Achilles BuildingConfidence audit explained: what to expect and how to prepare

An Achilles BuildingConfidence audit assesses whether a supplier’s management systems and supporting evidence meet the applicable requirements. Gold CAS Desktop includes a desktop audit, while Gold CAS Site includes an on-site audit. Effective preparation means ensuring policies, records, responsibilities and working practices are current, consistent and capable of demonstrating compliance.

Does Achilles BuildingConfidence involve an audit?

It can do – not every BuildingConfidence supplier undergoes the same assessment.

Achilles currently offers Silver+, Gold CAS Desktop and Gold CAS Site membership. Silver+ is designed for suppliers where Common Assessment Standard accreditation is not required, while the two Gold levels include CAS accreditation and additional assessment.

Gold CAS Desktop involves a desktop audit. Gold CAS Site involves an on-site audit and provides a higher level of assurance. Understanding which level applies is therefore an important first step before preparing for assessment.

What actually gets tested during a BuildingConfidence audit?

It’s easy to assume an audit means an assessor working through the same categories covered earlier in the process – health and safety, quality, environmental management, competence, and so on. It does, but the audit stage isn’t really about which categories are in scope. It’s about a different test being applied to them: can you demonstrate it, not just describe it.

At desktop level, that means an assessor working from what you’ve submitted, checking whether policies, records and evidence are internally consistent and current. At site level, it extends further: an assessor comparing what’s documented against what’s actually happening on the ground.

In practice, this means the audit tends to expose a narrower set of issues than the requirements themselves might suggest – documentation that’s technically present but out of date, evidence that exists but isn’t easy to locate, or practice that’s drifted from what a policy describes. Preparation is less about the range of topics and more about closing that gap between what’s on paper and what can be shown.

What is a BuildingConfidence desktop audit?

Gold CAS Desktop includes Common Assessment Standard accreditation and a desktop audit.

This means the assessment is based on the management arrangements, documentation and supporting evidence supplied by the organisation rather than an assessor visiting an operational site.

Businesses should therefore ensure that their submitted documentation is complete, current and consistent.

Policies should accurately describe the organisation’s arrangements, and supporting records should demonstrate that those arrangements genuinely exist.

Having a policy with the right title is not enough if the organisation cannot provide evidence to support it.

What happens during a BuildingConfidence site audit?

Gold CAS Site adds an on-site audit, providing an additional level of assurance.

This allows the assessment to go beyond documentation and consider how management arrangements are reflected in practice.

For organisations preparing for site-based assessment, consistency is therefore particularly important.

If a documented procedure says that a particular process takes place, the organisation should be able to demonstrate that the process is actually being followed.

That can mean ensuring relevant records are available, staff understand their responsibilities and operational practice reflects the management system presented during assessment.

What are assessors looking for?

Strong audit preparation is not about attempting to predict individual questions.

It is about making sure your organisation’s management arrangements are credible, complete and demonstrable.

Areas worth reviewing include whether:

• Policies and procedures are current
• Responsibilities are clearly defined
• Risk assessments reflect current activities
• Training and competence records are complete
• Required inspections or checks are recorded
• Supporting evidence is easy to locate
• Documentation reflects what happens operationally
• Identified actions have been completed and recorded

A well-prepared organisation should be able to demonstrate not just what it says it does, but the evidence behind it.

Why can organisations struggle with BuildingConfidence audits?

One common problem is a gap between documentation and reality.

An organisation may have appropriate policies but lack the records needed to demonstrate implementation. Procedures may have been written several years earlier and no longer reflect current operations. Training may be undertaken but recorded inconsistently.

These are not necessarily signs of a poorly managed organisation.

Often, they develop gradually as a business grows, responsibilities change or new processes are introduced.

The purpose of preparation is to identify those gaps before formal assessment does.

Already ISO certified? Here’s specifically where audits catch people out

ISO certification and BuildingConfidence assessment aren’t testing the same thing, even where they cover similar ground on paper – and the gap tends to show up in fairly predictable places at audit stage.

ISO audits are usually sampling-based and assess whether a management system is being maintained and improved over time. A BuildingConfidence assessment is checking against a specific, fixed question set – so an organisation can be a well-functioning ISO 9001 or 45001 site and still find that a particular piece of evidence its ISO auditor never asked for is exactly what a BuildingConfidence assessor expects to see.

The pattern we see most often: an ISO-certified business has the underlying arrangement in place – a competence framework, a subcontractor management process – but the specific record format, the named responsibility, or the evidence trail that CAS asks for doesn’t exist in the shape the question set wants it. The management system is genuinely sound; it just hasn’t been mapped onto BuildingConfidence’s specific evidence requirements.

The fix isn’t building a second system. It’s going through the applicable requirements line by line against what your ISO system already produces, and creating the missing evidence trail only where it’s genuinely absent.

What documentation should you prepare?

Much of what’s needed overlaps with the wider evidence discussed elsewhere in this series – but a few items come up specifically at audit stage because they’re where assessors most often ask for something more granular than a policy document:

• Toolbox talk records
• Plant and equipment inspection records
• Maintenance and testing records
• Evidence of operational checks and controls, tied to specific dates and sign-offs

The key word is evidence. An organisation may have perfectly good arrangements in practice, but if those arrangements cannot be demonstrated when assessed, that can still create difficulties.

How should you prepare for a BuildingConfidence audit?

Preparation should begin with a structured review of the management systems and evidence already in place.

Review the applicable requirements
Understand what will be assessed at your particular membership level.

Carry out a gap analysis
Compare those requirements with your existing systems and evidence.

Update outdated documentation
Make sure policies and procedures reflect the organisation as it operates today.

Check your records
Ensure training, competence, inspection and other supporting records are current and accessible.

Check practice against procedure
For site-based assessment in particular, establish whether documented arrangements accurately reflect what happens operationally.

Address gaps before assessment
Where weaknesses are identified, deal with them before they become formal audit findings.

Good preparation should make the assessment less disruptive because the organisation already understands where its evidence sits and how its arrangements operate.

What happens if gaps are identified?

Finding gaps during preparation is not necessarily a problem.

In fact, that is precisely why an audit-readiness review can be valuable.

Identifying an issue before formal assessment gives the organisation an opportunity to strengthen documentation, improve evidence or clarify responsibilities while there is still time to do so.

Where issues arise during the formal assessment itself, organisations may need to provide additional evidence or take corrective action depending on the finding and applicable requirements.

The aim should therefore be to find and address weaknesses as early as possible.

How JVR Consultancy supports audit preparation specifically

Beyond the general accreditation support described on our Achilles BuildingConfidence service page, our audit-preparation work tends to focus on the last mile before assessment: sitting alongside your team to check that the specific evidence an assessor will ask for actually exists, is dated correctly, and matches what’s written in your policies – whether that’s for a desktop submission or a site visit.

For organisations with established ISO-certified systems, that usually means mapping your existing records against the CAS question set and identifying the handful of gaps, rather than reviewing the whole management system from scratch.

Preparing with confidence

A BuildingConfidence audit should not be approached as a last-minute paperwork exercise.

The strongest preparation comes from ensuring that management systems, supporting records and day-to-day practice tell the same story.

Understanding the applicable requirements early gives businesses time to identify gaps, update evidence and enter the assessment knowing that their arrangements can be demonstrated clearly.

Need help preparing for an Achilles BuildingConfidence audit?

JVR Consultancy can review your existing arrangements, identify potential gaps and provide practical support ahead of desktop or site-based assessment.

Learn more about our Achilles BuildingConfidence accreditation and audit support.