ADOSH-SF Audit Non-Conformance: A Guide for Auditors

Article-level navigation isn't available for this document — showing the full text as extracted.

Abu Dhabi Occupational Safety and
Health System Framework
(ADOSH-SF)
ADOSH-SF Technical Guideline
ADOSH-SF Audit Non-Conformance
(A Guide for Auditors)
Version 4.0
July 2024

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 2 of 30
Table of Contents
1. Introduction ....................................................................................................................................................... 3
2. Definitions .......................................................................................................................................................... 4
3. Identification of Audit Results.................................................................................................................... 5
3.1. Audit Findings and Non-conformance Process .......................................................................... 5
3.2. Classification of Non-Conformance ................................................................................................ 6
3.3. Recording Non-Conformance............................................................................................................ 6
4. Guidance on levels of Non-Conformance ................................................................................................ 7
5. Document Amendment Record ................................................................................................................. 29

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 3 of 30
1. Introduction
(a) This technical guideline provides additional information to assist entities to comply
with the requirements of
ADOSH-SF- Element 8 – Audit and Inspection. The contents
of this technical guide are not mandatory; however, adopting the information within
this guide will assist you in compliance to the requirement of the Element.
(b) Within the ADOSH-SF, there is no definition of a major or minor non-conformance or
indeed the need to classify any findings as anything other than a non-conformance,
however it is common practice of auditors, both internal and external to classify any
non-conformance as either major or minor.
(c) This classification of non-conformance will always lead to debate as there is no strict
criteria that states one issue must be set as a major or minor non-compliance. This is
due to the many different circumstances within each organization that will be audited.
(d) Further to this, the competency of the lead auditor will also have an impact upon how
audits non-conformances are classified. The lead auditor should have sufficient
experience and knowledge to review the information that is presented as documented
evidence and from this make a reasonable judgment upon the impact of the non-
conformance.
(e) The purpose of this technical guideline is to provide information to entities and
auditors with some base information on which these judgements can be made, leading
to a more consistent approach to auditing thorough the emirate of Abu Dhabi.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 4 of 30
2. Definitions
(a) An audit has been defined within the
ADOSH-SF as:
(i) a systematic, independent and documented process for obtaining audit evidence
and evaluating it objectively to determine the extent to which audit criteria are
fulfilled.
(b) A non-conformance has been defined within the
ADOSH-SF as:
(i) a non-fulfillment of a requirement. Specifically, a nonconformance is any
deviation from work standards, practices, procedures, regulations, management
system performance etc. that could either directly or indirectly lead to injury or
illness, property damage, damage to the workplace, or a combination of these.
(c) A corrective action has been defined within the
ADOSH-SF as:
(i) corrective actions are steps that are taken to remove the causes of an existing
non-conformity or undesirable situation. The corrective action process is
designed to prevent the recurrence of nonconformities or undesirable situations.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 5 of 30
3. Identification of Audit Results
3.1. Audit Findings and Non-conformance Process
(a) Audit findings, conforming or non-conforming, will be established following the
process described below:
Collect information by appropriate
sampling
Evaluate Audit infomation
Evidence meets Audit criterea?
Write NC form
Review findings with audit team
Define level of NC
Conclude Audit Findings
No
Yes

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 6 of 30
3.2. Classification of Non-Conformance
(a) As highlighted in section 1, the ADOSH-SF does not include any mandatory
requirements for classification or indeed definitions of what constitutes a major or
minor non-conformance, however for the purposes of this guideline, the following
definitions are provided:
(i) A non-conformance may be as ‘major’ if the audit evidence shows one or more of
the following situations:
1. An issue, which has or can lead to harm to human safety and health and /
or property damage;
2. Failure to document (such as procedure or work instruction) an ADOSH-SF
requirement;
3. Non-implementation of an ADOSH-SF requirement rendering the overall
system non-effective; and
4. Continuous presence of one or more ‘minor’ non-conformance without
action.
(ii) Minor Non-Conformance
1. A Minor Non-Conformance has been defined as issues that reduce the
effectiveness of the OSHMS implementation, partial breakdown of a
process.
(iii) Positive Point:
1. Worth mentioning points of strength, good practice which organization
should continue.
(iv) Observation:
1. Requirements and expectations have been met, but with minor
inadequacies or omissions, and / or in the opinion of the auditor preventive
action will improve effectiveness of the implemented OSHMS where
corrective action is not mandatory.
3.3. Recording Non-Conformance
(a) A nonconformance should be written in a brief and simple manner to convey the
identified problem fully and without ambiguity. While writing a nonconformance, the
following should be considered:
(i) Description of the problem (e.g. not inspected … not conducted …. not maintained
etc.) with audit evidence (objective and reproducible);
(ii) Where the problem was found e.g. identify the process / activity / location etc.;
and
(iii) Reference to audit criteria not met (e.g. section / clause of an element of
ADOSH-SF).

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 7 of 30
4. Guidance on levels of Non-Conformance
(a) The table below provides auditors with guidance on certain non-conformances that
have been observed during audits undertaken by ADPHC. The table goes through each
element within the ADOSH-SF.
(b) The table is not intended to provide an absolute guide as to the level of non-
compliance, however, more to provide the auditor with information which can help
them make a more informed decision on the level of non-conformance observed.
(c) Auditors must ensure that the information gathered during the audit is the
determining factor when deciding levels of non-conformance.
(d) There are many methods that auditors can use when determining the levels of non-
conformance, however the auditor should ensure they refer back to the definitions
provided in section 2 and the process in section 3.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 8 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
1.0 ADOSH-SF – Element 9 – Clause 3.1 – OSH Policy
1.1
Signed OSH Policy, dated with the current
year, fully communicated, however missing
some of the required commitments within
clause 3.1(a)(iv)
Minor / Major
The level of NC would depend upon how the entity has
implemented the requirements of the policy, along with how
many of the required commitments are missing from the policy.
1.2 OSH policy is not appropriate to the scale
or cover all the undertakings of the entity Minor / Major The level of NC will depend on the level of risk of the entity and
how much information is missing within the policy.
1.3 OSH policy not updated for more than two
years Major
The level of noncompliance will depend on what evidence the
entity can show on the review of the OSH policy. If the entity can
demonstrate that the policy has been reviewed periodically and
no update was required, then no Non Compliance should be given,
however without this evidence the auditor should make a
judgement dependent on the level of implementation
1.4
OSH policy is not independent of other
polies (i.e. includes environment or other
standards)
Major It is an absolute requirement of the ADOSH-SF that the OSH
policy should be standalone from all other polices.
1.5 OSH policy has not been communicated Minor / Major The auditor should check what knowledge employees of the
entity have of the OSH policy.
1.6 No OSH Policy in place Major The entity must have an OSH policy.
2.0 ADOSH-SF – Element 1 – Roles, Responsibilities and Self-Regulation
2.1 No procedure in place for the entity Major
It is an absolute requirement that the entity has developed and
implemented a roles and responsibility procedure. The auditor
may decide to downgrade it to a minor NC if this is the only
procedure not developed and the requirements of Clause 3.1
have been implemented and can be demonstrated through
records.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 9 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
2.2
Procedure developed however does not
cover all requirements as detailed in Clause
3.1.
Minor / Major
The level of Non-Compliance will be dependent on the
implementation of the requirements. If the entity can fully
demonstrate implementation, then a minor NC should be given
(unless this becomes a common theme throughout an audit),
however if little or no implementation of the requirements can
be demonstrated then a major NC should be given.
2.3
No Management Representative
appointed, or the person appointed not a
member of top management.
Minor Each entity must ensure that a member of top management is
appointed as the MR.
2.4
Roles and responsibilities developed for all
employees however have not been
communicated.
Minor / Major
The entity should be able to demonstrate effective
communication of the requirements. This should be tested
through interviews and/or questioning of general employees and
also reviewing records of communication. The level of non-
compliance will be dependent on the outcome. If during the
interview process it becomes clear that employees are not fully
aware of the requirements, this may lead to the NC being
elevated to major.
2.5 No mechanism to measure conformance of
employee roles and responsibilities Minor
A vital element of employees delivering OSH roles and
responsibilities is ensuring that mechanism exists to measure
performance. The level of Non-Compliance will differ dependent
on what the entity has implemented. If this has not been
considered, then a minor NC should be considered.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 10 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
2.6 None or Insufficient resources available
within the entity. Minor / Major
The level of non-compliance will depend upon what resource is
available and also at what level of competency. The Auditor
should review the organization chart to determine what resource
has been identified as required against what is available. If there
is a large disparity against the org chart the auditor may consider
a major non-compliance. Further consideration should also be
given to what plans the entity has in place to recruit further
resource. If documented evidence is available to show progress
this should be considered when determining the level of non-
compliance.
3.0 ADOSH-SF – Element 2 – Risk Management
3.1 No procedure in place for the entity Major Is it an absolute requirement for all entities to have a
documented risk management procedure in place for their
business and ensure this has been fully implemented? The
auditor may choose to downgrade the NC if evidence is available
of a plan to implement the requirements or some evidence to
show that risk assessments have been undertaken.
3.2
Procedure developed, however not
implemented, or does not meet the
requirements of the ADOSH-SF or
documented risk assessments in place
Major
3.3
Risk Management program does not cover
the full scope of the entities undertaking /
activities (routine and non-routine) or all
employees or persons affected by the
entities undertakings.
Minor / Major
The level of non-compliance will be dependent upon what
activities have not been included as part of the risk management
program. If these are considered low risk then the NC may be
given as minor, however if these are high risk activities then the
auditor should consider raising a major non-compliance.
3.4
Hierarchy of controls has not been
considered when identifying control
measures for specific hazards.
Minor / Major
The audit may choose to raise the level of non-compliance
dependent on the level of risk. If the entity has continually
identified PPE as a control measure for higher risk issues then a
major NC should be considered.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 11 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
3.5
Risk Assessments developed however
control measures have not been
implemented.
Major
As previous the level of non-compliance would depend upon the
degree of non-implementation. The entity should be able to
provide demonstrable evidence that they have implemented
each identified control measure.
3.6
Risk Assessments have not been updated /
reviewed on a regular basis, including
following incidents, implementation of
control measures, non-compliance etc.
Minor / Major
Risk assessments must be reviewed on a regular basis and
updated as required to ensure they are still valid and relate to
the entity undertaking. The auditor may choose to raise the level
of non-compliance if no evidence or review is available.
3.7
Employees not consulted on risk
management activities or results of risk
assessments not communicated to
employees
Minor
Staff who are undertaking the works should be consulted to
ensure that the risk assessment is suitable and sufficient and
also that any control measures that are identified are appropriate
for the actual task.
4.0 ADOSH-SF - Element 3 – Contractor Management
4.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 4.2 Procedure developed but not implemented
within the entity Major
4.3
Procedure does not meet the requirements
of the ADOSH-SF or does not cover the
scope and risk of the contractors engaged
by the entity
Minor / Major
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and what risk does this pose
to the entity. The level of NC should be based upon the review
findings
4.4
OSH not involved in the development of
tender documents or OSH not specified
within tender documents
Major
Entities must ensure that OSH requirements are specified within
all tender documents to allow contractors to submit appropriate
responses that meet requirements and also ensure that OSH is
built into the commercial proposal.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 12 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
4.5
No OSH criteria to evaluate contractor
selection or OSH not involved in contractor
selection
Major
It is vital OSH is included in the contractor selection process and
defined criteria is available. This should include a minimum pass
mark for contractors to meet before being considered for
selection.
4.6 No OSH requirements set within the
contractual agreement. Major
Requirements for OSH must be included within the contractual
agreement to provide both parties with a clear scope of the
minimum standards that must be implemented during the works.
4.7
No risk assessments or method statements
(RA/MS) submitted for the works being
undertaken or RA/MS submitted but
insufficient or not reviewed or approved
by the entity.
Major
The entity must ensure that the hazards that are present from
the works being undertaken are assessed and appropriate
controls in place. This should also consider what risks (if any) are
present to the entities own staff. The risk assessments
submitted by the entity should also consider what hazards are
present to the contractor’s staff from the entity’s own
undertakings.
4.8 No monitoring of the contractor’s activities Major
The auditor should consider what the entity has committed to
undertake as part of their process and from this determine what
level of non-compliance is appropriate.
4.9 Contractors staff not inducted to the
entity Minor
The entity must ensure that all staff that are working within their
workplace are fully inducted and aware of any hazards and risks
that may be present. The auditor may choose to raise the level
of non-compliance dependent on the risk and hazards present or
indeed the number of contractors working within the entity.
5.0 ADOSH-SF - Element 4 – Communication and Consultation
5.1 Communication
5.1.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 5.1.2 Procedure developed but not implemented
within the entity Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 13 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
5.1.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the
level of non-compliance through evaluating how much
information is not incorporated into the procedure and also
what risk does this pose to the entity.
5.1.4 Annual performance report not developed Minor The entity is required to develop an annual performance report
as part of the overall management review process.
5.2 Consultation
5.2.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 5.2.2 Procedure developed but not implemented
within the entity Major
5.2.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
5.2.4 Consultation with staff not considered at
all stages of risk management. Minor
The auditor should consider what consultation (if any) has been
undertaken and also the hazards and risks in relation to the
entity.
5.2.5 No OSH committee within the entity Major OSH committee shall be established in compliance with Element
4 requirements
5.2.6
OSH committee established however has
not met 4 times within the last calendar
year
Major / Minor
The auditor should consider what meetings have taken place (if
any) during the last year and decide the level of non-compliance
based upon this information.
5.2.7
OSH committee not chaired by a member
of top management with formal delegated
authority
Minor
The OSH committee must have authority to make decisions
based upon the information given during the meetings. If top
management do not attend or do not have the authority to make
any decisions, the purpose of the committee will not be met.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 14 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
5.2.8
OSH committee meetings are not
documented with minutes distributed to
relevant stakeholders, including staff
Minor
The entity must ensure that they have a mechanism to provide
feedback to all stakeholders on the output of the committee
meetings.
5.2.9 Actions agreed within the OSH committee
not implemented. Minor / Major
The auditor should consider what actions have been agreed on
(if any) and decide the level of non-compliance based upon this
information. The auditor may choose to raise the level by
considering the risk posed by not implementing agreed actions
and determine the level of non-compliance based upon this
information.
6.0 ADOSH-SF – Element 5 – Training, Awareness and Competency
6.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 6.2 Procedure developed but not implemented
within the entity Major
6.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
6.4
Training needs analysis not developed for
the entity or doesn’t cover all roles within
the entity or all OSH training required,
including refresher training.
Minor / Major (for
no training need
analysis)
The entity must ensure that it has identified all training needs
within the organization. The analysis should consider the outputs
of a number of issues such as risk management, role competency
requirements, Operational control procedures, role specific
training. The audits should review information available and form
this determine the level of non-compliance.
6.5 Identified training not planned or delivered Minor
The auditor should review what training has been identified
against what has been delivered and from this information make
a judgment of the level of non-compliance. If no training or a
small percentage has been delivered, the auditor may choose to
raise the level of non-compliance to a major.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 15 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
6.6
Content of training delivered does not
meet the requirements of the training
matrix or the ADOSH-SF
Minor / Major
The auditor should review a sample of the training to ensure that
it meets the requirements of the identified training within the
matrix. The level of non-conformance will be dependent on the
information supplied.
6.7 Training delivered is not evaluated to
ensure it meets the required outcomes. Minor
The entity should ensure that following the delivery of training,
an evaluation is undertaken to ensure that delegates have met
the desired outcome. The complexity of the training delivered
should dictate the level of evaluation the entity undertakes.
6.8
New staff OSH induction has not been
developed or does not cover all OSH topics
relevant to the entity.
Minor
The entities OSH induction should cover all necessary
information to ensure they are aware of the requirements within
the entity. The auditor should review the induction procedure
against what has been developed and decide upon the level of
non-compliance based on this information.
6.9 Staff have not been provided with an OSH
induction Minor
All staff within an entity must receive an OSH induction within a
reasonable timescale of joining the company. There may also be
a need to refresh this information. The auditor should review the
records for new staff and based on this determine the level of
non-compliance.
6.10 Internal trainers not competent to deliver
training. Minor
The entity must ensure that when training is being delivered
internally, the persons assigned to train staff are competent to
do so. This would normally include a specific train the trainer or
teaching qualification and also subject specific knowledge of the
subject they are training upon.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 16 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
6.11
Competency requirements not identified
for individual roles or not communicated to
individuals.
Minor / Major
The entity should identify the minimum competency
requirements for each roles within the organization and
document this. This is normally done through job descriptions.
The auditor may choose to raise the NC to major is no
consideration of competency has been undertaken.
6.12
No mechanism to measure individual
competencies against those identified for
the specific role
Minor
The entity must ensure that those persons who are performing
tasks are competent to do so. Each role should have specific
competency requirements and the entity should have a
mechanism in place to measure individuals against this. This is
normally done when the employee joins the organization and
then on an annual basis as part of a performance review.
6.13 Training records are not available for the
training that has been delivered Minor The entity must be able to demonstrate that employees have
been trained and are competent in the tasks they are assigned.
Part of this will be training records.
7.0 ADOSH-SF – Element 6 – Emergency Management
7.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 7.2 Procedure developed but not implemented
within the entity Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 17 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
7.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
7.4
Emergency scenarios have not been
developed or are not linked to the entity’s
undertakings – i.e risk based.
Major
The entity must ensure that they identify emergency situations
that are relevant to their business. Identification of generic
emergency situations should not be considered as compliant. For
each scenario that has been identified the entity should be able
to demonstrate why this is identified as an emergency situation
through risk assessment.
7.5 Emergency Response plans have not been
developed Major
The entity must ensure that specific emergency response plans
are developed for all identified scenarios, however at a minimum
this must include a Fire management plan and an emergency
evacuation plan. The emergency response plans must be specific
to the entity and comply with the requirements as set within the
ADOSH-SF
7.6
Emergency Response plans have been
developed but do not cover all identified
scenarios.
Minor
7.7
Emergency response plans have been
developed but are not specific to the
entities undertaking or workplace or cover
all requirements within the ADOSH-SF.
Minor
7.8 Emergency response plans do not include a
Fire management plan and an emergency
evacuation plan.
Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 18 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
7.9 Emergency Response Team not identified Major The entity must ensure that an appropriate emergency team has
been identified and are competent to undertake the role. The
entity must provide specific training to team members on the role
and duties they are expected to undertake. The training should
be in line with the complexity of the roles. The auditor should
also ensure that staff are fit and able to undertake the role
assigned.
7.10
Emergency Response team identified
however no training provided and/or team
members not communicated within the
organization
Major
7.11
Emergency evacuation procedures and
routes not communicated or clearly posted
around the building.
Minor/Major
The auditor should check around the building for the procedure
and evacuation routes, however this should also be followed up
by checking with a random sample of staff to check their
awareness.
7.12 Emergency response plans not tested on a
regular basis
Minor / Major (if
never tested)
The entity is required to ensure that all emergency response
plans are tested on a regular basis to ensure that staff are aware
of the contacts and action to take during a specific emergency.
The entity should be able to provide demonstrable evidence of
the testing. The testing of ERP’s should not be limited to fire or
emergency evacuation, however, should cover all identified
scenarios.
7.13 Emergency response plans not reviewed or
updated.
Minor
The entity should review all emergency plans at least annually to
ensure they are still valid. The review should incorporate
feedback form any drills or actual emergencies that have
happened.
7.14
Emergency equipment not in place, not
maintained or out of service, such as:
firefighting equipment, evacuation chairs,
fire blankets, fire alarm system, emergency
signage, and communications.
Major The auditor should judge the level of non-compliance against the
severity of the missing equipment.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 19 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
8.0 ADOSH-SF – Element 7 – Monitoring, Investigation and Reporting
8.1 Targets and Objectives
8.1.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 8.1.2 Procedure developed but not implemented
within the entity Major
8.1.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
8.1.4 Documented Key Performance Indicators
not established for the entity Major
Each entity must establish documented KPI’s, including those set
within Mechanism 6.0, that are specific to the entity.
8.1.5
Key Performance indicators do not include
the mandatory KPI’s as set within the
ADOSH-SF
Minor / Major
8.1.6 Documented KPI’s do not have measurable
targets set for each individual KPI. Minor
The KPI’s that the entity sets must have measurable targets. A
common NC seen is when entities will set KPI’s such as a 10%
reduction however no base line figure has been set on which the
10% reduction can be measured upon.
8.1.7 Documented programs for achieving each
individual KPI have not been developed. Major
For each individual KPI, a program on how the entity will deliver
the KPI should be in place. The program should include detailed
information on how the KPI plans to meet the objective, including
timelines, responsibilities etc.
8.1.8 Set target and objectives are not
monitored to ensure compliance. Major The entity must ensure that as part do the plan to achieve the
set targets, a monitoring plan is developed and implemented.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 20 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
8.1.9 Targets set have not been met, however
no action has been taken by the entity. Minor
The entity must ensure that where it does not meet the set
target, this is escalated and a corrective action plan developed.
The auditor should review what information is available and from
this decide upon the level of non-compliance. If all targets have
not been met and no action taken, the auditor may decide to raise
the NC to major.
8.1.10 Targets and Objectives not communicated
to all relevant stakeholders Minor
This is vital to ensure that all persons are aware of what the
entity has committed to achieve within the set timescale and
also to ensure they are aware of their individual roles within.
8.2 Incident Notification, Investigation and Reporting (including Mechanism 11.0 requirements)
8.2.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 8.2.2 Procedure developed but not implemented
within the entity Major
8.2.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
8.2.4
Competency requirements for those
designated to investigate incidents not
defined
Minor
It is vital that the entity defines what the minimum competency
levels are for those designated to undertake incident
investigations.
8.2.5
Completed investigations reports do not
include all required information as stated
within
ADOSH-SF – Mechanism 11.0
Minor / Major
The auditor should review a sample of all completed
investigation reports and from this information decide upon the
level of non-compliance. If all investigation reports are missing
information, then the auditor may decide to raise the level of
non-compliance to major.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 21 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
8.2.6 Completed investigation reports do not
identify the root cause of incidents Minor / Major
The auditor should review a sample of all completed
investigation reports and from this information decide upon the
level of non-compliance. A common error is to identify immediate
causes for the root cause or identify human error as the main
cause.
If all or the majority of investigation reports are missing
information, then the auditor may decide to raise the level of
non-compliance to major.
8.2.7
Output of completed investigations are not
communicated internally or to other
stakeholders
Minor The entity must ensure that all stakeholders are aware of the
results of the investigation and also the outputs and actions.
8.2.8
Entity unable to demonstrate the status of
investigations. i.e which are closed, still
under investigation.
Minor The entity should be in a position to identify which
investigations are currently ongoing or closed and also what the
status of any corrective actions that may have been identified as
part of the investigation. 8.2.9
Entity unable to demonstrate the status of
any corrective actions identified within
completed investigations
Minor
8.2.10
Relevant Risk assessments, Standard
operating procedures or other relevant
information not reviewed following an
incident
Major
As part of each investigation the entity should review all relevant
information relating to the incident and ensure this is current and
up to date following the incident. This should not only be limited
to risk assessments and SoP, but also consider training and other
information.
8.2.11 Serious OSH incidents not notified to the
relevant SRA / ADPHC Major The auditor may choose to downgrade the NC if this is limited to
an isolated incident and all other information is correct.
8.2.12
Serious OSH incidents not reported to the
relevant SRA /ADPHC within the correct
timescales.
Minor
The auditor should review a sample of investigations and
determine the level of NC from this information. If a significant
number are not reported within the correct timescales, the
auditor may decide to upgrade the NC to a major NC.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 22 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
8.2.13
Completed incident investigation reports
not reviewed by top management / OSH
management representative.
Minor
Top Management must be aware of incidents that are occurring
within and entity and should also be signing / endorsing the
incident investigation to ensure that any actions that are
identified have been agreed by top management, especially
where there is a requirement for budgets etc.
8.3 OSH Performance Monitoring and Reporting including Mechanism 6.0 requirements
8.3.1
Monitoring requirements not identified to
ensure the effectiveness of OSH programs
and control measures
Major Entities need to identify the monitoring requirements for a
number of issues within their organization such as Occupational
Nosie, indoor air quality, targets and objectives etc.
8.3.2
Monitoring requirements identified but not
checked or do not meet the agreed
standards/parameters
Minor
8.3.3 Equipment used for monitoring has not
been calibrated. Minor
Monitoring equipment should be calibrated annually, and the
entity should be able to demonstrate this through certification
for each individual device.
8.3.4
Quarterly Performance reports, as required
by ADOSH-SF – Mechanism 6.0, have not
been submitted or the information within
is not accurate
Minor / Major
The auditor should review a sample of submitted reports and
decide the level of NC from this information. If no reports have
been submitted this should be considered a major NC
9.0 ADOSH-SF – Element 8 – Audit and Inspection
9.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 9.2 Procedure developed but not implemented
within the entity Major
9.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor / Major
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 23 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
9.4 Audit / Inspection plan for the entity not
developed Minor Each entity is required to develop an audit and inspection plan
that covers the scope of the organization and also the OSH MS.
The entity should be able to demonstrate effective
implementation of the pan through documented audit and
inspection records. The auditor should review the plans and
from this information decide upon the level of non-compliance.
9.5
Audit / Inspection plan does not cover the
scope of the entity and/or the complete
OSHMS.
Minor
9.6 Audit / Inspection plan developed but not
implemented Minor
9.7
Documented criteria for undertaking audits
not available (audit checklist) or doesn’t
cover entire scope of the entity and/or all
applicable legal requirements).
Minor
Entities are required to develop documented criteria (audit
checklist) for internal audits. The criteria should cover all the
requirements within the ADOSH-SF and also of the internal
management system.
9.8 Auditor undertaking internal audits not
competent to do. Minor
Internal auditors are not required to hold a recognized lead
auditor or internal auditor qualification, however, must be
suitable knowledgeable of the auditing process and also of the
ADOSH-SF.
9.9 Non-Conformance and corrective action
procedure not in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 9.10
Non-Conformance and corrective action
procedure developed but not implemented
within the entity
Major
9.11
Corrective actions identified do not
effectively address the non-conformance
i.e. prevent reoccurrence
Minor The auditor should review the corrective actions that have been
identified, through audits, inspections or other means within the
entity, and review how effective they are in preventing re
occurrence of the non-compliance. Each identified non-
compliance should be allocated timescales for closure and also
responsibilities for implementation. The entity should also be
able to effectively demonstrate the current status of non-
conformances within the organization.
9.12
The entity is unable to effectively
demonstrate current status of all
corrective actions that have been
identified
Minor
9.13 Corrective actions identified have not been
allocated timescales or responsibilities Minor

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 24 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
9.14
3 rd Party audit has not been undertaken
within one year of approval or annually
thereafter
Major
Failure to undertake a 3rd party audit should always be classified
as a major non-compliance. The auditor may choose to
downgrade this to a minor NC if a plan is in place to undertake
the audit, dependent on the timescales.
9.15
Entity undertaking 3rd party audit not
approved by ADPHC or audit led by
practitioner not approved by ADPHC as an
auditor
Major Failure to use an approved OSH Professional entity or OSH
practitioner should always be classified as a major non-
compliance. Similarly, if an entity has been engaged that helped
with the development of the internal OSHMS this should also be
viewed as a major non-compliance. 9.16
Entity and/or practitioner undertaking 3rd
party audit has worked on the
development of the entity OSHMS within
the last 2 years.
Major
9.17
Man days undertaken on the audit not in
line with the scope and complexity of the
entity
Minor
The auditor should review the scope of the entity against the
number of man days that have been delivered as part of the 3rd
party audit and check if this appears reasonable to cover the
scope of the entity. As an example, if an entity has multiple
locations and is involved in complex industrial processes,
however the 3 rd party audit only delivered 2-man days, this may
be seen as unreasonable
9.18 3 rd party audit does not cover the scope of
the ADOSH-SF Major The scope of the audit must be against the requirements of the
ADOSH-SF and not voluntary standards such as 45001 etc.
9.19 3 rd Party audit not reported to the relevant
SRA / ADPHC Minor The entity is required to report the audit to the relevant SRA
within 30 calendar days of the audit.
10.0 ADOSH-SF – Element 9 – Compliance and Management Review
10.1 Legal Compliance
10.1.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 10.1.2 Procedure developed but not implemented
within the entity Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 25 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
10.1.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
10.1.4
Monitoring and / or verification of
identified legal requirements not
undertaken or implemented
Major Where legislation dictates, a monitoring plan will be required to
ensure compliance to the legal requirements.
10.1.5 Legal register not developed Major Failure to develop a robust legal register should be considered as
a major non-compliance within an entity.
10.1.6 Legal register does not include all
requirements as stated within ADOSH-SF Minor The auditor should review the legal register and how this has
been implemented within the entity and form this determine the
level of non-compliance. The entity should be able to
demonstrate how the have communicated the requirements to
relevant stakeholders.
10.1.7 Legal register does not consider all
applicable legislation Minor / Major
10.1.8 No process to communicate the legal
requirements to relevant stakeholders Minor
10.2 Standard Operating Procedures
10.2.1 Standard operating Procedures (SoP) not
developed for higher risk tasks Major Each entity should develop SoP’s for those tasks that require
additional administrative controls to minimize risk. Staff must be
trained on the requirements of the SoP’s and they should contain
sufficient information for staff to follow to reduce the risks
associated with the tasks.
The auditor should review the SoP’s that are available against
the risk register to determine if the required SoP’s have been
developed. Further training records should be available for staff
that are undertaking the task.
10.2.2 Staff not trained on the requirements of
SoP’s Major
10.2.3
SoP’s do not provide adequate information
to adequately control the risks associated
with the task
Minor / Major
10.2.4
SoP’s do not comply with, fully meet the
requirements of, or are contrary to the
requirements of the ADOSH-SF and the
specific CoP.
10.3 Document Control and Record Retention
10.3.1 No procedure in place for the entity Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 26 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
10.3.2 Procedure developed but not implemented
within the entity Major
It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF
10.3.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
10.3.4 Obsolete versions of documents available
for use Minor The entity should control their documents to ensure that only
current versions are available. A master document list is one
method of ensuring this along with a distribution record. The
auditor should check issued versions of documents to ensure
they are current.
10.3.5 Revision history not available for
documents Minor
10.3.6 Record retention timescales not identified Minor
A common error is not fully identifying the retention timescales
for individual documents. The audit should review the process
to ensure it is correct and then sample a number of records to
check compliance.
10.4 Management of Change
10.4.1 No process in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 10.4.2 Process developed but not implemented
within the entity Major

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 27 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
10.4.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the
level of non-compliance through evaluating how much
information is not incorporated into the procedure and also
what risk does this pose to the entity.
10.4.4
Changes are implemented without
appropriate hazard identification and Risk
Assessment
Major
The auditor should review the procedure and determine the
level of non-compliance through evaluating how much
information is not incorporated into the procedure and also
what risk does this pose to the entity.
10.5 Management Review
10.5.1 No procedure in place for the entity Major It is an absolute requirement that the entity must develop and
implement a process that complies with the requirements of the
ADOSH-SF 10.5.2 Procedure developed but not implemented
within the entity Major
10.5.3
Procedure developed but does not meet
the requirements of the ADOSH-SF or the
scope of the entity
Minor
The auditor should review the procedure and determine the level
of non-compliance through evaluating how much information is
not incorporated into the procedure and also what risk does this
pose to the entity.
10.5.4 OSH Management review not undertaken
within last calendar year Major Each entity must undertake a full OSH management review at
least annually.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024
Page 28 of 30
# Possible Evidence / Issue Suggested Non-
Compliance Comments / Considerations
10.5.5
Agenda / Inputs / Criteria for OSH
management review does not meet the
requirements of the ADOSH-SF
Minor The management review must cover the minimum criteria as
stated within the ADOSH-SF and should review the past
performance.
A member of top management must attend / chair the OSH
management review to ensure that the committee has the
authority to agree / approve and changes that are recommended
within the OSH Management review.
The outputs should be recorded including any decisions that are
made, this should include timescales and responsibilities.
10.5.6 OSH Management review not attended /
chaired by member of top management. Minor
10.5.7
OSH Management review not recorded, or
outputs do not include recommendations
for improvement/ Targets and objectives
for following year / approval for any
agreed changes.
Major
11.0 ADOSH-SF – Codes of Practice
11.1 Not identifying or complying with relevant
Codes of Practice Major
Each entity regardless of risk must comply with the requirements
of those codes of Practice that are relevant to their operations.
This should be identified through their legal register and internal
OSH MS.
The auditor should review this information and determine the
level of risk from not identifying or complying with the
requirements. If the non-conformance is an isolated event the
auditor may choose to downgrade the level of non-conformance.

ADOSH-SF – Technical Guideline
ADOSH-SF Audit Non-Compliance (A guide for Auditors)
Version 4.0 – 15 th July 2024 Page 29 of 30
5. Document Amendment Record
Version Revision Date Description of Amendment Page/s Affected
4.0 15th July 2024
System acronym updated from OSHAD-
SF to ADOSH-SF to accurately reflect
document title
ThroughoutChange from OSHAD to ADPHC
Change of Logo
Minor editorial changes throughout the
document without changing requirements.