Construction safety audits fall into two families. The first is classified by who performs the audit: first-party (internal), second-party (customer or main contractor) and third-party (independent). The second is classified by what is examined: compliance, management system, programme, activity-based and culture audits. In Singapore, one distinction outranks the rest. A worksite with a contract sum of S$30 million or more must engage an external, accredited auditor for a ConSASS audit every 6 months, while smaller worksites must carry out an internal review at the same interval.
TL;DR
- By auditor: first-party audits are internal, second-party audits are conducted by a client or main contractor on suppliers, and third-party audits are independent and underpin certification such as ISO 45001.
- By scope: compliance, management system, programme, activity-based and culture audits answer different questions and are often combined.
- Singapore rule: worksites of S$30 million or more need an SAC-accredited WSH Auditing Organisation to conduct a ConSASS audit every 6 months. Smaller worksites must conduct an internal SHMS review every 6 months.
- ConSASS scores maturity in bands, and it verifies through documents, interviews and physical inspection, not paperwork alone.
- Treat an audit as a test of the safety system, not a hunt for individual defects.
Table of Contents
- What a safety audit examines, and what an inspection does not
- Classification by auditor: first, second and third party
- Classification by scope: what the audit looks at
- The Singapore position: what is mandatory
- How a ConSASS audit works
- Choosing the right audit for your project
- Our perspective on audit practice
- How MOSAIC supports audit readiness
- FAQ
- Sources
What a safety audit examines, and what an inspection does not
An inspection looks at conditions: an unguarded edge, a damaged lifting gear tag, a blocked access route. An audit tests whether the management system that should prevent those conditions is functioning. NEBOSH distinguishes the two as complementary proactive reviews, with inspections generally anchored in the physical workplace and audits assessing wider systems and performance.
The practical consequence is that a site can pass an inspection on a good day and fail an audit. Missing training records, inconsistent enforcement of permit-to-work rules and unreviewed risk assessments rarely show up on a walk-round. IOSH notes that audits check whether safety systems are working effectively and protecting workers as intended, and an objective outsider tends to expose systemic gaps that internal teams stop noticing during daily operations.
Classification by auditor: first, second and third party
The most common taxonomy, used in management system auditing guidance, separates audits by the relationship between auditor and auditee. The European Agency for Safety and Health at Work lists the same family as internal, external, second-party and third-party audits.
| Type | Who conducts it | Typical construction use | Main value |
|---|---|---|---|
| First-party (internal) | Your own staff or a delegated team | Periodic SHMS review, pre-audit readiness check | Frequent, low cost, builds ownership |
| Second-party | A client, developer or main contractor auditing a subcontractor or supplier | Prequalification of subcontractors, tender conditions | Controls supply-chain risk |
| Third-party | An independent body with no commercial tie to the auditee | ConSASS audit, ISO 45001 certification, bizSAFE assessment | Credibility with regulators and clients |
Internal versus external: what actually differs
An internal audit is performed on the organisation’s own decision, for its own use. An external audit, whether second-party or third-party, is performed by someone outside it. The difference is not only independence. External audits follow a fixed protocol, produce a result that others can rely on, and cannot be softened by familiarity. Internal audits are better at frequency and at tracking corrective actions between external visits.
Third-party audits and certification
Certification audits are the best-known third-party form. The ISO 45001 standard specifies requirements for an occupational health and safety management system, and an independent audit against it gives clients and regulators justified confidence that the system meets the standard. Certification is often voluntary, yet it becomes a practical necessity when a public body or major developer makes it a condition of tendering.
Stage 1 versus stage 2 audits
Certification audits are normally conducted in two stages. Stage 1 is a documentation and readiness review: the auditor confirms that the management system is defined, that scope and policy are in place, and that the organisation is ready to be assessed. Stage 2 verifies implementation on the ground through interviews, records and observation of actual work, and it is where nonconformities are raised. Surveillance audits follow in later years. Treat these stages as the usual certification-body practice rather than a statutory Singapore requirement, and confirm the exact programme with your certification body.
Classification by scope: what the audit looks at
The same auditor can apply different lenses. Practitioners commonly distinguish the following.
- Compliance audits test conduct against legal and contractual requirements. In Singapore this means the Workplace Safety and Health framework administered by the Ministry of Manpower (MOM), together with specific requirements such as the SHMS obligation for construction worksites.
- Management system audits test a documented system, such as an ISO 45001 or ConSASS-aligned SHMS, for design and implementation.
- Programme audits examine a single programme, for example working at height, lifting operations or confined space entry.
- Activity-based audits observe a specific task or phase, such as formwork striking or excavation.
- Gap assessments compare current practice with a defined criterion before a formal audit. They are particularly useful before a first certification or before a ConSASS cycle. For example, a gap assessment against the ConSASS elements can show where the system is weakest before an external auditor arrives.
- Culture audits use surveys, interviews and observation to gauge attitudes and leadership behavior that formal checks miss.
Top-ranking guides vary on how many scope types exist (three, four or five), because the boundaries overlap. What matters is choosing the lens that matches the decision you need to make. If the question is whether you can legally continue to work, you need a compliance or ConSASS audit. If it is whether your system will win a tender, you need certification. If it is why incidents keep recurring, a culture or programme audit usually yields more.
The Singapore position: what is mandatory
The legal trigger is the contract sum. According to the ConSASS User Guide and MOM’s requirements for factories and worksites (updated 28 March 2025), construction worksites must implement a safety and health management system, and the review cycle depends on project value.
| Contract sum | Required review | Frequency | Who conducts it |
|---|---|---|---|
| S$30 million or more | ConSASS audit of the SHMS | Every 6 months | SAC-accredited WSH Auditing Organisation |
| Below S$30 million | Internal review of the SHMS | Every 6 months | The contractor’s own competent personnel |
This answers the frequency question for most readers: in both cases the cycle is six months. For a detailed walk-through of the threshold, see our S$30M audit requirements checklist.
A common error is to run a sub-S$30 million internal review as though it were a full external ConSASS audit. That consumes resources on documentation-heavy protocol where practical compliance is what the rule asks for. The opposite error, treating a large project’s internal review as a substitute for the accredited audit, is a breach.
How a ConSASS audit works
ConSASS was developed by an MOM-led industry workgroup in 2006 and has since been revised, with Version 4.0 aligned to SS ISO 45001:2018, according to the ConSASS User Guide. Several features distinguish it from a generic checklist.
- Structured method. Auditors follow an opening meeting, familiarisation tour, employee interviews and physical inspection.
- Three verification techniques. Each question is verified by Document Review, Interview of Personnel or Physical Inspection. For interview questions, credit is awarded only if at least 70% of those interviewed respond positively and consistently. A procedure that managers can describe but workers cannot is not credited.
- Banded maturity. Questions are grouped in bands. A contractor must satisfy at least 70% of Band I and Band II questions before Band III best practices are assessed. This prevents advanced refinements from masking basic control failures.
The tool is a maturity profile, not an exact science. Its value lies in showing which SHMS elements are weakest so management can direct resources there, rather than chasing a one-time pass. For a deeper explanation, read our overview of how ConSASS is reshaping construction safety in Singapore.
Choosing the right audit for your project
Use the decision in sequence.
- Check the contract sum. At S$30 million or more, the accredited ConSASS audit is not optional.
- Check contractual conditions. Developers and main contractors may require second-party audits or ISO 45001 certification from subcontractors.
- Run an internal review before every external one. A readiness check or gap assessment typically reveals the nonconformities an auditor would raise.
- Add a targeted programme or activity audit when a high-risk phase begins, such as deep excavation or a major lifting campaign.
- Schedule a culture review when records look sound but incident or near-miss patterns do not improve.
Site protection is a separate discipline from safety management. Some contractors pair audit programmes with site security planning, although the example here is from a New Jersey provider and Singapore sites should consult local licensed providers.
Our perspective on audit practice
We have supported construction firms for more than 20 years, and the most persistent misreading we encounter is the belief that an audit is an event. It is a measurement of a system. Firms that treat the six-monthly cycle as a deadline assemble documents the week before the auditor arrives, and the interview component of ConSASS exposes this immediately, because documents cannot answer for workers.
Our recommendation is to separate three activities: a continuing internal review rhythm, a gap assessment ahead of any external audit, and the independent audit itself. Each has a distinct purpose, and merging them dilutes all three. We also advise clients to read audit findings by element rather than by total score, since a respectable aggregate can conceal one weak element that later becomes the cause of an incident.
Finally, audits should feed design. Hazards removed at the Design for Safety stage never have to be controlled, audited or reported later, and that is the cheapest control in the hierarchy.
— Aman
How MOSAIC supports audit readiness
MOSAIC Eco-construction Solutions provides ConSASS support, WSH audit and inspection, ISO certification assistance and bizSAFE Level 3, 4 and Star guidance, along with EHS documentation, training and manpower outsourcing. If you need a readiness check before your next audit cycle, contact the team through our main site and describe your project and its contract sum. For practical audit scenarios, see our safety audit examples for Singapore construction compliance.
FAQ
What are the main types of construction safety audits?
By auditor, they are first-party (internal), second-party (customer or main contractor) and third-party (independent). By scope, they include compliance, management system, programme, activity-based and culture audits. Most projects use a mix of these.
How often must a construction safety audit be done in Singapore?
Every 6 months. Worksites with a contract sum of S$30 million or more need an SAC-accredited WSH Auditing Organisation to conduct a ConSASS audit. Smaller worksites must conduct an internal SHMS review at the same interval, per MOM.
What is the difference between a third-party and an internal safety audit?
An internal audit is run by your own people for your own improvement. A third-party audit is run by an independent body, follows a fixed protocol and produces a result that regulators and clients can rely on.
What is the difference between stage 1 and stage 2 audits?
Stage 1 reviews documentation and readiness, and stage 2 verifies that the system is implemented in practice. Both belong to the usual certification process for standards such as ISO 45001, so confirm the programme with your certification body.
Sources
- Construction Safety Audit Scoring System (ConSASS) Version 4.0, MOM
- Requirements for factories and worksites, MOM
- The safety audit #3: audit types and process-based auditing, OHS Canada
- Understanding health and safety auditing, IOSH
- Auditing, reviewing and certifying OSH management systems, OSHwiki
- ISO 45001:2018
- Audits unpicked, NEBOSH
