Health and Safety Audit Checklist: 71-Point CMIOSH Template

Most health and safety audit checklist templates stop at a list of boxes to tick. That gets you a record of what someone looked at, not a defensible answer to the question an inspector, an insurer or a client framework actually asks: how bad is each gap, and who is fixing it by when? A health and safety audit checklist only earns the name “audit” once every line is rated against a consistent scale and tied to a named owner and a date.

What follows is the 71-point checklist our chartered team works from on site, grouped into the 9 sections an auditor in Ireland or the UK is expected to cover, plus the scoring method that turns a walk-round into a written, defensible record. Sector add-ons for construction, wind and utilities sites sit at the end.

What This Checklist Covers, and Why the Jurisdiction Matters

A thorough safety audit checks 2 things at once: that the paperwork describes the work accurately, and that the site matches the paperwork. The 9 sections below are built to test both halves together, section by section, rather than running a paper review and a site walk as 2 disconnected exercises.

The legal frame behind each section depends on where the site sits. In Ireland, the baseline duties run through the Safety, Health and Welfare at Work Act 2005 and the Safety, Health and Welfare at Work (General Application) Regulations 2007, with the Health and Safety Authority (HSA) as the regulator. In the UK, the equivalent baseline sits in the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999, enforced by the Health and Safety Executive (HSE). Where a site holds ISO 45001 certification, the same visit can double as the internal audit clause 9.2 of the standard requires, provided the scope and auditor competence match what the clause asks for.

HSE frames this kind of check as the formal “check” stage of its plan-do-check-act cycle, the point where a board tests whether the system on paper is the system the site actually runs. Scoring the checklist below is how that test produces a written, comparable answer rather than a verbal impression.

We cross-reference every finding against the citation the site’s own regulator would use, which is also why a competent person needs to own the checklist rather than treat it as a one-off form.

How We Score Every Finding

A checklist without scoring is a list of opinions. We rate every item against 4 severity levels, so the written report reads as risk-ranked work rather than a flat series of yes-or-no answers.

Compliant needs no action before the next scheduled review. Minor is a low-risk gap, usually a documentation or housekeeping item with no breach of a legal duty, fixed within 90 days. Major breaches a legal duty or a standard without an immediate danger to life, and gets a named owner and a 30-day target. Critical is an immediate risk to life, or a breach already in progress, and the task stops until the fix is verified.

Every Major and Critical finding feeds into a written corrective action register with an owner and a date, the same register that should sit inside a wider safety management system so nobody has to re-discover the same gap next year.

The 71-Point Health and Safety Audit Checklist

The checklist runs to 71 items across 9 sections. Items are numbered 1 to 71 straight through, so every finding in the written report has its own reference number, and the table below shows where each section starts and ends.

Work through the 9 sections below in order. Each line is scored Compliant, Minor, Major or Critical using the scale above.

Section 1: Policy, Leadership and Governance (Items 1 to 8)

1. Written safety and health policy statement is signed, dated and reviewed within the last 12 months.
2. Policy names the most senior accountable person by role, rather than “the directors” as a group.
3. Organisation chart shows the reporting line from floor to board for safety matters.
4. Safety is a standing item on board or senior leadership meeting minutes.
5. Budget for corrective actions is approved and tracked, not informally agreed.
6. Safety statement under the Safety, Health and Welfare at Work Act 2005 is in place in Ireland, or the general policy duty under the Health and Safety at Work etc. Act 1974 is evidenced in the UK.
7. Competent person or persons are named and documented in writing.
8. The previous audit’s corrective actions are closed out, or carry a live target date.

Section 2: Risk Assessment, RAMS and Safe Systems of Work (Items 9 to 17)

9. Risk assessments exist in writing for every significant hazard.
10. Risk assessments describe the work as it is actually done, not a generic template.
11. RAMS and Method Statements are site-specific and signed by the person carrying out the work.
12. Lift plans comply with General Application Regulation 42 where lifting operations take place.
13. A permit-to-work system covers hot works, confined space entry, work at height and isolation or lock-off.
14. Risk assessments are reviewed after any incident, near miss or change to the task.
15. COSHH or hazardous substance assessments are current and substance-specific.
16. A risk register captures findings that fall outside the standard checklist.
17. The date of the last review is visible on every live risk assessment and RAMS pack.

Section 3: Training and Competence (Items 18 to 25)

18. A training matrix maps every role to its mandatory training.
19. Certificates on file match the training matrix, not a loose folder of paperwork.
20. Refresher dates are tracked and flagged before they lapse.
21. Induction records exist for every new starter, including agency and contractor staff.
22. Supervisors can describe the competence standard for their crew in their own words.
23. Toolbox talk records are dated, topic-specific and signed.
24. Named competent persons hold evidenced qualifications for their appointed role.
25. Training records for staff recently moved to a new task or location are up to date.

Section 4: Contractor and Visitor Management (Items 26 to 32)

26. Contractor pre-qualification and vetting records are on file before work commences.
27. Site induction is mandatory and logged for every contractor and visitor.
28. PSCS and PSDP appointments are documented for Irish construction projects.
29. CDM 2015 duty holders, client, principal designer and principal contractor, are named for UK construction projects.
30. Contractor RAMS are reviewed and approved before work starts, not after the fact.
31. Visitor sign-in records capture completion of a safety briefing.
32. Multi-contractor sites have a documented process for managing interface risks between trades.

Section 5: Work Equipment (Items 33 to 41)

33. Statutory inspection records for lifting equipment, pressure systems and local exhaust ventilation are current.
34. Work equipment checks under the Irish General Application Regulations or UK PUWER 1998 are documented.
35. Machine guarding is in place and matches the original design intent.
36. Portable appliance testing records are current and visible.
37. Maintenance schedules exist and the records show they are being followed.
38. A defect reporting process is known to operators and acted on promptly.
39. Plant and vehicle pre-use checks are completed and signed on the day of use.
40. Calibration records exist for gas detection, monitoring or test equipment.
41. An ergonomic review has covered repetitive tasks, manual handling loads and workstation set-up.

Section 6: Emergency Preparedness (Items 42 to 49)

42. A fire risk assessment is current and site-specific.
43. An emergency evacuation plan is displayed and known to staff, contractors and visitors.
44. Fire extinguishers, alarms and emergency lighting are serviced to schedule.
45. Evacuation drills are run and logged at a reasonable interval.
46. First aid provision, trained first aiders, kit and a defibrillator where relevant, matches the site’s risk profile.
47. An emergency contact list is current and accessible without relying on one person’s phone.
48. Spill or environmental incident response equipment is in place where relevant.
49. A muster point and headcount procedure is documented and tested.

Section 7: Incident Reporting (Items 50 to 56)

50. An accident and near-miss log is maintained, with near misses categorised separately from recordable incidents.
51. Incidents reportable under RIDDOR in the UK are identified correctly against the regulations’ thresholds.
52. Incidents reportable to the HSA in Ireland, including any absence of more than 3 consecutive days following a workplace accident, are identified correctly.
53. Reporting timescales are met and evidenced with submission records.
54. A root-cause investigation is carried out for every reportable incident, beyond completing the report form.
55. Corrective actions from investigations are tracked through to close-out.
56. Near misses and incidents are reviewed together for trends, as well as one by one.

Section 8: Welfare Facilities (Items 57 to 63)

57. Toilets, washing facilities and drinking water meet the minimum provision for headcount on site.
58. Rest and break facilities are suitable, heated or ventilated, and accessible.
59. Changing and drying facilities are provided where the work is wet or dirty.
60. Facilities are clean, maintained and not used for storage.
61. Welfare provision for a mobile or multi-site workforce, site cabins or welfare vans, is adequate.
62. Accessibility of welfare facilities matches the site’s workforce needs.
63. Display screen equipment workstation assessments are current for office-based staff.

Section 9: Documentation and Record-Keeping (Items 64 to 71)

64. The safety statement, risk assessments and RAMS are version-controlled, and the live version is the one actually on site.
65. Document retention meets statutory minimums for accident and training records.
66. An audit trail exists for who approved and distributed each live document.
67. Records are accessible to the people who need them, not held in one manager’s inbox.
68. Employers’ liability and public liability insurance documentation is current and on file.
69. ISO 45001 documented information requirements are met where the site holds certification.
70. Previous external audit reports and this audit’s corrective action register are cross-referenced.
71. Subcontractor safety documentation is filed against the project it relates to.

Score every one of the 71 items above the same way and the result is a single, comparable health and safety audit checklist you can run again next year and measure progress against, rather than a fresh opinion each time.

Industry Add-Ons: Construction, Wind and Utilities

The core 71 points apply to any site. High-risk industries carry a short list of sector-specific items on top, scored the same 4 ways. Add-on items carry a letter prefix (C for construction, W for wind, U for utilities) so they stay separate from the core 1 to 71 numbering.

Turning the Checklist Into a Defensible Audit Trail

A health and safety audit checklist only does its job once it is scored, owned and repeated. Run the same 71 points, plus whatever sector add-on applies, at a consistent interval and the result stops being a one-off report and starts being a trend line you can show a regulator, an insurer or a client framework.

Where a finding touches incident reporting or a documented management system already working toward ISO 45001 certification, the same checklist slots into the audit programme those frameworks already expect. We run this exact checklist for clients across Ireland and the UK, scored by a CMIOSH-chartered advisor rather than self-marked. Book a compliance consultation and we will tell you exactly where your site scores before the next inspection does.