Compliance monitoring and safety management use common information but answer distinct questions: whether the requirement is met and whether the risk is controlled. An audit with no non-conformities does not by itself prove the absence of operational hazards.
What needs to be defined at the start?
Delimit the activities, organizations, and interfaces included. Build a matrix that associates the requirement and its revision with the process, the person responsible, the procedure, and the evidence. Mark applicability and the reason for the exclusion of a provision, where applicable.
ADR.OR.D.005 of Regulation (EU) No 139/2014 constitutes the benchmark of the management system for the target operators. Implementation is adapted to the organization and actual operations, with documented processes and tracking mechanisms.
How do you prepare a useful audit?
Define the criteria, sample, period, and methods: document review, interview, and field observation. Include relevant contracted activities and ensure the auditor's independence from the audited activity. A checklist is not sufficient without verifiable evidence.
The finding describes the requirement, the observed situation, and the record supporting it. If a control cannot be verified due to lack of access to evidence, record the limitation; do not turn the lack of verification into a favorable conclusion.
How do you build a risk assessment?
Clearly formulate the hazard, the undesirable event, and the consequences. Describe the scenario and exposure, then document existing controls. Probability and severity are evaluated using explicit criteria and available data, not just the color of a matrix.
For residual risk, explain what the measure changes and how you verify its functioning. Identify dependencies: two controls performed by the same person, based on the same incorrect information, are not necessarily independent. Risk acceptance is documented at the level designated by the organization.
How do you close a finding?
Separate the correction of the situation from the action addressing the root cause. Fixing a lighting unit eliminates the specific defect; root cause analysis may require changing a circuit, protection, or inspection schedule. The measure must address the cause supported by evidence.
The action register contains the responsible person, deadline, implementation document, and effectiveness verification. Administrative closure should not replace field verification. Recurrent findings require re-evaluation of previous causes and measures.
What do you report to management and what do you send for bidding?
Choose indicators with a definition, source, denominator, and analysis frequency. A number of events should be interpreted together with the volume of operations and changes in the reporting culture. Present pending actions, major risks, and necessary decisions.
For bidding, send the organizational chart, manuals, scope of activity, audit program, and anonymized examples of registers. Specify whether you need a diagnosis, a methodology overhaul, a specific audit, or support in implementing the action plan.
Consult the technical chapter in the guide