Who Can Perform a Third-Party EHS Compliance Audit?

When a regulatory audit is coming and no one inside the company can perform an EHS compliance audit beforehand, many organizations look outside. A third-party EHS audit can be the fastest way to find gaps, but only if the auditor is qualified. Here is how to tell.

Independence

A useful audit is performed by someone who did not build the system being audited. An internal team auditing its own work tends to confirm what it expects to find. A third-party auditor brings a fresh view and no incentive to overlook problems.

Competence

Ask about the auditor's background in three areas:

• Regulatory knowledge: familiarity with the OSHA, EPA, and state requirements that apply to your operations.
• Audit training: recognized lead auditor credentials for the standards in scope, such as ISO 14001 or ISO 45001.
• Industry experience: an auditor who understands chemical processing, aerospace, or heavy manufacturing will ask better questions than a generalist.

Method

ISO 19011 provides internationally recognized guidance for auditing management systems. A credible auditor follows a defined process: an audit plan, objective evidence gathered through document review, observation, and interviews, and findings graded by significance. Ask to see a sample report before you engage.

How Regulators View Self-Audits

The EPA's policy Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations (commonly called the Audit Policy) can reduce penalties for violations discovered through systematic audits and disclosed and corrected under its conditions. OSHA's policy on voluntary self-audits states that the agency will not routinely request self-audit reports at the start of an inspection. These policies have specific conditions, so discuss them with counsel, but they reflect a clear point: regulators favor organizations that look for their own problems.

Questions to Ask Before You Hire

• Which regulations and standards will the audit cover?
• Who will perform the audit, and what are their credentials?
• How are findings classified and reported?
• Will the auditor help your team understand and close the findings, or just hand over a report?

Related reading: Why Independent Auditing Matters.

How Compliance Fortress Solves This: The Exceleor Path

1. Discovery: understand the problem, measure where things stand today, and agree on what success looks like.
2. Define the engagement path: most organizations don't know the path. We do. A proven method, tailored to your situation.
3. Training: bring your people to a clear understanding of the requirements.
4. Implement and engage: carry out the work jointly, with your people involved from day one.
5. Verify: confirm the work was done and meets the requirement.
6. Validate: confirm the original problem is actually solved, measured against the success measures from Discovery.
7. Transfer ownership: we collaborate throughout, so your team can run it without us.
8. Sustain and grow: we stay close, check in, and catch the next need early. We're here to make sure you succeed.

Is this your situation? See how we approach it on the Regulatory Compliance Audit Coming page, or request a Situation Review. You can also email [email protected].