Guides ·
Closing safety audit findings in a CMMS: turning audit recommendations into tracked corrective work orders
A safety audit makes a plant safer only when each recommendation is closed with evidence. This guide sets out what IS 14489:2018, OSHA's process safety rule and ISO 45001 expect after an audit, a seven-step loop from finding to closed corrective work order, and what a CMMS record should hold for each finding.
By Upvantix team
A safety audit is finished on paper when the report is issued. The plant is safer only when each recommendation has a corrective action with an owner, a target date, the work done, evidence attached and closure verified.
In India, the code of practice IS 14489:2018 puts that duty on the audited unit: an action plan with a department and time limit for each recommendation, documented reasons for any not implemented, and monitored status. Statutory and legal recommendations are to be fully implemented.
In the US, OSHA's process safety management rule (29 CFR 1910.119) requires employers to "promptly determine and document an appropriate response to each of the findings" of a compliance audit, and to "document that deficiencies have been corrected".
Most physical findings (guards, relief valves, earthing, instruments, leaks) are maintenance work. Raising each one as a corrective work order on the right asset in the computerized maintenance management system (CMMS) gives you the owner, the due date, the evidence and a closure history an auditor can follow.
Why audit findings stay open
In mid-October 2026, a blast at SynZeal Pharmachem in Bharuch, Gujarat, during a hydrogenation process killed five workers and injured five, as reported by ETChemicals; a multi-agency probe is under way and its findings are pending.
Whatever the regime, findings stay open for the same practical reasons:
- The findings live in a PDF or a spreadsheet, separate from the system where work is planned.
- No owner is named for each recommendation.
- Target dates slip because nobody reviews them.
- Items are marked "closed" without evidence of the work.
- The same finding appears again at the next audit.
What the standards expect after the audit
IS 14489:2018 in India
IS 14489:2018, Occupational Health and Safety Audit — Code of Practice, is published by the Bureau of Indian Standards (BIS). It is active and was reaffirmed in 2023. Its follow-up clause is direct: "The auditee is responsible for determining and initiating corrective action on audit recommendations."
Follow-up then means:
- Prepare an action plan specifying action by the concerned departments and time limits for completion.
- Set each time limit by the importance and safety implications of the recommendation.
- Communicate the audit report to those who must act on it.
- Where no action is proposed on a recommendation, document the reasons for that decision.
- Develop a monitoring system and periodically assess implementation status.
- Use a follow-up audit, where needed, to review implementation.
A note in the standard adds that recommendations on compliance with statutory and legal requirements are to be fully implemented. The standard can also be used for self-demonstration of conformance to IS/ISO 45001.
OSHA process safety management in the US
For processes covered by OSHA's process safety management (PSM) rule, 29 CFR 1910.119, the compliance audit section requires employers to:
- Certify at least every three years that they have evaluated compliance with the rule.
- Have the audit conducted by at least one person knowledgeable in the process.
- Develop a report of the findings.
- Promptly determine and document a response to each finding, and document that deficiencies have been corrected.
- Keep the two most recent compliance audit reports.
The same rule asks employers to resolve process hazard analysis (PHA) recommendations "in a timely manner", document the resolution and develop a written schedule. Under its mechanical integrity section, equipment deficiencies outside acceptable limits must be corrected "before further use or in a safe and timely manner" when necessary means are taken to assure safe operation.
ISO 45001
ISO 45001:2018 specifies requirements for an occupational health and safety (OH&S) management system. It covers policy, objectives, planning, implementation, operation, auditing and review, including incident investigation and continual improvement, and a revision is planned as ISO 45001:2027.
Audit finding to work order: a 7-step loop
- Log each finding as its own record, linked to the audit report and to the asset or location.
- Classify it: statutory or legal, engineering, procedural, or training.
- Decide the action. Record whether you accept, modify or reject the recommendation, with the reason, as IS 14489 expects.
- Raise the corrective work order with an owner, a priority, a due date set by risk, the procedure, the parts and any permit needed. See our guides on permit-to-work for corrective jobs and lockout/tagout before work.
- Execute and capture evidence: photos, measurements, test results and parts used.
- Verify closure by someone other than the person who did the work, such as the EHS lead or area head.
- Review status monthly and before the next audit. Feed repeat findings into preventive maintenance schedules so they do not return.
Step 6 makes a closure credible: the doer's sign-off shows work happened; someone else's check shows the finding is resolved.
Not every finding is a work order
Findings about procedures, training, documentation or management systems usually belong in EHS, quality or HR processes, not the maintenance queue. Forcing them into the CMMS creates work orders maintenance cannot complete. Keep the link instead: the finding record shows the action is owned elsewhere, and any physical work it triggers runs as a work order.
Audits also differ from statutory inspections, which periodically examine specific equipment. For the equipment side, see our guides on statutory inspections of lifts, hoists and pressure vessels and boiler inspection records. Food plants should also see our guide to FSSAI audit records.
What a CMMS record should hold for each finding
This is a recommended structure, not a list from any standard.
| Field | What it holds |
|---|---|
| Finding ID and audit date | A unique reference and the date of the audit report |
| Source | Internal, statutory, insurer or customer audit |
| Asset or location | The equipment or area the finding applies to |
| Risk and priority | How serious the finding is, which sets the due date |
| Action and owner | The agreed corrective action and the person responsible |
| Due date | The time limit set in the action plan |
| Work order numbers | One or more corrective work orders raised for the finding |
| Evidence | Photos, measurements, test results and parts used |
| Verified by and date | Who confirmed closure, and when |
| Status | Open, in progress, awaiting verification, closed, or not implemented with the reason |
India: statutory safety audits for hazardous units
The Manufacture, Storage and Import of Hazardous Chemical (MSIHC) Rules, 1989 prescribe safety audits. As stated by the government in 2022, the Integrated Guidance Framework for Chemicals Safety from the Ministry of Environment, Forest and Climate Change (MoEFCC) and the Central Pollution Control Board (CPCB) guides units to conduct safety audits as per IS 14489:2018. According to the Press Information Bureau release:
- Only agencies accredited by the Ministry of Labour and Employment's accreditation board can undertake these safety audits.
- Where no such accreditation exists, agencies must have the approval of the Chief Inspector of Factories (CIF) appointed under the Factories Act, 1948.
- CIFs can issue an improvement notice under Rule 19 of the MSIHC Rules, including for failure in a safety audit, and ask units to comply within 45 days.
In Andhra Pradesh, as reported by Deccan Chronicle on 4 October 2026, the state has 1,339 hazardous units, including 116 major hazardous units. Audits are generally annual for major hazardous units and once in two years for hazardous units, and a new audit system with three-member expert teams is scheduled to start in November. As reported, the proposal followed a boiler-unit explosion at TIL Healthcare that killed five workers. It is a plan, not a notified rule.
For chemicals and process industries, a 45-day improvement notice is reason enough to track every finding against a due date from day one.
How Upvantix CMMS fits
Upvantix CMMS is designed to organise the asset register, schedule preventive maintenance and complete work orders with a connected history for every piece of equipment. It is designed for deployment in your AWS environment.
For findings that become maintenance work, the relevant parts are:
- Assets and equipment: asset register, equipment hierarchy, locations, documents and history.
- Work management: work requests, work orders, priorities and status, and completion records.
- Preventive maintenance: PM schedules, checklists and inspections, for repeat findings.
- Procedures and technical documents, plus procedures and checklists at the point of work; photos, notes and measurements; and parts and time capture.
The record stage captures findings, measurements, parts and completion on each job. AI assistance in Upvantix CMMS is designed to help find and prepare context, with human review required before operational action.
Upvantix CMMS is maintenance software, not an EHS or CAPA system. It tracks the maintenance work behind a finding; using it does not by itself make a plant compliant.
Talk to us about how your audit findings would map to assets and corrective work orders.
Common questions about closing safety audit findings
What should happen after a safety audit report is issued?
The audited unit should prepare an action plan. Under IS 14489:2018, that plan specifies the action each department will take and a time limit for each recommendation, set by its importance and safety implications. The report is communicated to those who must act, reasons are documented where no action is proposed, and implementation status is monitored periodically.
Who is responsible for closing safety audit recommendations?
The audited unit. IS 14489:2018 states that the auditee is responsible for determining and initiating corrective action on audit recommendations. The auditor recommends; the plant decides, acts and monitors. In practice, each recommendation should have a named owner in the department that will do the work, and a separate person who verifies closure.
Can a plant decide not to implement an audit recommendation?
Under IS 14489:2018, yes, for some recommendations, but the reasons for that decision should be documented. The standard also notes that recommendations on compliance with statutory and legal requirements are to be fully implemented. Record the decision, the reason and who approved it on the finding record, so the next auditor can see it.
What does OSHA require after a PSM compliance audit?
In the US, 29 CFR 1910.119 requires employers to develop a report of the audit findings, promptly determine and document an appropriate response to each finding, and document that deficiencies have been corrected. Compliance must be evaluated at least every three years by at least one person knowledgeable in the process, and the two most recent reports kept.
How do you prove an audit finding is closed?
Show the work and the check. Link each finding to the corrective work orders raised for it, attach evidence such as photos, measurements and test results, and record who verified closure and when. Verification should come from someone other than the person who did the work, such as the EHS lead or the area head.
Should every audit finding become a CMMS work order?
No. Findings about equipment and physical conditions, such as guards, relief valves, earthing, instruments and leaks, belong in the CMMS as corrective work orders. Procedural, training and documentation findings usually belong in EHS, quality or HR processes. Keep a link between the finding and its owner so nothing falls between the two systems.
Which Indian rules require safety audits for chemical units?
The MSIHC Rules, 1989 prescribe safety audits, as described by the Press Information Bureau in 2022, and the MoEFCC and CPCB framework guides units to conduct them as per IS 14489:2018. The audits are carried out by agencies accredited by the Ministry of Labour and Employment's board or approved by the Chief Inspector of Factories, and State Chief Inspectors of Factories can act on the findings. Andhra Pradesh, for example, generally audits major hazardous units annually and hazardous units once in two years, as reported.