A compliance audit is a systematic check of whether an operation is doing what a specific set of requirements says it must do. The requirements come from outside: a regulation (OSHA, EPA, FDA), a management system standard the company is certified to (ISO 9001, ISO 14001, ISO 45001), or a customer's supplier requirements. The audit compares what the standard requires with what is documented, what is actually happening on the floor, and what the records show, and reports the gaps as findings. In a plant or warehouse, "compliance audit" usually means one of three things: an OSHA inspection, an ISO certification or surveillance audit, or a customer audit.
Compliance audits vs. other audits
Manufacturing runs several kinds of audits, and they are easy to confuse.
| Audit | Checks against | Who does it | Frequency |
|---|---|---|---|
| Compliance audit | An external requirement: regulation, standard, customer contract | Regulator, certification body, customer, or the company auditing itself against the same requirement | Regulatory: unannounced or complaint-driven. ISO: annual surveillance, triennial recertification. Customer: per contract. |
| Internal management system audit | The company's own documented procedures (which are built to meet the standard) | Trained internal auditors from another department | Every process at least annually; required by ISO 9001 |
| Layered process audit | Standard work at a station: are the posted steps being followed? | Supervisors, managers, and executives on a rotating schedule | Daily to weekly, a few questions each |
| 5S audit | Workplace organization standard for the area | Area team, supervisor, or peer area | Weekly or monthly |
| Safety inspection | Hazards present in the area, regardless of paperwork | Safety committee, supervisor, EHS | Weekly to monthly |
The four internal audits are how a plant stays ready for the compliance audit. A facility that runs layered process audits and 5S audits every week does not prepare for an ISO visit; it is already prepared.
The three compliance audits a plant sees
OSHA inspections
OSHA does not audit on a schedule. Inspections are triggered by an imminent danger report, a fatality or hospitalization, an employee complaint, a referral, or a programmed inspection of high-hazard industries. They are usually unannounced. The compliance officer presents credentials, holds an opening conference, walks the facility (an employee representative may accompany), reviews records (OSHA 300 logs, training records, written programs), and holds a closing conference. Citations, if any, arrive by mail afterward with penalties set by OSHA's published schedule, which is adjusted annually.
What an inspector looks at is predictable, because the same standards are cited year after year. OSHA publishes its most frequently cited standards; for general industry and warehousing the recurring ones are hazard communication (chemical labels and SDS), lockout/tagout, respiratory protection, powered industrial trucks (forklift training and operation), machine guarding, electrical wiring and equipment, walking-working surfaces, PPE, and eye and face protection. Several of these are visual-workplace items: labeled chemical containers, marked aisles, posted PPE requirements, lockout points identified.
ISO management system audits
A company certified to ISO 9001 (quality), ISO 14001 (environmental), or ISO 45001 (occupational health and safety) is audited by its certification body on a three-year cycle: a certification audit, two annual surveillance audits, and a recertification audit. The auditor samples processes against the standard and against the company's own documented system, interviews people doing the work, and reviews records. Findings are graded as major nonconformities (a requirement is not met or the system has failed), minor nonconformities (an isolated lapse), and observations. Majors have to be closed before the certificate is issued or maintained. The auditor is checking that the system described on paper is the one running on the floor, which is why a QA system that exists only in a binder fails.
Customer audits
Customers in automotive, aerospace, medical devices, food, and other regulated supply chains audit their suppliers against their own requirements, which usually combine the relevant ISO or sector standard (IATF 16949, AS9100, ISO 13485, a GFSI food scheme) with customer-specific items: PPAP documentation, control plans, traceability, specific labeling and packaging, and their layered process audit expectations. These are the audits with the most direct commercial consequence: a poor result can mean a corrective action request, a downgraded supplier rating, or lost business.
What a compliance audit checks
Whatever the standard, the auditor is looking at the same three layers and the consistency between them:
- Documentation. Written programs and procedures that the requirement says must exist: hazard communication program, lockout procedures per machine, quality manual, control plans, emergency action plan. Are they current, approved, and controlled?
- Implementation. Is the floor doing what the documents say? Chemical containers actually labeled, lockout actually applied, inspection actually done at the frequency in the control plan, aisles actually marked and clear. This is the walk-through, and it is where most findings come from.
- Records. Evidence that it has been happening over time: training records with dates and signatures, calibration certificates, inspection check sheets, audit results, corrective action records, OSHA 300 logs. No record means, to an auditor, it did not happen.
How to prepare
- Know the standard. Get the actual text of the regulation or standard and the customer's requirements document, not a summary. Build a checklist from it, clause by clause.
- Audit yourself against it first. Walk the facility with the checklist and the eyes of the auditor. Open the lockout procedures and go find the machine. Pull a training record for a random forklift operator. Check a chemical cabinet for unlabeled secondary containers. Write up your own findings.
- Fix the findings through corrective action. Each gap goes through root cause analysis and a process fix, not a one-time cleanup. An auditor who finds the same issue a second year treats it as a system failure.
- Get the records in order. One place, indexed, where training, calibration, inspection, and audit records can be produced in minutes. If it takes an hour to find a record during the audit, the auditor assumes there are others you cannot find.
- Brief the floor. People will be interviewed. They should know what the procedures are for their job, where the documents are, and that honest answers are the right answers. Coaching people to say what the auditor wants to hear is the fastest way to a major finding.
- Assign an escort and a scribe. One person accompanies the auditor, answers or finds who can, and takes notes of every observation so nothing in the closing conference is a surprise.
- Run the audit cycle year-round. Internal audits, layered process audits, and 5S audits on a schedule, with findings tracked to closure. The compliance audit then confirms what you already know.
How 5S and the visual workplace make audits easier
A large share of what compliance auditors check is visible from the aisle. A plant that has done 5S properly has already produced much of the evidence:
- Floor marking shows aisles, keep-clear zones at fire equipment and electrical panels, and pedestrian separation: walking-working surfaces and egress requirements, visible without opening a document.
- Labels and signs cover hazard communication (container labels), PPE postings, lockout point identification, pipe marking, and calibration status on gauges.
- Standard work posted at the station is the implementation evidence for the documented procedure.
- The 5S audit sheet is a record showing the condition has been maintained, not staged for the visit.
- 6S adds the hazard checks directly to the audit the area already runs.
Auditors notice staging. A floor that was marked last week for the visit looks different from one maintained for a year, and the records show the difference.
After the audit: findings and corrective action
Every finding gets a corrective action: containment (fix the immediate instance), root cause, a process change that prevents recurrence, and verification that it worked. For ISO audits this is formal and the certification body reviews the response. For OSHA citations there are deadlines for abatement and a process for contesting. For customer audits, the response usually goes in the customer's 8D or CAR format. Findings that recur are the ones that damage credibility; findings that are closed with real root cause work are, to most auditors, evidence the system functions.
Frequently asked questions
What is the difference between a compliance audit and an internal audit?
A compliance audit checks against an external requirement and is usually done by an outside party. An internal audit checks the company's own procedures, is done by trained employees, and is how the company finds gaps before the external audit does. ISO 9001 requires internal audits as part of the system.
How often are compliance audits conducted?
OSHA inspections are not scheduled; they are triggered by complaints, incidents, referrals, or targeted programs. ISO certification runs on a three-year cycle with annual surveillance audits. Customer audits follow the contract, often annually or on a risk-based schedule.
Can OSHA show up unannounced?
Yes. Most inspections are unannounced. Employers may require a warrant, but doing so rarely changes the outcome and delays the inspection by days.
What is a layered process audit?
A short, frequent audit of standard work at the station, done by successive layers of management on a rotating schedule: the supervisor daily, the manager weekly, the plant manager monthly. It keeps procedures followed between formal audits and is a requirement in automotive supply chains.
What are the most common OSHA findings in a warehouse?
Forklift operation and training, hazard communication, lockout/tagout, blocked or unmarked aisles and exits, electrical hazards, and PPE. OSHA's annual top-ten list shows the same standards year after year.
What happens if a plant fails an ISO audit?
Major nonconformities must be corrected, with evidence, within a set period or the certificate is suspended or withdrawn. Minor nonconformities need a corrective action plan reviewed at the next audit. Very few audits produce no findings; what matters is how they are closed.
Related resources
The system a compliance audit checks is described under quality assurance and quality control; the method for closing findings is root cause analysis. The visual workplace that produces most of the evidence is covered on the 5S, 6S, floor marking, and labels and signs pages, and the 5S Scorecard is a starting point for the internal audit. For the standards themselves, OSHA's most cited standards show where to look first, and ISO's ISO 9000 family page is the reference for the management system standards.