Insights
COR Audit Preparation Checklist: 12 Months to Audit Day
COR audit preparation is not a sprint in the final weeks before the auditor arrives. It is a 12-month process of building documentation, generating field records, and keeping the program current. This checklist breaks the preparation down by timeframe -- from booking the auditor to closing corrective actions after the report arrives.
Published 13 May 2026 · The On-Track Team
7 min readKey Takeaways
- Book your COR auditor 12 months in advance -- experienced auditors in construction and energy fill their calendars early.
- The 90-day mark is critical: documentation should be complete, training records current, and field records generating.
- Auditors test whether workers can describe the safety program out loud -- not just whether it exists on paper.
- JHSC meeting minutes, inspection logs, and formal hazard assessments are among the most commonly cited gaps.
- A pre-audit gap review 60 to 90 days out identifies correctable weaknesses before the official score is on record.
- Corrective actions after the audit must address root causes, not just produce new paperwork.
1. Book your auditor and scope the engagement
- Select your certifying partner (if not already established)
- Book an external auditor -- experienced auditors fill calendars early
- Confirm the audit scope: single province or multi-province, number of sites, number of workers in the sample
- Request the certifying partner's current audit tool and scoring guide
- Run a high-level gap review against the audit elements: policy, hazard assessment, SWPs, training, inspections, investigations, emergency response, records, and program review
- Identify the elements with the weakest documentation and schedule work to address them
Note: Most experienced COR auditors book 12 or more months in advance in construction and energy sectors. Waiting until 6 months out means choosing from whoever is available.
2. Build or update the safety program documentation
- Complete a formal gap analysis against each audit element
- Update or build the OHS policy (signed, dated, current)
- Review and update all hazard identification and assessment documents for the current scope of work
- Update safe work practices and procedures for all significant hazards and work tasks
- Confirm training matrix is current for all workers: what training is required, what is complete, what expires before the audit
- Update the emergency response plan for current site locations
- Confirm the inspection program is active and producing records
- Confirm the incident investigation procedure matches the current regulatory requirements
Note: Documentation that has not been touched in 2+ years is a red flag in an audit. Auditors look at document review dates as evidence the program is actively maintained.
3. Generate the the auditor will review field records
- Complete at least 3 months of documented site inspections at a frequency that matches your safety program
- Ensure all workers have current training sign-offs in their records (certificates, course completions, orientation sign-offs)
- Complete at least one toolbox talk per week, documented with attendance
- Complete all documented pre-task hazard assessments (FHAs or equivalent) for significant work tasks
- Confirm JHSC (Joint Health and Safety Committee) or health and safety representative documentation is current if required
- Address any corrective actions from previous inspections -- open CARs on audit day reduce scores
- Update the worker sample list for the auditor's review
Note: The single biggest predictor of a passing score is the volume and quality of field records from the 90 days before the audit. Policy without records does not pass.
4. Finalise documentation and brief the team
- Final review of all documentation for completeness and consistency
- Ensure all training records are collected and organised by worker
- Confirm all open corrective actions from inspections and previous audits are closed or documented with a plan
- Brief supervisors and worker representatives on what to expect during the audit
- Confirm the audit schedule with the auditor: site visit dates, documentation review logistics, worker interview arrangements
- Prepare a document index so the auditor can navigate the program without hunting
- Confirm insurance certificates and WCB clearance letters are current
Note: Workers who are surprised by an audit perform poorly in interviews not because they do not know the program, but because they have not thought about it recently. A brief pre-audit talk with the crew makes a measurable difference.
5. Support the auditor and make the records accessible
- Provide the auditor with a quiet space to review documentation
- Make the document index available at the start of the review
- Designate a single point of contact to answer auditor questions and locate records
- Ensure workers selected for interviews are available and informed
- For site visits, arrange safe access and PPE consistent with what the safety program prescribes
- Do not coach workers on answers -- auditors score authenticity, not recitation
- Record any verbal feedback the auditor offers during the audit: it often signals where the formal report will identify gaps
Note: The auditor's job is to evaluate the program as it actually exists, not as it should exist. Attempting to fill gaps during audit week by creating records backfires. The preparation window is in the months before, not the days before.
6. Close corrective actions and maintain the cycle
- Review the corrective action report in detail when received
- Assign owners and due dates for every corrective action
- Respond to the certifying partner by the deadline with the corrective action plan
- Complete and document all corrective actions within the agreed timeline
- Book internal auditor training if not already completed (for years 2 and 3 maintenance audits)
- Set calendar reminders for the year 2 and year 3 maintenance audit windows
- Set a reminder to book the recertification auditor 12 months before year 3 is due
Note: Corrective actions that are not addressed or are addressed without documentation will resurface in the next audit. The cycle of audit, correct, maintain, and re-audit is what builds a safety program that improves over time.
The worker interview element catches most first-time failures
7. Keep certifications current
One of the most consistent contributors to low training element scores is expired worker certifications discovered during the audit. A worker whose First Aid certificate expired three months ago, or whose forklift certification lapsed over the winter, creates a gap in the training matrix that the auditor will flag.
The Worker Cert Tracker feature in the Compliance Portal monitors expiry dates for every certification in the training matrix and sends alerts at 90, 60, 30, and 14 days before expiry. No more spreadsheet audits to find the gaps before the auditor does.
Worker Cert Tracker - your roster, your renewal calendar
90, 60, 30, and 14-day expiry alerts. Sample roster shown.
- 1 critical
- 1 renew soon
- 2 schedule
- 0days
S. Tremblay - Roofing Lead
Working at Heights
CriticalAuto-emailed at 14d
- 0days
J. Khalil - Site Foreman
First Aid Level 1
Renew soonAuto-emailed at 14d
- 0days
M. Okonkwo - Welder
WHMIS 2018
ScheduleAuto-emailed at 14d
- 0days
R. Singh - Equipment Op
Forklift
ScheduleAuto-emailed at 14d
- 0days
K. Beaupre - Pipeline Crew
H2S Alive
OKAuto-emailed at 14d
- 0days
A. Hernandez - Excavator Op
Ground Disturbance 201
OKAuto-emailed at 14d
Cert tracking with 90, 60, 30, and 14-day alerts is included from the Foundation tier. OCR-extracted certificate data, worker self-service, and the audit-prep workspace map are unlocked at Compliance tier and above.
A clean training matrix with no expired certifications on audit day is a reliable source of high element scores. Getting there requires visibility into what expires when -- weeks before the expiry, not the day before.
Our Services
Ready to start your COR audit preparation?
The audit team is ACSA and ESC certified with 17 years on the ground. We handle gap reviews, documentation builds, and the external audit.
See COR audit details8. Frequently asked
How long does it take to prepare for a COR audit from scratch?
Starting from scratch -- no safety program in place -- a realistic timeline is 6 to 12 months from decision to audit-ready. This allows 2 to 3 months to build documentation, 3 to 6 months to implement the program and generate field records, and 30 days for final preparation. Companies with a partially complete safety program can compress this timeline if the existing documentation is current and the record-keeping has been active.
What documents does a COR auditor typically ask for?
A COR auditor will typically request: the OHS policy (signed and dated), the hazard identification and assessment register, safe work practices and procedures for significant hazards, training records for all workers in the sample, completed inspection reports from the past 3 months, toolbox talk records, incident investigation reports for any incidents in the review period, the emergency response plan, JHSC meeting minutes (if applicable), and corrective action logs. The specific document list depends on the certifying partner's protocol.
What is the most common reason companies fail a COR audit?
The most common reason for element scores below 50% -- the threshold that fails the audit regardless of the overall score -- is a gap between what the safety program documents describe and what the auditor can verify with records. Written policies and procedures that are not supported by inspection logs, training records, and incident documentation score below 50% on the evidence criteria. The program must be implemented and documented, not just written.
Can a company re-audit if they fail a COR audit?
Yes. If an initial certification or recertification audit scores below the pass threshold (80% overall or below 50% in any element), the company can re-audit after addressing the identified gaps. The certifying partner typically specifies a re-audit window, often within 6 months. On a maintenance audit (year 2 or 3 internal audit), a failed result may require a corrective action plan and a re-audit before the certificate is renewed.
Do I need to be present during the entire COR audit?
An owner or senior manager typically needs to be available for the opening and closing meetings and for any questions the auditor has during documentation review. Worker interviews and site visits may proceed without constant management presence -- auditors often prefer to conduct worker interviews without management present to get more candid responses. Designating a single knowledgeable contact person to support the auditor throughout the audit week is the standard approach.
What is the difference between a maintenance audit and a recertification audit?
A maintenance audit in years 2 and 3 of the COR cycle can be an internal audit, conducted by a company employee trained by the certifying partner. It uses the same scoring protocol as an external audit but is not reviewed by an accredited third-party auditor. A recertification audit at the end of year 3 is always external. The recertification audit determines whether the certificate is renewed for another three-year cycle.