COR audit readiness checklist

The checklist is below, in full, on this page. You can also download it as a PDF or an editable DOCX, free, with no email required.

How to use this

Five steps. The order matters, because the slowest thing to fix is the thing most people leave until last.

1. Book a day and treat it as the audit. Not an hour between other work. If you cannot give it a day, you will skim, and skimming finds nothing.
2. Work with your own documents open. For every line, the question is not whether you have a policy that mentions the thing. It is whether you can put your hand on the evidence in about a minute.
3. Sample across the entire audit period. Pick a random week from eighteen months ago. That is what the auditor does, and it is where gaps live.
4. Interview two or three workers yourself, and write down what they actually said rather than what you hoped they would say.
5. Turn every gap into a dated action with a name on it. A gap list without owners is just a more organized version of not knowing.

Then do the slow things first: documentation and evidence generation. Site conditions can be fixed in an afternoon. A missing three months of inspection records cannot be fixed at all, only started.

1. Management commitment and policy

The auditor is establishing whether safety has authority in your company or is a department that files things.

• A current health and safety policy exists, signed and dated by the most senior person in the company. Not by the safety coordinator.
• The policy has been reviewed within your own stated review cycle, and the review itself is recorded, even in the years nothing changed.
• Responsibilities are written down for every level: senior management, supervisors, workers, and contractors. Specific duties, not slogans.
• Health and safety is a standing item at management meetings, and the minutes show it.
• Management can describe what they personally do about safety, with examples.
• Workers can describe what management commitment looks like on their site. This is the one that catches people. If workers say management never comes to site and only cares about production, that answer goes in the report.

2. Hazard identification and assessment

• Formal hazard assessments exist for the tasks your company actually performs. Generic assessments bought in a binder, or inherited from a previous employer, are visible immediately.
• Each formal assessment shows who took part, including at least one worker who does the job.
• Assessments are reviewed on a stated schedule and after any significant change, with dates.
• Field level hazard assessments are completed before work starts, on the day, for the actual conditions.
• Field level cards reference the formal assessment they come from. Auditors look for this link specifically and it is often missing.
• Hazards are rated using a consistent method, and the method is written down somewhere a worker could find it.
• New workers, young workers and workers on unfamiliar tasks are addressed specifically.
• Field level cards from a random week eighteen months ago can be produced.

If the difference between formal and field level assessments is not completely clear in your program, fix that before anything else on this list. It is the most commonly muddled part of a safety program and it affects several audit elements at once. The hazard assessment guide covers the distinction.

3. Hazard control

• Controls follow the hierarchy: eliminate, substitute, engineer, administer, then personal protective equipment.
• Personal protective equipment is not the first or only control listed for serious hazards. An assessment where every control is a hard hat and gloves has not been finished.
• Safe work practices and procedures exist for the higher risk tasks your crews perform.
• Workers can find the procedure for their task without phoning the office.
• Personal protective equipment requirements are specified by task, and there are records that workers were trained on the equipment they use.
• Where a control failed, something changed as a result, and the change is recorded.

4. Training, competency and orientation

Orientation records are the most examined documents in most audits, because orientation is where your program either reaches the worker or does not.

• Every worker has a documented orientation before starting work, and it is specific rather than a signature under the words "orientation completed".
• Site specific orientation happens when a worker moves to a new site.
• A training matrix shows what each role requires and who currently holds it.
• Certificates and tickets are on file, and none of the ones in current use are expired. Check this today. It is the easiest finding in the world to hand somebody.
• Competency is verified, not assumed. Somebody watched the worker do the task and recorded that they were competent. A ticket proves attendance at a course, not competence at your work.
• Supervisors have training in their safety responsibilities, not only in the trade.
• Subcontractors' training and competency are verified too, and recorded.

5. Inspections

• Inspections happen at your stated frequency, and the records prove the stated frequency was actually met. If your program says monthly and you have eight for the year, that is a finding created by your own document.
• Inspections are done by the people your program says will do them.
• Deficiencies are assigned to a person with a due date.
• Deficiencies are closed out and the closure is verified by somebody other than the person who did the work, where practical.
• Inspections record positive observations too. Reports that only ever find fault get treated as fault finding, and cooperation drops.
• Equipment pre use inspections are being completed by operators, and they exist for the whole period.
• Inspection reports show variety. Twelve identical reports with nothing found tell an auditor nobody is really looking.

6. Incident reporting and investigation

• All incidents are reported, including near misses. A company with injuries but no near misses is not reporting near misses.
• Workers confirm in interviews that reporting a near miss is expected rather than punished.
• Investigations look past worker error. If every investigation concludes somebody was careless, that is a finding against the program, not against the worker.
• Investigations identify contributing factors across categories: people, equipment, materials, environment, process, and management systems.
• Corrective actions are assigned, dated and closed, and closure is verified.
• Findings are communicated back to the crews, and there is evidence: a toolbox talk record, a safety meeting minute, a revised procedure.
• Serious incident reporting obligations to the regulator and the workers compensation board are written down, naming who calls whom.
• Statistics are compiled and reviewed by management, and somebody can explain what changed and why.

7. Emergency preparedness

• Emergency response plans exist for the sites and the work you actually do, including remote work.
• Emergency contacts, site access directions and muster points are current and posted where a crew can reach them.
• Drills or exercises have been run and recorded, with dates and participants. This is a very common gap.
• First aid coverage matches your crew size and the distance to medical help, and the certificates are current.
• Working alone or in isolation is addressed, with a check in procedure that a named person actually monitors and escalates.
• Workers can describe what they would do in an emergency on their site, without reading it.

8. Program administration and records

• Records cover the full audit period with no unexplained gaps of weeks or months.
• Your health and safety committee or worker representative arrangement matches what your jurisdiction requires at your size.
• Committee minutes show issues raised, actions taken, and issues closed, not just attendance.
• Contractors and subcontractors are prequalified, oriented and monitored, with records.
• There is an annual review of the program itself, with findings and an action plan.
• Document control is real: people can tell which version is current.

The failure points, in order of how often I see them

If you only have an afternoon, look at these six.

How far ahead to start

There is no single answer, but there is a reliable rule: documentation can be fixed faster than evidence can be accumulated.

• Program is current, records are consistent. A few weeks. Run one honest self audit and close what it finds.
• Program exists but records have gaps. Three to six months, because you need clean months to accumulate.
• Starting close to scratch. Plan on building the program first and treat the audit date as a consequence of that work rather than a deadline driving it. Rushing produces a program that passes once and falls over at the maintenance audit.

The uncomfortable truth is that you cannot manufacture a record of an inspection that did not happen. Anybody offering to help you do that is offering to end your certification and possibly your relationship with your clients. The only real option is to start generating genuine evidence and let time pass.

Download the checklist

Free, direct download, no email required, in both formats. The PDF is laid out to print and write on. The DOCX is there so you can put your own company name on it and change the lines that do not fit your work.

The full template library has the field level hazard assessment card, the formal hazard assessment worksheet, the incident report, the corrective action tracker and the rest, all on the same terms.

Next

• What documents does a COR auditor ask for? covers what gets requested first, and what a weak answer looks like next to a strong one.
• Formal and field level hazard assessments sorts out the distinction that affects several audit elements at once.
• COR certification in Canada is the overview, including the certifying partner for your province.