This article is general guidance, not legal advice.
Factory customer audits may review how an organisation manages workplace safety, emergency readiness, ergonomics and follow-up actions. The exact checklist depends on the customer, audit scope and applicable requirements, so confirm the criteria directly before the audit.
Key Takeaways
- There is no single audit checklist that applies to every Penang factory or multinational customer.
- Common audit frameworks, including ISO 45001-style management systems and the Responsible Business Alliance (RBA) Code of Conduct, can help you anticipate broad health and safety themes.
- Auditors may look for evidence that policies, risk reviews, training, inspections and corrective actions are current and used in practice.
- Admin offices can be included in workplace reviews, especially for workstation ergonomics, access routes, emergency information and document control.
- Use the customer’s audit scope and current requirements as the source of truth; do not treat a general guide as a promise of audit compliance.
The 2-minute version
- Get the scope: Ask which standard, code, customer questionnaire and site areas are included.
- Check the basics: Review current safety responsibilities, risk assessments, emergency information and training records.
- Walk the office: Look at workstations, walkways, storage, electrical concerns and posted information.
- Match records to practice: Confirm that documents reflect what employees actually do and that the records are current.
- Close gaps: Assign an owner and due date for each finding, then keep evidence that the action was completed and reviewed.
What might a factory customer audit cover?
A customer audit is an assessment against a defined set of expectations. The customer may use its own supplier code, a third-party audit programme, a recognised management standard or a combination. The scope can differ by customer, factory, product, service and business relationship.
This article describes common themes found in health and safety management approaches. It does not claim that any particular multinational company uses these exact checks, nor that every audit includes all of them.
ISO 45001 is an international standard for occupational health and safety management systems. ISO describes key elements such as leadership commitment, worker participation, hazard identification and risk assessment, legal compliance, emergency planning, incident investigation and continual improvement. These ideas can help a factory prepare its system and records, but an ISO-style review is not the same as a particular customer audit.
The RBA Code of Conduct is a set of social, environmental and ethical industry standards. Its health and safety content includes themes such as emergency preparedness, communication, risk management, worker participation and ergonomics or physically demanding work. RBA materials can be useful reference points, but do not assume a factory is being assessed under the RBA programme unless the customer says so.
Which documents should the admin team check first?
Start with the audit request. Note the named standard or code, the locations and departments in scope, the period of records requested, the format required and the deadline. Ask the customer or audit coordinator to clarify anything ambiguous.
Then locate the current versions of the documents that relate to those topics. Depending on the scope, this may include safety policies, risk assessments, training records, inspection records, emergency plans, incident follow-up and evidence of corrective actions. The appropriate records depend on the organisation and legal requirements.
Admin staff often help gather and organise evidence, but they should not guess at legal interpretations or change technical records to make them appear complete. Ask the responsible safety, HR, facilities or operations owner to verify content and resolve questions.
| Common audit theme |
Evidence an auditor may request |
Admin office check |
| Roles and responsibilities |
Current policy, organisation chart, assigned duties or committee records where applicable |
Names, roles and contact details match current personnel |
| Hazard identification and risk review |
Risk assessments, action logs, review dates and evidence of worker input |
Documents are approved, current and stored where authorised staff can find them |
| Training and communication |
Training matrix, attendance evidence, briefings and worker information |
Records identify the subject, audience, date and any follow-up needed |
| Emergency preparedness |
Emergency plan, contact arrangements, drill records and follow-up actions |
Posted information is readable, current and consistent with the controlled plan |
| Incident and corrective action |
Incident records, investigation notes, action owners and completion evidence |
Open actions are tracked; closed actions have evidence of completion |
| Ergonomics and office safety |
Workstation checks, reported concerns, risk controls or improvement records |
Walkways, storage, desks and shared areas are checked and concerns are routed |
How do auditors look at health and safety management?
An audit commonly checks whether the organisation has a process and whether that process is working. A policy on a shared drive is only one piece of evidence. The auditor may compare the documented process with records, workplace conditions and employee understanding.
For example, a risk assessment may identify a hazard and name a control. The auditor could then ask who is responsible, whether the control is in place, how employees are informed and whether the organisation checks that it remains effective. If an incident or inspection identified a gap, the auditor may follow the action through to closure.
ISO 45001 provides a framework for managing occupational health and safety. It does not mean every customer audit is an ISO audit. A company may use ISO 45001 as an internal system reference, ask a supplier about its practices, or require a particular certification. Confirm which applies rather than assuming.
What office conditions could come up in a factory audit?
The admin office may be part of the factory workplace and may be included in a walk-through. Auditors or internal reviewers may notice whether workstations support the tasks being performed, whether storage creates a hazard, whether routes are clear and whether information is legible and current.
DOSH publishes Malaysian guidance on display screen equipment, seating, standing work and ergonomic risk assessment. These documents can inform practical workstation reviews. They do not replace the organisation’s risk management process or determine the exact questions a customer will ask.
Consider how employees use screens, keyboards, phones and paper records. Check whether commonly used items are easy to reach, whether glare or clutter interferes with work, and whether chairs and desks are in suitable condition. Invite staff to report discomfort or difficulties, and route concerns to the right person for review.
For office safety responsibilities in Malaysia, see OSHA for Offices in Malaysia.
How should you prepare emergency information?
Emergency preparedness is a common theme in occupational health and safety systems. ISO 45001 includes emergency planning and response among its key elements. RBA’s Code of Conduct and related assessment material also address emergency plans, communication, evacuation and drills.
For the admin office, check that the relevant emergency information is easy to find, readable and aligned with the current controlled plan. Confirm that the correct internal contacts and reporting routes are listed. If the building layout, emergency team or contact details have changed, refer to the responsible owner to update the posted information.
Do not invent or display emergency instructions that conflict with the site’s approved plan. If you notice inconsistent maps, contact numbers or exit information, raise the issue and record who will correct it. A customer audit may ask how the organisation ensures that employees receive instructions and how it follows up on gaps identified during exercises.
Keep drill and training evidence in the format required by the organisation and the applicable audit scope. If the auditor requests records for particular dates, shifts, departments or groups, check the request with the responsible safety owner before declaring that evidence is complete.
How should you manage audit findings and corrective actions?
A finding is an issue identified during an audit or review. A corrective action is the response intended to address the cause and reduce the chance of the issue recurring. Different customers may use different labels, severity ratings, deadlines and closure rules, so follow their process.
For each finding, capture what was observed, the relevant requirement, the person responsible, the agreed action and the due date. Keep evidence of the work completed. Where the customer asks for a root cause, the responsible team should explain why the issue occurred rather than simply restating the observation.
Check that the proposed action addresses the issue. Replacing a damaged chair may resolve that immediate condition, while recurring damage may also call for a maintenance or purchasing review. Whether that deeper review is needed depends on the finding and the organisation’s process.
Before submitting evidence, make sure it is accurate, legible, relevant to the finding and approved by the right owner. Keep a copy of what was submitted and record any customer response or request for more information.
| Finding stage |
Question to resolve |
Useful evidence |
| Record |
What exactly did the auditor observe or identify? |
Finding text, date, location and related requirement |
| Assign |
Who can investigate and approve the response? |
Named action owner and agreed due date |
| Correct |
What immediate step addresses the observed issue? |
Repair, update, communication or other completion record |
| Review cause |
Why did the issue happen, and could it recur elsewhere? |
Investigation notes and any wider review |
| Verify |
Did the action work, and is it accepted under the audit process? |
Follow-up check, supporting evidence and customer response |
What common audit preparation mistakes should you avoid?
- Assuming all MNCs use the same checklist: Ask for the customer’s actual scope and criteria.
- Calling a general review an RBA audit: Use RBA language only when the assessment or customer request supports it.
- Assuming ISO certification is required: Verify whether the customer asks for a certified system, alignment with a standard or other evidence.
- Sending outdated records: Check versions, dates, names and locations before sharing documents.
- Preparing documents that do not match practice: Walk the office and confirm that posted information and actual arrangements align.
- Closing actions without proof: Keep records showing what was done and any required follow-up.
- Using furniture as a compliance claim: A particular desk or chair does not prove that the whole safety management system meets an audit criterion.
- Guessing at technical or legal answers: Refer the question to the responsible qualified person and mark uncertain items for verification.
Fictional Malaysian example: a Penang factory office
This example is fictional and does not represent the requirements of any named company.
A factory in Bayan Lepas receives notice of a customer audit covering workplace health and safety. The email names emergency preparedness, worker communication and office ergonomics but does not explain which departments are included.
The admin manager asks the audit coordinator to confirm the scope and period of records required. The safety team checks the emergency information and training records. Facilities reviews the office workstations and the action log for reported issues. They find an old contact number on a noticeboard and a completed workstation action that has no follow-up note.
The responsible owners update the contact information and record the follow-up check. The admin manager organises the approved evidence by audit topic and tracks any remaining questions. The team does not claim that this preparation guarantees a successful audit; it gives them a clearer, more accurate way to respond.
How can office furniture support workplace readiness?
Furniture supports the way people work, organise documents and move through shared spaces. When planning a factory admin office, consider the tasks, user needs, storage, adjustability, durability and maintenance. Review the setup with employees and facilities staff, then include any concerns in the workplace review process.
Furniture is one part of the work environment. It does not establish ISO 45001 certification, RBA conformance or customer audit approval. Those depend on the relevant assessment criteria and the organisation’s wider systems and evidence.
iGreen can help organisations in Kuala Lumpur and Penang review office furniture and workspace requirements.
Request a site assessment from iGreen (KL and Penang).
Frequently asked questions
Do all Penang MNC factories use the RBA Code of Conduct?
No general statement can establish that for every factory or customer. RBA publishes a Code of Conduct used across multiple industries, but confirm whether a particular customer or audit programme applies it.
Does ISO 45001 require a factory to have office furniture certified to ISO 45001?
ISO 45001 is an occupational health and safety management system standard for organisations. It is not a furniture product certification. Check the ISO standard and the customer’s request for the exact scope.
Will an auditor inspect the admin office?
It depends on the audit scope and site arrangements. Office areas may be included in a workplace review, so keep the area orderly and make sure relevant information is current.
What should we do if an audit request is unclear?
Ask the customer or audit coordinator to clarify the applicable standard, locations, period, evidence format and deadline. Route technical or legal questions to the responsible qualified person.
Does buying ergonomic furniture make the office audit-ready?
No. Furniture may support a suitable work setup, but audit readiness also involves risk review, communication, training, emergency arrangements, records and follow-up under the applicable criteria.
Reviewed by
Official sources