Most Brisbane businesses don't find out their WHS system has gaps until someone asks a hard question. A new contract client, an insurer, or a Workplace Health and Safety Queensland inspector. By then, you're fixing problems under pressure instead of on your own timeline.
A WHS audit isn't just a compliance box to tick. It's a structured look at whether what's written in your policies actually matches what happens on site, in your vehicles, or on the tools every day. Here's how to tell if your business would hold up, and what to do if it wouldn't.
The warning signs
Your SWMS haven't been touched since they were written. A Safe Work Method Statement is meant to reflect the job as it's actually done. If your crews have changed equipment, sites, or processes since the SWMS was last updated, it's no longer protecting anyone. It's just paperwork.
Training records live in someone's inbox, not a system. If you'd need to email three people and wait two days to prove a worker completed their induction or a ticket is current, that's a problem an auditor will find in minutes.
Contractors aren't managed the same way employees are. Queensland's WHS laws don't draw a neat line between "our people" and "their people." If a contractor gets hurt on your site, your systems get scrutinised regardless of whose payroll they're on.
Near misses get mentioned in the lunchroom, not logged anywhere. If your only incident record is what people remember happened, you've got no evidence of a functioning safety system, and no data to actually prevent the next one.
Nobody's checked that corrective actions were closed out. Risk assessments and audits are only useful if the actions they generate get followed through. A folder full of identified risks with no evidence they were fixed can be worse than not identifying them at all.
What a WHS audit actually involves
A proper audit isn't a single walk-through with a clipboard. It typically looks at:
- Documentation: policies, SWMS, risk assessments, and whether they're current and consistent with each other
- Site or operational observation: whether daily practice matches what's on paper
- Training and competency records, including currency of tickets, licences, and inductions
- Incident and near-miss history: how it's captured, reviewed, and acted on
- Contractor and subcontractor management: induction, supervision, and verification of their own WHS documentation
The output should be a clear, prioritised list of gaps, not just a pass or fail. The businesses that get the most value from an audit are the ones that treat it as a health check, not a report card.
Why proactive beats reactive
An audit you commission yourself, on your own schedule, gives you time to fix things properly. An audit triggered by an incident, a complaint, or a regulator visit gives you none of that. The gap is usually the same either way. The difference is whether you're the one who finds it first.
For Brisbane businesses juggling multiple sites, subcontractors, and tight project timelines, a periodic independent audit is one of the more efficient ways to catch drift before it becomes a serious incident, a lost tender, or a regulatory notice.
Before, during and after the audit
Before the audit
A genuine audit starts before anyone sets foot on site. That means agreeing the scope, whether it's a full system audit or focused on a specific area like a particular hazard category or a single site, and gathering existing documentation in advance, policies, procedures, risk assessments, training records and incident history, so the auditor isn't starting from nothing on the day.
The audit criteria should also be established upfront. Depending on the purpose of the audit, this may include WHS legislation and Codes of Practice, the organisation's own procedures, client or contractual requirements, or management system standards such as ISO 45001.
On the day
The on-site component typically covers a document review against what's actually happening in practice, not just whether the paperwork exists, direct observation of work being carried out, checking whether controls described in documentation are actually being followed, and conversations with workers and supervisors, since what people say about how things actually work often reveals more than the documentation does.
A good auditor isn't looking to catch people out. They're looking for the gap between what the system says should happen and what actually happens, because that gap is where incidents come from.
A good audit is also evidence-based. Where something can't be verified from the records, observations or discussions available during the audit, that should be clearly identified rather than assumptions being made either way.
After the audit
A proper audit doesn't end with a checklist of ticks and crosses. It should produce clear, evidence-based findings, identify any nonconformities or areas requiring improvement, set out practical corrective actions where appropriate, and identify anything requiring further verification, with a plan to confirm those actions actually get closed out, rather than sitting in a report nobody revisits.
Audit findings commonly arise where documented controls haven't kept pace with changes in equipment, tasks, personnel, or the way work is actually performed. If your business operates plant, machinery or higher-risk activities, it's worth reviewing whether your risk assessments reflect how those tasks are actually carried out today.
Getting a clear picture
If you're reading through this list and aren't sure where your business would land, that uncertainty is usually the tell. Overwatch Safety Solutions gives you a practical, prioritised action plan rather than just a compliance score.
Get in touch for a chat about what an audit would look like for your operation, and what it typically uncovers.