13.3 Documented Information, Internal Audit, and Management Review
Key Takeaways
- The Construction Regulations 2014 make a specific list of documents compulsory, including the CR 7(1)(a) health and safety plan, the CR 7(1)(b) site file, CR 10(2) fall protection plan, and the CR 12(3)(f), CR 13(2)(h), CR 23(1)(k) and CR 24(d)-(e) inspection registers.
- Retention periods differ by record type: at least three years for the GAR 9(1) Annexure 1 record and GAR 5(b) committee records, and at least ten years for the service history of leased lifting equipment under DMR 18(7)(c).
- CR 5(1)(o) and CR 7(1)(c)(vii) both require audits and document verification at intervals not exceeding 30 days, and CR 5(1)(p) requires the client's audit report to reach the principal contractor within seven days.
- An audit examines the system that produces safe conditions and requires independence from the activity audited, whereas an inspection examines the physical condition of plant, structures or work.
- ISO 45001 clause 9.3 requires management review outputs to be decisions on suitability, improvement, change and resources - which under CR 7(1)(a) must feed back into a revised health and safety plan.
13.3 Documented Information, Internal Audit, and Management Review
[!NOTE] SACPCMP Blueprint Context: This section completes the management-system chapter by covering the Check and Act clauses of ISO 45001 (clauses 7.5, 9.2 and 9.3) and their South African statutory analogues. It connects directly to Annexure B item 4, "Health and Safety Performance (audit and reviews)", which Chapter 14 then develops in measurement detail.
1. Documented Information: What Must Exist, and Why
ISO 45001 clause 7.5 uses the term documented information to cover both what older standards called "documents" (things that specify how work is done) and "records" (evidence that it was done). On a South African construction site the statutory documentation load is heavy, and a CHSO must know which items are legally compulsory and which are system choices.
| Document | Statutory source | Compulsory? |
|---|---|---|
| Baseline risk assessment | CR 5(1)(a) (client), CR 9 | Yes |
| Client health and safety specification | CR 5(1)(b) | Yes |
| Principal contractor's health and safety plan | CR 7(1)(a) | Yes |
| Health and safety file, on site | CR 7(1)(b), CR 7(2)(b) | Yes |
| Consolidated file handed to client on completion | CR 7(1)(e) | Yes |
| Register of contractors on site, agreements, type of work | CR 7(1)(f) | Yes |
| Medical certificates of fitness (Annexure 3) | CR 7(1)(g), CR 7(8) | Yes |
| Induction training records kept on site | CR 7(7) | Yes |
| Fall protection plan | CR 10(1)(a), CR 10(2) | Yes |
| Excavation inspection register | CR 13(2)(h) | Yes |
| Temporary works inspection register | CR 12(3)(f) | Yes |
| Temporary electrical installation register | CR 24(d) | Yes |
| Electrical machinery daily checklist register | CR 24(e) | Yes |
| Construction vehicle / mobile plant daily register, kept in the vehicle | CR 23(1)(k) | Yes |
| Annexure 1 incident record, kept at the workplace at least three years | GAR 9(1) | Yes |
| Health and safety committee records, kept at least three years | GAR 5(b) read with s 20(2) | Yes |
| Copy of the Act and relevant regulations available at the workplace (five or more employees) | GAR 4 | Yes |
| ISO 45001 procedure manual, KPI dashboard, audit schedule | — | System choice |
[!IMPORTANT] Retention is not uniform. GAR 9(1) requires the Annexure 1 record to be kept for at least three years. GAR 5(b) requires health and safety committee records under section 20(2) to be kept for at least three years. Occupational medical surveillance records under the Hazardous Chemical Agents Regulations and the Asbestos Abatement Regulations carry far longer retention — up to 40 years after the last exposure entry for certain agents — and are held confidentially by the occupational medicine practitioner, not in the site file. DMR 18(7)(c) requires the owner and lessor of leased lifting equipment to keep full service history records for at least 10 years. Do not average these into a single "three-year rule".
Document control on a construction site fails in predictable ways: superseded method statements left in the file next to the current one; a temporary works drawing without a revision number; an appointment letter for a person who left three months ago. The control that matters is not a fancy register — it is a single named person who removes superseded versions the day they are superseded.
2. The Internal Audit Programme
Clause 9.2 of ISO 45001 requires internal audits at planned intervals. South African law supplies its own audit obligations, and they are stricter in frequency than most management systems:
- CR 5(1)(o): the client must ensure that periodic health and safety audits and document verification are conducted at intervals mutually agreed between the principal contractor and any contractor, but at least once every 30 days.
- CR 5(1)(p): a copy of that audit report must be provided to the principal contractor within seven days after the audit.
- CR 7(1)(c)(vii): the principal contractor must ensure that periodic site audits and document verification are conducted at intervals mutually agreed with any contractor, but at least once every 30 days.
Three attributes separate an audit from an inspection, and examiners test the distinction:
| Inspection | Audit | |
|---|---|---|
| Object | The physical condition of plant, structures or work | The system that is supposed to produce safe conditions |
| Question | "Is this scaffold safe today?" | "Does the process that inspects scaffolds work, and can you evidence it?" |
| Frequency | Daily to weekly, driven by regulation and standard | At planned intervals; on site at least every 30 days by law |
| Output | Register entry, tag status | Findings, non-conformances, corrective action requests |
| Who | Appointed competent person for that plant | A person independent of the activity being audited |
Independence is the attribute most often compromised. A scaffold inspector cannot meaningfully audit the scaffold inspection process. On a small site independence may mean a colleague from another section or a group safety manager, but it must mean someone other than the person who performs the work.
3. Non-conformance and Corrective Action
Clause 10.2 of ISO 45001 requires an organisation to react to non-conformities and incidents, evaluate the need for action to eliminate the root cause so the non-conformity does not recur, and review the effectiveness of the action taken. The South African statutory mirror is GAR 9: the incident is recorded in Annexure 1 (GAR 9(1)), investigated within seven days (GAR 9(2)), the findings entered in Annexure 1 immediately after completion (GAR 9(3)), and the record examined by the health and safety committee at its next meeting with the necessary actions implemented and followed up to prevent recurrence (GAR 9(4)).
A workable corrective action record answers five questions, and a CHSO auditing another contractor's system should look for exactly these:
- What failed — the condition or behaviour, stated factually.
- Why it failed — the root cause, not the immediate act. "Worker did not clip on" is an immediate cause; "no anchor point within reach of the leading edge, and the fall protection plan was not revised when the slab layout changed" is a root cause.
- What will change — the control, at the highest practicable level of the hierarchy.
- Who owns it and by when — a named person and a date, not "management" and "ASAP".
- How effectiveness was verified — a re-check, dated and signed, after the due date.
The fifth is the one South African sites most often omit, and its absence is why the same finding reappears in three consecutive monthly audits.
4. Management Review
Clause 9.3 requires top management to review the system at planned intervals. On a construction project the review is usually monthly or quarterly and must consider, at minimum: the status of actions from the previous review; changes in external and internal issues including legal requirements; the extent to which objectives have been met; incident, non-conformity and corrective action trends; monitoring and measurement results; audit results; consultation and participation of workers; risks and opportunities; and the adequacy of resources.
The output is not minutes. The outputs required by clause 9.3 are decisions: on the continuing suitability, adequacy and effectiveness of the system; on opportunities for improvement; on any need for change; and — critically on construction projects — on resources. A management review that identifies inadequate supervision ratios and does not resolve to fund more supervisors has produced a record, not a review.
Under CR 7(1)(a) the review has a statutory consequence: where the review shows the health and safety plan no longer matches the work, the plan must be updated. That is the point at which a management system stops being documentation and starts being management.
A client's representative conducts the site health and safety audit on 3 March and again on 12 April, and issues each report to the principal contractor 10 days after the audit. Which statutory requirements have been contravened?
An identical finding — missing edge protection at the lift shaft — appears in three consecutive monthly audit reports, each time closed out with a photograph of reinstated guardrails. What is the most significant system defect this pattern reveals?
Which combination of retention periods is correct under South African law?