How to prepare for OSHA inspections, customer safety audits, and ISO 45001 audits in fabrication shops and field operations
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
The Week Before the Audit Is Already Too Late
You have a safety audit on the calendar. Maybe it’s a customer’s safety team. Maybe it’s your ISO 45001 surveillance audit. Maybe you don’t know it’s coming at all, because OSHA doesn’t schedule with you.
Safety audit preparation that starts the week before is not preparation. It’s damage control. Auditors don’t grade how hard you scrambled. They grade what your records, your floor, and your people show on the day they walk in. Real safety audit preparation happens all year, not in the final week.
The good news: the shops that pass audits cleanly aren’t doing anything exotic. They run the same program every week, so the evidence already exists when someone asks for it.
From the Floor: I run operations at an OSHA VPP site today, and that status doesn’t survive on a cram session. I’ve also had a safety manager on my team whose entire audit prep happened the week before the audit date. Prepare one week out of 52 and you will miss things, and you’ll be scrambling for answers while the auditor stands there. They’re there to audit, not to wait. When the program runs year-round and the processes are actually followed, you already have the answers to the questions the auditor is going to ask. That safety manager is no longer with the company. You just can’t operate that way.
👉 Before your next audit, find the gaps yourself instead of letting the auditor find them. The free Construction Compliance Checklist gives you 81 items across OSHA 1926, ANSI/ASSP consensus standards, quality flow-downs, environmental permits, and subcontractor management. Run it this week, and you’ll know where you stand before anyone else does →
In This Guide
This safety audit preparation guide covers:
- The five safety audits and inspections manufacturers and contractors may face, and what’s at stake in each
- The three evidence tests behind a safety audit: paper, records, and the floor
- How to prepare for an OSHA inspection, a customer or owner audit, and an ISO 45001 audit
- A year-round audit-readiness cadence that replaces the one-week scramble
- A 90/30/7-day pre-audit verification sequence
- A quick audit checklist and answers to frequent safety audit questions
Table of Contents
👉 Start Here (Top Resources)
If your safety program leans on consensus standards for its procedures (lockout, fall protection, construction operations), you need the edition your contract or written program actually requires on hand, not a photocopy nobody can date. The ANSI Safety Standards collection on the ANSI Webstore is the place to confirm editions and buy the titles your programs reference.
If you’re working toward or maintaining ISO 45001 certification, the auditor will audit you against the standard itself: ISO 45001:2018 with Amendment 1:2024 (climate action changes). Get the ISO 45001 package from the ANSI Webstore, which includes both the 2018 standard and Amendment 1:2024, so the people writing and checking your procedures are reading the same text the registrar reads.
If you want a U.S. safety management framework without pursuing certification, ANSI/ASSP Z10.0-2019 — ANSI Webstore is the U.S. consensus standard for occupational health and safety management systems, and a solid yardstick for internal safety audits.
If nobody on your team has been trained to run an internal audit, fix that before the external one. BSI Group’s ISO 45001 training courses and ISOQAR’s ISO 45001 courses both cover internal auditor and lead auditor levels.
Five Safety Audits and Inspections Your Operation May Face
“Safety audit” means different things depending on who is walking through your gate. OSHA conducts inspections, while customers, certification bodies, and your own organization conduct audits or evaluations. Each has a different yardstick and different consequences. Safety audit preparation aimed at the wrong one wastes time.
| Audit Type | Who Audits and Against What | What’s at Stake | Notice |
|---|---|---|---|
| OSHA inspection | OSHA compliance officer, against 29 CFR 1910 (general industry) or 1926 (construction) | Citations and penalties, abatement deadlines, repeat-violation exposure | Generally none |
| Customer or owner safety audit | Client safety department or contractor-management platforms such as ISNetworld or Avetta, against contract terms, client site rules, and OSHA | Bid eligibility, site access, contract renewal | Usually scheduled; site spot checks happen |
| ISO 45001 certification or surveillance audit | Accredited certification body, against ISO 45001:2018 + Amd 1:2024 | Your certificate and customer contracts tied to it | Scheduled |
| OSHA VPP evaluation | OSHA evaluation team, against VPP program criteria | VPP status and the exemption from programmed inspections (unprogrammed inspections from complaints, referrals, or fatalities can still occur) | Scheduled |
| Internal safety audit | Your own trained auditors, against your program, ISO 45001 clause 9.2, or ANSI/ASSP Z10 | Findings you control and fix on your own timeline | You set it |
If you are a field contractor bidding owner-client work → the customer audit and prequalification review are the ones that cost you work. Start there.
If you are an ISO 45001-certified shop → your surveillance audit is predictable. The bigger readiness test is the OSHA inspection you didn’t schedule. If you’re a VPP site, remember that VPP exempts you from programmed OSHA inspections, but unprogrammed enforcement activity (complaints, referrals, fatalities) can still bring an inspector to your gate.
If you’ve never run an internal safety audit → do that first. It’s the only audit on this list where the findings stay in-house.
The Three Evidence Tests Behind a Safety Audit
Different auditors use different criteria. Underneath those criteria, a safety audit tests three things: what your program says, what your records prove, and what people are actually doing. I’ve sat on both sides of the table. As a certified ISO 9001 internal auditor, I audit management systems for a living. As an operations manager, I’ve hosted the auditors. The evidence logic doesn’t change between quality and safety.
Test 1: The Paper
Do you have the written programs your operation requires? Hazard communication, lockout/tagout, respiratory protection, confined space, fall protection, hot work, emergency action. The auditor checks that each program exists, is current, and matches the hazards you actually have.
Test 2: The Records
Does the paper produce evidence? Training rosters, equipment inspections, permits, the OSHA 300 log, incident investigations, corrective actions. A program with no records is a document, not a program.
Test 3: The Floor
Does what people do match what the paper says? This is where last-minute audit prep falls apart, because you can’t fake it in a week. The auditor asks a welder how he verifies zero energy. They look at the fall protection on the deck crew. They check the inspection tag on the sling in use against your crane and rigging program.
Common finding in practice: training records that don’t match the people actually doing the work. The roster says the crew completed lockout training. The auditor asks the second-shift maintenance tech who’s actually working on the press, and his name isn’t on it. That’s a training finding and a lockout/tagout finding in one question.
Common finding in practice: inspections signed in a batch. Thirty days of forklift pre-use checks in the same pen, the same handwriting, signed on the same afternoon. Experienced auditors spot that from across the room, and it calls every other record into question.
👉 If you can’t say with certainty that your training records match who’s actually on the floor this week, an auditor will find out for you. Check first. The Manufacturing Compliance Checklist walks shop teams through training, inspection, and recordkeeping evidence item by item →
OSHA Inspection Prep: What Has to Be True Before the Knock
OSHA rarely calls ahead. That makes the OSHA inspection the purest test of year-round readiness.
An inspection typically runs through credentials, an opening conference, a walkaround of the areas in scope, and a closing conference where the compliance officer discusses apparent violations. Your job is to make sure the walkaround finds what your written programs say it will find.
Recordkeeping That Holds Up
Recordkeeping is one of the easiest places to create compliance exposure, and one of the easiest places to find gaps before an inspection. Covered employers must post the Form 300A summary from February 1 through April 30 each year and keep the 300 log, 300A, and 301 forms for five years. Fatalities must be reported to OSHA within 8 hours, and in-patient hospitalizations, amputations, and losses of an eye within 24 hours. OSHA’s injury and illness recordkeeping page lays out who is covered and which establishments must also submit data electronically.
What a Citation Costs in 2026
OSHA made no inflation-based adjustment to its maximum civil penalties for 2026. The January 2025 amounts carried forward because the inflation data OSHA uses was not published during the federal shutdown, according to OSHA’s May 21, 2026 penalty memorandum.
| Violation Type | 2026 Maximum Penalty | Notes |
|---|---|---|
| Serious / Other-than-serious | $16,550 per violation | Gravity-based; reductions for size, good faith, and history may apply |
| Failure to abate | $16,550 per day beyond the abatement date | Accrues daily |
| Willful or repeated | $165,514 per violation | Reduction factors generally don’t apply |
The citation may be only one part of the financial impact. Downtime, legal fees, insurance effects, corrective work, and lost bids can add significantly to the cost of a serious compliance failure. We break down that full picture in the cost of non-compliance in manufacturing.
Consensus Standards Auditors Use as Benchmarks
OSHA regulations establish enforceable requirements. Customer contracts and specifications may add ANSI/ASSP consensus standards to the requirements you need to meet, and auditors may use recognized consensus standards as references where applicable.
If your crews work at height, have the current ANSI/ASSP Z359 Fall Protection Code on the shelf. If your energy control program goes beyond 1910.147’s minimum, ANSI/ASSP Z244.1 is a reference experienced auditors recognize. Field contractors should look at the ANSI/ASSP A10 Construction Package, which bundles more than 30 A10 construction operations standards at a lower price than buying them separately. The ANSI Webstore also serves international buyers and carries many standards in multiple languages, which matters for multinational sites and multilingual crews.
Customer and Owner Safety Audits: Where Contractors Win or Lose Work
For field contractors, the owner’s safety audit can matter more than OSHA. An OSHA citation costs money. Failing an owner’s prequalification costs you the bid.
Prequalification reviews typically look at your written programs, your injury rates, your experience modification rate (EMR), and your training records. Site audits then check whether your crew does what your paperwork promised.
Shop and field audits are not the same audit. The hazards differ, so the evidence an auditor looks for differs too.
| Audit Focus | Fabrication Shop | Field Crew |
|---|---|---|
| Primary hazards | Machine guarding, material handling, hot work, overhead cranes | Fall protection, scaffolding, excavations, mobile cranes |
| Permits checked | Hot work, confined space entry | Hot work, confined space, excavation, owner-issued work permits |
| Inspection records | Pre-use checks on forklifts, cranes, and slings; guard and interlock checks | Daily scaffold and harness inspections, competent-person excavation checks |
| Training evidence | Equipment-specific authorization, lockout, hot work | OSHA 10/30 cards, site orientation, competent-person designations |
If one safety program covers both, make sure it has separate field procedures. I’ve watched a single program written for the shop fall apart in the field because the hazards are different. More on that in building a safety management system that works in the shop and the field.
Owners also check training credentials. Owner contracts and site requirements may specify OSHA 30 for supervisors and OSHA 10 for workers. A card in the file proves successful completion of Outreach training. It does not prove job-specific competence, and good owner auditors know it. See OSHA 10 vs OSHA 30 for what those cards actually cover.
If you are bidding owner-client work this quarter → pull your prequalification data now. Confirm your EMR, injury rates, and written programs are current before the owner pulls them for you.
ISO 45001 Audits: Certification, Surveillance, and Recertification
ISO 45001 audits are the most predictable of the five. You know the date. You know the standard. You still see shops get findings, because the auditor samples evidence the system was supposed to produce all year.
For an initial certification cycle, Stage 1 reviews readiness and the management system’s documented information, Stage 2 evaluates implementation and effectiveness, surveillance audits normally follow in the first and second years, and recertification occurs in the third year. Two core areas are clause 9.2, Internal Audit, and clause 9.3, Management Review. If you can’t show a working internal audit program and management reviews with real decisions in them, the rest of your system looks unverified. Our ISO 45001 documentation requirements guide lists the records auditors ask for.
The internal audit program needs a method, not just a schedule. ISO 19011:2018 on the ANSI Webstore is the international guideline for auditing management systems. If you’re buying ISO 45001 and ISO 19011 together, the ANSI Webstore bundle options cost less than buying standards separately, and code CC2026 takes another 5% off through December 31, 2026 via the ANSI coupon link.
What about the revision? ISO 45001:2018, together with Amendment 1:2024 on climate action, is the current published edition. The revised draft went to Draft International Standard (DIS) ballot on June 16, 2026, voting closed September 9, and ISO expects the new edition to replace the 2018 version in the first half of 2027. Your next audit is against the current edition and amendment, not an unpublished draft. Don’t put off fixing findings while you wait for a standard that isn’t published yet.
Your certification body also matters. Make sure it’s accredited. You can verify accreditation through ANAB in the U.S. or through the IAF member directory internationally. See our ranking of the best ISO certification bodies for options.
If you are preparing for your first ISO 45001 certification → read the ISO 45001 certification guide and, before Stage 2, complete the internal audit and management review activities your management system and certification process require.
The Year-Round Safety Audit Preparation System
This is the part that replaces the one-week scramble. Readiness isn’t a project. It’s a cadence. Each activity produces evidence as a byproduct of doing the work, so nothing has to be reconstructed later.
| Frequency | Activity | Evidence It Produces |
|---|---|---|
| Daily / per shift | Pre-use equipment inspections, JSAs before the task, permits issued and closed | Dated inspection sheets, signed JSAs, closed permits |
| Weekly | Supervisor safety walk with written observations | Walk logs, open items assigned to a name and date |
| Monthly | Safety committee meeting; corrective action review; training matrix check against current roster | Minutes, closed corrective actions, current training matrix |
| Quarterly | Internal audit of one or two programs (rotate through all of them each year) | Audit reports, findings, corrective action records |
| Annually | Management review; written program review; 300A posting; VPP self-evaluation if applicable | Review records, revision history, posted summary |
The test of this table is simple. Could someone pull a random week from eight months ago and find the evidence? If yes, you’re audit-ready. If you’d have to “go find it,” you’re not.
The 90/30/7 Pre-Audit Sequence
When you do know the date, safety audit preparation shifts from building to verifying. Use the lead time to confirm, not to create.
- 90 days out: Run a full internal audit against the auditor’s criteria. Assign every finding to a person and a due date.
- 30 days out: Close or document every open corrective action. Spot-check training records against the current roster and equipment inspections against what’s actually in service.
- 7 days out: Walk the floor like the auditor will. Confirm postings, signage, and housekeeping. Brief supervisors on who escorts the auditor and who answers which questions. Don’t coach anyone on the answers.
That last point matters. If a crew member has to be coached on how to describe your lockout procedure, the auditor will notice. Fix the training instead.
👉 A finding you catch 90 days out is a corrective action. The same finding caught by the auditor goes in their report. Find it first. Download the Construction Compliance Checklist and use it as your 90-day internal audit baseline →
“We Don’t Have a Full-Time Safety Manager for This”
Small shops and lean field crews raise this objection for good reason. Year-round readiness sounds like a full-time job, and nobody has budget for one.
It isn’t. Year-round safety audit preparation doesn’t add work. It moves the work you’re already doing (or should be doing) onto a schedule, and gives each piece an owner. Supervisors own daily inspections and weekly walks. One person owns the training matrix. The quarterly internal audit takes a trained auditor a day or two.
Compare that with the alternative. The one-week scramble pulls your best people off production right before the audit, and it still misses things. A finding on a surveillance audit means a corrective action, follow-up evidence, and sometimes a follow-up visit. An OSHA serious citation starts at real money and gets worse if it repeats.
The second form of this objection is “we’re not certified, so we don’t need internal audits.” Customers and OSHA don’t care whether you hold a certificate. Internal audits are just how you find problems before someone with authority does. For the implementation traps to avoid, see common mistakes in ISO 45001 implementation.
If you are under customer pressure to show a working safety system quickly → get one person trained as an internal auditor first. BSI Group’s ISO 45001 internal auditor training and ISOQAR’s ISO 45001 course catalog are both built for that.
Quick Safety Audit Preparation Checklist
Use this as a recommended audit-readiness baseline, not a list of universal legal requirements. What applies to you depends on your hazards, contracts, and management system.
✅ Every written program required for your hazards exists, is dated, and has been reviewed at the interval required by the applicable standard, contract, or management system
✅ Training records match the people actually doing the work this week, including second shift and temps
✅ Equipment inspections are dated and signed on the day they were done
✅ If you’re covered by OSHA recordkeeping, Form 300A for the prior year was posted February 1 through April 30, and five years of records are on file
✅ Every open corrective action has an owner and a due date
✅ Your internal audit program is current, with scheduled audits completed and findings addressed
✅ Management review records show actual decisions, not just attendance
✅ Permits (hot work, confined space, excavation) are issued, closed, and filed
✅ Consensus standards referenced by your contracts, specifications, or written programs are verified against the edition actually required
✅ Supervisors know who escorts the auditor and where records live
✅ Field procedures exist separately where field hazards differ from the shop
⚠️ If more than two of these are uncertain, schedule an internal audit now. Don’t wait for the external one.
Frequently Asked Questions
How far in advance should safety audit preparation start?
The honest answer is that safety audit preparation never stops. Readiness comes from running your program every week. When you have a known audit date, start verification 90 days out with a full internal audit. That gives you time to close findings with real corrective actions rather than quick patches.
Does OSHA give notice before an inspection?
Generally, no. OSHA inspections are typically unannounced, which is why OSHA inspections are the best test of year-round readiness. Plan as though an inspection could happen on any working day.
What documents do safety auditors ask for first?
Expect early requests for written safety programs, training records, the OSHA 300 log and 300A summary, equipment inspection records, incident investigations, and corrective action records. ISO 45001 auditors will also ask for internal audit reports and management review records.
What’s the difference between a safety audit and a safety inspection?
A safety inspection checks physical conditions at a point in time, such as guards, extinguishers, and housekeeping. A safety audit checks whether the system that controls those conditions works: programs, training, records, and corrective actions. A good audit includes inspection activities, but it goes further.
How much does an OSHA citation cost in 2026?
OSHA’s 2026 maximums are $16,550 per serious or other-than-serious violation, $16,550 per day for failure to abate, and $165,514 per willful or repeated violation. These are unchanged from 2025 because no inflation adjustment was published for 2026.
Who should conduct internal safety audits?
Someone trained in audit methods who doesn’t audit their own work. In a small shop, that might mean the quality manager audits safety and the safety lead audits quality. ISO 19011 provides the international guidance on auditing management systems, and ISO 45001 internal auditor courses from providers such as BSI and ISOQAR cover the method.
Do you need ISO 45001 certification to pass a customer safety audit?
No. Customer and owner audits typically evaluate your actual program, records, and performance, not your certificate. Some contracts do require certification, so check your contract terms. A system built to ISO 45001 or ANSI/ASSP Z10 will make any audit easier either way.
Should we wait for ISO 45001:2027 before fixing our safety management system?
No. ISO 45001:2018 with Amendment 1:2024 is the current edition, and your next audit will be against it. ISO expects the revision in the first half of 2027, followed by a transition period. A system that works under the 2018 edition is the foundation you’ll adapt, not something you’ll throw away.
📥 Free Resources
- Construction Compliance Checklist — 81-item jobsite self-assessment covering OSHA 1926, ANSI/ASSP consensus standards, quality flow-downs, environmental permits, and subcontractor management, for contractors and fabrication crews working in the field
- ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system
- Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
- Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
Not Sure What to Do Next?
🔹 Still sorting out which audits apply to you? Start with ISO 45001 vs OSHA to see where the regulation ends and the management system begins, then ISO 45001 vs ANSI Z10 if you’re weighing a framework without certification.
🔹 Ready to build your internal audit capability? Get one person trained this quarter through BSI Group’s ISO 45001 courses or ISOQAR’s training programs, then run your first quarterly audit using the Construction Compliance Checklist as the baseline.
🔹 Need the standards your programs reference? Buy the ISO 45001:2018 standard from the ANSI Webstore (add Amendment 1:2024 if you buy it on its own) or browse the full ANSI Webstore catalog for the A10, Z359, and Z244.1 titles your field and shop programs cite. Code CC2026 saves 5% through the end of 2026. Our guide on where to buy ANSI safety standards covers which titles to buy first.
Last-minute safety audit preparation doesn’t pay off. Audits reward a program that runs the same way in March as it does the day the auditor shows up. Build the cadence, give every piece an owner, and let the evidence pile up on its own. The Standards Navigator will keep breaking down the standards behind that program, one clause and one regulation at a time.
Stop Cramming for Audits Your Program Should Already Pass
Some operations treat safety audits like final exams, with a week of late nights, missing signatures, and crossed fingers. Others barely notice the audit date, because the inspections, training, and corrective actions are already on file from the other 51 weeks.
The Standards Navigator covers the OSHA regulations, ANSI consensus standards, and ISO 45001 requirements that shop and field operations get audited against, written by people who have hosted those audits.
👉 Get updates on OSHA, ANSI safety standards, and ISO 45001 audit requirements
👉 Be first to access new safety checklists, audit tools, and compliance guides
Industrial Compliance. Clearly Explained.
