I get about a dozen calls a year from folks asking me about their PSM/RMP due dates. I try to explain that of course OSHA or EPA can cite the facility if the audit is past due. For example, the last audit was done the 2nd week of February 2020, it is expected that the 3-year audit will be conducted BEFORE the 2nd week of February 2023. That is easy math, but the CRITICAL DATE regarding these audits is NOT the week the audit was done, but rather the really important date is
the day that senior management reviewed the findings, accepted the findings and approved the corrective action plans for the findings. This is what EPA and OSHA mean when they use the word “certified” in their audit element. (emphasis by me)
| 1910.119(o)(1)
Employers shall CERTIFY that they have evaluated compliance with the provisions of this section at least every three years to verify that the procedures and practices developed under the standard are adequate and are being followed. |
|
68.79 Compliance audits. (a) The owner or operator shall CERTIFY that they have evaluated compliance with the provisions of this subpart at least every three years to verify that procedures and practices developed under this subpart are adequate and are being followed. |
Doing the actual audit is the easy part! It may be painful at times, but auditing is a CRITICAL element in any management system. it is intended to test the management system and verify that it is identifying hazards, analyzing those hazards, determining the level of risk those hazards pose, and controlling those risks.
But as important as the actual audit is the actions that happen after the audit play a LARGER role in the audit process. This is where senior management of the facility/business sits down and takes in all the audit findings and begins to analyze how each finding was missed by the SMS. How big of a miss was it? But most importantly, how will the facility CLOSE each finding so that not only is the material finding corrected, a means to ensure that the SMS can recognize the failure(s) that led to the finding.
So certifying the actual audit report is ONLY HALF of what needs to be certified – the PLAN to correct the findings AND to strengthen the SMS must be part of that certification process.