The enterprise should have its OSHMS audited regularly to confirm it is implemented and maintained, that it works, and where it is weak. Audits are broader than inspections: the auditor reviews policies, procedures, plans and records, interviews a sample of people from each level with open questions, observes work to check that records match practice, and holds a closing session on urgent problems, findings and strengths and weaknesses. The programme should ideally combine internal audits by in-house staff and external audits by someone with no day-to-day involvement. Planning covers date and notification, pre-audit information on hazards and controls, layout and process flow, previous reports, an audit plan and checklists. The report contains an executive summary, the background and scope, an overall evaluation, the findings with recommendations and conclusions, and an action plan; the Annex 8 self-assessment checklist supports it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.