In brief
An OHS audit carried out by an OEM at a supplier is based on the contract, but most of the questions asked are about evidence of obligations under Law No. 6331. If you map your document set to its legal basis, show consistency between documentation and practice during the site walk, and close findings with an action plan that names a root cause, an owner and a deadline, the audit stops being a threat.
How does a supplier OHS audit differ from a statutory inspection?
The quality manager of a firm producing parts for an OEM has been told that a customer audit will take place in two weeks, and this time the list includes an "OHS" heading. A supplier OHS audit is not an inspection by a Ministry labour inspector; its basis is the customer's purchasing requirements and the supplier contract. The auditor does not issue fines, but the findings may be reflected in the supplier rating score, decisions on new projects and whether the contract continues.
The good news is this: most OEM OHS requirements ask for evidence of work you are already legally obliged to do. The auditor does not stop at asking "do you have a risk assessment?"; they look at whether the assessment is up to date, whether the measures in the field match the documentation, and how the gaps they find will be closed. The essence of preparation is making documents, the site and the action plan consistent with one another.
Ask your customer for the audit form or supplier manual in advance. OEMs use different forms and scoring systems; some are based on their own question list, others on an international management system standard. The checklist in this article maps headings commonly found in these forms to their equivalents in Turkish legislation.
Document expectations and their legal basis
The table below shows the document section of a supplier audit checklist and the legal basis of each item. Most of the references are in Law No. 6331.
| Auditor's question | Legal basis | Evidence that should be ready |
|---|---|---|
| Is the risk assessment up to date? | Art. 10; renewal every 2 / 4 / 6 years | Signed document, method used, list of open actions |
| Are an OHS specialist and a physician assigned? | Art. 6 | Contracts approved on ISG-KATİP, work records of the specialist and physician |
| Emergency plan and drill | Art. 11 | Plan, evacuation layout, list of support staff, latest drill form |
| Has training been given? | Art. 17; 2026 training regulation | Induction records, basic training certificates, refresher schedule |
| Health surveillance | Art. 15 | Pre-employment reports, periodic examination plan |
| Periodic inspections of equipment | Regulation on Work Equipment, Annex III | Current reports, follow-up of equipment found "unfit for use" |
| Workplace measurements | Art. 10/4 | Measurement reports for noise, dust, lighting and similar |
| Accident and near miss records | Art. 14 | Incident records, root cause analyses, SGK notifications |
| PPE management | Regulation on the Use of PPE | Task-based PPE matrix, issue records |
| OHS committee (50 or more employees) | Art. 22 | Committee meeting minutes and follow-up of decisions |
| Employee representative | Art. 20 | Election or appointment record |
| Vocational training certificates | Regulation on Vocational Training | Certificates of workers in the jobs listed in Annex 1 |
A few details often cause problems during audits:
- Know your hazard class correctly. In Bursa's automotive supply industry, different classes may exist under the same roof: manufacture of motor vehicle parts and accessories (29.32.20) is hazardous, while laser cutting of metals (25.53.03) and nickel plating (25.51.01) are very hazardous. Your renewal and training frequencies change accordingly.
- OHS committee meeting frequency: Under Art. 9 of the Regulation on OHS Committees, the committee meets at least once a month; it may decide to extend this to two months in hazardous workplaces and three months in less hazardous workplaces.
- Drills: An emergency drill is held at least once a year and a drill form is completed. For details, see our emergency plan guide.
- ISG-KATİP approvals: Keep ready the screen showing that the assignment is approved in ISG-KATİP, the Ministry's online OHS registration system. We described the process in our article on ISG-KATİP contract approval.
The site walk: where does the auditor look?
After the document review, the auditor goes into the field and looks for what is written in the documentation. For example, if the risk assessment says "press guards must be interlocked", they will want to open the guard and see whether the press stops. Before the site walk, walk the same route with your own team and answer these questions:
- Are pedestrian and forklift routes marked on the floor and clear, and are stacks narrowing the aisles?
- Are machine guards in place and working? We collected guard types and common mistakes in our article on machine guards.
- Are there padlocks, tags and written instructions for energy isolation and lockout, and can the maintenance worker explain how it is applied?
- Are chemicals in labelled containers, with the safety data sheet near the point of use and drip trays against spills?
- Are emergency exits open and marked, are fire extinguishers unobstructed and their inspection labels up to date?
- Is PPE used in line with the task-based matrix? For PPE obligations, see our article on the Regulation on the Use of PPE.
- Are electrical panels closed and unobstructed?
- Do racks carry load labels, and are impact-damaged uprights in use?
When planning the walk, do not focus only on the production hall. Auditors also enter "back" areas such as the compressor room, boiler room, chemical and waste stores, maintenance workshop, canteen and the gas cylinder store outside; these are the places most often forgotten in preparation. If a maintenance contractor, cleaning company or temporary workers are on site that day, expect questions about their induction briefing and PPE use too.
Auditors also ask employees questions: "Where do you go if the fire alarm sounds?", "What do you do before carrying out maintenance on this machine?", "How do you report a near miss?" An operator who knows the answers to these questions is stronger evidence than a thick binder. Building induction and job-specific risk training around these questions makes the preparation permanent.
Action plan: from finding to closure
Most OEM audits end with a list of findings and an action plan expected from the supplier. The most common mistake here is writing "employees will be trained" against every finding. The auditor wants to see the root cause and a permanent solution. A good action plan line contains the following fields:
| Field | Example |
|---|---|
| Finding | Curtain at the welding cell torn; operator at the adjacent station exposed to arc light |
| Interim measure | Spare curtain fitted the same day, area separated with tape |
| Root cause | No one responsible for checking curtains and no replacement criterion defined |
| Permanent action | Curtain check added to the start-of-shift checklist; spare stock defined |
| Owner and deadline | Maintenance supervisor; 15 days |
| Evidence | Photo, updated checklist, completed forms for the first two weeks |
| Effectiveness check | Site check by the OHS specialist one month later |
Audit findings are also an input to your risk assessment. If a new hazard has been identified or an existing measure has proved inadequate, the document should be updated; this update is the best evidence at the next audit that the system works. If a finding stems from a workplace accident or near miss, follow the investigation steps in our guide on what to do after a workplace accident.
The 30 days before the audit
To avoid leaving preparation to the last week, we recommend the following schedule:
- Day 30: Obtain the audit form and the previous audit report from the customer. Assign an owner to every question on the form.
- Day 25: Fill in the document table; list expired reports, missing signatures and unapproved contracts. Check periodic inspection and examination dates with the OHS calendar; for equipment inspection intervals, see our Annex III guide.
- Day 20: Carry out a preliminary site walk with the specialist, physician and production manager; photograph the findings.
- Day 10: Close findings that can be fixed quickly; prepare a plan with deadlines for longer-term ones.
- Day 5: Go over the questions that may be asked of employees with shift supervisors.
- Audit day: Keep documents ready in digital and printed form; make sure the specialist or physician attends the opening meeting.
For jobs requiring vocational training, completing certificates can take time; if you have gaps in this area, read our article on the vocational training certificate and put it at the top of the schedule.
Common mistakes
- What is in the binder is not in the field: a measure written in the documentation but absent in practice is a more serious finding than a missing document.
- The risk assessment not being updated after a new line, a new machine or a relocation.
- Subcontractors, maintenance firms and temporary workers being left outside OHS coordination. Art. 23 of the Law requires employers sharing the same work area to cooperate and coordinate.
- Assuming that a management system certificate replaces legal compliance.
- Not updating the status in the action plan even though the deadline has passed.
For automotive supply industry suppliers in Bursa, setting up the document table with its legal references, carrying out the preliminary site walk and following up the action plan are part of our OHS specialist service. We provide this support in Nilüfer, home to Bursa OSB and Nilüfer OSB, in Osmangazi, home to Demirtaş OSB, and in Bursa's other districts.
Frequently Asked Questions
The OEM requires an ISO 45001 certificate; is this a legal obligation?
No. ISO 45001 is a voluntary management system standard; the customer may require it as a supply condition. Whether or not you hold the certificate, the obligations in Law No. 6331 and its regulations apply in full, and the auditor mostly looks for evidence of these.
Do the customer auditor's findings lead to legal sanctions?
A customer auditor cannot impose administrative fines; that power belongs to the Ministry. The consequences of findings depend on the contract between you and the customer. However, if a finding points to a legal deficiency, the same deficiency could also be fined during an inspector's inspection.
Do we have to enter audit findings into the risk assessment?
Yes, if a new hazard or an inadequate measure has come to light. The risk assessment is a living document updated with changes in the working environment and new information; recording the audit finding will also serve as evidence in your favour at the next audit.
Can the specialist and physician from the OSGB attend the audit?
They can, and it is recommended. The OHS specialist can directly answer questions about the risk assessment, training and site measures, and the workplace physician can answer questions on health surveillance; their presence at the opening or closing meeting helps build a realistic action plan.
A certified specialist matched to your hazard class: site inspections, approved logbook, training plan, annual plan and report follow-up.
Bursa SİSTEMER OSGB Technical Team — written from the field experience of our OHS specialists and workplace physicians. Legal information is valid as of the publication/update date; contact us for an assessment specific to your business.