Preparing for a SMETA audit: the four pillars and common nonconformities

A buyer's compliance team sends a short message: before the next purchase order is confirmed, your site needs a current SMETA audit on the Sedex platform. You have a window of a few weeks. Booking the audit is the easy part. Being ready for it is where most factories lose ground, because a SMETA audit does not hand out a pass or a fail. It produces a report and a corrective action plan that your customers can read line by line.

That distinction changes how you should prepare. SMETA, the Sedex Members Ethical Trade Audit, is a shared audit method rather than a certificate you either earn or miss. Auditors measure your site against the agreed code of conduct and local law, write up every gap as a finding, and upload the result for your members to see. Preparation, then, is not about looking good for a day. It is about closing real gaps before they are recorded against you and shared across your customer base.

How the format sets your preparation scope

SMETA runs as either a two-pillar or a four-pillar audit, and your customer tells you which version they expect, with large retailers increasingly insisting on all four. That single detail decides how wide your preparation has to reach. If the order calls for four pillars, the environment and business-ethics evidence you bring to the SMETA audit has to be as ready as your labour and health-and-safety work, never an afterthought you assemble the night before. Scope your preparation to the format the day you book it, because those two extra pillars are where an otherwise well-run site still collects avoidable findings.

Whichever format applies, the auditor works through the same logic in each area: what does your policy say, what do your records show, what does the floor look like, and what do workers tell us in private. Findings are raised where those four views disagree. The four pillars below are where audits actually catch people, and each one carries its own recurring pattern of nonconformities.

Labour standards: where the hours rarely add up

Working hours sits consistently among the most frequently raised findings in ethical audits, year after year. Excessive overtime, missing rest days, and a seventh consecutive working day are common, but the deeper problem is record integrity. Auditors triangulate: they compare time records against payroll and against production output. When a line ran at full volume on a day the time sheets show as quiet, the gap becomes a finding, and a suspicion of double records is far more damaging than honest overtime.

Wages are the next recurring theme. Overtime premiums calculated at the wrong rate, incomplete payslips, and workers not fully enrolled in social insurance all show up regularly. So does the handling of young workers and the right to work: missing age-verification records or incomplete identity files can turn into a child-labour or forced-labour concern very quickly, and those carry the heaviest weight in any report. Retaining original documents, charging recruitment fees, or taking deposits are read as indicators of forced labour even when no one intended harm.

The corrective action that closes these findings is rarely a quick fix. If overtime is structural, the root cause sits in production planning and staffing, not in the time-keeping software. Recalculate the affected wages, correct the records going forward, and be ready to show the auditor the change at the follow-up, not just a promise on paper.

Health and safety: the largest pile of findings

By sheer count, health and safety tends to generate more nonconformities than any other pillar, partly because it is so physical and visible. Fire safety leads the list: blocked or locked emergency exits, missing or out-of-date extinguishers, no evidence of drills, and alarms that have never been tested. Auditors walk the escape routes themselves, so a corridor stacked with cartons is found in minutes.

Machine safety is close behind. Unguarded moving parts, missing emergency stops, and no record of maintenance are standard findings on a production floor. Chemicals are another reliable source: a safety data sheet missing for a solvent in daily use, incompatible substances stored together, or no secondary containment under a drum. Round it out with personal protective equipment that workers do not actually wear, too few trained first-aiders, and risk assessments that exist as a template but were never applied to the real workplace.

The mistake here is cosmetic remediation. Painting a walkway line the week before the audit does not address why guarding was removed or why the exit was blocked. A finding closes properly when you can show a risk assessment that drove the change, the dated evidence that the fix is in place, and a system that keeps it there.

Environment and business ethics: the pillars people forget

Sites that prepare hard for labour and safety often arrive underprepared for the other two pillars, and four-pillar audits punish that. On the environmental side, the usual findings are an expired or missing operating permit, waste streams that are not segregated or documented, and wastewater discharged without the right consent. None of this is exotic, but the paperwork has to be current on the day.

Business ethics is the quietest pillar and the one most often empty. Auditors look for a written anti-bribery and corruption position, a grievance channel that workers can actually reach, and evidence that it is used and acted on. A grievance box no one has opened in a year is worse than none, because it shows the mechanism is decorative. Put a real policy in place, tell workers how to raise concerns without fear, and keep a log that shows issues were handled.

Turning findings into a plan that actually closes

Every SMETA audit ends with a corrective action plan report. Each finding is recorded against the requirement it breaches, rated by severity, and handed to you to resolve. Some findings are flagged as business critical: an immediate danger to life, any sign of child or forced labour, an attempt to bribe the auditor, blocked access, or evidence that records were falsified or workers coached. These are the issues that stop buyers in their tracks, and they cannot be talked away.

This is why honesty during preparation matters more than polish. Coaching workers on what to say, or dressing up records for the day, is itself one of the most serious findings an auditor can raise, and it travels straight to your customers through the shared platform. Treat the corrective action plan as a real remediation schedule: fix the immediate hazards now, set realistic dates for the structural items, assign each action to a named owner, and gather the evidence as you go so the follow-up stays short.

A pre-audit routine that holds up

Start with an honest self-assessment. The questionnaire you complete for your Sedex membership is a useful map of what the auditor will examine, so treat each question as a gap analysis rather than a form to clear. Pull the document pack together early: time and payroll records, age and right-to-work files, contracts, risk assessments, machine maintenance logs, the chemical inventory with its data sheets, fire-drill and first-aid records, permits, and the grievance log. Then walk your own floor the way an auditor will, checking exits, guarding, chemical storage, and welfare facilities with fresh eyes.

Reconcile your numbers before someone else does: hours, pay, and production should tell the same story. Brief your managers and your workers honestly, so they understand the audit is confidential and that candour is expected, never rehearsed answers. Disclose subcontractors, agency labour, and any homeworkers rather than letting the auditor discover them. Finally, name one person to own the corrective action plan from the first finding to the closing evidence. If you want the audit run and supported end to end, our team handles the SMETA audit and the route into membership, so the report that reaches your buyers reflects the site you have genuinely built.