaluating it against established criteria to determine the extent to which requirements are fulfilled.
I recently had a lengthy discussion with the executive team regarding my PSM/RMP audits over the years. These men and women are at the highest level of a Fortune 500 company and were under the impression that the business was “managing risks” via a formal Safety Management System (SMS). I have audited 14 of their facilities over the years; many of these audits are what we call “one and done” audits, as we never hear from the facility again. And when the Sr. VP of Operations retired two years ago, the business allowed each facility to manage its PSM auditing on its own. That worked well until three of the facilities experienced large PSM/RMP events in the past 18 months. And it seems EPA has learned a lot from my audit at one of these sites. So the business wanted to discuss the history and create a new path forward. But what really set them back in their chairs was learning that none of the 14 facilities I had audited had undergone a Health and Safety Audit. Some of the facilities are over 50 years old, and no one can recall ever having been audited. Yet the “C-Suite” was being told that risks were being managed by an SMS. On Day 2 of our discussions, three plant managers joined the discussion and had the opportunity to explain their SMS. To say the least, it was difficult to watch and listen to.
The day before, I laid out the elements of an SMS and how they function; I actually used the 14 elements of PSM and added a few more, like Behavior-Based Safety. So the executive team knew what a functioning SMS was supposed to look like and the role management played in each element. All three (3) PMs failed miserably; none could even name more than 4 elements, and the elements they named, they were unable to say who owned the element, other than “EHS Team”, or how the element was measured to ensure it was producing the desired result. The picture as to how these three (3) incidents were becoming clearer and clearer for this executive team.
By the end of our two days, they knew the path forward: it started with a formal audit plan for each facility. We discussed how to establish the order in which the facilities would be audited, based on known risks and patterns of EHS failures/incidents. We talked about the quality of the auditing and budgeting to ensure qualified auditors were used. We start the audits in July!
Auditing is not merely a “check-the-box” exercise; it is the heartbeat of a functioning SMS, acting as the primary mechanism for verifying that your safety policies, procedures, and practices are not just written on paper, but are actually being performed correctly in daily operations.
Audits ensure that the organization adheres to both internal safety standards and external regulatory requirements.
While proactive reporting systems (such as voluntary hazard reporting) capture many issues, audits reveal latent organizational hazards—systemic weaknesses, training gaps, or process inefficiencies that individuals might not recognize or report because they have become “normalized.”
Auditing fulfills the “Check” phase of the PLAN-DO-CHECK-ACT cycle. It measures whether the controls/barriers/safeguards put in place are actually mitigating risks to an acceptable level. If the audit shows that a control is ineffective, it triggers a redesign of the safety process.
REGULAR and non-punitive auditing encourages transparency. When employees see that audits are focused on system improvement rather than blaming individuals, they are more likely to participate in safety improvements and report concerns openly.
Without regular auditing, an SMS will inevitably “drift” away from its design. People take shortcuts, procedures become outdated as operational environments change, and equipment degrades. Auditing provides the “systemic mirror” that allows leadership to see the organization as it truly is, rather than how they assume it to be.