The safety audit report runs to forty pages. It confirms that all 22 fire extinguishers are in date, that the first-aid boxes are stocked, that the emergency exit signs are lit and that 94 percent of workers were wearing safety shoes on the day. It recommends more awareness training. It does not mention that the quench tank next to the sealed-quench furnace has no high-temperature oil alarm, that the furnace door interlock was bypassed with a wedge two years ago, or that the only person who knows how to shut the endothermic gas generator down in an emergency works the day shift.
That report is what most plants get, because that is what most plants ask for: a walk-through against a checklist, scored, with a certificate at the end for the customer file. It satisfies the customer, it satisfies the certification body and it leaves the three things that could kill someone exactly where they were.
A safety audit is a structured search for the ways this particular plant can hurt people, and a judgement on whether the controls in place are enough. The checklist is a tool for that search, not a substitute for it.
The legal basis in India
The ground shifted recently. The Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025 and its Central Rules were notified on 8 May 2026, replacing the Factories Act, 1948 and twelve other statutes. States are now notifying their own rules under the Code; Andhra Pradesh did so in August 2026 and others are following. Until a state's rules are out, the practical position in that state is that the old state factory rules continue to be read alongside the Code.
For safety audits the practical effect is continuity more than change. Under the Factories Act, section 7A placed a general duty on the occupier for the health and safety of workers, and the state rules made periodic safety audits mandatory for factories carrying on hazardous processes under the First Schedule; the Gujarat Factories Rules, for example, required a safety audit by a competent person at a fixed interval, with the report filed with the Factory Inspectorate. The Code carries the general duty across, keeps the hazardous-process concept, keeps safety officers and safety committees above the thresholds, and adds a free annual health check for prescribed classes of workers. A heat-treatment shop running controlled-atmosphere furnaces with endothermic or ammonia-based gases, or a plating shop with cyanide or chromic acid, has been a hazardous-process factory throughout and remains one.
The standard for the audit itself is IS 14489:1998, Code of Practice on Occupational Safety and Health Audit, from the Bureau of Indian Standards. It sets out the scope, the auditor's qualifications, the elements to cover and the report format, and it is what a competent person's report is expected to follow. A customer or an insurer asking for a safety audit in India usually means an IS 14489 audit, whether or not they know the number.
Check your own state's current rules before quoting an interval or a form to a client; the numbers in the old factory rules are the ones being rewritten this year.
Three audits that share a name
When a plant says it needs a safety audit it usually means one of three things, and the mismatch between what was bought and what was needed explains most useless reports.
A compliance audit checks the plant against the law and the licence: the Code and state rules, the factory licence conditions, the pressure vessel and lifting tackle certificates, the electrical inspectorate approval, the fire NOC, the hazardous-waste authorisation. It is a documents-and-inspection exercise and it is what the Inspectorate, the insurer and most customers actually want. It will not find the wedged interlock unless the auditor walks past it.
A management-system audit checks whether the plant has a working safety management system, usually against ISO 45001: policy, hazard identification, legal register, objectives, competence, operational control, emergency preparedness, incident investigation, management review. It is the certification-body audit. It is good at finding that the system is not being run, and poor at finding a specific technical hazard, because the auditor samples the system rather than inspecting the process.
A process or technical safety audit takes one process, or one hazard, and examines it in depth: the furnace and its gas system, the quench, the generator, the gas storage, the electrical installation, the material handling. It uses the hazard-study methods, a HAZOP or a what-if for the gas system, a machinery risk assessment for the presses, and it asks whether the engineered safeguards exist, work and are maintained. It is the audit that finds the three things in the opening paragraph, and it is the one almost nobody commissions.
A hazardous-process factory needs all three, but not in equal measure and not from the same person. The compliance audit is annual and cheap. The system audit is the certification cycle. The technical audit is where the risk is, and a plant that has never had one on its furnace gas system is running on luck.
How a good audit is run
Scope by hazard before you scope by area. Before the visit, list the ways this plant can cause a fatality or a major injury: fire and explosion from furnace atmospheres and gas storage, burns and scalds from quench and molten salt, crushing from presses and material handling, electrocution from the installation, asphyxiation in pits and generators, chemical exposure in cleaning and plating. Rank them. The audit day goes to the top of that list first, and the fire extinguishers get checked on the way past.
Read before you walk. The previous audit report and the status of its actions, the incident and near-miss register for two years, the maintenance records for safety-critical equipment, the permit-to-work records, the training matrix, the emergency plan, the legal register. An incident register with nothing in it for two years in a plant of a hundred people is itself a finding: near misses are not being reported.
Walk the process, not the building. Take the sealed-quench furnace line from the gas generator to the washing machine. At the generator: the gas detection, its calibration record, the ventilation, the shutdown procedure and who can perform it on each shift. At the furnace: the door interlocks, the flame curtain, the purge sequence, the over-temperature trip, the atmosphere alarm, and whether any of them have been bypassed, which you find by looking, not by asking. At the quench: the oil temperature alarm, the fire suppression, the lid, the oil level. At the salt bath, if there is one: the hood, the shielding, the handling of wet parts. Then the electrical room, the compressed air, the lifting gear, and the pits.
Talk to the night shift. The audit happens by day; most incidents do not. Ask the operator what he would do if the atmosphere alarm sounded at two in the morning, and whether he has ever seen it sound. Ask the fitter which interlock he last reset. Ask the contractor's man where the assembly point is. The answers tell you whether the emergency plan is a document or a practice.
Finish with a full tour against the checklist, so the compliance items are covered and the report can be filed, but do it last.
Findings that matter
The hierarchy of controls is the test for every finding and every recommendation. Eliminate the hazard; substitute something less dangerous; engineer a safeguard that works whether or not anyone remembers; put in an administrative control such as a procedure, a permit or training; and only then rely on personal protective equipment. The further down the list a control sits, the more it depends on a human doing the right thing at the right moment, and humans on the night shift at the end of twelve hours do not.
That is why 'PPE not worn' is a weak finding and 'more training' is a weak recommendation. Both sit at the bottom of the hierarchy. A report with twenty findings about helmets and gloves and none about interlocks and alarms has audited the workers and not the plant.
A strong finding names a hazard, the control that should be there, the state it was found in, and the consequence if it fails. 'Furnace 3 door interlock bypassed with a mechanical wedge; furnace can be opened with the atmosphere live; the flame curtain was observed not to light on two door openings; consequence is a flash fire at the door with the operator in front of it.' The report should grade findings by consequence and by how far down the hierarchy the current control sits, and the top five should be on the first page, not in an annex.
The weakest reports score the plant. A percentage lets an 87 hide a bypassed interlock. Report the findings, grade them, and leave the arithmetic out.
After the audit
The closing meeting is with the occupier or plant head, not the safety officer alone, because the actions that matter cost money and the safety officer cannot authorise them. Read the top findings aloud with the consequence attached, and agree on the spot what is to be done tonight: a bypassed interlock is restored before the shift ends, not scheduled for the next shutdown.
The action plan that comes back should have an owner by name, a date, and an action that moves the control up the hierarchy. 'Operators to be retrained on interlock use' is not a closure for a bypassed interlock; 'interlock restored, bypass made impossible by relocating the switch inside the panel, verified by the auditor on a return visit' is. Verify closures by seeing them. A photograph is better than a letter; a visit is better than a photograph.
Re-audit on risk and on change. A finding on the gas system gets a follow-up within the quarter, scoped to the gas system only. A new furnace, a new process, a new gas, a change of layout or a serious incident each triggers a fresh technical audit of that part before it runs, whatever the calendar says. The annual compliance audit continues regardless, and the ISO 45001 cycle runs on its own clock. Three audits, three rhythms, and the technical one is the only one that should never wait for its turn.
Sources
- Taxmann, OSH Code 2020 complete guide and Central Rules 2026
- Taxmann, Government notifies 21 November 2025 for enforcement of the OSH Code
- TeamLease RegTech, Andhra Pradesh OSH Rules 2026
The extinguisher count is not wrong; it is just not the audit. The audit is the search for the things in this plant that can kill someone, the honest judgement of whether the controls against them would hold at two in the morning, and the pressure to move those controls from a procedure to a piece of hardware. Everything else in the report is there so the file is complete. Make sure the first page is the other thing.
