01 Audit Program

The audit program is how the department finds out whether its safety management system works, rather than whether it exists on paper. It sets out what is checked, against what, how often, by whom, how the result is scored, what happens to a finding, and how the audit program itself is held to account.

It answers four questions the fire chief, the JOHSC and the regulator will each ask in their own words:

1. Is every element of the written program in place, and does it meet the law and the standards the department has adopted?
2. Is it practised everywhere, on every platoon and at every volunteer station, and can the people who do the work describe it?
3. Is it working, measured by the department’s own indicators, not by the absence of a bad year?
4. When it is not, who fixes it, by when, and who checks?

The applicable occupational health and safety statute sets when a written OHS program is required and what it must contain, which can include provision for monitoring the program’s own implementation and effectiveness (J03 OHS Policy and Program). NFPA 1550 expects the department to evaluate the effectiveness of its occupational safety, health and wellness program on a fixed cycle, and its annex guidance describes an internal audit at least annually with an external audit every three years (NFPA 1550, 2024, ch. 6 and Annex H). ISO 45001 requires internal audits at planned intervals, with auditors selected for objectivity and impartiality, and results reported to management and to workers and their representatives (ISO 45001:2018, cl. 9.2). This program satisfies all three in one cycle.

• Audit: a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled (ISO 19011:2026, cl. 3).
• Audit criteria: the policies, procedures, legal requirements and standards against which evidence is compared (ISO 19011:2026, cl. 3).
• Audit evidence: records, statements of fact or other verifiable information relevant to the criteria (ISO 19011:2026, cl. 3).
• Finding: the result of evaluating evidence against criteria: conformity, nonconformity, opportunity for improvement or good practice (ISO 19011:2026, cl. 6.4.8).
• Nonconformity: non-fulfilment of a requirement; graded major or minor in this program (section 6).
• Priority: the rating every nonconformity and opportunity for improvement receives on the department’s one scale, P1 (Imminent), P2 (Serious), P3 (Moderate) or P4 (Improvement), which sets the interim control, the plan and closure due dates, and the extension and escalation rules (section 6; Corrective Action Register).
• Corrective action: action to eliminate the cause of a nonconformity and prevent recurrence (ISO 45001:2018, cl. 10.2).
• Spot-audit: this program’s quarterly in-depth audit of one checklist category.
• Effectiveness index: the weighted roll-up of the effectiveness dimension across items (section 5.5).
• Maturity band: the label the effectiveness index maps to (section 5.6).
• Legislated item: a checklist item flagged L because it discharges a duty under the applicable statute or regulations; must score at least 2.
• Peer assessor: a trained auditor from another department who assesses under a reciprocal arrangement.
• Psychological safety: the shared belief that it is safe to speak up, ask, admit error and challenge, created by leaders’ behaviour and the response to reports (Edmondson, 1999)DOI.

The audit is built on the same four principles as every policy in the package, and it scores them:

1. People are the solution we build around, not the problem to fix. The audit looks for the conditions that make work go right (staffing, time, equipment, training, margins) before it looks for the person who deviated. A finding names a condition and an owner, never a member.
2. Procedures describe work as done, written with the people who do it. Where observation shows a gap between the procedure and the practice, the auditor’s first hypothesis is that the procedure is wrong. The finding goes to the program team’s learning-team method, not to enforcement.
3. Learning comes before blame, and learning information is never used for discipline. Interview notes are confidential and destroyed after the report is accepted. Nothing said to an auditor is the basis for discipline. Learning-team write-ups and near-miss reports are read by the auditor for what they show about the system, and the audit scores whether the department protects them.
4. Psychological safety is a condition of safety, so speaking up is expected and protected. Every interview in every category ends with the same two questions: “If you saw something unsafe tomorrow, who would you tell, and what would happen?” and “Have you raised a concern in the last year, and did you get an answer?” The answers are scored as effectiveness evidence for the category and rolled up in the report as the department’s psychological-safety measure. A department whose members cannot answer the first question specifically has a major finding in category 1, whatever its documents say.

The audit itself has to live by these. An auditor who arrives to catch people out will be told what they want to hear, and the report will be worth nothing.

The audit covers the whole department as an employer sub-unit of {{Municipality}}:

• every station, career and volunteer, including shared or leased premises;
• training grounds, props and burn buildings;
• fleet maintenance areas the department operates, and the service-level agreement where fleet is corporate;
• dispatch and communications where the department operates them;
• all emergency operations, training evolutions and non-emergency work (public education, inspections, station duties);
• contractors working on department sites and mutual aid operations under the department’s command;
• every program module switched on in 01 Program Profile Worksheet. Modules switched off are recorded as not applicable with the reason, and the reason is itself audited (dispatch data is checked for responses to the hazard the department says it does not face).

Four layers, each feeding the one above it. A department at Stage 1 runs the first two; Stage 2 adds the third; Stage 3 adds the fourth.

Three triggers add an audit outside the cycle:

• Post-event audit. After a line-of-duty death, a serious injury (as the applicable OHS law defines it for reporting to the regulator; J08 Incident Reporting and Investigation), a mayday, a structural collapse with members inside, an SCBA failure in an IDLH atmosphere, a vehicle collision with injury, or a near miss graded high potential by the learning program. The audit covers the categories the event touches and is run within 60 days by someone independent of the event and of the investigation.
• Regulator order or external finding. Any order, direction or external nonconformity triggers a spot-audit of the affected category within 30 days of closure to confirm the fix held.
• Significant change. A new station, a new service, a merger with another department, or a change in law. The Gap Assessment is re-run for the affected modules (02 Gap Assessment Tool) and the next spot-audit cycle starts with them.

Audit criteria are the reference against which evidence is judged (ISO 19011:2026, cl. 3). The criteria register below is kept current by the safety division and its version is recorded on every audit plan.

Every checklist item that answers a CFAI performance indicator carries the indicator number in its CFAI column, so an accredited agency can lift the audit working papers straight into its self-assessment exhibits. Core competencies (CC) are marked; the package treats every Category 11 indicator as mandatory whether or not it is a core competency. Intent is paraphrased; the manual’s wording is not reproduced (CPSE, 2019).

Where criteria conflict, the strictest applies unless the department has recorded a documented, risk-assessed reason in the program module. The auditor confirms each clause number against the current edition before relying on it.

Every checklist item is scored on three dimensions. The auditor records all three; they tell different stories and are rolled up separately.

The item score is the canonical 0 to 3 ladder every checklist uses (02 Audit Checklist Master Index section 5). It is derived from the three dimensions, not chosen separately:

A practice that is done well but not written down scores I at 2 or 3 and D at 0 or 1; its item score is 2 at best, and the finding says “document what you do”. This is deliberate: an unwritten control dies with the person who carries it.

Each item carries an evidence code saying what kind of evidence can support it:

Codes joined by a plus sign (D+I, D+O, O+I, D+O+I) mean both required: the item cannot score above 1 on implementation unless each listed type of evidence was collected and supports it. The rule exists because a document plus a convincing manager is the commonest way a dead element passes an audit. The both-required flag and the majority-of-interviews rule follow the convention used in Canadian COR audit instruments (CFCSA, 2021; CSNS, 2023). Interview evidence supports an item when a majority of the people interviewed on it give a positive, specific answer; “I think so” is not positive.

Items that discharge a legal duty also carry the flag L. A legislated item must score at least 2 as an item score for the category to pass, whatever the category percentage. This is a softened form of the Ontario COR rule that legislated items score 100 per cent (IHSA, 2017): the package requires the duty to be implemented, and lets the effectiveness evidence mature.

For each category:

• Category score (per cent) = sum over items of (weight x item score) divided by sum over items of (weight x 3), x 100. Items marked not applicable, with a reason recorded, are removed from both sums.
• Effectiveness index (per cent) = sum of (weight x E) divided by sum of (weight x 3), x 100.
• Documentation index (per cent) = the same calculation on D. Reported for Stage 1 departments, where it shows how far the writing has got.
• Legislated floor test: every L item has an item score of at least 2. Pass or fail.

For the program:

• Program score = the same weighted calculation across all applicable items in all categories. It is reported alongside the 20 category scores, never on its own.
• Pass = program score at least 80 per cent and every category at least 50 per cent and every legislated floor test passed and no open major nonconformity at the close of the corrective action window. The thresholds are the COR national convention of 80 per cent overall and 50 per cent per element (CFCSA, 2021), chosen so a department can walk into a COR audit or a compensation board’s certification audit without re-scoring.
• Program effectiveness index = the weighted effectiveness calculation across all items.

The effectiveness index, not the program score, places the department on the maturity ladder. A department can be fully compliant and not yet effective; the two numbers are reported side by side so that is visible.

The bands borrow the shape of the five-rung culture ladder (Westrum, 2004DOI; Hudson, 2007DOI); the labels are the package’s own so they do not collide with any department’s existing culture survey. The culture survey in 05 Safety Culture Baseline is reported next to the band, and a wide gap between the two is itself a finding.

Each scored item carries four short fields, borrowed from the CFAI self-assessment model (CPSE, 2019), so the auditee’s own narrative and the auditor’s judgment sit together: Description (what the department does), Appraisal (how well, with the data), Plan (what will change, with owner and date), References (the exhibits examined). The checklist tables carry the score columns; the answer template is completed in the audit working papers for every item scored below 3 and for every item sampled for verification.

Every finding takes a grade, which says what kind of finding it is, and every finding that needs action also takes a priority on the department’s one scale, which sets its clocks. It is the same scale the Corrective Action Register applies to every deficiency, whatever its source (inspection, audit, investigation, near miss, JOHSC recommendation, program team, regulator order), so an audit finding and an inspection finding of the same seriousness are handled the same way.

The priority sets the interim control and the due dates:

A P1 condition seen during fieldwork is not held for the closing meeting: the auditor tells the officer in charge at once, and the interim control is applied the same shift. An opportunity for improvement the department decides not to adopt is cancelled in the register with the reason recorded, not left open.

ISO 19011 permits nonconformities to be graded but leaves the grades to the organization (ISO 19011:2026, cl. 6.4.8); the definitions above and the priority scale are this department’s. Every nonconformity and opportunity for improvement records the criterion, the evidence, the root cause as the auditee and auditor understand it, the owner, the priority and its due dates, and when the person who raised it was told the outcome. It goes into the Corrective Action Register within five working days of the closing meeting, or on the day it is found if it is P1. A finding without an owner is not a finding; it is a note.

1. Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based and risk-based approach (ISO 19011:2026, cl. 4).
2. This program: criteria, the scoring model, evidence codes, weights, grading, the register.
3. Interview technique: one-on-one, open questions, no leading, confidentiality, how to record a majority finding.
4. Observation: what to watch in an apparatus check, a decon cycle, a drill, a JOHSC meeting; how to avoid changing what is observed.
5. Sampling: how to draw a records sample, how to record its limits.
6. Fire service content: the hazard profile, the critical controls, the specialty modules switched on.
7. Report writing: the finding format, the answer template, the executive summary.
8. Conduct: the auditor is a guest in the station; the crew’s time is operational time; a call takes precedence over the interview, always.

Record: name of course, provider, date, and the audits the person has taken part in. Internal auditors refresh with a half day every three years and take part in at least one audit every two years to stay current. The department aims for a pool of four to six trained internal auditors across divisions, including at least one volunteer officer in a composite department, so no single absence stops the audit.

• Declare and record any conflict at the planning meeting: reporting line, program team membership, involvement in an event under review, personal relationship with an auditee.
• An auditor who identifies a conflict mid-audit hands that item to another team member and records the handover.
• No auditor scores an item on which they are also the owner of a corrective action.
• The lead auditor’s independence is confirmed in writing by the fire chief on the audit plan.
• Interview notes are confidential to the audit team and destroyed after the report is accepted; the report records the number interviewed by group, never who said what.

The audit cannot look at everything. The sampling plan is written into the audit plan, and its limits are stated in the report, as ISO 19011 expects of judgement-based sampling (ISO 19011:2026, Annex A). The interview table below follows the practice of Canadian COR instruments of scaling one-on-one interviews to headcount (IHSA, 2017).

The question bank for interviews and observation prompts sits in each checklist note under “Interview and observation prompts”; the Index carries the combined list.

How to interview. One person, one auditor, a quiet room or a cab, 15 to 20 minutes, no supervisor present. Open with what the audit is and is not (it is not an investigation and nothing said is attributed). Ask open questions from the bank (“Walk me through what you do with your gear after a working fire”), then probe (“Where does the bagged gear go on the tanker?”). Score each question positive, negative or unclear on the sheet. Finish by asking what the member would fix first if they ran the department, and record it: that answer is the best single source of opportunities for improvement in any audit.

How to observe. Tell the officer what you will watch and why. Watch the whole task. Record what was done, not what was said about it. Where the task differs from the procedure, ask the crew afterwards why, without judgment; the gap is usually a procedure problem, and the learning team (06 Program Improvement Teams section 5) is the place it goes.

Volume. Per category in the annual audit: at least three interviews and one observation. Per spot-audit: three to five interviews and one observation. Items with code I or an I combination cannot be scored without them.

The two standing questions. Every interview, whatever the category, ends with the two psychological-safety questions in section 1a. The sheet records a positive answer only when the member names a specific person or route and describes a specific response. The report gives the proportion positive, by group (career, volunteer, officer, member), as the department’s psychological-safety measure, next to the near-miss and good-catch reporting rate and the stop-work calls recorded and reviewed without reprisal. These three figures also appear in the monthly indicator report (03 Accountability and Reporting).

Completed for every spot-audit and annual audit on Form - Audit Plan and Report Template. Fields:

The auditee receives the plan at least 15 working days before the opening meeting for the annual audit and five working days for a spot-audit. A post-event audit may proceed on 48 hours’ notice.

Issued within 15 working days of the closing meeting on Form - Audit Plan and Report Template. Contents:

1. Executive summary (one page): program score and pass or fail; category profile (20 scores in a table); effectiveness index and maturity band; number of findings by grade; the three things the department should fix first; the three things it does best. Written so a council member can read it.
2. Three-pillar view: a paragraph each on whether the system makes the department effective (controls work), efficient (effort goes where the risk is) and good for its people (participation, culture, wellness). The framing follows the UK fire and rescue inspectorate’s three pillars (HMICFRS, 2025); it keeps the report from reading as a list.
3. Scope, criteria, team, method, sampling and its limits.
4. Category results: for each category, score, effectiveness, legislated floor result, findings, good practice, trend against the last audit.
5. Findings register: each finding with reference, grade, category, item, criterion, evidence, root cause, owner, plan due, closure due.
6. Status of prior findings: closed with evidence, open, overdue.
7. Conclusion: the auditor’s overall judgment and the recommended priorities for the management review.
8. Appendices: interview counts by group; observations completed; documents examined; the completed category score sheets.

Distribution: fire chief; senior officer responsible for H&S; HSO; deputy chiefs; program managers for their categories; both JOHSC co-chairs; the municipality’s chief administrative officer or corporate safety function; union and volunteer association representatives. ISO 45001 requires audit results to be reported to workers and their representatives (ISO 45001:2018, cl. 9.2.2); the JOHSC posting satisfies this. The full report goes to the JOHSC; a member-facing summary goes to every station within 30 days.

Every nonconformity and opportunity for improvement enters the Corrective Action Register within five working days of the closing meeting (a P1 on the day it is found), with the audit reference as its source, its priority from section 6, and the plan and closure due dates that priority sets. The register, not the audit report, is the live record; extensions and escalation follow the priority scale. The auditor’s role ends when the report is accepted; verification of closure is done by the HSO for minor findings and by an internal auditor other than the finding’s author for major findings, with evidence, and an effectiveness check follows closure (register rules). The management review receives the open-item age profile and the closure rate.

The committee is a named actor in this program, not an audience. The applicable OHS statute sets the committee’s functions, which can include auditing compliance with health and safety requirements in the workplace and participating in inspections and investigations (J05 Joint Committee and Health and Safety Representative); this program gives those functions a method.

• A JOHSC member joins each station’s inspection at least annually, and the committee reviews the monthly inspection completion rate every meeting.
• A JOHSC worker member and an employer member are briefed on the annual audit plan and may attend the opening and closing meetings.
• The committee receives the full audit report, the category profile and the findings register; it records its comments in the minutes and may make a recommendation on any finding.
• A JOHSC worker member is interviewed in every annual audit; the committee’s own effectiveness is a checklist category (Checklist - Worker Participation and JOHSC).
• The committee reviews the overdue corrective action report at every meeting (Corrective Action Register).
• A JOHSC member is invited to train as an internal auditor; a committee that has an auditor on it reads reports differently.

Default for an April to March fiscal year; shift by the same offset for another year end (04 Annual Program Cycle and Calendar).

Every month: station inspections; register review at the JOHSC meeting; overdue report.

Loop test. The January audit finds that a volunteer station’s SCBA have no record of annual flow testing. The finding is graded major and rated P1 (Imminent): a breathing apparatus whose test cannot be shown is a critical control that may have failed. The same shift, the units are tagged out of service and swapped for tested units from the reserve, and the fire chief and the JOHSC co-chairs are told within 24 hours. The same day the finding is in the register with the respiratory protection program manager as owner. Within two working days the plan is written: the untested units flow tested, every station’s test records reconciled against the SCBA inventory, the test schedule rebuilt, the gap explained to the JOHSC. Within seven days the untested units are tested or stay out of service; because the reconciliation covers every station, the fire chief extends the closure once, to 30 days, with the interim control kept in place. By then every unit has a current test record, an internal auditor who did not write the finding has checked the records against the units, and the closure is reported to the JOHSC and the fire chief. Six months later the HSO checks that the schedule held through the next test cycle. The station’s volunteer members hear what was found and what was fixed from their officer at the next training night, not from a report.

Audit program review questions (section 16 verifier, asked annually):

1. Did the audit cover every category, every career station and the volunteer station sample?
2. Did the auditors meet the competence and independence rules, and were conflicts recorded?
3. How many auditor days did it take, and was the time proportionate to the risk?
4. What did events in the year (injuries, near misses, regulator contacts) show that the audit missed, and why?
5. What proportion of findings were closed on time, and did effectiveness checks confirm the fixes held?
6. Did the JOHSC and the members get the report in the time set?
7. What should change in the plan, the checklist, the sampling or the auditor pool next year?

This chapter relies on the following legal requirements, which differ by province and territory. Check your jurisdiction’s section on each topic page before adopting it.

Alberta Municipal Health and Safety Association [AMHSA]. (n.d.). Certificate of Recognition (COR) program [Web page]. http://www.amhsa.net/cor/

BC Municipal Safety Association [BCMSA]. (n.d.). Certificate of Recognition (COR) program [Web page]. https://www.bcmsa.ca/cor/