Last reviewed 29 April 2021

Christopher Wagner of Pellys Transport & Regulatory Law considers the increased use of compliance audit undertakings, the importance of ensuring that audits are carried out and acted upon correctly and the regulatory risks involved in getting them wrong.

The role of compliance audits

The purpose of compliance systems auditing in commercial vehicle operations is to ensure that quality standards, particularly in relation to O-licence undertakings, are met. It is not uncommon, especially during the Covid-19 pandemic, for operators to be required by Traffic Commissioners (TCs) to commission independent audits of their compliance systems and keeping in mind the true purpose of the audit should help operators to ensure they gain maximum value from the process and avoid potentially serious regulatory pitfalls.

Most operators will be aware of systems compliance audits as a means to evaluate how they are doing. Commissioning these audits may be voluntary for some but for others, an audit may be required to fulfil an undertaking imposed by a Traffic Commissioner. Either way, the purpose of the audit is the same: to have an independent party carry out an assessment of the operator’s current systems and procedures for compliance and identifying areas which require improvement.

The increased use of auditing during Covid-19

At the peak of the first Covid-19 lockdown, all the Offices of the Traffic Commissioner were forced to close and a number of hearings were therefore cancelled or postponed. Given the inevitable backlog of cases, this created the availability of hearing time once the tribunals re-opened became limited, so the most serious cases (or those with the most urgent road safety concerns) were prioritised for hearings ahead of less serious cases.

One of the effects of this build-up of cases is that there has been an increase in the use by Traffic Commissioners of compliance audit undertakings to monitor the performance of operators that have popped up on the regulatory radar. In this way, the need to attend a hearing is avoided (at least initially — see below) but the Traffic Commissioner is still provided with valuable information on the operator’s compliance performance which can inform what further steps, if any, to take.

These compliance audit undertakings generally require the operator to arrange an independent systems audit by a specified date, with the audit report to be supplied to the Office of the Traffic Commissioner (OTC) usually with 2–4 weeks of the audit visit. Importantly, the undertaking also commonly requires the operator to provide its proposals for implementing any recommendations made by the auditor, usually at the same time as supplying the report.

Completed properly, this compliance audit process presents operators with a golden opportunity to avoid what might otherwise be a difficult hearing and the risk of immediate regulatory action. However, a failure in relation to any part of the audit process (as reviewed below), could land the operator in an even worse position.

Getting the audit right

Before instructing an auditor, the operator should carefully review the wording of the undertaking. Often, there are specific requirements relating to the content and format of the audit, perhaps informed by the types of issues the operator is being scrutinised for in the first place. There may also be a stipulation as to the qualifications of the auditor and, in certain cases, specific providers may even be named.

In addition to anything specific in the wording of the undertaking, there is also OTC guidance published on the correct content and format of audits which should be followed. The above link also provides this guidance with additional specific detail on how to conduct audits remotely during the Covid-19 pandemic.

Operators should therefore be forward in asking the auditor directly whether they are familiar with this guidance — and should keep in mind that it is for the operator to provide the auditor with instructions as to what is needed. If the audit report is not assessed as meeting the requirements because of an issue with the content or format, the operator (not the auditor) will be held responsible.

There are many providers of audit services and there is variation in quality — it is thus vital to ensure that the auditor is suitably experienced, qualified and knows exactly what is required. It is also crucial to find out at the time of enquiry what the auditor’s capacity is, mindful that there will be a deadline and the auditor will need to be able to produce the report on time. An O-licence undertaking is the sum of all of its parts and failing to get the audit report submitted on time will almost certainly be viewed as a failure to comply with the undertaking (no matter how good the late audit report is). This could then invite a further public inquiry.

Preparing for the audit

Consider again that the purpose of the audit is an examination of the quality or standard of the operator’s compliance systems. Via the audit report, the Traffic Commissioner is asking for an independent view on how compliant an operator is — so there is an obvious rationale to ensuring that the report produced will be as positive as it can be by the time of the audit.

Operators ought to go through the OTC guidance in advance to assess where they are in relation to each of the items being checked in the audit. Some auditors may be prepared to send the operator a blank copy of the report template they will use so that operator can carry out its own “dry run”. It is certainly worth asking and it is important that the operator is well-prepared.

Responding to the audit

Perhaps the most crucial element of the whole process is the way in which the operator responds to the auditor’s recommendations. No matter how well prepared an operator may be, it is highly unlikely that a competent auditor will find nothing to suggest and operators should treat a 100% perfect audit with an element of scepticism — the Traffic Commissioner certainly will.

Upon receipt of the report, in addition to checking that it is complete, covers everything it should and is correctly formatted (reference again the OTC guidance), operators should check that the findings reflect what the operator believes was shown to the auditor. Whilst the auditor must remain independent (and cannot re-write negative elements of the report if they are accurate), the operator is fully entitled to raise queries where it appears the auditor has misunderstood something or just made a mistake.

Assuming that the report is a true reflection, the operator should then provide a detailed written response. Each individual recommendation should be explicitly referred to and then responded to. In most cases, this is likely to involve realistic, achievable plans to implement the recommendations, including a feasible timetable. Yet equally, these are recommendations, not stipulations and whilst the benefit of good auditors is their experience and expertise, they do not have final say; if something that the auditor has recommended is simply not feasible, or the operator has a genuine objection to it, then they are entitled to an alternative view as long as it is explained. What is important is that the Traffic Commissioner is clear that the operator has applied genuine consideration to each of the recommendations.

Most fundamentally, the operator will be held to the promises made in this document — so operators should be wary of agreeing to do something which is unrealistic.

Assessing regulatory risk and reward

As well as being late on submitting the audit, any shortcomings in the format and content of the audit, or failing to produce a suitable response at all, will be regarded as a failure to comply with the undertaking and could well lead to a public inquiry.

The findings of the audit and the content and quality of the operator’s response will also be scrutinised by the Traffic Commissioner and glaring compliance issues (or failure to respond to them properly) will very likely also trigger a call-up to public inquiry.

With that said, an audit should be seen as an opportunity to improve rather than a difficult examination and operators should do all they can to be “audit ready” at any time. After all, most of the points that form the basis of an audit are fundamental O-licensing pre-requisites, which would form part of any DVSA inspection visit.

Even if there is no requirement for an audit, it may well be worth commissioning one to identify areas of improvement and, at the very least, reviewing the audit guidance can help form a view about how you are doing.

In the end, the process of completing an audit well, as outlined above, can be as straightforward, organised and effective as you want to make it and following the process properly, with attention paid to details and decisions, could make the difference between losing and keeping your operator’s licence.