Preparing for a COMAH inspection: what inspectors actually trace

What a COMAH inspection is

The Control of Major Accident Hazards Regulations 2015 — Great Britain's implementation of the Seveso III Directive — put one duty above all the paperwork: the operator must take all measures necessary to prevent major accidents and limit their consequences. Upper-tier establishments describe those measures in a safety report; lower-tier establishments in a major accident prevention policy. Inspections are carried out by the Competent Authority — the Health and Safety Executive working jointly with the relevant environment agency — on a planned programme.

Here is the framing that makes preparation make sense: the safety report is a claim, and the site is the test. The report says a safety management system exists — that checks happen, that abnormal conditions are managed, that changes are controlled, that people are competent. The inspection exists to find out whether those sentences are true on a wet Tuesday night shift.

The show-me culture

The style of modern COMAH intervention is operational verification, not document review. Inspectors go to the plant. They ask the operator at the panel, not only the manager in the meeting room — and an operator who describes the actual practice, confidently, is worth more than any procedure binder. They pick a claim from the safety report and follow it down: name a measure, then “show me it running — last month, not last audit.”

This is why preparation-as-an-event fails. A site that scrambles to assemble evidence for a visit is demonstrating, in real time, that the evidence isn't produced naturally by its operations — which is itself a finding about the safety management system. The only preparation that works is running, every week, in a way that would survive an unannounced trace.

What gets traced

A trace starts at a sentence in the safety report and ends at operational reality. The trails inspectors walk most often:

• Scheduled checks → did they happen? The report says operating rounds and routine checks monitor the plant. Show the schedule, show completions against it — and show what the gaps look like, because a record with no visible gaps invites the harder question of whether it can show gaps at all.
• Abnormal findings → what followed? An operator flagged something. Where did it go, who judged it, what happened next? A warning that surfaced only after the failure it predicted is the classic incident-report sentence, and inspectors read incident reports.
• Defeated protection → who knows, who authorised, what's watching? Every plant sometimes runs with a device inhibited or bypassed. The question is whether that state is declared, authorised, compensated and time-bounded — or discovered. Ask any site to list every defeat live right now, with authorisations; the speed of the answer is the finding.
• Changes → were they controlled? The round that was modified, the procedure that was updated, the trip setting that moved: who changed it, on whose authority, and does the record show it?
• People → competent and attributable?Who carried out the check matters as much as the check. Records that can't say who — or that show leavers still holding access — undermine everything else they claim.

Questions to expect

Rehearse these — not the answers, the evidence behind them:

• “Show me the last month of rounds on this unit — and the ones that didn't happen.”
• “List every protective device currently defeated, who authorised each, and what's compensating.”
• “This reading was flagged abnormal in March. Walk me to its resolution.”
• “Who changed this check's frequency, when, and on what basis?”
• “How do I know this record hasn't been tidied since it was written?”
• “Ask that operator what they do when something looks wrong — then show me the record agreeing with them.”

What ready looks like

Ready is a set of properties, not a binder. Evidence that survives a trace is:

• Retrievable in minutes.“We'll get back to you” is an answer about the system, not the question.
• Honest about gaps.A missed check recorded as missed is a functioning system having a bad day. A blank that could be anything is a system that can't tell the difference.
• Attributable. Who did it, who judged it, who authorised it — including who could have touched the record.
• Tamper-evident. Corrections visible as corrections, never silent replacements.
• Produced naturally. The daily exhaust of running well — not an artefact assembled for the visit.

Note what's absent from that list: any particular technology. A disciplined paper system can hold these properties, at growing cost in effort; an undisciplined digital system holds none of them. The properties are the standard — pursue them in whatever medium your site can sustain.

Straight talk