A compliance audit pack means different things in different contexts. A client carrying out due diligence wants different evidence to an HSE inspector who has just walked onto your site. But the underlying principle is the same: you need to be able to demonstrate, with documentation, that a project has been managed to a standard that meets your legal and contractual obligations.
The problem is that most companies don't maintain compliance evidence in a state where it can be produced quickly. When a client asks for an audit pack as part of a tender, or an inspector requests records on the day of a visit, the scramble to compile everything from disparate sources is stressful, time-consuming, and often incomplete.
Here's what a complete CDM audit pack needs to contain — and why.
1. The Construction Phase Plan
This is the centrepiece of CDM compliance on a notifiable project. It needs to be project-specific, not a recycled template, and it needs to reflect the current state of the work — not just the pre-construction plan that was written at the start. Inspectors and clients will look for site-specific hazard identification, emergency arrangements, welfare provision details, and evidence of how coordination between contractors is managed.
Include the original plan and any revisions, with dates.
2. F10 HSE Notification Reference
If the project is notifiable, the F10 reference is your proof of compliance with the notification requirement. It should be displayed on the site notice board and included in any audit documentation. If you've updated the F10 (for changes to key personnel or programme), include the updated version.
3. Daily Site Logs
A chronological record of what work was carried out, how many workers were on site, what plant was in use, any deliveries, and anything of note. The value of daily logs in an audit context is that they demonstrate continuous management — they show that someone was on site, taking responsibility, recording what was happening. A gap in the logs is a gap in your evidence.
Site diaries that are only completed retrospectively are generally obvious — the writing is too consistent, the detail is too thin, and the dates don't quite align with other records. Inspectors recognise this.
4. Toolbox Talk Records
Date, topic, who delivered it, which workers attended (signed), and brief notes on what was covered. Toolbox talks are one of the key ways a principal contractor demonstrates it's maintaining an ongoing safety briefing culture on site. The content should reflect current site conditions and work activities — a generic "manual handling" talk delivered in week one isn't the same as safety briefings that track the progression of work.
5. Site Induction Records
Every person who sets foot on the site should have completed an induction, and you should be able to demonstrate this with a signed record. The induction register should cross-reference with daily log entries — if a worker appears in your daily records before their induction date, that's a gap that needs explaining.
6. Checklist and Inspection Records
Regular site inspections — weekly safety walkarounds, scaffold inspections, fire equipment checks, pre-use plant checks — generate a trail of evidence that demonstrates ongoing management. Completed checklists, with dates, the name of the person carrying out the inspection, and any remedial actions recorded, are valuable evidence of proactive compliance management.
7. Incident and Near-Miss Log
All incidents and near misses, however minor, should be recorded. For any that met the RIDDOR reporting thresholds, include the HSE notification reference. For any that were investigated, include the investigation findings and actions taken.
An incident log with very few entries isn't necessarily reassuring to an auditor or inspector — on a large, active site, a zero-incident log can suggest that near misses are being missed or not reported internally.
8. Document Register
Insurance certificates (employers' liability, public liability, professional indemnity where relevant), RAMS from subcontractors, method statements, COSHH assessments, and any other project-specific documents. Critically — with their expiry dates. A document register that contains expired insurance is potentially worse than no register at all, because it shows you knew about the expiry and didn't act.
9. Subcontractor Compliance Records
For each subcontractor: their insurance certs, a copy of their RAMS, evidence that you reviewed and accepted their RAMS before work started, and records of their workers' certifications (CSCS, plant licences, trade cards) where relevant. Principal contractors carry responsibility for subcontractor management — if a subbie's worker is injured and their employer liability insurance had lapsed, the principal contractor is in a difficult position.
10. Worker Competency Matrix
CSCS cards, first aid qualifications, working at height certifications, plant operator licences, asbestos awareness, CISRS scaffolding cards. For skilled roles — scaffolders, plant operators, electricians — competency needs to be demonstrable. A matrix that shows each worker's certifications, their issue dates, and when they expire is a clear and auditable format.
The compilation problem
The challenge isn't understanding what an audit pack needs — it's maintaining all of this information in a form where it can be compiled quickly. When these records exist across a combination of paper files, email attachments, spreadsheets, photos on phone cameras, and site office folders, pulling them together takes days and people.
SiteProof is built so that every item in this list is captured digitally as it happens — daily logs completed on-site, checklists ticked off on mobile, incidents reported with photos attached. The result is that generating an audit pack for any project for any date range is a 30-second operation rather than a multi-day exercise.
Try SiteProof free for 14 days and see what a complete, always-current audit pack looks like.