RISQS audit explained:
What to expect and how to prepare

When a RISQS audit is required

RISQS operates on a risk-based model.

Lower-risk services may only require completion of the online questionnaire. Higher-risk activities, particularly those involving trackside work or interaction with live rail infrastructure, require a formal RISQS audit.

This distinction is important. Organisations often prepare in the same way regardless of risk level, only to find that audit expectations are significantly more detailed.

What the audit involves

A RISQS audit is a structured review of your management system and how it is applied day to day.

This typically includes:

• Review of policies and procedures
• Discussion of how work is planned and controlled
• Assessment of risk management processes
• Evaluation of staff competence and training
• Examination of records and supporting evidence

The auditor will not simply check that documents exist, they will also look at whether your organisation can demonstrate control, consistency and understanding of its responsibilities within a rail environment.

What auditors are really looking for

A common misconception is that the audit is about documentation.

In reality, auditors are assessing whether:

• Your policies reflect how work is actually carried out
• Staff understand and follow those processes
• Risks are identified and managed consistently
• Records support what your systems claim is happening

For example, a procedure may state that certain checks are completed before work begins. The auditor will expect to see evidence that those checks are consistently carried out and recorded. There’s a big difference between having a written process and adhering to it.

Where organisations typically struggle

Most difficulties arise from a gap between documentation and reality.

Common issues include:

• Policies that meet general standards but not rail-specific requirements
• Unclear ownership of responsibilities
• Inconsistent or incomplete records
• Processes that exist on paper but are not followed in practice

These are rarely intentional oversights, or laziness. They usually develop over time as systems evolve without being reviewed against RISQS expectations.

How to prepare effectively

Preparation for a RISQS audit is about making sure your policies, records and day-to-day activity all match.

This means:

• Reviewing policies against rail-specific requirements
• Ensuring responsibilities are clearly defined
• Checking that records support your processes
• Confirming that staff understand how systems are applied

What happens after the audit

Following the audit, organisations may receive:

• Confirmation of compliance
• Observations
• Non-conformities requiring corrective action

Addressing non-conformities promptly and thoroughly is essential. Delays or incomplete responses can affect accreditation timelines.

Why preparation makes the difference

The outcome of a RISQS audit is rarely determined on the day. It reflects the level of preparation beforehand.

Organisations that understand how they will be assessed, and ensure their systems reflect that, are far more likely to achieve and maintain RISQS accredited status.

Working towards your RISQS audit?

If you’re unsure whether your systems will stand up to audit scrutiny, we can help. Our RISQS consultants support organisations through every stage of the accreditation process, from preparation to audit readiness.

→ View our RISQS consultants service