Risk and Control Health and Safety Issues Key Issues 1.1 How can management be assured that they have identified and adequately addressed all health and safety risks and hazards within the organization?

1.2 Has an authorized and documented health and safety policy been developed and implemented, and is it maintained up-to-date?

1.3 How can management be certain of compliance with all the relevant legislation and regulations?

1.4 What processes ensure that staff are fully aware of workplace risks and how to correctly utilize safety equipment and protect themselves?

1.5 Has sufficient and appropriate safety equipment (i.e. fire extinguishers, protective clothing, etc.) been provided, and what measures ensure that it all remains in working order and effective?

1.6 Have sufficient and effective fire prevention and protection systems been provided, and are they regularly tested?

1.7 Are adequate security measures in place to restrict access to facilities and protect staff and equipment from attack?

1.8 How can management be certain that all incidents and accidents are reported and appropriately dealt with?

1.9 Have adequate first aid and medical facilities (equipment and personnel) been provided, and are supplies replenished when used?
1.10 Are adequate hygiene and cleanliness standards established, and what mechanisms ensure that the required standards are maintained?
1.11 How can management be assured that adequate and appropriate insurance cover is provided and maintained?
1.12 What mechanisms ensure that all the required regulatory inspections are conducted and that the appropriate regulatory certification is obtained?
1.13 How can management be assured that all hazardous materials are safely, correctly and securely stored?
Detailed Issues 2.1 Has management undertaken a risk assessment of health and safety implications throughout the organization in order to identify the risks and ensure that they are addressed?
2.2 Has a health and safety policy been introduced, and have specific responsibilities for safety issues been allocated?
2.3 What mechanisms prevent non-compliance with the prevailing health and safety regulations?
2.4 How can management be sure that they maintain an up-to-date awareness of all the relevant health and safety regulations?
2.5 Are all staff adequately trained in safety matters, including use of equipment and clothing (and how can management be certain that all the relevant staff actually receive the appropriate training)?
2.6 Are staff progressively tested on their level of understanding of safety measures in order to identify further training needs?
2.7 How can management be assured that all the relevant safety equipment is maintained in working order?
2.8 Are all relevant machines fitted with guards, safety cut-outs, etc., to the required standard?
2.9 How can management be sure that all computer equipment conforms to the required standards (i.e. screen radiation levels, etc.)?
2.10 Are building evacuation, fire and security drills regularly conducted and assessed for effectiveness?
2.11 Are adequate fire alarms and security systems installed, tested and maintained (and would faults be promptly detected)?
2.12 How can management be assured that all building environmental systems (i.e. heating, lighting, air conditioning, etc.) are working correctly and to the required legal standards?
2.13 What mechanisms prevent unauthorized access to buildings and facilities?
2.14 Are the relevant staff (i.e. receptionists, door guards, post room staff, etc.) aware of the action required in the event of a bomb alert, an attack on the building, or a suspicious package, etc.?
2.15 What processes ensure that the records of incidents and accidents are fully and correctly maintained in accordance with any regulatory requirements?
2.16 Are sufficient and suitably trained first aid and medical personnel available, and how can they be promptly summoned to an incident?

2.17 In the event of an emergency, how can management be certain that all visitors are accounted for?
2.18 Are transitory safety risks (such as trailing power leads, wet floors due to cleaning, etc.) adequately addressed?
2.19 How can management be certain that the organization has sufficient insurance cover in the event of being sued for negligence with regard to health and safety conditions?
2.20 What processes ensure that insurance cover is renewed, at the appropriate level and current?
2.21 What processes ensure that all the required certificates and licences are obtained to enable the lawful operation of facilities?
2.22 What mechanisms prevent unauthorized access to hazardous materials?
2.23 How is accuracy of data input from other systems (i.e. human resources)
confirmed?
2.24 How is the accuracy of data output to other systems (i.e. estates management) confirmed?
Reproduced from The Operational Auditing Handbook – Auditing Business Processes (1997:
pp. 396–399), John Wiley & Sons, Chichester, England, with permission from Management Audit LLP.