Internal or External Audit?

The Ministry of Manpower opened a workshop on action plans for companies implementing SMK3, Indonesia's occupational safety and health management system, in Jakarta on 3 December 2024. The acting Director General for labour inspection and OHS said that to prove a company has implemented SMK3, it must be assessed through an SMK3 audit, either by the company itself or by a third party, an SMK3 audit body, in order to gain national recognition. The ministry also cited BPJS Ketenagakerjaan reports showing work accidents rising from 234,371 cases in 2021 to 298,137 in 2022 and 370,747 in 2023 (Kementerian Ketenagakerjaan [Kemnaker], 2024).

That statement names two audit routes at once. On site they are often blurred: the internal audit is treated as a rehearsal for the external one, and the external certificate is treated as proof that the system is finished. This article compares internal and external SMK3 audits on five criteria: legal basis, who audits, criteria and frequency, outcome, and weak points.

Internal SMK3 Audits

Government Regulation No. 50 of 2012 on the Implementation of OHS Management Systems requires employers to monitor and evaluate OHS performance through inspection, testing, measurement and internal SMK3 audits carried out by competent people. A company without those resources may use an outside party, and the results are reported to the employer for corrective action (Article 14). Annex I states that internal audits must be periodic, may use the external audit criteria, and should be scheduled on the basis of previous audit results and evidence of hazards at the workplace. Annex II adds that internal audits are carried out by staff who are independent, competent and authorised (Pemerintah Republik Indonesia, 2012). In ISO 19011:2018 terms, this is a first-party audit, conducted by or on behalf of the organisation itself (International Organization for Standardization [ISO], 2018).

External SMK3 Audits

Regulation 50/2012 provides that SMK3 implementation is assessed by an independent audit body appointed by the Minister at the company's request, and that companies with high hazard potential must undergo the assessment (Article 16) (Pemerintah Republik Indonesia, 2012). Minister of Manpower Regulation No. 26 of 2014 sets out the details. External audits apply to companies that apply voluntarily, to high-hazard companies such as mining and oil and gas, and to companies designated by the Director General or a provincial manpower office (Article 3). The assessment has three levels: initial with 64 criteria, transitional with 122 and advanced with 166 (Article 20). Critical findings must be corrected within 1 x 24 hours and major findings within 1 month (Articles 26 and 27). A score of 0 to 59 percent is rated poor, 60 to 84 percent good and 85 to 100 percent satisfactory, with silver or gold certificates or flags valid for at most 3 years (Article 30). The audited company bears the cost (Article 31) (Kemnaker, 2014). ISO 19011:2018 classes audits of this kind as third-party audits (ISO, 2018).

Strengths and Weaknesses

External audits are stronger on independence and recognition. Their weakness is that they capture conditions on the audit day, while the award lasts up to 3 years. Internal audits can be run more often and aimed at the hazards that matter most, but they lose their edge when auditors review their own unit or hesitate to report findings to their superiors.

Field evidence shows that a certificate does not mean an absence of gaps. Ayunita et al. (2021) studied an educational institution holding a gold certificate at the initial level that still had minor findings, including training and certification of the designated OHS expert and emergency officers, and communication with the relevant government agencies on its OHS committee decree. A realist review by Madsen et al. (2020) of 18 empirical studies on OHSAS 18001 found that certified management systems succeed only when certain combinations of context and mechanisms are in place, and suggested thorough internal evaluations before a company starts a certification scheme. Both studies come from different settings and are small, so we use them as pointers rather than as measures of effectiveness.

From this comparison, we see the two audits working at different layers. The external audit answers whether the system meets national criteria at one point in time. The internal audit answers whether the system keeps running between those points.

Using Both Well

Some steps companies can take:

• Set an annual internal audit programme whose frequency follows hazard levels and earlier findings, not only the run-up to the external audit.
• Use the external criteria in Regulation 50/2012 as the internal checklist so that findings can be compared year on year.
• Choose internal auditors from other units or from outside so that nobody audits their own work, and train them in auditing.
• Track corrective actions to closure and take the results to management review.
• Treat the SMK3 certificate as the start of monitoring, not the end of a project.

How Nusa Safety Helps

Nusa Safety helps companies prepare and run internal SMK3 audits, and supports system building through SMK3 and ISO 45001 implementation. Nusa Safety is not an SMK3 audit body and does not issue SMK3 certificates; external audits remain the work of audit bodies appointed by the Minister.

This article is general information and is not legal or professional advice for any specific case.

References

1. Ayunita, D. R., Kurniawan, B., & Widjasena, B. (2021). Analisis ketidaksesuaian penerapan sistem manajemen keselamatan dan kesehatan kerja (SMK3) di institusi pendidikan X berdasarkan hasil audit SMK3 [Analysis of nonconformities in SMK3 implementation at educational institution X based on SMK3 audit results]. Jurnal Riset Kesehatan Masyarakat, 1(1). https://doi.org/10.14710/jrkm.2021.11920
2. International Organization for Standardization. (2018). Guidelines for auditing management systems (ISO Standard No. 19011:2018). https://www.iso.org/standard/70017.html
3. Kementerian Ketenagakerjaan Republik Indonesia. (2014). Peraturan Menteri Ketenagakerjaan Nomor 26 Tahun 2014 tentang Penyelenggaraan Penilaian Penerapan Sistem Manajemen Keselamatan dan Kesehatan Kerja [Minister of Manpower Regulation No. 26 of 2014 on assessing the implementation of OHS management systems]. https://jdih.kemnaker.go.id/peraturan/detail/577/
4. Kementerian Ketenagakerjaan Republik Indonesia. (2024, December 4). Kecelakan kerja terus meningkat, Kemnaker ajak perusahaan terapkan SMK3 secara konsisten [Work accidents keep rising, ministry urges companies to apply SMK3 consistently]. https://kemnaker.go.id/news/detail/kecelakan-kerja-terus-meningkat-kemnaker-ajak-perusahaan-terapkan-smk3-secara-konsisten
5. Madsen, C. U., Kirkegaard, M. L., Dyreborg, J., & Hasle, P. (2020). Making occupational health and safety management systems 'work': A realist review of the OHSAS 18001 standard. Safety Science, 129, 104843. https://doi.org/10.1016/j.ssci.2020.104843
6. Pemerintah Republik Indonesia. (2012). Peraturan Pemerintah Nomor 50 Tahun 2012 tentang Penerapan Sistem Manajemen Keselamatan dan Kesehatan Kerja [Government Regulation No. 50 of 2012 on the implementation of OHS management systems]. https://peraturan.bpk.go.id/Details/5263/pp-no-50-tahun-2012