A PSM compliance audit evaluates whether the procedures and practices developed under 29 CFR 1910.119 are adequate and are being followed. Under paragraph 1910.119(o), the employer must certify that this evaluation occurs at least every three years.
The audit is not only a document inventory. It should compare the written PSM system with field conditions, records, employee knowledge, and actual work practices. A complete manual cannot demonstrate that procedures are current, inspections occur at approved intervals, changes are controlled, or findings are resolved.
The six core requirements of paragraph 1910.119(o)
The regulation requires the employer to:
- Certify that compliance with the provisions of 29 CFR 1910.119 has been evaluated at least every three years;
- Use the audit to verify that developed procedures and practices are adequate and are being followed;
- Have the audit conducted by at least one person knowledgeable in the process;
- Develop a report of audit findings;
- Promptly determine and document an appropriate response to each finding and document that deficiencies have been corrected; and
- Retain the two most recent compliance audit reports.
OSHA’s compliance-audit interpretation emphasizes that deficiencies must be corrected as promptly as possible. The next three-year audit is not the default corrective-action PSM Compliance Audit deadline.
Three-year audit versus five-year PHA revalidation
The compliance-audit interval and PHA revalidation interval are different:
| Activity | Minimum frequency | Primary purpose |
|---|---|---|
| PSM compliance audit | At least every three years | Verify compliance with 29 CFR 1910.119 and whether developed procedures and practices are adequate and followed. |
| PHA update and revalidation | At least every five years after the initial PHA | Assure that the hazard analysis remains consistent with the current PSM Compliance Audit process. |
One activity cannot automatically replace the other. They ask different questions, use different requirements, and produce different records, although evidence from each can inform the other.
Who can conduct a PSM compliance audit?
The standard requires at least one person knowledgeable in the process. It does not state that every auditor must be external or fully independent. The team should nevertheless have enough knowledge of PSM, auditing, and the relevant process to evaluate technical and implementation evidence.
A practical team can combine process knowledge with an auditor who was not directly responsible for every program being assessed. This can improve objectivity, but it is an audit-program recommendation rather than an additional OSHA requirement. Define conflicts, access, authority, and reporting lines before PSM Compliance Audit fieldwork begins.
Define scope and criteria before fieldwork
The audit should cover the provisions applicable to the covered processes. Build the protocol from the current regulatory text, not only from an old checklist. Identify facilities, units, time period, previous reports, major changes, incidents, responsible functions, and sampling PSM Compliance Audit approach.
Useful preparation records include:
- The two most recent audit reports and closure evidence;
- Current process safety information and PHAs;
- Operating procedures and annual certifications;
- Training and competency records;
- Contractor-selection, orientation, evaluation, and injury-log records;
- PSSR and MOC files;
- Mechanical-integrity procedures, schedules, results, deficiencies, and QA records;
- Hot-work permits and safe-work-practice records;
- Incident investigations and corrective-action status;
- Emergency plans, training, drills, and coordination evidence; and
- Employee-participation and access PSM Compliance Audit records.
Use three evidence channels
1. Records review
Determine whether required procedures and records exist, are current, contain the required information, and show timely implementation. Test a meaningful sample rather than accepting an index or dashboard as proof.
2. Interviews
Speak with people whose jobs relate to the element being tested, including operators, maintenance employees, contractors, engineers, and program owners. Interviews can reveal whether employees understand current procedures, operating limits, emergency actions, or recent changes. They should support fact-finding, not become a memory contest detached from assigned PSM Compliance Audit work.
3. Field verification
Compare records with installed equipment and actual practices. Verify equipment identifiers, procedure accessibility, temporary installations, inspection status, safe-work controls, alarm or emergency information, and whether completed corrective actions exist in the PSM Compliance Audit field.
Write findings that can be resolved
A useful finding identifies the requirement or approved procedure, the objective evidence reviewed, the observed condition, and the specific gap. Avoid unsupported statements such as “program inadequate.” Clear findings allow the employer to determine an appropriate response and verify correction.
Classifying findings by risk or priority can help management allocate resources, but the classification system must not be used to delay required correction. Separate regulatory noncompliance from improvement opportunities so the report does not blur mandatory responses and voluntary PSM Compliance Audit recommendations.
Respond to findings and verify correction
The employer must promptly determine and document an appropriate response to every audit finding and document that deficiencies have been corrected. A corrective-action record should identify the finding, response, owner, due date, interim control where necessary, completion evidence, and closure verification.
If correction changes process chemicals, technology, equipment, procedures, or facilities, apply management of change. Closing a task in software does not establish that the deficiency is corrected. Verify the revised document, installed equipment, completed training, or other result appropriate to PSM Compliance Audit the finding.
Certification and record retention
The employer must certify that the compliance evaluation occurred at least every three years. The certification should identify the covered scope, audit dates, and responsible employer representative in a manner that can be retrieved. Do not confuse certification with a claim that no deficiencies exist.
Retain the two most recent compliance audit reports. Supporting workpapers and corrective-action evidence may be retained under the facility’s record system to demonstrate how conclusions were reached and deficiencies were corrected. Protect trade-secret information without restricting the access required PSM Compliance Audit under paragraph (p).
Common compliance-audit weaknesses
- Counting from the report-approval date in a way that exceeds the required interval;
- Using a checklist that does not match the current regulation;
- Reviewing documents without interviews or field verification;
- Failing to include a person knowledgeable in the process;
- Repeating an untested sample across every audit cycle;
- Writing findings without criteria or objective evidence;
- Deferring correction until the next audit;
- Closing findings without proof that deficiencies were corrected; and
- Failing to retain the two most recent PSM Compliance Audit reports.
1 Trackback / Pingback