A compliance audit pack means different things in different contexts. A UK client carrying out due diligence wants different evidence to an HSE inspector who has just walked onto your site. But the underlying principle is the same: you need to be able to demonstrate, with documentation, that a project has been managed to a standard that meets your legal and contractual obligations.
The problem is that most UK construction companies don't maintain compliance evidence in a state where it can be produced quickly. When a client asks for an audit pack as part of a tender, or an HSE inspector requests records on the day of a visit, the scramble to compile everything from disparate sources is stressful, time-consuming, and often incomplete.
Here's what a complete CDM audit pack needs to contain — and why.
1. The Construction Phase Plan
This is the centrepiece of CDM 2015 compliance on a notifiable project. It needs to be project-specific, not a recycled template, and it needs to reflect the current state of the work — not just the pre-construction plan written at the start. Inspectors and clients will look for site-specific hazard identification, emergency arrangements, welfare provision details, and evidence of how coordination between contractors is managed.
Include the original plan and any revisions, with dates.
2. F10 HSE Notification Reference
If the project is notifiable under CDM 2015, the F10 reference is your proof of compliance with the notification requirement. It should be displayed on the site notice board and included in any audit documentation. If you've updated the F10 (for changes to key personnel or programme), include the updated version.
3. Daily Site Logs
A chronological record of what work was carried out, how many workers were on site, what plant was in use, any deliveries, and anything of note. The value of daily logs in an audit context is that they demonstrate continuous management — they show that someone was on site, taking responsibility, recording what was happening. A gap in the logs is a gap in your evidence.
Site diaries completed retrospectively are generally obvious — the writing is too consistent, the detail is too thin, and the dates don't quite align with other records. HSE inspectors recognise this.
4. Toolbox Talk Records
Date, topic, who delivered it, which workers attended (signed), and brief notes on what was covered. Toolbox talks are one of the key ways a UK principal contractor demonstrates it's maintaining an ongoing safety briefing culture on site. The content should reflect current site conditions — a generic talk delivered in week one isn't the same as safety briefings that track the progression of work.
5. Site Induction Records
Every person who sets foot on the site should have completed an induction, and you should be able to demonstrate this with a signed record. The induction register should cross-reference with daily log entries — if a worker appears in your daily records before their induction date, that's a gap that needs explaining.
6. Checklist and Inspection Records
Regular site inspections — weekly safety walkarounds, scaffold inspections, fire equipment checks, pre-use plant checks — generate a trail of evidence that demonstrates ongoing management. Completed checklists, with dates, the name of the person carrying out the inspection, and any remedial actions recorded, are valuable evidence of proactive compliance management.
7. Incident and Near-Miss Log
All incidents and near misses, however minor, should be recorded. For any that met the RIDDOR reporting thresholds, include the HSE notification reference. For any that were investigated, include the investigation findings and actions taken.
An incident log with very few entries isn't necessarily reassuring to an auditor — on a large, active site, a zero-incident log can suggest that near misses aren't being reported internally.
8. Document Register
Insurance certificates (employers' liability, public liability, professional indemnity where relevant), RAMS from subcontractors, method statements, COSHH assessments, and any other project-specific documents — critically, with their expiry dates. A document register that contains expired insurance is potentially worse than no register at all, because it shows you knew about the expiry and didn't act.
9. Subcontractor Compliance Records
For each subcontractor: their insurance certificates, a copy of their RAMS, evidence that you reviewed and accepted their RAMS before work started, and records of their workers' certifications where relevant. Principal contractors carry responsibility for subcontractor management under CDM — if a subcontractor's employer liability insurance had lapsed and something goes wrong, the principal contractor is in a difficult position.
10. Worker Competency Matrix
CSCS cards, first aid qualifications, working at height certifications, plant operator licences (CPCS/NPORS), asbestos awareness, CISRS scaffolding cards. For skilled roles, competency needs to be demonstrable. A matrix showing each worker's certifications, their issue dates, and when they expire is a clear and auditable format. See our guide on CSCS card and certification expiry tracking for more detail.
The compilation problem
The challenge isn't understanding what an audit pack needs — it's maintaining all of this information in a form where it can be compiled quickly. When these records exist across a combination of paper files, email attachments, spreadsheets, photos on phone cameras, and site office folders, pulling them together takes days and pulls people away from site work.
Lasso is built so that every item in this list is captured digitally as it happens — daily logs completed on-site, checklists ticked off on mobile, incidents reported with photos attached. The result is that generating an audit pack for any project for any date range is a 30-second operation rather than a multi-day exercise.
Sign up for Lasso and see what a complete, always-current audit pack looks like.
Frequently asked questions
What is a CDM compliance audit pack?
A CDM compliance audit pack is a compiled set of documentation demonstrating that a UK construction project has been managed in accordance with CDM 2015. It typically includes the Construction Phase Plan, daily site logs, toolbox talk records, induction records, incident logs, subcontractor compliance documents, and worker competency records.
How quickly should a UK construction company be able to produce a compliance audit pack?
Immediately. HSE inspectors can arrive unannounced and request records on the day. If producing a compliance pack takes more than a few minutes, the process of maintaining those records needs reviewing.
How long must construction compliance records be kept in the UK?
RIDDOR records must be kept for at least 3 years. In practice all project documentation should be retained for a minimum of 6 years given limitation periods under the Limitation Act 1980 for potential civil claims.
What happens if your audit pack is incomplete during an HSE inspection?
An incomplete audit pack can result in improvement notices, further scrutiny, and potentially prohibition notices if gaps suggest active safety risks. Even where no immediate action is taken, a letter identifying compliance gaps creates a record that affects culpability if a subsequent incident occurs.