Compliance Audits for Environmental and Occupational Safety Obligations

An environment and safety compliance audit shows, on evidence, which environmental and occupational safety obligations apply to a site and whether the organisation is meeting them. itmad provides these audits against legislation, permits and client HSE requirements, with local auditors and a travelling team, following the principles of ISO 19011. itmad operates across the Middle East, Asia and Europe. Last reviewed: October 2026.

What the audit establishes

Environmental and occupational safety obligations arrive from several directions at once: legislation, the conditions written into permits, the requirements that a client has imposed by contract, and whatever the organisation's own HSE management system commits it to. A compliance audit works out, on evidence, which of these apply to a particular site and whether they are being met.

The benchmarks

Legislation and permits come first. Obligations differ by activity and by permit, so itmad identifies the regime that actually governs a site and does not audit against a generic checklist.

Client and contractual HSE requirements often go well beyond legislation, and they are enforced through the contract and not through a regulator. Audits are therefore made against the client's HSE specification or project HSE plan, or against corporate standards where those are the benchmark the organisation is held to.

Where an organisation is responsible for contractors working on its site or under its contract, itmad audits at the contractors' premises and worksites on the organisation's behalf. The question is whether a contractor's HSE arrangements exist only on paper or are really carried out by the crews doing the work. These audits are used for pre-qualification before award, at intervals during a long contract, and after an incident.

ISO 14001 and ISO 45001

Audits can also be made against ISO 14001 and ISO 45001 as a gap assessment or readiness review. One restriction applies: itmad is a certification body, and ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that it certifies. Where itmad holds an organisation's ISO 14001 or ISO 45001 certification, itmad does not audit that organisation against either standard in any other capacity.

How the audit is carried out

The first task is to establish the requirements that apply to the specific site, activity and permits, which is usually the part that clients have least visibility of. Auditors review permits, licences and consents and their conditions, including expiry and renewal status, and examine the controls in place for the identified hazards and environmental aspects.

They then inspect the workplace physically, including areas that are not on the planned route, and sample records: monitoring data, emissions and discharge results, waste transfer documentation, training and competence, statutory inspection certificates, incidents and maintenance. Interviews are held at the levels where requirements are actually met and not only with HSE personnel, and the audit verifies that corrective actions from earlier audits and regulatory inspections were completed and are still effective.

When organisations commission one

Typical occasions are ahead of a scheduled regulatory inspection, to find gaps before the regulator does; as a condition of contract award or client HSE pre-qualification; where an insurer requires independent verification of HSE controls; after a serious incident, enforcement notice or regulatory finding; when taking on a new site, lease or acquisition and inheriting unknown liabilities; at agreed intervals under a corporate HSE assurance programme; and before applying for or renewing an environmental permit.

Who audits

Audits are planned and carried out following ISO 19011, which governs auditor competence, the evidence-based approach and impartiality. Auditors are qualified in HSE disciplines and experienced in the sector being audited, which matters because recognising that a control is inadequate requires knowing how the work is really done.

Frequently asked questions

What is an environment and safety compliance audit?

It establishes, on evidence, which environmental and occupational safety obligations apply to a site and whether the organisation is meeting them. The obligations come from legislation, permit conditions, client contract requirements and the organisation's own HSE management system.

What does the audit assess against?

Legislation and permits, client and contractual HSE requirements, and corporate HSE standards, including contractor and supply chain HSE arrangements. Audits can also be made against ISO 14001 and ISO 45001 as a gap assessment or readiness review.

What are contractor and supply chain HSE audits?

They are audits at the premises and worksites of contractors, made on behalf of the organisation that is responsible for them. They show whether a contractor's HSE arrangements exist only on paper or are carried out by the crews doing the work.

Can itmad audit against ISO 14001 or ISO 45001?

As a gap assessment or readiness review, yes, with one restriction. ISO/IEC 17021-1 prohibits a certification body from performing internal audits for an organisation that it certifies, so itmad does not audit its own certified clients against those standards in any other capacity.

When are these audits used?

Ahead of a regulatory inspection, as a condition of contract award, where an insurer requires verification, after a serious incident or enforcement notice, when taking on a new site, and before applying for or renewing an environmental permit. Each is an occasion when an organisation needs to know, on evidence, where it stands against its obligations.

Who carries out the audits?

Auditors qualified in HSE disciplines and experienced in the sector being audited, working to the principles of ISO 19011. Knowing how the work is really done is what lets them recognise an inadequate control.