5 Workplace Safety Mistakes That Only Show Up During an Audit
Most companies think they are doing safety right — until an auditor walks in.
Not because they are cutting corners. Most of the time, the training was actually done. The equipment was actually delivered. The risk assessment was actually discussed in a meeting.
The problem is that none of it was documented properly. And in safety compliance, if it is not documented, it did not happen.
Here are five mistakes I see over and over again. They are invisible in daily operations. They only become visible — and expensive — when someone asks to see the records.
1. Training was done but never documented
This is the most common one. A supervisor gathers the team, explains a new procedure, maybe even runs a hands-on session. Everyone learns, everyone understands. Nobody signs anything.
Three months later, an auditor asks: “Can you show me the training records for this procedure?”
And the answer is: “We did it, but…”
That “but” is where the fines start. In most European jurisdictions, the employer must be able to prove that training was delivered, who attended, what topics were covered, and when it happened. A verbal briefing with no record is legally the same as no briefing at all.
The fix is not complicated. Every training session needs a record with a date, a topic description, and signatures. Digital or paper, it does not matter — what matters is that it exists and can be retrieved when needed.
2. Risk assessments exist but were never updated
Many companies did a proper risk assessment when they started, or when they moved to a new facility, or when a consultant came in and set everything up. That document still sits in a folder somewhere.
The problem: it was written three years ago. Since then, the company added a new production line, changed a chemical supplier, moved a storage area, and hired 15 new employees. None of those changes triggered an update to the risk assessment.
EU-OSHA is clear on this: risk assessments must be reviewed regularly and updated whenever there are significant changes in the workplace. “Regularly” does not mean “when we get around to it.” It means on a schedule, with a documented review even if nothing changed — because “we reviewed it and found no updates needed” is a valid record. A missing review is not.
The real issue is that nobody owns the update cycle. It lives in someone’s memory, or in a calendar reminder that got dismissed. There is no trigger connected to actual changes in the business.
3. PPE was delivered but there is no traceability
Gloves, helmets, hearing protection, safety shoes — companies buy them, hand them out, and move on. When an auditor asks “Can you show me who received what PPE and when?”, the answer is often a blank stare.
Get Emanuele Sandri’s stories in your inbox
Join Medium for free to get updates from this writer.
PPE traceability is not just good practice. In many countries, it is a legal requirement. The employer must be able to demonstrate that appropriate personal protective equipment was provided to each worker based on the risks identified in their role. This means records: who received what, when, and based on which risk assessment.
Without traceability, a workplace accident involving PPE becomes a much bigger legal problem. “We always provide gloves” is not a defense. “Here is the signed record showing this employee received cut-resistant gloves on March 12, appropriate for the risks in their workstation” is.
4. Safety roles were assigned but never formalized
Someone handles fire safety. Someone else is the first aid officer. A third person manages chemical storage. Everyone in the company knows who these people are.
But when the auditor asks for the formal appointment letters, they do not exist.
In most regulatory frameworks, safety roles need to be formally designated in writing. The designation should specify what the role involves, who holds it, and from what date. In many cases, it also needs to reference the qualifications or training that make that person eligible for the role.
This is one of those findings that surprises companies the most during audits. The people are doing the work. The competence is there. But the paperwork that makes it official is missing, and that turns a functioning safety organization into a non-compliant one.
5. Deadlines are respected — from memory
Medical exams, equipment inspections, fire extinguisher servicing, training renewals, document reviews. Every safety system has dozens of recurring deadlines.
In many companies, these deadlines live in one person’s head. Or in a spreadsheet that someone updates when they remember. Or in a calendar that only one person can see.
This works until it does not. The person goes on vacation, the spreadsheet gets forgotten for two weeks, and suddenly three medical exams are overdue and a fire extinguisher inspection was missed by a month.
An auditor does not care that you have a good track record. They care about right now. If something is overdue today, it is a finding today.
The pattern here is always the same: reliance on individual memory instead of a system that alerts, tracks, and escalates automatically.
The common thread
If you look at all five mistakes, they share one root cause: the company is doing the right things but has no system to prove it.
Safety compliance is not just about actions. It is about evidence of actions. And evidence requires structure — something that captures what happened, when, and who was involved, without depending on a single person remembering to write it down.
This is exactly where many companies get stuck. They outgrow their spreadsheets but do not realize it until an audit makes the gaps visible. The transition from informal tracking to structured safety management does not require a massive project. Platforms like 4HSE exist specifically to handle this — training records, risk assessment workflows, PPE traceability, role designations, and automated deadline management — without requiring companies to reinvent their processes.
But whatever tool you choose, the principle is the same: if your safety compliance depends on someone remembering, it is only a matter of time before an audit catches what they forgot.
