SMETA Documentation Before an Audit: Policies, Procedures and Records That Must Work as One System

SMETA documentation is not a collection of policies prepared for the day of the auditor’s visit. It must demonstrate that employment practices, working time and payroll controls, health and safety, environmental management, business ethics and oversight of external personnel operate in practice. The auditor will compare documents with source records, site observations and confidential worker interviews. Any inconsistency between these sources undermines the credibility of the entire audit trail.

Preparation should therefore begin by confirming the audit scope and mapping how processes actually operate. The next steps are to assign accountability, organise policies and procedures, reconcile data across systems and conduct a readiness review. The objective is not to create an appearance of compliance, but to show that the site can explain its rules, decisions, exceptions and records using specific workers, shifts and events as evidence.

A document is not evidence on its own

SMETA should be treated as an ethical supply chain audit methodology, not as a certifiable management system standard. The audit outcome should not be presented as a certificate of conformity. Sedex provides an information-sharing platform; it is not a certification body issuing such a certificate. Site preparation is about demonstrating consistency between the commissioning party’s requirements, stated policies, actual working conditions and source records.

The first decision should be to confirm the scope in writing with the customer or party commissioning the audit. This should cover the site, audit type, two-pillar or four-pillar scope, core and support processes, worker groups and the expected record-review period. Temporary workers, contractors and shift workers should be included where they fall within scope. Requirements should be verified against current arrangements with the audit company and the applicable SMETA methodology documents, rather than assumptions carried over from an audit at another site.

Documentation is best organised as evidence trails: from the governing rule, through assigned accountability and completed activity, to a record that allows a specific case to be reconstructed. This requires cooperation between HR, payroll, operations, occupational health and safety, and those responsible for contractor oversight. One coordinator should control the scope, document versions, data completeness and ownership of identified gaps. A similar approach to organising evidence is discussed in NIS2 and KSC documentation before an inspection: which policies, registers and evidence are actually required.

The auditor will compare policies and procedures with workplace observations, worker interviews and source data. A policy prohibiting excessive working hours does not demonstrate conformity if time records, schedules, payroll data and worker accounts indicate otherwise. The ability to trace a selected worker, shift or period and explain every discrepancy matters more than an elaborate procedure. A document created only for the visit, with no evidence of implementation, increases rather than reduces the risk of inconsistencies being identified.

Risk and accountability mapping

Document control should begin with a process and risk map covering recruitment and employment, working time, pay, occupational health and safety, the environment, business ethics, contractors and, where applicable, accommodation and transport. The map should reflect actual employment arrangements, labour providers, shifts, locations and ancillary facilities, based on current organisational data. Only then can the organisation decide whether document oversight may remain centralised or requires designated local owners.

For each area, the process owner and record owner, storage location, required access level, review period and method for approving changes must be clearly defined. Access to personnel files and payroll documents by the auditor requires a separate decision. Access should support effective verification while remaining consistent with data protection rules and internal authorisations.

The most serious gaps tend to arise at handover points between functions. HR maintains personnel files, payroll calculates allowances, production changes schedules, security records site access, and an external company assigns workers to the site. Each dataset may appear correct in isolation, while comparison reveals a non-conforming practice. A documentation gap means that evidence is missing or unavailable. A non-conforming practice exists when reliable records, observations or interviews demonstrate a departure from the stated rule.

When time is limited, priority should go to issues with the greatest potential impact on people and conformity, the broadest scale and the highest difficulty of reconstructing data—not to procedures that are easiest to write. Top management should approve the responsibility matrix, resources and escalation route for non-conformities. The coordinator manages scope, deadlines and gap status but does not assume the responsibilities of HR, production, occupational health and safety or procurement. The importance of this division of responsibility is also addressed in ASME NQA-1—how to structure quality, accountability and oversight in nuclear energy projects.

Policies that set clear boundaries

The policy framework should reflect the confirmed audit scope, the site’s risk profile, customer requirements and the rules applicable to its operations. No single package is suitable for every organisation. Policies will typically be required for labour standards, the prohibition of forced labour and child labour, non-discrimination and harassment prevention, freedom of association, pay and working time, occupational health and safety, environmental matters and business ethics. These may be consolidated into one framework document or divided into subject-specific policies where that structure reflects operational accountability. A supplier code of conduct may complement the framework, but it does not replace the rules that apply within the site.

Each policy should define management’s commitment, the groups covered, the roles responsible for implementation, available reporting channels, protection against retaliation, the process for handling cases and how the policy is communicated to workers. Approval at the appropriate management level gives the document authority but does not prove implementation. Operational mechanisms and evidence are needed to demonstrate that the intended audience knows the policy, understands it and can use it. Useful measures may include communication coverage, confirmed understanding and the timeliness of responses to reports.

The scope should not stop at directly employed workers. The organisation must determine which rules apply to individuals working under civil-law arrangements, temporary and migrant workers, and contractor personnel present at the site. An anti-harassment policy is ineffective if a night-shift worker does not know the reporting channel or cannot use it in a language they understand. Multilingual communication should reflect the actual workforce profile, rather than the formal language of the documentation.

Particular care is required when adopting group-level policies. Before implementation, the organisation should confirm that the named roles exist in the local entity, reporting channels work, response times are achievable, and the stated benefits and organisational arrangements genuinely apply. Otherwise, the document creates commitments that conflict with actual practice.

A single responsible employment policy may replace several documents if it preserves clear accountability and remains linked to operational controls. The document hierarchy should be clear: a policy establishes the principle, a procedure defines the process, an instruction explains how to perform the task, and a form or register retains the evidence. This distinction is also useful in the approach described in ISO 9001 gap analysis—how to assess organisational readiness reliably without unnecessary cost.

Procedures that control operational practice

Procedures should focus on points where a manager’s decision, an exception to plan or inconsistent data could lead to a breach. In the employment area, they should cover recruitment, verification of age and right to work, the issue and amendment of employment terms, confirmation that work is voluntary, and the prohibition of unauthorised recruitment fees. The end of the working relationship and the return of documents belonging to the worker should be controlled equally clearly.

Not every activity requires a separate procedure where processes share the same roles and controls. Separate workflows are needed, however, for matters involving different confidentiality requirements, approval routes or accountabilities. Documentation should support decisions and the retention of evidence, rather than mirror the organisational chart for formality’s sake.

The relationship between staffing, production capacity and working time requires particular oversight. The procedure should define how shifts are planned, how overtime is approved—manually or within a system—how attendance is recorded, and how allowances, leave and deductions are calculated. A core control is the reconciliation of access-system data, schedules, working-time records and payroll, with discrepancies explained before payroll is closed.

If an urgent order requires a change to the plan, the exception should identify who approved it, the basis for the decision, the conformity assessment and the record retained after implementation. Limits, rest periods, payroll rules and deadlines must be assessed against current requirements applicable to the individual’s employment arrangement and circumstances, rather than against a single value treated as universally applicable.

Occupational health and safety procedures should reflect the site’s actual hazards. They should cover risk assessment, training, selection and issue of personal protective equipment, accident reporting and investigation, emergency preparedness, first aid and fire safety. Oversight of equipment inspections and the safe performance of particularly hazardous work should also be included where relevant to the operation.

Authorisation of work requiring special safeguards cannot rely solely on a workstation instruction. It must have a decision owner, defined conditions for starting work, stop criteria and an inspection record. A similar approach to controlling competence and evidence is discussed in ISO 3834—how to control welding, competence and quality records in production.

The grievance mechanism should define accessible channels, confidentiality rules, independence in case handling, response times, protection against retaliation, feedback and case-closure arrangements. A suggestion box without a handling register is not a complete mechanism. The organisation must determine who receives a complaint involving a supervisor or senior management, and when the matter is referred to an independent person or organisation. The register should support assessment of response times, case status and completion of actions without unjustified disclosure of the reporting person’s data.

Environmental management and business ethics should be supported by procedures proportionate to the organisation’s activities and impacts. These may cover control of applicable requirements, waste, resource use and environmental incidents, as well as conflicts of interest, gifts, misconduct and reporting. Exceptions are best defined through their justification, decision authority, permitted boundaries and required record, rather than by expanding a document to cover every conceivable scenario.

Records that reconstruct the facts

A record is valuable when it allows the working conditions of a specific individual or the course of an event to be reconstructed: who acted, when, on what basis and with what outcome. Before the audit, the organisation should identify the reference data source for each process, the rules for version identification and how errors are corrected without obscuring the original entry. Retention, availability and archiving are equally important. The record must cover the correct site and review period, and its origin should be verifiable.

Personnel files and HR records should match each individual’s status. They may include the basis of employment or engagement, confirmation of terms, information required for lawful work, evidence of training and information provided, changes to terms, and the end of the working relationship. The most important conformity test, however, is to trace one person through the complete process: from the schedule, actual attendance and working-time record, through approvals or instructions for additional work, to payroll calculation and evidence of payment. The HR system, access-control records, supervisor documentation and payroll must describe the same factual position.

If the access-control system shows presence after recorded working time has ended, the discrepancy should neither be automatically classified as overtime nor dismissed as a technical error. Its cause must be investigated by comparing the schedule, workstation record, supervisor instructions and payroll calculation, followed by documented clarification and an approved correction.

The review sample should be risk-based. It should cover different employment arrangements, shifts and departments, periods of increased production, additional work and exceptional cases. Sample size should reflect the scale of operations and the discrepancies identified, rather than a fixed number selected without analysis.

For occupational health and safety, the evidence trail should connect current risk assessments with training, medical assessment and authorisation records, inspections of equipment and safeguards, issue of personal protective equipment, emergency drills, accidents, corrective actions and workplace-condition reviews. For environmental and ethics matters, the organisation should arrange the permits and notifications relevant to its activities, monitoring results, operational records, incidents, complaints, conflicts of interest, reports of misconduct and follow-up actions—where these areas fall within audit scope. The importance of record traceability is also illustrated in AQAP 2110—which documents and processes do auditors most often examine in the defence sector?

A separate evidence trail is required for labour agencies and contractors. Documentation should support assessment of their qualifications, contractual conditions, lists of assigned personnel, required notifications, settlements, oversight and responses to identified irregularities. A commercial contract alone does not demonstrate that people working at the site have the appropriate status, receive the agreed benefits and work under the declared conditions. The process owner should therefore periodically reconcile contractor data with attendance, working-time records, settlement documents and the results of on-site checks.

Readiness review and gap closure

The readiness review should reproduce the logic of the actual audit: document review, site tour, interviews with management and workers, sampling of personnel files and reconciliation of data across systems. A policy checklist is not enough because it will not reveal the difference between a rule stated in a procedure and actual practice on a production shift. Depending on the team’s competence and independence, the organisation may conduct a mock audit internally or commission an independent assessment, following the approach described in ISO 9001 gap analysis—how to assess organisational readiness reliably without unnecessary cost. The readiness review must be clearly distinguished from the formal audit.

Each identified gap should be classified as:

• a missing document or record;
• failure to implement an established rule;
• ineffective oversight;
• a data discrepancy;
• a potential breach requiring immediate action.

The classification determines ownership and the escalation route. Missing approval of an instruction may be assigned to the process owner, whereas suspected incorrect calculation of working time requires immediate involvement from HR, management and—depending on the circumstances—legal counsel. A similar risk-assessment approach is used in Supplier audit before contract signature—how to reduce quality and delivery risk.

The action plan must go beyond adding a missing form. It should include correction of the current situation, root-cause analysis, corrective action, a deadline, an accountable owner, required implementation evidence and an effectiveness review. Gap closure should be approved by a person with sufficient competence and independence to assess the evidence, rather than automatically by the person who completed the action.

The readiness register should present gaps by area and risk, together with owners, deadlines and evidence status. Not every gap can be responsibly closed before the audit. A newly introduced record that does not cover a sufficient period to demonstrate effectiveness is not yet evidence of sustained improvement.

Preparing workers and managers means explaining the purpose of the audit, participant rights, confidentiality rules and how information will be made available. Coaching people to give expected answers undermines interview credibility and may conceal genuine risks. Workers should understand the applicable rules and channels for raising concerns, but they should answer according to their own experience.

Top management should decide whether the site is ready based on the register of open risks, the consistency of evidence trails and the ability of process owners to explain actual practice clearly. Any potential worker-related breach, absence of reliable data or gap requiring a longer period to confirm effectiveness should be escalated. Where customer requirements and organisational arrangements allow, serious unresolved gaps may justify rescheduling the audit.