Preparing for a SMETA audit is not a matter of tidying records for the day of the visit. The site must demonstrate that employment conditions, working hours, pay, safety, grievance mechanisms and oversight of external workers operate as one coherent system in day-to-day practice. The auditor will compare records with site observations, management explanations and confidential worker testimony. Any inconsistency between these sources undermines the credibility of the remaining evidence. Preparation should therefore begin by confirming the audit scope, mapping how processes actually operate and assigning responsibility for closing identified gaps. Only then should the organisation organise its records, conduct a mock audit and make the practical arrangements needed for an efficient assessment.
SMETA tests practice, not declarations
SMETA is an ethical audit methodology used in supply chains. It is not management system certification and does not result in a certificate of conformity. The audit report records findings for a specific site, scope and assessment date. Customers use it for supplier oversight and supply chain due diligence.
Before preparation begins, senior management should confirm with the customer the audit scope, site, processes and worker groups to be assessed, as well as the arrangements for sharing the report. A two-pillar audit covers labour standards and health and safety. A four-pillar audit extends the assessment to environmental performance and business ethics. The organisation should not assume that the scope will be the same as a previous audit or another customer’s requirements. It should also consult official Sedex materials to confirm which version of the methodology and reference documents will apply on the audit date.
The auditor does not assess procedures in isolation. Findings are developed by comparing records, observations of site conditions, management interviews and confidential worker interviews. If working-time records appear correct but workers report starting before their shifts and the auditor observes tasks being performed before clock-in, the formally correct records lose credibility. Similar inconsistencies may arise in relation to pay, health and safety, agency labour, environmental management and business ethics.
Preparation should be led by managers with the authority to eliminate the causes of nonconformities, rather than being left solely to quality or HR. Coordination must include operations, health and safety, HR and payroll, procurement and those responsible for agency workers. The underlying approach is similar to that described in How to prepare a company for a second-party audit at a key supplier. SMETA findings and follow-up actions may affect supplier approval or retention, but the consequences depend on the customer’s rules and the applicable contractual arrangements.
Start with scope and accountability
SMETA preparation should be managed as a cross-functional project. The project owner needs a mandate from senior management, access to relevant data and authority to escalate risks. The coordinator does not, however, replace process owners. Subject-matter accountability remains with HR and payroll, health and safety, operations, environmental management, procurement, administration and those overseeing employment agencies and contractors. Senior management should approve the scope, timetable, reporting arrangements and resources for corrective action.
| Area | Process owner | Evidence sources | Primary risk | Required timing |
|---|---|---|---|---|
| Employment and pay | HR and payroll | Contracts, personnel files, working-time records, payroll records | Mismatch between working time and pay | Before closing the gap analysis |
| Working conditions | Health and safety and operations | Risk assessments, inspections, workplace observations | Risk to health or life | Immediately upon identification |
| Agency labour | Procurement and agency oversight | Contracts, worker lists, payment records, oversight records | Insufficient control over employment conditions | According to the significance and scale of the gap |
| Grievances and ethics | Administration or designated function | Grievance logs, investigations, worker communications | Inaccessible or ineffective mechanism | Before assessing effectiveness |
A gap analysis cannot be limited to checking whether documents are complete. It should reconstruct how recruitment and employment, time recording, payroll, contractor access, grievance reporting and supervision across individual shifts work in practice. The review should account for different employment arrangements, the number of labour providers, production seasonality and periods of increased overtime. The complexity of these factors—not simply the audit date—determines how much time is required for credible preparation.
Priorities should be based on risk to people, legal exposure, the scale of the issue and the time required to remove its cause sustainably. Well-presented documentation must never take precedence over safety or workers’ rights. Every action should be entered in a tracker identifying the owner, due date, completion evidence and method for verifying effectiveness. Deadlines that cannot be met should be escalated rather than concealed.
Operational management involvement is essential because decisions on staffing, overtime, output and delivery dates may create the conditions that lead to inconsistencies. If the production plan drives working practices that conflict with established requirements, changing a form will not resolve the problem. Senior management must make decisions about resources, work organisation or commitments made to the customer. Roles should be defined as clearly as in the approach described in How to design an onboarding process for a new quality engineer or ISO management system representative.
Site conditions must support the records
The preparatory walk-through should follow the worker journey, not the presentation route used for visitors. It should cover entry to the site, changing rooms, the route to the workstation, the production floor or other work area, toilets, welfare facilities, warehouses, traffic routes and emergency exits. Where accommodation is provided by the employer or an intermediary, it should also be included. The sample should cover all shifts, higher-risk locations, workstations away from main routes and areas used by external personnel. The objective is not to check housekeeping during an announced visit, but to determine whether normal working conditions match the records.
The walk-through should examine machine guarding, clear traffic and evacuation routes, fire protection, the storage and labelling of hazardous substances, the availability and use of personal protective equipment, first-aid provision and the clarity of safety signage. The mere presence of equipment does not demonstrate that controls are effective. Observations should be compared with current occupational risk assessments, training records, accident and near-miss logs, and the inspections and measurements applicable to the site.
Every technical defect must have an owner and a realistic correction deadline. Interim controls should reduce risk until the permanent correction is completed. If they do not provide an adequate level of safety, temporarily stopping the process may be the appropriate decision rather than extending the deadline in an action tracker.
Working conditions must also be assessed against the production plan. Nominal staffing and shift arrangements may look acceptable while the actual workload results in excessive overtime, shortened or bypassed breaks, work by people without the required authorisation, or effective instruction being replaced by a signature. The analysis should therefore cover actual shift staffing, overtime utilisation, absence levels and the presence of external providers.
The assessment is not limited to directly employed workers. It also covers temporary and migrant workers, security, cleaning, internal logistics and canteen personnel, and other groups working on the site. Operational risk does not end at the boundary of the organisation’s payroll. Contractor controls must establish who authorises people to work, verifies competence and responds to deviations.
A health and safety action cannot be considered effectively closed if a machine guard exists only in an inspection record, workers bypass it during normal operations and supervisors tolerate the practice to maintain output. This situation indicates a technical failure, ineffective supervision, poorly designed production targets and organisational tolerance of unsafe behaviour. Evidence that the issue has been resolved should include a durable engineering solution, observation of work after implementation, and confirmation that production planning and staffing no longer encourage the control to be bypassed.
The same principle of evidence consistency is applied in Supplier audits in the nuclear energy sector: what is assessed and how to prepare before qualification. Declarations and inspection records retain their value only when supported by the way work is actually performed.
Records must present one consistent account
Records should not be organised solely by department because the auditor reconstructs the employment history of individual workers, not the site’s organisational chart. For selected workers, the organisation should be able to connect evidence covering recruitment, employment contracts and right-to-work status, working time, pay and deductions, leave, training, medical examinations, grievance reporting and termination. This end-to-end view exposes gaps that remain hidden when HR, payroll, health and safety and production records are reviewed separately.
Employment agency records require particular control. The external provider may formally own these records, but the site should ensure that the evidence needed to demonstrate working conditions on its premises is available.
The document sample should include people from different shifts, departments and employment arrangements, including temporary workers, as well as periods of normal and peak workload. For each person, the agreed contractual terms should be compared with work schedules, access-control logs, working-time records, payroll records, payment confirmations and, where applicable, agency documentation. Selecting only complete personnel files or the most recent quiet month produces a convenient but unrepresentative picture. Record retention and accessibility should therefore support reconstruction of the full period under review, not only the current position.
The most serious inconsistencies commonly occur at the interfaces between systems. Access-control data may show presence outside recorded working time, production plans may require staffing that conflicts with approved schedules, and piecework or bonus calculations may not reconcile with HR, payroll and overtime data. One accurate report does not resolve contradictions between different sources.
Every discrepancy should be logged, together with its cause, correction and impact on the worker—particularly any effect on pay due, rest periods, leave or deductions. A late departure from the site may, for example, result from waiting for transport, but this explanation requires evidence and cannot automatically be applied to every case.
In parallel, the organisation should verify that policies, procedures, risk assessments, permits, inspection records, training logs and grievance mechanisms are current. The controlled document register should identify the owner and review date. The site should not, however, create instructions that it does not actually follow. An unused document increases the risk of inconsistency between stated and actual practice and undermines the credibility of the records.
Access to personnel files must be arranged with due regard for confidentiality and personal data protection. The person supporting the audit should know where the evidence is held, who may release it, what may be disclosed and how each record is generated. This applies both to the organisation’s own files and to information held by agencies or other service providers. Similar evidence discipline is necessary wherever formal conformity and source credibility are assessed, as illustrated by Mandatory KSC audits: which essential entities need to prepare for their first conformity assessment.
Inform workers—do not coach them
Preparing workers for a SMETA audit should reduce organisational uncertainty, not influence what they say. Workers should be informed in advance about the purpose of the audit, its likely course and the possibility of taking part in a confidential interview with the auditor. Communications must make clear that honest answers, raising a concern or declining to discuss matters unrelated to work will not lead to adverse consequences.
Information should be provided through channels accessible to all shifts and in languages workers genuinely understand. If some workers do not have sufficient command of Polish, the organisation should determine whether an interpreter is needed and ensure that the person is impartial and maintains confidentiality.
Mock interviews should not be used to teach approved answers, nor should the organisation select only workers considered “safe”. These practices do not improve conformity. They obstruct assessment of actual conditions and may be perceived as pressure. Differences between worker testimony, employment records and management practice indicate weak oversight or ineffective communication. Pressuring workers creates a separate ethical risk, particularly in relation to pay, working hours, grievances and supervisor conduct.
Before the audit, the organisation should check whether workers can use its processes—not whether they can recite procedures. Workers should understand how pay and overtime are calculated, how leave is taken, the core health and safety requirements, and which channels are available for grievances and reporting concerns. A practical test is to ask where and how a concern can be raised, who handles the report and whether the worker understands the prohibition on retaliation.
Management should review use of grievance channels and response times without disclosing the identity of those raising concerns. An absence of reports does not, by itself, demonstrate that the mechanism works correctly. It may also mean that the channel is not known or is perceived as unsafe.
Managers should be prepared to explain processes, data sources, exceptions and corrective actions factually. A manager should know who approves work schedules, where working-time data originate, how deviations are handled and where evidence of completed corrections is retained. “I don’t know, but I will check” is more credible than speculation, concealing an exception or making an unsupported promise. Manager preparation should cover, at a minimum, their responsibilities for working time, pay, health and safety, grievance handling and the prohibition on retaliation.
This approach reflects the principle of coordinated preparation described in How to prepare a team for a customer audit involving APQP, PPAP and root cause analysis. Each person understands their role, can identify the source of information and does not assume the process owner’s accountability. This does not mean scripting what people say. In a SMETA audit, credibility arises when workers’ unprompted accounts, management explanations and organisational records describe the same way of working.
Mock audit and post-audit action
A mock audit should replicate the way evidence is gathered during a SMETA audit: document review, site walk-through and confidential worker interviews. Its purpose is not to confirm a predetermined conclusion of conformity, but to identify inconsistencies between records, practice and the accounts of people performing the work. An assessment conducted by someone independent of the processes under review will generally provide greater value.
Site readiness should not be measured simply by the number of actions marked as closed. The assessment should consider the significance of unresolved risks, completeness of evidence and effectiveness of action taken. Useful measures include document retrieval time, the number of unexplained discrepancies and the percentage of high-risk actions closed with verified evidence of effectiveness.
The mock audit should support a management decision: keep the planned audit date, implement interim controls or agree to postpone the audit. Every significant risk should have an owner, an impact assessment and a documented decision. A scenario-based schedule can be useful, following the approach presented in How to prepare for ISO 9001 certification in 90, 180 or 270 days: realistic scenarios.
Before the audit day, the organisation should appoint contact people, agree site access and movement arrangements, prepare access to records and define how additional evidence will be retrieved promptly. It should also provide a suitable room for confidential interviews, arrange an interpreter if necessary and communicate the site’s safety rules to the auditors.
A practical test of the arrangements is to request several records from different periods and departments during the mock audit. If retrieval requires improvisation, manual reconciliation of conflicting data or the involvement of one irreplaceable individual, the site does not yet have a stable evidence system.
Known problems should not be concealed. A credible response sets out the facts, the interim control applied, the outcome of root cause analysis and a realistic plan for permanent resolution. Due dates should reflect available resources and the scope of work, rather than pressure to close a finding quickly.
After the audit, correction must be clearly distinguished from corrective action. Amending an individual record or resolving a local defect does not replace identifying the root cause, assessing the scale of the problem or checking whether it also occurs in other departments or periods. The post-audit action plan should state the cause, scope, owner, deadline and evidence of effectiveness. An action should be closed only after a sustained change has been verified—not merely when task completion has been declared.
Masz pytania? Porozmawiajmy.
Bezpłatna konsultacja – bez zobowiązań.
