OHS Legal Compliance Audit South Africa: Complete Employer Audit Checklist + Free Audit Pack
QUICK ANSWER
An OHS legal compliance audit is a structured employer review that tests whether the occupational health and safety duties applicable to a South African workplace are actually being implemented, maintained and evidenced. It should not stop at checking whether documents exist: it should compare the legal requirement with the workplace condition, the people responsible, the control in use and the evidence that proves the control is working.
South African law does not prescribe one universal legal-compliance-audit checklist for every workplace. The correct audit scope depends on the employer's activities, hazards, machinery, substances, exposures, people, contractors and the legislation and regulations that apply to that specific workplace.
Audit Question | What the Employer Must Establish |
What applies? | Identify the Act, regulations and other enforceable requirements relevant to the workplace. |
What is required? | Translate each applicable requirement into a clear audit criterion or duty. |
What exists? | Check documents, workplace conditions, people, equipment and controls. |
What is missing? | Record non-compliance, partial compliance, uncertainty or evidence gaps. |
Who owns the fix? | Assign a responsible person and realistic due date. |
Was it actually fixed? | Verify the corrective action and retain closeout evidence. |
OHS Legal Compliance Audit South Africa: What Does It Test?
A strong OHS legal compliance audit South Africa employers can use should test implementation, not paperwork alone. The audit should start with the requirements that apply to the actual workplace and then ask whether those requirements can be demonstrated in practice.
That creates a simple governance chain:
APPLICABLE REQUIREMENT → AUDIT CRITERION → EVIDENCE → WORKPLACE VERIFICATION → FINDING → CORRECTIVE ACTION → OWNER → DUE DATE → VERIFIED CLOSEOUT
If the legal requirement cannot be connected to an observable control, accountable person or credible record, the employer may have a compliance gap even when the safety file looks complete.
Is an OHS Legal Compliance Audit Legally Required in South Africa?
The Occupational Health and Safety Act 85 of 1993 imposes legal duties on employers, employees and other duty holders, but it does not create one universal statutory form called an 'OHS legal compliance audit' that every employer must complete in the same format.
Section 8 places a broad duty on employers to provide and maintain, as far as reasonably practicable, a working environment that is safe and without risk to employees' health. It also addresses safe systems of work, hazard identification and precautionary measures, information, instruction, training, supervision and enforcement of health and safety measures.
A compliance audit is therefore best understood as a management and verification mechanism: it helps the employer test whether applicable legal duties and controls are actually being discharged. Client requirements, certification systems, contracts, industry rules or specific regulatory requirements may create additional audit obligations in particular settings.
Legal Register vs Compliance Audit vs HIRA vs Safety File
Tool | Primary Question |
Which legal and regulatory requirements apply to this workplace, and why? | |
Legal Compliance Audit | Are those applicable requirements actually implemented, evidenced and effective? |
What can cause harm, how serious is the risk and what controls are needed? | |
Where is the controlled evidence that supports the workplace OHS system? | |
Can the employer demonstrate compliance when an authorised inspector tests the workplace? |
These systems should reinforce one another. The legal register identifies the requirement; the HIRA helps connect risk to controls; the audit tests implementation; the safety file retains evidence; and inspection readiness tests whether the system can withstand external scrutiny.
Why Employers Should Audit the Workplace, Not Just the File
The Department of Employment and Labour's inspection powers extend beyond documents. Under section 29 of the OHS Act, inspectors may enter relevant premises, question people, require records and documents, and inspect articles, substances, plant, machinery, work and workplace conditions.
That is why an employer audit should use more than one evidence source. A signed form may show that a control was planned; it does not automatically prove that the control exists, is understood or is being followed at the point of work.
Current enforcement activity also shows why this distinction matters. In February 2026, the Department reported substantial OHS non-compliance during inspections in the Overberg and cited gaps including risk assessments, asbestos information, first-aider arrangements, PPE, installation certification, equipment servicing and training.
What Should an Employer OHS Compliance Audit Check?
1. Legal Applicability and Version Control
Confirm that the employer knows which Acts, regulations, incorporated requirements and site-specific obligations apply. Check that the legal register is current, that applicability decisions are recorded and that draft proposals are not mistakenly treated as current law.
Legal change control matters. The Department's 2025 promulgations included updated Physical Agents Regulations, Noise Exposure Regulations and amendments to the General Safety Regulations. An audit system should therefore record when a legal source was last checked, what changed and whether workplace controls were reassessed.
2. Employer Duties and Safe Systems of Work
Test whether the employer's systems of work, plant and machinery are being maintained so far as reasonably practicable without risks to health and safety. Do not accept a written procedure as sufficient evidence if the actual work method contradicts it.
3. Hazard Identification, Risk Assessment and Control Implementation
Confirm that hazards connected to actual work, machinery, substances, movement, energy, access, contractors and exposure are identified. Then verify whether stated controls are physically present, used and maintained.
4. Legal Appointments, Representatives and Committees
Where appointments, health and safety representatives, committees or competent persons are triggered by the applicable legal framework, verify the appointment basis, scope, competence, acceptance, authority, records and actual performance of the role. For role-specific detail, see OHS Legal Appointments South Africa.
5. Information, Instruction, Training and Supervision
Section 8 includes information, instruction, training and supervision among the employer's duties. Audit whether people doing the work understand relevant hazards, precautions and procedures, and whether supervision is appropriate to the work and the person's competence.
6. Machinery, Equipment and Technical Controls
Inspect guarding, isolation, access, condition, maintenance, examinations, certifications and other technical controls where they are applicable. Records should match the equipment actually in use, including identification numbers, dates and service status where relevant.
7. Occupational Health and Exposure Controls
Where work creates exposure to noise, hazardous chemical agents, physical agents, ergonomic risks or other regulated hazards, verify the applicable assessment, control, monitoring, medical-surveillance and recordkeeping requirements. The audit should escalate specialist matters rather than pretending a generic checklist can replace competent occupational hygiene, medical or engineering work.
8. Personal Protective Equipment
Check whether PPE follows the risk assessment and hierarchy of controls, whether the selected equipment is suitable, whether it is issued and maintained correctly, and whether employees know its limitations. PPE should not be used as a convenient substitute for a reasonably practicable higher-order control.
9. Emergency, First Aid and Fire Readiness
Test whether emergency arrangements reflect the site's actual risks and occupancy. Check access and egress, emergency equipment, communication, assigned responsibilities, first-aid arrangements, drills and any applicable servicing or inspection records.
10. Contractors and People Other Than Employees
Section 9 addresses risks to persons other than employees who may be directly affected by the employer's activities. Audit contractor selection, induction, coordination, site rules, work interfaces and evidence that agreed controls are being followed. The Contractor Safety Checklist South Africa provides additional contractor-control detail.
11. Incident Reporting, Investigation and Learning
Check whether incidents are recognised, escalated, recorded, investigated and reported when the applicable legal threshold is met. Section 24 of the OHS Act identifies categories of incidents that must be reported to an inspector. The audit should also test whether corrective actions from investigations are closed and whether recurring causes are being identified.
12. Evidence, Records and Retrieval
Evidence should be current, attributable and retrievable. A record should identify what it relates to, who completed or approved it, when it was completed and what changed as a result where relevant. Obsolete documents, unsigned appointments, expired service records and generic templates should not be counted as effective controls merely because they are filed.
How to Conduct an OHS Legal Compliance Audit in 10 Steps
Step 1 — Define the Audit Scope
State which legal entity, site, department, activity, contractor interface, equipment or process is being audited. A vague scope produces vague findings.
Step 2 — Confirm the Applicable Legal Requirements
Use the current legal register and official sources to identify the requirements that genuinely apply to the audit scope. Record uncertain items for competent legal or technical review instead of guessing.
Step 3 — Convert Requirements Into Audit Criteria
Rewrite each applicable duty as something that can be tested. A useful criterion should make clear what must exist, happen, be maintained or be evidenced.
Step 4 — Request Evidence Before the Walk-Through
Review relevant policies, procedures, appointments, registers, assessments, training records, service records, inspection records, incident records and corrective-action logs before walking the site.
Step 5 — Verify the Workplace
Observe actual work, plant, machinery, access routes, housekeeping, guarding, storage, signage, emergency arrangements, PPE and other controls relevant to the scope.
Step 6 — Speak to the People Who Do and Supervise the Work
Ask practical questions: What is the hazard? What control do you use? What happens if it fails? Who may stop the job? Where is the procedure? A control that exists only in management's explanation is weak evidence.
Step 7 — Record the Finding Against the Requirement
State the requirement, objective evidence, finding and affected location or process. Avoid vague statements such as 'safety needs improvement'. A finding should be specific enough that another competent person can understand exactly what was observed.
Step 8 — Prioritise the Gap
Prioritise action according to the nature of the legal breach, the exposure and potential consequence, the number of people affected and the immediacy of the risk. A serious uncontrolled hazard should not wait for the next management meeting because its paperwork is complete.
Step 9 — Assign Corrective Action
Every open finding should have an owner, a due date and a defined completion requirement. Corrective action may involve engineering, maintenance, procurement, specialist assessment, procedure changes, training, supervision or another control appropriate to the cause.
Step 10 — Verify Closeout
Do not close a finding because someone says it is done. Confirm the corrective action, inspect the changed condition where relevant, review the new evidence and record who verified closure and when.
How Should Audit Findings Be Classified?
Finding Status | Practical Meaning |
Compliant | The applicable requirement is implemented and supported by appropriate evidence. |
Partially compliant | Some elements exist, but the requirement is not fully implemented or evidenced. |
Non-compliant | The applicable requirement is not met or a required control is absent or ineffective. |
Not applicable | The requirement does not apply to the defined scope, and the reason is recorded. |
Further assessment required | Applicability, technical adequacy or legal interpretation cannot responsibly be concluded from the available evidence. |
Avoid using a single 'yes/no' answer where the legal requirement contains several duties. A partially completed control can be hidden by an over-simple checkbox.
The Four Evidence Layers: Document, Workplace, Person and Control
A defensible audit should cross-check four evidence layers:
DOCUMENT — the policy, procedure, appointment, assessment, register, certificate, record or report.
WORKPLACE — what is physically present and what condition actually exists at the point of work.
PERSON — whether the responsible person, supervisor or worker understands the requirement and performs the role in practice.
CONTROL — whether the preventive or protective measure is present, suitable, maintained and effective.
The strongest finding is based on aligned evidence. If the procedure says a machine is isolated before maintenance but the maintenance team demonstrates a different practice, the audit should record the real condition rather than accepting the document.
How to Build a Corrective-Action Register That Actually Closes Gaps
A corrective-action register should be more than a list of defects. Each action should be traceable from finding to verified closure.
Field | What to Record |
Finding reference | Unique audit finding number. |
Requirement | Act, regulation, internal criterion or other applicable requirement. |
Evidence | What was seen, reviewed, measured or confirmed. |
Action | Specific correction or corrective action required. |
Owner | Person accountable for completion. |
Due date | Target date based on risk and practical control requirements. |
Interim control | Temporary risk-reduction measure where final action cannot be immediate. |
Closeout evidence | Proof that the action was completed. |
Verified by / date | Independent confirmation that the action is effective enough to close. |
How Often Should an OHS Legal Compliance Audit Be Done?
There is no single universal audit frequency that suits every South African workplace. The review cycle should reflect the legal requirements that apply, the risk profile, changes in work or equipment, incident history, previous findings, client or certification requirements and the reliability of existing controls.
An additional review should be considered when there is a material legal change, new machinery or process, significant workplace modification, serious incident, recurring non-compliance, major contractor change, enforcement notice or evidence that an existing control is no longer effective.
Who Should Conduct the Audit?
The auditor should have enough competence to understand the audit scope, the relevant legal duties and the evidence being tested. Independence should be proportionate to the purpose of the audit: routine internal verification may be performed by competent internal personnel, while complex exposure, engineering, medical, electrical, pressure-equipment or other specialist matters may require appropriately qualified specialists.
An audit checklist must never create false confidence by encouraging a generalist to sign off a technical matter they are not competent to evaluate.
Common OHS Audit Mistakes That Create False Assurance
Auditing a generic checklist instead of the requirements that actually apply to the workplace.
Treating a document's existence as proof that the control is implemented.
Accepting expired, unsigned, mismatched or obsolete evidence.
Failing to inspect the workplace and interview people who perform the work.
Marking requirements 'not applicable' without recording the reason.
Ignoring contractors, visitors and other people affected by the employer's activities.
Recording findings without owners, deadlines or closeout evidence.
Closing findings based only on an email or verbal confirmation.
Failing to update audit criteria after legal, process, equipment or organisational change.
Using training as the default solution when the real gap requires an engineering, maintenance or specialist control.
The 15-Minute OHS Audit Readiness Test
Choose one significant workplace risk and test the complete chain. Within 15 minutes, can the employer show:
the applicable legal or regulatory requirement;
the relevant hazard or risk assessment;
the control selected to manage the risk;
the responsible person or role;
the procedure, instruction or standard used;
the relevant training or competence evidence where required;
the physical control at the workplace;
the inspection, maintenance, monitoring or service evidence where applicable;
any open finding or corrective action; and
proof that previous corrective actions were verified before closure?
If the evidence cannot be retrieved, does not match the workplace or depends on one person remembering where everything is stored, the system needs attention even before an external inspector arrives.
What Is Included in the Free OHS Legal Compliance Audit Pack?
The free employer audit pack is structured to help South African workplaces move from a generic checklist to a controlled audit process. It is designed around applicability, evidence, findings, corrective action and verification rather than a simple tick-box score.
Employer and site audit-scope profile.
Legal-register-to-audit-criteria mapping sheet.
Document, workplace, person and control evidence check.
OHS compliance audit checklist by management-system area.
Finding classification and objective-evidence record.
Not-applicable justification record.
Corrective-action register with owners and due dates.
Interim-control and escalation record.
Closeout-verification register.
Legal-change review trigger sheet.
Management summary and open-findings dashboard.
15-minute inspection-readiness check.
The pack is a management tool, not a substitute for the OHS Act, applicable regulations, competent legal advice or specialist technical assessments. An employer remains responsible for identifying and complying with the requirements that apply to its own workplace.
Frequently Asked Questions
What is an OHS legal compliance audit?
It is a structured review that compares the legal and regulatory requirements applicable to a workplace with actual controls, evidence, responsibilities and conditions to determine whether the employer can demonstrate compliance.
Is there one official OHS audit checklist for every South African workplace?
No single universal checklist can accurately cover every workplace. Audit criteria must reflect the employer's actual activities, hazards, machinery, substances, exposures and applicable legal requirements.
What is the difference between a legal register and a legal compliance audit?
The legal register identifies what applies. The compliance audit tests whether those applicable requirements have been implemented, maintained and evidenced.
Can a safety file prove legal compliance?
A safety file can organise important evidence, but the existence of a file does not prove that workplace controls are adequate or implemented. The audit must compare records with actual conditions and practices.
Should an audit include employee interviews?
Where understanding, competence, supervision or work practice is relevant, speaking to the people who perform and supervise the work can provide important evidence that documents alone cannot provide.
How often should an OHS compliance audit be completed?
The frequency should be based on applicable requirements, risk, change, incident history, previous findings and the reliability of controls. There is no single universal interval suitable for every employer.
Who can close an audit finding?
The employer should define an appropriate verification authority. The person verifying closure should have enough competence and independence to confirm that the required action is complete and effective.
Can training close every OHS audit finding?
No. Training is appropriate where the gap genuinely involves knowledge, skill, instruction or competence. Other findings may require engineering controls, maintenance, procurement, monitoring, medical surveillance, specialist assessment or management action.
What happens if an inspector finds serious non-compliance?
The OHS Act gives inspectors significant enforcement powers. Depending on the circumstances, enforcement can include requirements to correct contraventions and, where a threatened danger exists, prohibition of an act or activity. Employers should treat serious uncontrolled risks as immediate management issues rather than waiting for an inspection.
What records should be kept after the audit?
Keep the audit scope, criteria, evidence, findings, corrective actions, ownership, due dates, closeout evidence and verification record. Retention periods may also be prescribed for particular records under applicable regulations, so the employer should check the specific legal requirement.
Authoritative Sources & Regulatory References
Authoritative Source | What It Supports |
Employer duties, incident reporting, inspector functions and enforcement powers. | |
Administrative and record-related requirements under the OHS framework. | |
Current General Safety Regulation amendments relevant to workplace controls. | |
Official record of 2025 promulgations including Physical Agents, Noise Exposure and General Safety changes. | |
Examples of matters inspectors may check during workplace inspections. | |
Current enforcement context and examples of recurring workplace OHS non-compliance. |
Read More
Read More | Why Read It |
Identify which legal requirements apply before testing compliance. | |
Build the evidence-management system that supports audit and inspection readiness. | |
Understand how external OHS inspection and enforcement differ from internal employer auditing. |
Final Word
A legal register tells an employer what applies. A legal compliance audit asks the harder question: can the employer prove that those requirements are working in the real workplace?
The strongest audit follows a disciplined chain from requirement to evidence, workplace verification, finding, corrective action and verified closeout. That is how a checklist becomes a management control rather than another document stored in the safety file.
Know what applies. Test what is real. Fix what is missing. Verify what was closed.
