How to Review Records and Inspect a Site for OHS Compliance

A polished safety file can still hide gaps on the ground. An OHS compliance audit in the UAE checks whether your health and safety system meets applicable requirements and works in day-to-day operations, not just whether procedures exist on paper.

It’s reasonable to expect an audit to examine both records and real working conditions. This guide explains how to prepare and review policies, risk assessments, training and incident records, then inspect work activities and follow up on findings. It also outlines how UAE requirements, including ADOSH-SF and Ministerial Resolution No. 44 of 2022, relate to the audit, and what ISO 45001 expects from an implemented system.

Shebin Abraham, the author, is an ADOSH-SF Senior OHS Practitioner with IDIP NEBOSH, CertIOSH and MIIRSM credentials, and 21 years of OHS experience. His practical perspective keeps the focus where it belongs: sound evidence, effective controls and the people they are meant to protect.

What is a Health and Safety Audit?

A health and safety audit evaluates whether a workplace’s safety management system meets applicable requirements and works in practice. In the UAE, it considers federal rules, emirate requirements, records, leadership involvement and conditions observed during inspection.

There is no single audit interval that applies to every UAE workplace. Internal compliance reviews are recommended every month, while third-party SRA audits against OSHAD-SF V 3.1 are described as annual audits.

Auditor arrangements depend on the audit and sector. For OSHAD-SF third-party audits, OSHAD audits government entities, while an OSHAD-registered auditing company audits semi-government and private entities.

1. Identify Applicable UAE Safety Requirements

   Map the federal and emirate-specific requirements that apply to your operations. Federal Law No. 8 of 1980 is included in the UAE’s federal health and safety legal framework. Ministerial Resolution No. 44 of 2022 sets occupational health and safety controls and procedures, including expectations for labour accommodation.

   For Dubai construction, include the Code of Construction Safety Practice in the review. Abu Dhabi workplaces should identify whether ADOSH-SF applies. ADOSH-SF is Abu Dhabi’s OSH System Framework, issued by ADPHC, formerly OSHAD. Don’t assume a requirement in one emirate automatically applies in another.

2. Review Leadership Involvement and Audit Scope

   Set an audit scope that reflects actual work, hazards and responsibilities. Include management discussions, observations of workplace acts and conditions, and interviews with relevant personnel. Visible leadership involvement is an expectation of ISO 45001 systems; examine how leaders support controls and follow up on findings.

   Use a practical checklist for workplace, construction and lifting activities. Check whether workers follow safe procedures, equipment is maintained and hazards are controlled at the worksite. Select three to five critical tasks for closer observation, such as working at height, lifting, hot work or confined-space work.

3. Check OSHAD Audits and Required Documentation

   Identify the applicable OSHAD-SF audit route before setting the review schedule. Internal audits help prepare for third-party audits. OSHAD audits government entities, while an OSHAD-registered auditing company audits semi-government and private entities. Keep the audit purpose and scope clear.

   Gather health and safety policies, job risk assessments, operating procedures, induction and training records, incident reports, maintenance logs, emergency plans, contractor files and PPE records. Check that documents reflect current work and are accessible during an inspection. Compare written controls with site conditions, then record gaps for corrective action.

Compliance with applicable UAE legal and regulatory requirements

Assess each legal and regulatory obligation against the activities, locations and controls in your management system. A structured review shows where records, risk assessments and workplace practices align, and where corrective action is needed.

1. Assess Regulatory Compliance

   Build a regulatory register for each operating location and activity. Separate federal requirements from emirate-specific requirements, then note the responsible function, relevant evidence and review point. ISO 45001 requires organizations to comply with applicable legal and regulatory requirements, so connect each relevant obligation to an operational control.

   For each requirement, define what compliance looks like in practice. A construction operation in Dubai, for example, should map applicable construction safety requirements to site controls, work procedures and inspection records. In Abu Dhabi, assess whether ADOSH-SF requirements apply to the entity and its activities. Don’t treat a company-wide policy as proof that every location follows it.

   Review the regulatory register whenever operations, work locations or activities change. Check whether permits, certifications and renewals have annual requirements, then assign ownership and record due dates where relevant. Don’t assume every permit follows the same renewal cycle. Requirements depend on the specific permit or certification.

   Connect each obligation to evidence. A documented risk assessment should reflect the actual activity, while training records should support the relevant work controls. For reporting requirements, identify the responsible role and records showing that required reporting was completed. This makes the assessment traceable rather than relying on general statements of compliance.

2. Identify Regulatory Gaps

   Compare each applicable requirement with evidence from records, interviews and workplace observations. Mark an item as a gap when a required control is absent, incomplete, outdated or inconsistent with actual practice. For example, a procedure may describe a control that workers don’t apply, as an inspection reveals.

   Record each gap in plain terms. Identify the affected activity, location, requirement, supporting evidence and potential risk. Distinguish a missing document from a failed operational control. A missing training record needs different corrective action from an observed unsafe task, even when both relate to the same requirement.

   Rank findings by the risk they present and the need for prompt action. Assign each corrective action to a responsible role, set a practical deadline and specify the evidence needed to demonstrate closure. Keep reporting records with the original finding so reviewers can follow the decision and outcome.

   Use a mock audit before a government inspection to test documentation and staff readiness. Define the relevant scope, including whether Dubai Municipality or OSHAD enforcement applies to the covered entity. An internal review should also establish whether earlier corrective actions addressed the underlying cause, rather than merely closing the paperwork.

Document review and site walkthroughs

Use a planned sequence to connect written evidence with the conditions workers face. A sound audit moves from preparation and document review to onsite observations, reporting and follow-up.

1. Plan the Audit and Review Documents

   Set the audit scope, locations, activities and required evidence before fieldwork begins. Send the document request list one week before the audit, giving relevant teams time to gather records. Organize the material by topic, such as risk assessments, operating procedures, training and incident reporting.

   Review documents for relevance, consistency and use. Compare a risk assessment with its related operating procedure, then note any differences to examine onsite. Check whether policies reflect current activities and whether incident records identify recurring hazards or follow-up actions. A document’s presence alone doesn’t show that workers understand or apply its controls.

   Prepare questions from the records rather than relying on a generic checklist. If an incident report identifies a recurring equipment issue, include that equipment in the walkthrough. Record missing, conflicting or outdated evidence as an audit point. This helps the audit team use site time to test specific controls and clarify how work is performed.

2. Conduct Site Walkthroughs

   Walk through the agreed areas with a clear route and audit scope. Observe work as it normally happens, including how workers use procedures, equipment and protective controls. Compare conditions with relevant records, and note where actual practice differs from documented expectations. Keep observations factual and tied to the location or activity.

   Speak with workers and relevant supervisors about the tasks being observed. Ask how they identify hazards, respond to changing conditions and report incidents or near misses. Their explanations can reveal whether induction and occupational safety information are understood in practice. Assess interviews alongside observations and records.

   Capture conditions that need further review without unnecessarily interrupting safe work. For example, a control described in a procedure may be present but poorly maintained. Record what was seen, where it occurred and which activity was underway. Separate immediate hazards from broader system issues so the report can address each appropriately.

3. Prepare Audit Documentation and Reporting

   Write findings so another reviewer can trace each conclusion to evidence. Include the location, activity, relevant record or observation, and the requirement or control being assessed. Distinguish verified facts from interpretations. Clear reporting helps management understand both the operational issue and its connection to the occupational health and safety system.

   For each finding, document its root cause, corrective action, deadline, responsible person and closure evidence. Use the 5 Whys or a fishbone diagram when a simple correction may not address the underlying cause. For example, repeated gaps in equipment inspection records may point to unclear ownership, not merely an isolated missed entry.

   Share the report with responsible managers and track follow-up to closure. Evidence may include revised procedures, completed training records or a later inspection showing the control works. Review outstanding actions and record whether they reduced the identified risk. This turns audit reporting into practical improvement, not just a file kept for reference.

Consultant support and consequences of non-compliance

The cost of an OHS compliance audit in the UAE depends on its scope and is provided after a quote request. Locations, operational risks, audit duration and evidence requirements shape the assessment.

1. Use an OHS consultant when internal reviews identify gaps your team can’t resolve confidently. A consultant can evaluate how procedures work in practice, examine evidence and help prioritize corrective action. Agree on the audit scope first, including locations, activities, applicable requirements and available records. Clear boundaries keep the evaluation focused on operational risks.

   For an organization preparing for ISO 45001 certification, audit support can help identify weaknesses before an external audit. A failed ISO 45001 audit can delay or prevent certification. Consultants can help assess whether controls are implemented, findings are addressed and improvement evidence is recorded. Certification itself is issued through the applicable certification process, not by an OHS consultant.

2. Address findings through corrective action, rather than treating an audit report as the final outcome. Assign each finding a root cause, action, deadline, responsible person and closure evidence. For example, repeated missed inspections may require clearer ownership or revised procedures, not simply another reminder. Follow-up should establish whether the change addressed the cause.

   Keep evidence linked to each finding. This could include revised procedures, updated risk assessments, training records or follow-up inspection results. A documented review also helps managers see whether similar gaps affect other activities or locations. Track open actions until evidence demonstrates completion, and record any remaining control concerns for management review.

   Consultant involvement is most useful when an audit requires an independent assessment, regulatory gap analysis or structured preparation for certification. It can also help translate findings into practical actions for workers and supervisors. The organization remains responsible for implementing and maintaining its controls.

3. Understand the possible consequences of unresolved safety violations. UAE companies may face administrative fines ranging from thousands to hundreds of thousands of dirhams for safety violations. The outcome depends on the violation and relevant enforcement process, so an audit should identify gaps early and document the response.

   Prepare for a government inspection by testing documentation and staff readiness through a mock audit. Review whether procedures match actual work, responsible personnel can explain their roles, and corrective actions have evidence of closure. This can expose practical weaknesses before an inspection or external assessment.

   Prioritize findings that affect immediate controls, then assign owners and deadlines for each action. Management should review overdue items and remove barriers to completion. A clear reporting trail shows what the organization found, how it responded and whether follow-up confirmed improvement. The practical takeaway is direct: identify gaps early, address their causes and retain evidence that controls work.

The cost depends on the audit’s scope and is provided after a quote request. Locations, operational risks, audit duration and evidence requirements shape the assessment.

What does a UAE workplace OHS compliance audit cover?

An audit tests how occupational health and safety controls work across daily operations. It combines management discussions, workplace observations and interviews with relevant personnel.

1. Start by examining how work is organized and risks are controlled. Review whether formal risk assessments cover actual tasks, changing conditions and outsourced work. ISO 45001 applies to operational activities that include outsourced work, so include contractor activities within the audit scope.

   Compare planned controls with operational practice. For example, a risk assessment may identify a lifting hazard, while the audit checks whether workers follow the relevant controls during lifting operations. Check how supervisors respond when conditions change. The objective is to evaluate whether risk management remains active, not simply whether a document exists.

   Assess whether workers receive enough instruction to apply controls consistently. Induction, task-specific instruction and supervision all affect how procedures are used. Interviews can reveal whether workers understand hazards, know how to report concerns and can explain the controls relevant to their tasks.

2. Observe work activities and conditions directly. Include access routes, housekeeping, equipment condition and how people carry out tasks. For construction work, observe activities such as working at height, hot work or lifting. Record the activity and conditions seen, rather than relying on general impressions.

   Discuss observations with workers and supervisors who understand the task. Their explanations can clarify whether a condition is temporary, routine or linked to a wider control issue. Compare those discussions with the risk assessment and operating procedure. Differences may point to a control that needs review or better implementation.

   Include relevant outsourced activities in the operational review. Contractor work can introduce hazards and interfaces with employees’ tasks. Check how the organization identifies those interfaces and communicates relevant controls. The audit should consider the work being performed, not only the direct employment relationship.

3. Evaluate whether the safety system learns from incidents and near misses. Review reporting patterns, investigation quality and how findings influence risk controls. Near-miss reporting per 100 workers can serve as an audit performance indicator. Interpret that measure alongside reporting practices and follow-up, rather than treating a single figure as proof of performance.

   Look for evidence of proactive risk management and continuous improvement. ISO 45001 audits assess implementation in workplace operations, not written procedures alone. Check whether identified risks lead to revised controls, updated assessments or further instruction. Visible leadership involvement also matters: examine how managers participate in reviews and support action.

   Bring these strands together in a clear evaluation of operational effectiveness. Discuss your workplace audit requirements when you need help assessing how controls function across your operations.

Shebin Abraham

Shebin Abraham can help translate audit findings into practical OHS actions for your workplace. Turn to him for support interpreting applicable requirements, reviewing safety controls or preparing to address gaps identified during an audit.

His OHS Services and Freelance HSE Service support workplace health and safety compliance. For organizations subject to Abu Dhabi requirements, Freelance ADOSH-SF OHS consulting provides relevant regulatory support; Trakhees OHS consulting addresses applicable requirements in that context. The focus is on connecting documented procedures with site conditions and clear corrective actions.

Contact Shebin Abraham to discuss the OHS audit support your workplace needs.

Build audit learning into everyday decisions

Make the next OHS compliance audit in the UAE part of how your organization plans work, rather than a separate compliance event. Bring audit learning into routine management discussions, especially when work methods, contractors or operating conditions change. This keeps safety considerations connected to decisions that affect people on site.

Choose a practical next step: identify who will own audit follow-up and how progress will reach the people responsible for workplace controls. Clear ownership keeps improvements active between reviews, while open communication gives workers a way to raise concerns as operations evolve.

Shebin Abraham’s OHS support can help organizations turn audit needs into a practical way forward. If you’re ready to discuss your situation, contact Shebin Abraham about your audit. A considered next step can help your team strengthen its approach with care and confidence.

Frequently Asked Questions

What occupational health and safety (OHS) laws and regulations apply to businesses in the UAE?

Applicable OHS requirements can include federal rules and emirate-specific frameworks. The UAE legal framework includes Federal Law No. 8 of 1980 and Ministerial Resolution No. 44 of 2022, which sets OHS controls and procedures, including labour accommodation expectations. Abu Dhabi’s ADOSH-SF provides an emirate framework, while Dubai construction operations are subject to the Code of Construction Safety Practice. Identify which requirements apply to your activities and location.

Which UAE authorities oversee OHS compliance in each emirate and free zone?

Authorities involved in OHS inspections and audits include MOHRE, Abu Dhabi Municipality and Dubai’s Occupational Safety and Health Centre (OSHAD). The applicable oversight depends on the workplace, activity and relevant jurisdiction. For a free-zone operation, map the zone’s applicable requirements alongside federal and emirate rules. Don’t assume one authority or framework covers every site; define the audit scope around the actual locations and work performed.

What records and documents are required for a UAE OHS audit?

Prepare accessible health and safety policies, job risk assessments, operating procedures, training and induction records, incident reports, maintenance logs, emergency plans, contractor files and PPE records. The auditor may also need evidence that records match current work. For example, a risk assessment for lifting should correspond with the activity and controls observed. Organize records by location or activity so relevant evidence can be retrieved efficiently.

What are the steps to prepare for and complete an OHS compliance audit in the UAE?

Define the audit scope, locations and activities first. Arrange relevant records, then plan interviews and site observations around work with meaningful risk. Send a document request list one week before the audit. During the review, compare evidence with workplace practice, document findings and assign actions with owners and deadlines. Follow up by recording closure evidence and checking whether the action addressed the underlying issue.

What penalties apply for OHS non-compliance in the UAE?

UAE companies may face administrative fines ranging from thousands to hundreds of thousands of dirhams for safety violations. The consequence depends on the violation and applicable enforcement process. A separate certification risk applies to ISO 45001: a failed audit can delay or prevent certification. Treat findings promptly, preserve evidence of corrective action and ensure management understands outstanding risks rather than focusing only on audit paperwork.

How do OHS audit requirements differ between Dubai, Abu Dhabi, other emirates, and free zones?

Requirements can combine federal rules with emirate-, sector- and zone-specific controls. Dubai construction operations are subject to the Code of Construction Safety Practice, while Abu Dhabi uses ADOSH-SF. Other locations and free zones may have different applicable requirements. Build the audit scope around the workplace’s location and activities, then assess the relevant requirements rather than applying one emirate’s checklist across every operation.

What common OHS audit findings and workplace risks affect UAE employers?

Audits may identify differences between written procedures and actual work, incomplete records, or controls workers don’t consistently apply. High-risk tasks to examine include working at height, lifting operations, hot work and confined-space work. For example, an assessment may describe a control that isn’t followed during an observed task. Interviews, records and site observations help distinguish an isolated lapse from a wider system issue.