WHS Audit Checklist: What an Auditor Asks to See

A WHS audit checklist should list records, not topics: the emergency plan and how it is tested, the registers, licence evidence, training and consultation notes, and each contractor's file for the day sampled. Below, each record has the law behind it and the person who holds it; most of it comes from routine inspections and audits. Download the 3-page PDF or the CSV.

What Is a WHS Audit?

A WHS audit is a structured check of whether a safety system is in place, is followed, and can be shown to work, against a stated standard: WHS law, your own procedures, a client's requirements, or ISO 45001.

An inspection looks at conditions in one place on one day; an audit samples records across a period and asks whether the system produced them.

Does the Law Require a WHS Audit?

Not as such. The model WHS Act as at 5 December 2025 does not contain the word audit, and the model Regulations of the same date use it only in the schedule on safety management systems at major hazard facilities.¹² Some checklists in circulation say the law requires an assessment of every workplace each 12 months. No model WHS provision says so.¹²

What the law does set is the duties and many of the records. It also gives officers of the business a duty of due diligence, including reasonable steps to verify that safety resources and processes are provided and used, and an internal audit is one way to do that.¹ Our guide to PCBU responsibilities covers who counts as an officer.

Two cautions. The model Regulations state that they have no legal effect by themselves, and Safe Work Australia says the Commonwealth, states and territories must each implement the model laws as their own, so numbering can differ.²³ Safe Work Australia also says the model laws have been implemented in every jurisdiction except Victoria, where the Occupational Health and Safety Act 2004 and the Occupational Health and Safety Regulations 2017 apply.³⁷

The Records an Auditor Asks For, and the Law Behind Each.

Each duty carries its own qualifiers. The general duties in the Act apply so far as is reasonably practicable; most of the regulations in this table (r 42, r 43, r 85, r 237, r 346, r 425, r 427 and r 429) do not, so the record has to show the thing was done.²

Document	What the auditor asks to see	Model law	Usually held by
Emergency plan	The plan for each workplace, how often its procedures are to be tested, and the record of the last test2	r 43 (the test record is practice)	Building or site manager
First aid	Equipment locations, and trained first aiders or access to them2	r 42 (the record is practice)	Site manager
Hazardous chemicals register	The list of hazardous chemicals used, handled or stored, with a current safety data sheet for each, where workers can reach it2	r 346	Site or warehouse manager
Asbestos register and plan	For buildings in scope, the register and the management plan2	r 425, r 429	Owner or FM provider with management or control of the building
Asbestos register copy	The date each contractor whose work risked exposure to airborne asbestos was given a copy of the register2	r 427(2)	Owner or FM provider
Registered plant records	Tests, inspections and maintenance of registered plant such as lifts, kept while it is used or until you hand over control, then passed on2	r 237	FM provider or engineering
High risk work licence	The written evidence of each licence, sighted before the work and kept at least 1 year after it2	r 85	Site or warehouse manager
Notifiable incident records	Each notifiable incident, kept at least 5 years from notice. The model Act as at 5 December 2025 adds notifiable extended absences and suicides; check your state1	s 38	Safety manager
Control measure reviews	When each control was last reviewed and why, including any request from a health and safety representative2	r 38 (the record is practice)	Safety manager with site managers
Training and instruction	What each worker was trained in, for the work they do and its risks2	r 39 (the record is practice)	HR or training coordinator
Consultation with workers	Committee minutes, representative arrangements, and toolbox notes that record outcomes1	s 47 (the record is practice)	Safety manager
Coordination with other duty holders	What was agreed with tenants, the FM provider and contractors about shared work1	s 46 (the record is practice)	Building or site manager

Six rows deserve a second look. The model provisions behind control measure reviews (r 38), training (r 39), first aid (r 42), the record of the last emergency test (r 43), coordination (s 46) and consultation (s 47) set the duty, but none says a record must be kept.¹² Safe Work Australia's model consultation code says consultation need not be documented unless the Regulations require it, though records are good practice.⁴

An auditor will ask for all six anyway; our guide to WHS procedures covers how long records are kept. The code's advice is that a record can be brief and simple: the matter, who was involved, what was decided and why, and who will act by when.⁴

What a Certification Audit Adds.

A certification audit also tests your management system against a standard: ISO 45001:2018, with its 2024 amendment on climate action, which Standards Australia adopted in October 2018 under the number AS/NZS ISO 45001:2018.⁵⁶ ISO describes it as setting criteria for an occupational health and safety policy, objectives, planning, implementation, operation, auditing, and review.⁵

So a certification auditor also asks for:

• Policy and objectives. The policy, the objectives, and the plan for each.
• Internal audits. What was audited, when, by whom, and the reports.
• Management review. Leadership's review of the results, and what it changed.
• Nonconformities. Each one, its cause, and the action taken.

Those rows close the download, marked as certification, so an uncertified business can skip them. Two facts catch people out:

• AS/NZS 4801 is superseded. Standards Australia announced in August 2019 that AS/NZS 4801:2001 was 'available superseded', while noting it remained 'a current Australian Standard cited in legislation across Australia'.⁶ A checklist built on 4801 is out of date for certification.
• ISO 45001 is being revised. ISO's catalogue page says the 2018 edition will be replaced by a version under development, as at 12 October 2026.⁵

Who in the Business Holds Each Record?

Rarely the safety manager alone, which is why audits stall. In a commercial property portfolio the records usually sit like this:

• Facilities manager or FM provider. The asbestos register, the registered plant records and the emergency plans.
• HR. Training and induction records.
• Procurement, or whoever booked the job. Contractor files.
• Company secretary. Board papers and the WHS reports officers received.

Put a person's name against every row, not a team's, and ask each to produce one sample record now. Where a landlord or a labour hire agency holds it, note how you would get it within the hour. A row nobody claims is already a finding.

Contractor Records Are Where the Sample Breaks.

The auditor takes a job from the work order system or the sign-in log, then a date and a worker's name, and asks what the business knew about that person on that day.

The law makes that a fair question. A business's primary duty, so far as is reasonably practicable, covers workers it engages or causes to be engaged and workers whose activities it influences or directs, while they are at work in the business or undertaking, and a contractor's employees are workers.¹ Where you, a contractor and a tenant share a duty, each of you must, so far as is reasonably practicable, consult, cooperate and coordinate with the others.¹

For one contractor worker on one day, the file should show four things:

1. The company was approved for the work on that date. Insurance, licences and safety history current then, not only today.
2. The person was cleared. Their induction, and for high risk work the licence evidence your site sighted before they started.
3. They were there, and you knew. The sign-in record and any permit issued for the job.
4. The method was agreed. For high risk construction work, the safe work method statement the contractor must have before work starts (r 299), and your check of it; a principal contractor must take all reasonable steps to get a copy first (r 312).²

The gaps are usually in the second and third, because the licence sits in the contractor's records and the sign-in sits in a paper book at the gate. Our guides to the contractor safety management system and the training and competency matrix cover the controls and the tickets.

Worked Example: An Office Portfolio With Contractors on Site.

Take a property manager in property and facilities management running six commercial office buildings, one of them in Victoria, with an FM provider, a lift contractor, and trades booked job by job (an illustration, not a customer). The internal auditor picks last March's chiller replacement in one building's plant room.

First, the mechanical contractor's file: approved, with current insurance, on the day work began. Next, the asbestos register, because the building dates from the 1980s and the plant room had known asbestos-containing gaskets. Where the work carried a risk of exposure to airborne asbestos, the contractor had to be given a copy of the register (model Regulations, r 427(2)).² Then the lift records, because the lift carried the old unit down, and lifts are plant that must be registered under the model Regulations (Schedule 5).²

The gap is rarely the FM provider's paper; it is the handover. The register is on file, but nobody can show the contractor received it, and the drill record lists a warden who left in May.

The Victorian building needs its own column. There the asbestos register sits under regulation 227 of the Occupational Health and Safety Regulations 2017 (Vic) and must be reviewed at least every 5 years (r 228(2)). The Victorian Regulations do not require an asbestos management plan for a workplace.⁷ Under the model Regulations the five-year review sits on the management plan (r 430(1)(e)), and the register must be reviewed whenever the plan is (r 426(a)).² Victoria also requires a copy of the register for every employer or self-employed person whose business is located in the building, usually each tenant (r 229(1)), and requires a contractor at risk of exposure to be told of the register and given access to it (r 229(2)).⁷

What the safety manager keeps, per building:

• Asbestos. The register, the plan, and the date each contractor was given the register.
• Lifts. The service records, in one place.
• Drills. The last date, and the warden list that day.

Worked Example: A Distribution Centre Before a Client Audit.

In transport and logistics, picture a 24-hour distribution centre with forklifts, a battery charging bay, labour hire pickers on nights, and contractors servicing the doors and racking. Its largest customer audits it every year.

The sample is one night shift in August. First, the forklift licences for every operator rostered that night: the business running the site must see written evidence of each licence before the work, and keep a record of it for at least 1 year after the work (model Regulations, r 85).² Labour hire operators are where this fails, because the agency holds the copy and nobody on site sighted it.

Then traffic. The person with management or control of the forklifts must ensure they do not collide with pedestrians or other powered mobile plant (model Regulations, r 215(4)), so the auditor asks for the traffic management plan and the last check of pedestrian routes on nights, when pickers and trucks share the aisles.² The auditor may also ask how psychosocial risks on the night roster are managed (model Regulations, r 55C).²

Next, the hazardous chemicals register covering the charging bay and the cleaning store, with a current safety data sheet for each hazardous chemical on it, kept where the night shift can reach it.² Then the emergency plan: how often it says the evacuation procedure is tested, and whether the night shift has ever taken part in a test.²

What we recommend: check licences at the roster, not at induction, because a labour hire worker can start on a night when nobody from the office is there, and run drills across shift patterns.

How Do You Use the WHS Audit Checklist?

Start it 6 weeks before the audit, not the week before. Write a named holder against every row and mark each site Y, P or N; there are columns for up to 6 sites, enough for the office portfolio above.

Then write a sample date and a contractor who worked that day at the top, produce every row for that date, and put anything slow to find in the action column. Our guide to preparing for a compliance audit covers what to say when a record cannot be produced.

Answer Any Audit Sample From One Record.

The contractor's day is the hardest sample to answer, because the approval, the licence and the sign-in usually sit in three places. In ComplyFlow, contractor management software, they sit on one record.

• The licence before the job. A site can require a document such as a High Risk Work Licence, and the requirement then appears on the dashboard of anyone assigned to that site.⁸ Where your team reviews documents itself, the reviewer checks the expiry date the contractor entered before approving or rejecting, and rejected documents stay in the history.⁹
• The sign-in on the day. Each sign-in point has its own QR code, an induction that is due is completed before sign-in, and site documents such as an asbestos register or a traffic management plan can be shown as the last step, with what was displayed logged in the Sign In Book PDF export.¹⁰
• The list for the auditor. The staff worker list filters and downloads to CSV.¹¹

Sample Yourself Before the Auditor Does.

An audit only sees a sample, so the test is whether any sample would hold. Fill in the checklist for one site this week, pick the date you would least like to be asked about, and see whether the records agree.

If they do not, you found the finding first, with weeks to fix it instead of a morning.