A letter from the accident insurance institution, a new warehouse opening or a workplace accident can make one question urgent: do you need a risk assessment versus safety audit? The answer is often both, but they do different jobs. One identifies and controls the risks in work before people are harmed. The other tests whether your safety arrangements are working as intended.
For employers operating in Germany, confusing the two can leave real gaps. A polished audit report does not replace the legally required assessment of workplace hazards. Equally, a risk assessment filed away and never checked may fail to reflect what actually happens on site. Think of them as two parts of the same heroic journey: first understand the danger, then check that your safeguards hold up in practice.
Risk assessment versus safety audit: the core difference
A risk assessment (Gefährdungsbeurteilung) is a structured examination of hazards connected with your work. You identify who could be affected, evaluate the level of risk, decide on suitable protective measures, document the result and review it when circumstances change.
Under the Occupational Health and Safety Act (Arbeitsschutzgesetz, ArbSchG), employers must assess working conditions and take necessary protective measures. This duty applies whether you run a small office, a retail site, a production facility or a logistics operation. It is not a one-off form for a launch folder. It needs to reflect the actual workplace, tasks, equipment, people and substances involved.
A safety audit is a systematic review of whether your health and safety system, controls and records meet defined requirements. Its scope can be broad, looking at management arrangements across a site, or narrow, focusing on a subject such as fire safety, electrical equipment, training records or racking inspections. An audit asks questions such as: are assessments current, have actions been completed, are inspections documented, and do employees follow the measures set out?
Put simply, a risk assessment decides what needs controlling. A safety audit checks whether the organisation has controlled it properly and can demonstrate that it has done so.
What a risk assessment must examine
A useful risk assessment starts with observation, not assumptions. A generic template may offer a starting point, but it cannot tell you how staff use a particular loading bay, where visitors cross forklift routes, or whether a new cleaning product creates a hazardous substance exposure.
The assessment should consider physical, chemical, biological and organisational hazards, as well as ergonomic and psychosocial factors where relevant. For a warehouse, this may include vehicle movements, manual handling, work at height, storage systems, battery charging and emergency routes. In an office, it may cover display screen work, electrical equipment, home working arrangements, fire precautions and work-related stress.
The measures should follow the hierarchy of controls. Removing a hazard is stronger than relying on a warning sign, and engineering separation is generally stronger than asking people to be more careful. Personal protective equipment can be necessary, but it should not become the default answer where a safer system of work is possible.
Your documentation should make clear what was found, which measures were chosen, who owns each action and when the assessment will be reviewed. Employers must revisit it after meaningful changes, such as new machinery, altered layouts, new work processes, an accident or near miss, or a change in the workforce. Regular review also matters, because informal workarounds can slowly undo sensible controls.
What a safety audit looks for
An audit takes the risk assessment and follows the evidence. The auditor may tour the workplace, interview employees, sample records and compare day-to-day practice with your procedures and applicable requirements.
For example, your assessment may require forklift and pedestrian segregation. An audit checks whether marked routes remain visible, barriers are in place, new staff have been briefed, incidents are analysed and site changes have not introduced new crossing points. It tests implementation rather than accepting the document at face value.
A worthwhile audit usually considers several connected areas:
- whether risk assessments, operating instructions and emergency arrangements are current and suitable;
- whether statutory inspections, maintenance and testing have been planned and recorded;
- whether employees have received appropriate instruction and can apply it in their work;
- whether accidents, near misses and deficiencies lead to corrective action; and
- whether responsible people, including external specialists, have clearly defined tasks.
The audit result should distinguish between an isolated paperwork issue and a control failure that could expose people to harm. It should also set priorities. Not every finding carries the same urgency. A blocked emergency exit needs immediate attention; an overdue signature may still need correction, but it calls for a different response.
Are both required in Germany?
The risk assessment is an employer duty under ArbSchG. It is the foundation for many further obligations, including employee instruction, occupational medicine, fire precautions and controls for hazardous substances. Specific regulations may demand more detailed assessments for particular risks, such as work equipment under BetrSichV or hazardous substances under GefStoffV.
A general safety audit is not a single, universal document prescribed in the same way. However, audits and systematic reviews are often the practical way to demonstrate that safety management is being checked, maintained and improved. They may also be expected within a customer standard, an internal group framework, a certification programme such as ISO 45001, or an action plan following an inspection.
This distinction matters when you receive a deficiency notice from an accident insurance institution (Berufsgenossenschaft, or BG). If the notice asks for an assessment, sending an audit report alone is unlikely to address the underlying request. If you have an assessment but the authority identifies poor implementation, a focused audit can help reveal why the controls did not work in practice.
When each should come first
Start with a risk assessment when you are opening a German site, introducing a new activity, changing equipment or layouts, employing people in a new role, or discovering that no suitable assessment exists. You need a clear picture of the hazards before you can judge compliance.
Start with a safety audit when you already have safety documents and arrangements but lack confidence that they are current, complete or consistently followed. This is common in growing businesses where responsibilities have moved between managers, sites have changed quickly, or records sit in several systems.
After an accident, use both. Review the relevant risk assessment to establish whether it identified the hazard and specified adequate controls. Then audit the wider system: were the measures implemented, was training effective, was equipment maintained, and did supervision match the level of risk? The aim is not to assign blame. It is to prevent a repeat through evidence-led corrective action.
Turning findings into action
The value of either exercise lies in what happens next. A long list of issues without owners, deadlines and verification is only an inventory of exposure.
A practical route has three steps:
- Inspect and assess. Visit the workplace, identify hazards, review existing documents and speak to the people doing the work.
- Correct and document. Set proportionate measures, appoint responsible owners, update records and deliver instruction or training where needed.
- Review and maintain. Check that actions are complete, monitor changes and schedule recurring reviews, inspections and safety committee activity.
An occupational safety specialist (Fachkraft für Arbeitssicherheit, or SiFa) can support the technical assessment and help translate requirements into workable measures. A company doctor (Betriebsarzt) brings occupational health expertise where health risks, preventive care or workplace adjustments are involved. Their advice should connect with operations, rather than sit separately from them.
For some employers, an independent review is especially useful because it can challenge familiar habits without disrupting the business. For others, the priority is speed: a site inspection followed by a clear corrective plan when a BG letter or accident has exposed a gap. The right scope depends on your risks, sector, workforce and existing evidence.
Common questions about assessments and audits
Can an audit replace a risk assessment?
No. An audit may review the quality and implementation of risk assessments, but it does not replace the employer’s duty to assess workplace hazards and set protective measures.
How often should a risk assessment be reviewed?
There is no sensible single calendar answer for every workplace. Review it whenever conditions change or an incident reveals a weakness, and set routine reviews that fit the level and nature of risk.
Does a small office need both?
A small office still needs a suitable risk assessment. A formal, wide-ranging audit may not be proportionate every year, but periodic checks of fire safety, electrical arrangements, display screen work, training and documentation are sensible ways to keep controls effective.
Workplace safety becomes manageable when you treat it as an operating discipline, not a last-minute response to an inspection. If you are unsure which documents exist, which duties apply or where the practical gaps sit, Captain Safety can help you inspect the position, prioritise the work and move forward with confidence.