Sherm Login

Author: Marnie Cruickshank

Managing Contractor Work On Site

Posted on by Marnie Cruickshank

Managing contractors on-site is a critical part of delivering safe, compliant, and efficient projects across Australia’s construction, infrastructure, and industrial sectors. Whether you’re overseeing a small refurbishment or a major build, effective contractor management comes down to three core pillars, oversight, coordination, and control. Getting these right not only reduces risk but also keeps timelines and budgets in check.

Why Contractor Management Matters

Contractors often bring specialised skills and flexibility to a project, but they also introduce variability. Different teams, systems, and safety cultures can create gaps if not managed properly. In Australia, where workplace safety laws are stringent and enforced, poor contractor oversight can quickly lead to compliance breaches, delays, or worse, serious incidents.

A structured approach ensures everyone on-site understands expectations, follows consistent processes, and works toward shared outcomes.

Oversight: Knowing What’s Happening (and What Should Be)

Oversight is about visibility. As a site manager or principal contractor, you need a clear picture of who is on-site, what they’re doing, and whether it aligns with the project plan.

Key practices include:

  • Prequalification and onboarding: Ensure contractors are vetted for licences, insurances, and competencies before they arrive. Inductions should cover site rules, hazards, and emergency procedures.
  • Daily monitoring: Regular site walks, toolbox talks, and check-ins help you stay informed and spot issues early.
  • Documentation: Keep records of Safe Work Method Statements (SWMS), permits, and inspection reports. These aren’t just paperwork, they’re your audit trail.

Oversight isn’t about micromanaging, it’s about maintaining situational awareness and ensuring standards are met.

Coordination: Getting Everyone Working Together

On a busy site, multiple contractors often operate simultaneously. Without coordination, tasks can clash, leading to inefficiencies or safety risks.

Strong coordination involves:

  • Clear scheduling: Develop and communicate a realistic program of works. Make sure contractors understand dependencies and sequencing.
  • Communication channels: Establish who reports to whom, and how information flows. Regular coordination meetings can prevent misunderstandings.
  • Interface management: Pay close attention to where different trades overlap. For example, electrical and plumbing teams working in the same area need alignment to avoid rework or hazards.

Good coordination turns a collection of individual efforts into a cohesive operation.

Control: Setting Boundaries and Enforcing Standards

Control is about ensuring that work is carried out safely, legally, and to the required quality. It’s where policies and plans are backed by action.

Effective control measures include:

  • Permit systems: Use permits for high-risk activities like confined space entry, hot works, or working at heights.
  • Inspections and audits: Regularly check that work complies with specifications and safety requirements.
  • Corrective actions: When issues arise, act quickly. This might involve stopping work, retraining personnel, or revising procedures.

Control also means being prepared to make tough decisions. If a contractor consistently fails to meet standards, it may be necessary to remove them from site.

Balancing Safety, Productivity, and Compliance

In the Australian context, safety is non-negotiable. Regulations such as those under Work Health and Safety (WHS) laws place clear responsibilities on those managing or controlling work sites. But safety doesn’t have to come at the expense of productivity. In fact, well-managed sites often perform better because risks are minimised and workflows are smoother.

Practical Tips for Success

  • Set expectations early: Clear contracts and scopes of work reduce ambiguity.
  • Use technology: Digital tools for site management, reporting, and communication can streamline processes.
  • Build relationships: Respectful, professional relationships with contractors encourage cooperation and accountability.
  • Stay proactive: Don’t wait for problems to escalate, address them early.

Final Thoughts

Managing contractor work on-site is as much about people as it is about processes. By focusing on oversight, coordination, and control, Australian project managers can create safer, more efficient worksites where everyone knows their role and delivers to a high standard.

A disciplined approach doesn’t just protect your project, it protects your people, your reputation, and your bottom line.

This concept is explored further in our Contractor and Supplier Compliance Management Guide.

Get in touch with us and see how Sherm Software can help with site management, reporting and communication. Contractors engaged to work will also have access to Sherm via the Contractor and Supplier Register.

Use our Checklist to assess whether your contractor compliance approach would stand up to audit, investigation, or client scrutiny.

Contractor Inductions: Why Compliance Slips Through the Cracks

Posted on by Marnie Cruickshank

Across Australian worksites, from construction and mining to logistics and facilities management, contractor inductions are a routine part of onboarding. They’re meant to ensure every worker understands site rules, hazards, and responsibilities before starting work. On paper, the process looks solid. In practice, however, contractor inductions are one of the most common points where compliance quietly breaks down.

This isn’t usually due to negligence or bad intent. More often, it’s the result of rushed processes, fragmented systems, and assumptions that don’t hold up under scrutiny. Understanding where things go wrong is the first step to tightening compliance and reducing risk.

The “Tick-and-Flick” Mentality

One of the biggest pitfalls is treating inductions as a box-ticking exercise. When deadlines loom and contractors are needed on-site quickly, the focus shifts from comprehension to completion. Workers may click through online modules or skim documents just to gain site access.

The problem? Completion doesn’t equal understanding. If a contractor hasn’t genuinely absorbed key safety procedures, the business is exposed, not just to regulatory penalties, but to real-world incidents.

Inconsistent Induction Standards Across Sites

Many organisations operate across multiple locations, each with slightly different induction requirements. While some variation is necessary due to site-specific risks, inconsistency can create confusion, especially for contractors moving between sites.

Without a standardised baseline, important information can fall through the cracks. Contractors may assume they’ve “already done this before,” while site managers assume prior knowledge that may not exist.

Poor Record-Keeping and Verification

In an audit or incident investigation, documentation is everything. Yet many businesses still rely on scattered systems like emails, spreadsheets and paper forms to track inductions.

This fragmentation leads to common issues:

  • Missing or incomplete records
  • Difficulty verifying who completed what training
  • Expired inductions going unnoticed

When regulators come knocking, these gaps quickly become liabilities.

Language and Literacy Barriers

Australia’s workforce is diverse, and not all contractors will have the same level of English proficiency or literacy. Standard induction materials often fail to account for this.

If critical safety information isn’t clearly understood, the induction has effectively failed, even if it’s been “completed.” Visual aids, translated materials, and interactive formats can make a significant difference here, but they’re not always implemented.

Lack of Engagement and Relevance

Generic inductions that cover broad policies without tailoring to specific roles or risks tend to lose attention quickly. Contractors may struggle to see how the information applies to their actual tasks.

Effective inductions need to answer a simple question: What does this mean for me, today, on this site? Without that connection, retention drops and compliance weakens.

No Ongoing Reinforcement

Induction shouldn’t be a one-off event. Over time, people forget procedures, become complacent, or develop shortcuts. Yet many organisations fail to reinforce key messages after the initial onboarding.

Toolbox talks, refresher training, and periodic assessments are critical to maintaining compliance, not just establishing it.

Overreliance on Contractors to Self-Manage

It’s common for businesses to assume that contractors, especially experienced ones, will manage their own compliance. While contractors do carry responsibilities under Australian work health and safety laws, the host organisation still has a duty of care.

Assumptions like “they’ve done this before” or “they know the risks” can lead to dangerous gaps in oversight.

Closing the Gaps

Improving contractor induction compliance doesn’t necessarily mean adding more content, it means improving how it’s delivered, tracked, and reinforced.

Some practical steps include:

  • Standardising core induction requirements across sites
  • Using digital systems for real-time tracking and verification
  • Designing content for clarity, engagement, and accessibility
  • Incorporating site-specific, role-relevant information
  • Scheduling regular refreshers and compliance checks

Ultimately, contractor inductions are more than a procedural step, they’re a frontline defence against incidents and non-compliance. When done well, they set clear expectations, build safety culture, and protect both workers and businesses.

When done poorly, they create a false sense of security.

That’s where the real risk lies.

For a broader explanation of how inductions fit into defensible contractor management, see our Contractor and Supplier Compliance Management Guide.

Sherm Software can help close the gaps using the Contractor and Supplier Register by maintaining records and sending automatic notifications when scheduled refreshers and compliance checks are due.

Use our Checklist to assess whether your contractor compliance approach would stand up to audit, investigation, or client scrutiny.

Contractor Prequalification in Australia, More Than a Paper Chase

Posted on by Marnie Cruickshank

Across Australia, contractor prequalification is often treated as a compliance exercise—collect the required documents, tick the boxes, and move on. With strict regulatory frameworks and a strong focus on workplace safety, it’s understandable why documentation plays such a central role.

But here’s the reality, collecting documents alone doesn’t ensure a contractor is safe, capable, or reliable. In fact, over-reliance on paperwork can create blind spots that expose businesses to serious operational and legal risks.

Compliance Doesn’t Equal Capability

In the Australian context, contractors are typically required to provide:

  • Public liability and workers’ compensation insurance
  • Relevant licences and tickets (e.g. White Cards, high-risk work licences)
  • Safe Work Method Statements (SWMS)
  • Safety management plans and policies

These are all essential. However, they only confirm that a contractor meets minimum requirements at a specific point in time. They don’t guarantee that work will be carried out safely on-site or that systems are actively followed.

A contractor might submit a compliant SWMS, but is it actually used in day-to-day operations? Are workers properly trained, supervised, and accountable?

Documentation alone can’t answer these questions.

The Risks of a “Set and Forget” Approach

Many businesses adopt a “set and forget” model—documents are collected during onboarding and rarely revisited. In a fast-moving environment like construction, mining, or infrastructure, this approach can quickly become outdated.

Common issues include:

  • Expired insurances or licences going unnoticed
  • Generic SWMS that don’t reflect actual site conditions
  • Changes in subcontractors or workforce capability
  • Deterioration in safety performance over time

Under Australian Work Health and Safety (WHS) laws, businesses (PCBUs) have a duty to ensure, so far as reasonably practicable, the health and safety of workers—including contractors. Simply collecting documents is unlikely to meet this obligation if something goes wrong.

Bridging the Gap Between Paper and Practice

The key challenge is ensuring that what’s documented is actually implemented.

To bridge this gap, organisations need to go beyond collection and focus on validation. This might include:

  • Reviewing SWMS for task-specific relevance, not just completeness
  • Verifying licences with issuing authorities where applicable
  • Confirming insurance coverage directly with providers
  • Conducting site observations or audits
  • Speaking with referees about past performance

These steps help ensure that contractors are not just compliant on paper, but competent in practice.

Prequalification Should Be Ongoing

In Australia’s high-risk industries, conditions can change rapidly. That’s why contractor prequalification should be treated as a continuous process, not a one-off task.

A more effective approach includes:

  • Regular reviews of contractor documentation
  • Automated alerts for expiring licences and insurances
  • Monitoring incident reports and near misses
  • Periodic reassessment based on project risk

This dynamic model aligns more closely with WHS expectations and helps organisations stay ahead of potential issues.

Using Technology the Right Way

Digital prequalification platforms are becoming increasingly common across Australia, particularly in sectors like construction and energy. While these systems can streamline administration, they shouldn’t be used as a shortcut.

The real value of technology lies in:

  • Providing visibility over contractor compliance status
  • Enforcing document currency through automated reminders
  • Highlighting gaps or inconsistencies in submissions
  • Supporting ongoing monitoring and reporting

Technology should enhance decision-making—not replace critical thinking.

A Shift Towards Risk-Based Thinking

To strengthen contractor prequalification, Australian businesses need to shift their mindset from compliance to risk management.

Instead of asking, “Have we collected everything?”, the better question is, “Is this contractor genuinely capable of doing the job safely and effectively?”

This means considering factors such as:

  • The complexity and risk level of the work
  • The contractor’s track record and experience
  • Their safety culture and leadership
  • Their ability to adapt to changing site conditions

A risk-based approach ensures that higher-risk work receives greater scrutiny, rather than treating all contractors the same.

Building a More Robust System

A stronger contractor prequalification framework in Australia should include:

  1. Baseline document collection to meet regulatory requirements
  2. Verification processes to confirm accuracy and authenticity
  3. Ongoing monitoring aligned with WHS obligations
  4. Risk-based assessments tailored to specific work activities
  5. Continuous improvement driven by performance data

This approach not only supports compliance but actively reduces the likelihood of incidents and disruptions.

Final Thoughts

In Australia’s regulatory environment, paperwork is essential—but it’s only the starting point.

True contractor prequalification goes beyond documents to assess real-world capability, behaviour, and risk over time. Businesses that move past the “paper chase” mindset are better equipped to protect their workers, meet their WHS duties, and deliver successful projects.

Because when it comes to contractor management, what happens on-site matters far more than what’s sitting in a folder.

This is explored further in our Contractor and Supplier Compliance Management Guide.

Sherm Software manages all of your Contractor and Supplier requirements, from monitoring incidents reported to notifications sent when expiry dates are approaching for documentation supplied.  Get in touch and let us help you make periodic reassessment much easier.

Queensland Repeals HSR Access to WHSQ Enforcement Information

Posted on by Marnie Cruickshank

The Queensland State Government has made a significant—and controversial—change to the state’s work health and safety (WHS) framework. By repealing provisions that would have allowed Health and Safety Representatives (HSRs) to request and obtain enforcement information from Workplace Health and Safety Queensland (WHSQ), the government has reshaped the balance between transparency, regulatory control, and workplace power dynamics.

This development raises important questions about accountability, worker representation, and the future of safety oversight in Queensland workplaces.

Understanding the Repealed Rights

Under the now-repealed provisions, HSRs—and in some cases union officials—would have been able to request detailed compliance and enforcement information from WHSQ. This included data on:

  • Improvement notices
  • Prohibition notices
  • Non-disturbance notices

These notices are key regulatory tools. Improvement notices require employers to fix safety breaches within a timeframe, while prohibition notices address serious and immediate risks by halting unsafe activities. Non-disturbance notices preserve incident sites for investigation.

Access to this information would have given HSRs greater visibility into an employer’s safety history and regulatory interactions—potentially strengthening their ability to advocate for safer conditions.

Why the Government Repealed the Laws

The repeal forms part of broader amendments to Queensland’s WHS legislation. According to government statements, the decision was driven by concerns about misuse and overreach.

The repealed laws were criticised for:

  • Allowing unlimited requests for information
  • Lacking requirements for justification or relevance
  • Potentially enabling misuse by unions or representatives

The government argued that such provisions could be “weaponised” in industrial disputes, shifting the focus away from safety and toward workplace conflict.

In this context, the repeal is framed as an effort to restore balance and ensure that WHSQ remains focused on its core function: enforcing safety laws and preventing harm.

Implications for Workplace Safety

The removal of HSR access to enforcement data has sparked debate across industry, unions, and legal circles.

Potential Benefits:

  • Reduces administrative burden on WHSQ
  • Limits risk of sensitive information being used for non-safety purposes
  • Reinforces the regulator’s independence

Potential Risks:

  • Decreases transparency around employer compliance history
  • Limits HSR capacity to proactively identify systemic safety issues
  • May weaken worker participation in safety oversight

HSRs still retain important powers, including issuing provisional improvement notices (PINs) within their workgroups and participating in consultation processes.

However, without access to regulator-held information, their ability to form a complete picture of workplace risks may be constrained.

A Broader Policy Direction

This repeal reflects a broader policy direction within Queensland’s WHS reforms—one that appears to prioritise regulatory control and safeguards against perceived misuse over expanded information-sharing.

It also aligns Queensland more closely with the national model WHS framework, which does not provide equivalent broad access rights for HSRs to regulator enforcement data.

At the same time, the move highlights an ongoing tension in workplace safety law: how to balance transparency and worker empowerment with fairness, privacy, and the prevention of misuse.

Conclusion

The repeal of HSR rights to access WHSQ enforcement information marks a pivotal shift in Queensland’s approach to workplace safety governance. While the government frames the change as a necessary safeguard, critics argue it may reduce transparency and weaken frontline safety advocacy.

Ultimately, the long-term impact will depend on how effectively existing mechanisms—consultation processes, inspections, and enforcement actions—continue to protect workers without the added layer of information-sharing that has now been removed.

As Queensland’s WHS landscape evolves, this decision will likely remain a focal point in debates about the role of workers, regulators, and employers in maintaining safe workplaces.

ISO 45001 vs WHS Act: What Businesses Get Wrong

Posted on by Marnie Cruickshank

Many Australian businesses assume that if they’re certified to ISO 45001, they’ve “covered” their legal WHS obligations.

Others assume that if they comply with the WHS Act, there’s no need to worry about ISO certification.

Both assumptions are wrong.

Understanding the difference between ISO 45001 and Australia’s WHS legislation — and how they intersect — is critical to avoiding compliance gaps, wasted effort, and audit findings.

The Legal Foundation: The WHS Act

Australia’s work health and safety laws are built around the model Work Health and Safety Act 2011, adopted (with variations) across most states and territories.

The WHS Act:

  • Is law
  • Imposes mandatory duties
  • Creates enforceable obligations
  • Carries penalties for non-compliance

It establishes the primary duty of care for a PCBU (Person Conducting a Business or Undertaking) and requires risks to be eliminated or minimised so far as is reasonably practicable.

Regulators such as SafeWork NSW and WorkSafe Victoria enforce compliance.

Failure to comply can result in improvement notices, prohibition notices, fines, or prosecution.

The International Standard: ISO 45001

ISO 45001 is an international management system standard published by International Organisation for Standardisation.

It is:

  • Voluntary (unless contractually required)
  • A framework for managing OH&S risks
  • Audited by certification bodies
  • Focused on systems and continual improvement

It does not replace or override legal obligations.

The Core Difference

WHS Act = What you must do (legal duties)

ISO 45001 = How you can structure your system to manage those duties

One is law.

The other is a management framework.

Confusing the two is where businesses go wrong.

What Businesses Commonly Get Wrong

  1. “We’re ISO Certified, So We’re Legally Compliant”

ISO 45001 requires organisations to identify and comply with applicable legal requirements — but certification does not guarantee legal compliance.

Auditors assess whether you have a system to manage compliance. Regulators assess whether you are actually compliant.

An organisation can pass an ISO audit yet still breach the WHS Act.

Certification bodies do not enforce legislation — regulators do.

  1. Treating ISO as a Paper Exercise

Some businesses implement ISO 45001 purely for:

  • Tender eligibility
  • Prequalification
  • Client expectations

They build extensive documentation but fail to ensure controls are embedded operationally.

ISO 45001 emphasises:

  • Leadership commitment
  • Worker consultation
  • Risk-based thinking
  • Continual improvement

If documentation exists without real implementation, both ISO auditors and regulators will identify the gap.

  1. Ignoring Officer Due Diligence

The WHS Act imposes personal duties on officers (e.g. directors and senior executives).

ISO 45001 requires leadership involvement — but it does not create personal criminal liability.

Some businesses mistakenly believe board-level review for ISO purposes automatically satisfies WHS due diligence.

Due diligence under the Act requires officers to:

  • Acquire knowledge of WHS matters
  • Understand operations and risks
  • Ensure resources are provided
  • Verify controls are implemented

That verification element is where many organisations fall short.

  1. Confusing Risk-Based Thinking with “Reasonably Practicable”

ISO 45001 uses risk-based thinking to manage OH&S risks.

The WHS Act uses the legal test of “so far as is reasonably practicable.”

These concepts overlap — but they are not identical.

The legal test considers:

  • Likelihood of hazard or risk occurring
  • Degree of harm
  • What the person knows (or should reasonably know)
  • Availability and suitability of controls
  • Cost relative to risk

If risk assessments don’t reflect this reasoning, legal defensibility may be weak — even if ISO processes exist.

  1. Over-Documenting to Satisfy ISO

ISO 45001 does not require excessive paperwork.

Yet many organisations create:

  • 100+ page manuals
  • Multiple redundant forms
  • Complex approval pathways

The WHS Act does not require elaborate documentation either — it requires effective risk management and control.

Over-complication often creates implementation gaps.

  1. Failing to Integrate Psychosocial Risk Management

Australian regulators are increasingly focused on psychosocial hazards (e.g. bullying, workload, fatigue).

While ISO 45001 covers psychological health risks in scope, many organisations:

  • Focus heavily on physical safety
  • Fail to systematically assess psychosocial risks
  • Lack documented controls

Regulators are far more likely to issue notices for these failures than ISO auditors are to withdraw certification.

Where ISO 45001 Adds Value

When implemented properly, ISO 45001 strengthens WHS compliance by:

  • Creating structured governance
  • Formalising consultation mechanisms
  • Improving documentation control
  • Embedding continual improvement
  • Driving leadership accountability

In mature organisations, ISO becomes a tool to demonstrate WHS compliance — not a substitute for it.

A Practical Comparison

WHS Act ISO 45001
 Mandatory law  Voluntary standard
 Enforced by regulators  Audited by certification bodies
 Breaches can lead to prosecution  Nonconformities affect certification
 Focus on duties and risk control  Focus on systems and improvement
 Personal liability for officers  Organisational certification only

The Smart Approach

Australian businesses should:

  1. Treat the WHS Act as the baseline requirement
  2. Use ISO 45001 as a structured framework
  3. Ensure risk management aligns with the “reasonably practicable” test
  4. Embed leadership accountability beyond symbolic review
  5. Focus on implementation, not paperwork

Final Thoughts

ISO 45001 and the WHS Act are not competitors.

They operate at different levels:

  • The WHS Act defines your legal duty.
  • ISO 45001 provides a management system to help meet that duty.

Businesses get into trouble when they mistake certification for compliance — or treat compliance as a tick-box exercise.

In Australia, the safest position is this:

Build a WHS system that genuinely manages risk and meets legislative duties.

Then use ISO 45001 to strengthen, structure, and continuously improve it.

Get in touch with us today and see how Sherm Software and Safety for Life can help.

Our Audit Readiness Guide explains how businesses can design systems that withstand multiple audit regimes simultaneously.

Why Spreadsheets and Shared Drives Stop Working for Audit Readiness

Posted on by Marnie Cruickshank

For many Australian businesses, spreadsheets and shared drives start as practical solutions for managing compliance evidence, policies, and audit documentation. They are familiar, inexpensive, and flexible.

But as organisations grow and regulatory expectations increase, these tools often become the very thing that slows down — or jeopardises — audit readiness.

From ISO certifications to industry-specific regulations and internal governance reviews, businesses across Australia are finding that spreadsheets and shared folders simply cannot keep up with modern audit requirements.

Let’s explore why.

  1. Version Control Becomes a Nightmare

In a spreadsheet-based compliance system, multiple people often update documents simultaneously.

This creates problems like:

  • Multiple file versions (e.g. RiskRegister_v5_FINAL_FINAL.xlsx)
  • Uncertainty about which document is the latest
  • Edits being overwritten
  • Important changes going untracked

During an audit, this leads to confusion and delays when auditors ask a simple question:

“Which version of this control was in effect during the review period?”

Without clear version history, proving this can become difficult.

  1. Evidence Is Scattered Across Systems

Audits rely heavily on evidence.

However, when organisations rely on shared drives, audit evidence is often spread across:

  • Email attachments
  • Different folders on network drives
  • Personal desktop files
  • Team collaboration tools
  • Individual spreadsheets

This fragmentation creates a huge administrative burden during audits. Teams spend hours — sometimes days — searching for documentation instead of demonstrating compliance.

Worse still, critical evidence can be accidentally missed.

  1. No Clear Ownership or Accountability

Compliance tasks typically involve many people across different teams:

  • IT
  • Finance
  • HR
  • Operations
  • Risk and compliance teams

In spreadsheets and shared drives, responsibilities are rarely structured. Tasks might be written in a sheet, but there’s usually no system enforcing:

  • Ownership of controls
  • Deadlines for reviews
  • Automated reminders
  • Escalation when tasks are overdue

Without clear accountability, controls that look complete on paper may actually be outdated or untested.

  1. Limited Audit Trail

Auditors want to see a clear trail of activity.

They need to know:

  • Who updated a policy
  • When a risk assessment was last reviewed
  • When a control was tested
  • What changes were made

Spreadsheets rarely provide a reliable audit trail, especially when files are downloaded, copied, or edited offline.

This lack of traceability raises questions about the integrity of compliance records.

  1. Scaling Becomes Impossible

A spreadsheet-based compliance approach may work when a business has:

  • One certification
  • A small team
  • Limited regulatory exposure

But as organisations expand, compliance requirements multiply. Businesses may need to manage:

  • Multiple standards
  • Several audits each year
  • Hundreds of controls
  • Dozens of evidence requests

At this point, spreadsheets become unmanageable. Teams end up maintaining multiple disconnected trackers that quickly fall out of sync.

  1. Audit Preparation Becomes a Fire Drill

Perhaps the biggest problem with spreadsheet-driven compliance is what happens before an audit.

Instead of being continuously audit-ready, teams scramble to prepare documentation:

  • Evidence is chased across departments
  • Controls are quickly re-reviewed
  • Policies are updated at the last minute
  • Teams rush to assemble audit folders

This reactive approach increases stress, wastes time, and increases the risk of non-conformities.

  1. Lack of Real-Time Visibility

Executives and compliance leaders need a clear view of risk and compliance status.

However, spreadsheets rarely provide real-time insight into:

  • Which controls are overdue
  • Which risks are increasing
  • Which departments are behind on reviews
  • What evidence is missing

Without this visibility, compliance management becomes reactive instead of proactive.

What Modern Audit-Ready Organisations Do Differently

Organisations that consistently pass audits with minimal disruption typically move beyond spreadsheets and shared drives.

Instead, they implement structured compliance systems that provide:

  • Centralised evidence management
  • Automated control tracking
  • Built-in audit trails
  • Clear ownership and accountability
  • Real-time compliance dashboards

This allows teams to maintain continuous audit readiness, rather than preparing only when an audit is scheduled.

The Bottom Line

Spreadsheets and shared drives are useful tools — but they were never designed to manage complex compliance frameworks or support audit readiness.

As Australian businesses face increasing regulatory expectations, relying on manual systems becomes risky and inefficient.

Moving toward a more structured approach to compliance management helps organisations:

  • Reduce audit stress
  • Improve accountability
  • Save time during reviews
  • Strengthen governance and risk management

And most importantly, it ensures that when auditors arrive, the business is already prepared.

Get in touch with us today and see how Sherm Software can help with that preparation.

Our Audit Readiness Guide explains what scalable, audit-ready systems look like in practice.

Audit Evidence: What to Keep, What to Drop, What to Digitise

Posted on by Marnie Cruickshank

If you’ve ever prepared for a WHS audit, you know the temptation: keep everything.

Folders expand. Shared drives overflow. Email chains get archived “just in case.”

But experienced auditors don’t reward volume — they look for relevance, reliability, and traceability.

Whether you’re preparing for a regulator interaction, client audit, or certification against ISO 45001, here’s how to decide what audit evidence to keep, what to drop, and what to digitise.

First: What Counts as “Audit Evidence”?

Audit evidence is any information that demonstrates your WHS management system:

  • Meets legal requirements (e.g. Work Health and Safety Act 2011 and state equivalents)
  • Is implemented in practice
  • Is effective and reviewed

Evidence must be:

  • Accurate
  • Current
  • Accessible
  • Traceable

If it doesn’t support those criteria, it’s probably clutter.

What to Keep

These are documents and records that auditors consistently request and rely on.

  1. Core Governance Documents

Keep:

  • WHS policy signed by senior leadership
  • Roles and responsibilities
  • Organisational chart
  • Legal compliance register
  • Risk management procedure

These demonstrate structure and accountability.

  1. Risk Management Records

Keep:

  • Current risk assessments
  • SWMS (where applicable)
  • Hazard registers
  • Control implementation records
  • Review evidence

Important: Outdated risk assessments that no longer reflect operations should be archived — not active.

  1. Training and Competency Records

Keep:

  • Induction records
  • High-risk work licences
  • Verification of competency (VOC)
  • Refresher training logs
  • Supervisor competency evidence

Auditors look for proof that workers are competent at the time of work, not just when they were first hired.

  1. Incident and Corrective Action Records

Keep:

  • Incident reports
  • Investigation findings
  • Root cause analysis
  • Corrective action tracking
  • Evidence of close-out

What matters most is showing that actions were implemented and verified.

  1. Consultation Evidence

Keep:

  • Safety committee minutes
  • HSR records
  • Toolbox talk records
  • Worker consultation feedback

WHS legislation places strong emphasis on consultation — auditors expect to see evidence of it.

What to Drop (or Archive Properly)

Not all documents need to stay in your active audit folder.

  1. Superseded Policies and Procedures

If a document has been replaced:

  • Archive it with version control
  • Remove it from operational folders
  • Ensure only current versions are accessible

Auditors often identify “document control failures” when outdated procedures remain in circulation.

  1. Redundant Forms

Many organisations collect forms no one reviews:

  • Pre-start checklists never analysed
  • Hazard reports with no follow-up
  • Meeting minutes no one reads

If a record doesn’t inform decisions or improvements, question why it exists.

  1. Excessive Email Evidence

Email chains are weak audit evidence unless:

  • They demonstrate formal approval
  • They verify a decision
  • They confirm action completion

Where possible, convert critical decisions into controlled records.

  1. Duplicated Records

If information exists in multiple systems:

  • Choose one “source of truth”
  • Eliminate manual duplication
  • Reduce reconciliation errors

Duplication creates audit risk.

What to Digitise

Digitisation isn’t just about convenience — it improves traceability and audit readiness.

  1. Training Registers

Move from spreadsheets to:

  • Centralised training management systems
  • Automated refresher alerts
  • Licence expiry tracking

This reduces non-compliance risk.

  1. Risk Registers

Digital risk systems allow:

  • Version control
  • Review tracking
  • Control verification
  • Dashboard reporting

Auditors appreciate systems that clearly show when risks were last reviewed.

  1. Corrective Action Tracking

Manual spreadsheets often fail because:

  • Actions aren’t assigned clearly
  • Deadlines aren’t monitored
  • Close-outs aren’t verified

Digital systems provide accountability and audit trails.

  1. Contractor Management

Digitise:

  • Prequalification documents
  • Insurance currency
  • SWMS approvals
  • Induction records

This is especially valuable for construction, logistics, and multi-site businesses.

How Long Should You Keep WHS Records?

Retention requirements vary depending on the type of record and state legislation, but common examples include:

  • Incident records involving serious injury: often 5+ years
  • Health monitoring records (e.g. asbestos exposure): decades
  • Training records: duration of employment + additional period

Always align with applicable WHS regulations and industry-specific requirements.

The “Audit-Ready” Test

Ask these five questions about any document:

  1. Does this demonstrate compliance or effectiveness?
  2. Is it current?
  3. Is it controlled (versioned and authorised)?
  4. Can we retrieve it within minutes?
  5. Does it show follow-through, not just intent?

If the answer is “no” to most of these, reconsider its place in your system.

The Biggest Mistake Businesses Make

They build systems for the audit — not for the business.

Auditors (including those assessing against ISO 45001) are trained to detect:

  • Over-documented systems
  • Forms created purely for compliance
  • Records that exist but aren’t used

Strong evidence is:

  • Simple
  • Relevant
  • Consistent
  • Embedded in daily operations

Final Thoughts

Good audit evidence isn’t about volume — it’s about clarity and control.

Keep what proves your system works. Drop what adds noise. Digitise what improves visibility and accountability.

An audit-ready organisation isn’t the one with the most folders. It’s the one where evidence is accurate, current, and easy to find — every day, not just before the auditor arrives.

Sherm Software will help you to become an audit-ready organisation, book a demo today to see how.

Our Audit Readiness guide explains how businesses can design systems that withstand multiple audit regimes simultaneously.

What WHS Auditors Actually Look For

Posted on by Marnie Cruickshank

Work Health and Safety (WHS) audits can feel intimidating. Whether you’re preparing for a regulator visit, a client prequalification, or certification against ISO 45001, many businesses aren’t entirely sure what auditors are really assessing.

The good news? WHS auditors aren’t looking for perfection. They’re looking for evidence of a functioning safety management system that is practical, understood, and consistently applied.

Here’s what WHS auditors actually focus on.

Legal Compliance with WHS Legislation

First and foremost, auditors assess compliance with the relevant state or territory WHS legislation, such as:

  • Work Health and Safety Act 2011
  • SafeWork NSW requirements
  • WorkSafe Victoria guidance

They want to see that your organisation understands its primary duty of care, officer due diligence obligations, and worker responsibilities.

Typical evidence requested:

  • WHS policy signed by senior management
  • Documented responsibilities
  • Legislative compliance register
  • Evidence of periodic legal reviews

Risk Management Processes

WHS law is risk-based. Auditors expect to see a structured process for:

  • Hazard identification
  • Risk assessment
  • Implementation of controls
  • Review of control effectiveness

They’ll check whether your process aligns with the hierarchy of control (elimination, substitution, engineering, administrative, PPE).

Common areas reviewed:

  • High-risk construction work
  • Plant and equipment
  • Manual handling
  • Hazardous chemicals
  • Psychosocial hazards (increasingly important)

They’re not just checking paperwork — they’ll verify that controls exist in practice.

Consultation and Worker Participation

Under WHS laws, consultation is mandatory. Auditors will examine:

  • Health and Safety Representative (HSR) arrangements
  • Safety committee meeting minutes
  • Toolbox talks
  • Worker feedback mechanisms

They may interview workers directly. If employees can’t explain safety procedures or feel disconnected from the system, that’s a red flag.

Training and Competency

Auditors look for proof that workers are competent to perform their tasks safely.

Evidence may include:

  • Induction records
  • High-risk work licences
  • Verification of Competency (VOC) records
  • Supervisor training
  • Contractor onboarding systems

They’ll also check whether refresher training is scheduled and tracked.

Incident Reporting and Investigation

A strong WHS system treats incidents as learning opportunities.

Auditors review:

  • Incident reports
  • Investigation findings
  • Root cause analysis
  • Corrective actions
  • Evidence that actions were closed out

They may ask:

“Show me an incident from the last 12 months and what changed because of it.”

Documentation vs. Reality

One of the biggest misconceptions is that WHS audits are purely document checks.

They aren’t.

Auditors conduct:

  • Site inspections
  • Worker interviews
  • Observation of work practices

If your procedures say one thing but work is done differently, that gap will be identified. Consistency between Policy, Procedure and Practice is critical.

Contractor and Supplier Management

If you engage contractors, auditors will examine:

  • Prequalification processes
  • SWMS (Safe Work Method Statements)
  • Contractor induction
  • Monitoring and supervision
  • Performance reviews

Principal contractors and businesses conducting high-risk work receive particular scrutiny.

Emergency Preparedness

Auditors assess whether you are prepared for reasonably foreseeable emergencies.

They’ll review:

  • Emergency plans
  • Evacuation diagrams
  • Fire warden training
  • Drill records
  • First aid arrangements

And they’ll often ask workers what they would do in an emergency.

Continuous Improvement

A mature WHS system shows evidence of ongoing improvement.

Auditors look for:

  • Internal audits
  • Management review meetings
  • KPI tracking (e.g. TRIFR, LTIFR)
  • Corrective and preventive action systems

Certification audits (such as ISO 45001) place strong emphasis on leadership commitment and system improvement over time.

Officer Due Diligence

Under WHS law, company officers must exercise due diligence. Auditors may review whether directors and executives:

  • Receive WHS performance reports
  • Allocate adequate resources
  • Understand critical risks
  • Verify the implementation of controls

Board-level visibility of safety is increasingly expected.

What Auditors Are Not Looking For

  • A perfect safety record
  • Zero incidents
  • Overly complex documentation
  • A 500-page safety manual no one reads

They want to see a system that is:

  • Practical
  • Proportionate to your business size and risk
  • Understood by workers
  • Actively maintained

Final Thoughts

WHS audits are about evidence, consistency, and effectiveness.

If your safety system:

  • Identifies real risks
  • Implements appropriate controls
  • Involves workers
  • Learns from incidents
  • Demonstrates leadership commitment

…you’re already aligned with what auditors actually look for.

The key is not preparing for the audit the week before — it’s building a safety system that works every day.

Sherm Software is that safety system, book a demo today and see for yourself.

For a deeper explanation of how these expectations come together, see our guide to Audit Readiness for WHS, ISO and Principal Contractor Audits.

Common Reasons Businesses Fail WHS, ISO or Principal Contractor Audits

Posted on by Marnie Cruickshank

Workplace audits, whether for Work Health and Safety (WHS), ISO certification, or principal contractor compliance, are designed to ensure businesses operate safely, legally, and systematically.

Audits may be conducted under state-based WHS regulators such as Safe Work Australia (policy body), enforcement authorities like SafeWork NSW, or as part of ISO certification through standards developed by International Organisation for Standardisation. Principal contractors on construction projects also conduct prequalification and ongoing compliance audits to manage site risk.

Despite good intentions, many businesses fail these audits for preventable reasons. Below are the most common causes, and how to avoid them.

Incomplete or Outdated Safety Management Systems

A common failure point is having a WHS or ISO system that looks good on paper but hasn’t been updated, or implemented, in practice.

Typical issues include:

  • Policies not reviewed annually
  • Procedures that don’t reflect current operations
  • Missing version control
  • Documents that reference outdated legislation

Auditors look for evidence that your system is live, current, and embedded, not just a template stored in a folder.

How to avoid it:

Schedule annual management reviews and document revisions. Ensure procedures match actual site practices.

Poor Hazard Identification and Risk Assessments

Under harmonised WHS laws, businesses must identify hazards and implement effective controls.

Audit failures often arise from:

  • Generic, copy-paste risk assessments
  • Missing Safe Work Method Statements (SWMS)
  • No evidence of site-specific risk review
  • Controls not aligned with the hierarchy of control

Principal contractors in construction are especially strict about SWMS compliance and site-specific risk management.

How to avoid it:

Ensure risk assessments are task-specific, signed, dated, and reviewed when conditions change.

Inadequate Training and Competency Records

You may have competent workers, but if you can’t prove it, you can fail the audit.

Common documentation gaps include:

  • Expired high-risk work licences
  • Missing VOC (Verification of Competency) records
  • No training matrix
  • No induction records
  • No refresher training evidence

ISO standards such as ISO 9001 and ISO 45001 require documented competency evidence.

How to avoid it:

Maintain a live training register and monitor expiry dates proactively.

Lack of Consultation and Worker Participation

WHS laws require consultation with workers on safety matters.

Auditors may ask:

  • How are workers consulted about hazards?
  • Are toolbox talks documented?
  • Is there evidence of safety meetings?
  • Are HSRs (Health and Safety Representatives) involved?

If consultation is informal and undocumented, it may not meet compliance requirements.

How to avoid it:

Keep minutes of toolbox talks and safety meetings. Record attendance and action items.

Incident Reporting and Investigation Failures

Many businesses fail audits not because incidents occurred, but because they weren’t managed correctly.

Red flags include:

  • No incident register
  • No investigation reports
  • No root cause analysis
  • Corrective actions not tracked
  • Notifiable incidents not reported

Regulators expect a structured approach to incident management and corrective actions.

How to avoid it:

Use a formal incident reporting system and track corrective actions through to completion.

Contractor Management Gaps

Principal contractor audits often focus heavily on subcontractor compliance.

Common issues:

  • No contractor prequalification process
  • Missing insurances
  • No SWMS review process
  • No evidence of subcontractor induction
  • Lack of monitoring and supervision

If you can’t demonstrate oversight of subcontractors, you may fail site audits.

How to avoid it:

Implement a documented contractor management procedure with checklists and approval records.

Internal Audits Not Conducted (or Not Effective)

For ISO-certified businesses, internal audits are mandatory.

Frequent problems include:

  • No internal audit schedule
  • Superficial audits with no findings
  • No evidence of corrective action follow-up
  • Management reviews not conducted

Auditors expect to see continuous improvement, not just compliance.

How to avoid it:

Conduct structured internal audits annually and document management review outcomes.

Poor Document Control

Document control is a major ISO audit focus area.

Typical failures:

  • Uncontrolled forms in circulation
  • Staff using outdated procedures
  • Missing document registers
  • No approval signatures

Even strong systems can fail audits if document control is weak.

How to avoid it:

Use a controlled document register with version numbers and review dates.

Leadership and Due Diligence Gaps

Under WHS laws, company officers must exercise due diligence.

Auditors may question:

  • How leadership monitors WHS performance
  • Whether safety KPIs are reviewed
  • If directors receive safety reports
  • How compliance obligations are tracked

If leadership cannot demonstrate active involvement, this can result in major non-conformances.

How to avoid it:

Document board-level WHS reporting and decision-making processes.

“Paper Compliance” Without Real Implementation

One of the biggest audit failures is when systems exist, but workers don’t follow them.

Auditors commonly:

  • Interview workers
  • Observe work practices
  • Compare procedures against actual behaviour

If there’s a disconnect between documentation and practice, it’s a serious red flag.

How to avoid it:

Ensure supervisors enforce procedures and conduct regular site inspections.

Final Thoughts

Most WHS, ISO, and principal contractor audit failures aren’t caused by catastrophic breaches, they’re caused by:

  • Inconsistent documentation
  • Lack of follow-through
  • Poor monitoring
  • Weak leadership engagement

The key to passing audits is embedding safety and compliance into everyday operations, not treating audits as one-off events.

If your systems are current, documented, implemented, and regularly reviewed, audits become far less stressful, and far more predictable.

Proactive compliance doesn’t just help you pass audits, it strengthens your business resilience, protects workers, and enhances your reputation in competitive industries like construction, manufacturing, and civil works.

This article expands on concepts covered in our Audit Readiness pillar page, which explains how these failures can be prevented structurally.

What Audit Readiness Actually Means

Posted on by Marnie Cruickshank

When organisations say they’re “audit ready,” it often means very different things. For some, it’s a last-minute scramble before the auditor arrives. For others, it’s a year-round discipline embedded in governance, finance, IT, and operations.

True audit readiness isn’t about having neat folders or polished financial statements. It’s about being able to demonstrate compliance, accuracy, and control at any time—under regulatory and accounting standards.

Let’s break down what audit readiness really means in context.

Understanding the Regulatory Landscape

Audit readiness starts with knowing which rules apply to your organisation.

Financial reporting and audit requirements are shaped by:

  • The Australian Securities and Investments Commission (ASIC)
  • The Australian Accounting Standards Board (AASB)
  • The Australian Prudential Regulation Authority (APRA) (for financial institutions)
  • The Australian Charities and Not-for-profits Commission (ACNC) (for charities)

Depending on your structure (company, charity, public sector entity, financial institution), different standards and reporting obligations apply.

Being audit ready means you:

  • Know which standards apply to you
  • Understand reporting deadlines
  • Maintain documentation that aligns with Australian Accounting Standards (AAS)

It’s More Than Just the Annual Audit

Many organisations treat audit readiness as a seasonal project—usually starting a few months before year-end.

In reality, audit readiness means:

  • Clean reconciliations completed monthly
  • Controls operating consistently throughout the year
  • Policies reviewed and updated regularly
  • Evidence retained in real time

If documentation is only assembled when auditors ask for it, you’re not audit ready—you’re audit reactive.

Strong Internal Controls (Not Just Good Intentions)

Auditors focus heavily on internal controls. That includes:

  • Segregation of duties
  • Delegations of authority
  • Approval workflows
  • IT access management
  • Change management processes

For APRA-regulated entities, expectations are even higher around risk governance and operational resilience.

Audit readiness means controls are:

  • Documented
  • Tested
  • Understood by staff
  • Consistently applied

And importantly—evidence exists to prove it.

Documentation Is Everything

In audits, if it isn’t documented, it didn’t happen.

That includes:

  • Board minutes approving financial statements
  • Signed contracts
  • Revenue recognition support
  • Grant acquittals
  • Asset valuations
  • Lease calculations under AASB 16

Being audit ready means documentation is:

  • Centralised
  • Version controlled
  • Accessible
  • Complete

Auditors should not need to chase multiple departments repeatedly for basic evidence.

Alignment with Australian Accounting Standards

Australian Accounting Standards (AAS) align closely with IFRS but have specific local requirements.

Common areas where organisations struggle include:

  • Revenue recognition (AASB 15)
  • Leases (AASB 16)
  • Financial instruments (AASB 9)
  • Impairment assessments
  • Consolidations

Audit readiness means technical accounting positions are:

  • Clearly documented
  • Supported by calculations
  • Reviewed internally
  • Consistent year to year

If your team cannot explain why a treatment was adopted, auditors will flag it.

Governance and Board Oversight

Governance expectations are strong—particularly for public companies, large charities, and regulated entities.

Audit readiness includes:

  • Active audit and risk committees
  • Clear financial oversight
  • Documented risk management frameworks
  • Regular internal reporting

Board members should understand key financial judgments—not just sign off at year-end.

Data Integrity and Systems Reliability

Modern audits increasingly assess:

  • ERP system controls
  • Cybersecurity controls
  • Backup and disaster recovery
  • Data accuracy and integrity

Poor system controls often lead to expanded audit testing, higher fees, and delayed signoffs.

Audit readiness means your systems can:

  • Produce reliable reports
  • Track changes
  • Restrict unauthorised access
  • Maintain audit trails

Being Ready for Regulator Scrutiny

Audit readiness also means being prepared beyond the auditor.

Regulators such as ASIC, APRA, or the ACNC can request documentation, explanations, or supporting materials.

Organisations that are genuinely audit ready can:

  • Produce requested documents quickly
  • Demonstrate compliance clearly
  • Show consistent governance practices

This reduces regulatory risk and reputational damage.

Audit Readiness Reduces Cost and Stress

Audit fees continue to rise—particularly for regulated industries and larger organisations.

Poor readiness leads to:

  • Extended audit timelines
  • Multiple information requests
  • Rework and corrections
  • Increased audit fees

Strong readiness typically results in:

  • Faster fieldwork
  • Fewer audit adjustments
  • Cleaner audit reports
  • Better internal financial confidence

What Audit Readiness Is Not

Let’s be clear about common misconceptions.

Audit readiness is not:

  • A last-minute clean-up
  • Outsourcing responsibility to auditors
  • Relying on one finance team member
  • Assuming “we’ve always done it this way” is sufficient

It’s a structured, organisation-wide discipline.

The Real Definition of Audit Readiness

Audit readiness means:

Your organisation can demonstrate compliance, accuracy, governance, and control at any time—under regulatory and accounting standards—without scrambling for evidence.

It’s proactive, not reactive.

It’s embedded, not seasonal.

And it’s a competitive advantage.

If your organisation is preparing for growth, external funding, regulatory scrutiny, or board-level governance uplift, strengthening audit readiness is one of the most practical investments you can make.

Because when the auditor walks in, readiness shouldn’t start—it should already exist.

Learn more about Audit Readiness and use our free checklist to see how audit ready your organisation is.

App Login