Subchapter 3.1 · Savannah, Georgia

Setting: Savannah, Georgia

The card shows a service corridor walled in old red brick, under a single ceiling tube, and three people gathered round a linen trolley stacked with folded sheets above two canvas bags. The maintenance supervisor, in a navy work shirt, grips the handle with both hands and presses the brake pedal down with his boot, demonstrating something he has known for years. On the other side the head housekeeper, in a grey tunic, points at the floor ahead of the wheels. Between them the quality and compliance manager holds a few sheets of paper flat against her chest and looks down at the wheels. For once, nobody is looking at the paper.

The title is meant literally. In Savannah two of the seven trolleys had a brake that had never worked properly, and the maintenance supervisor knew it. The head housekeeper had raised the ramp twice, at the shift briefing and never in writing; a night porter had begun taking a longer route and told nobody. In September a room attendant let go of a loaded trolley at the head of the fourth-floor ramp, and it ran until the wall at the turn stopped it. Charlene Boyd’s audit that year had produced eleven findings, all correct, all accepted, all closed within eight weeks. The two upper plaques, “Eleven findings, all closed” and “Two brakes never worked”, set those facts side by side. Both were true at once, in the same building.

Clause 9.2 of ISO 45001:2018 asks two questions, not one: whether the system conforms to the organisation’s own requirements and to the standard, and whether it is effectively implemented and maintained. Boyd’s audit answered the first with rigour and never reached the second.

The clause also requires the programme to take into consideration the importance of the processes concerned, and in a safety system importance sits where the records are thinnest, in the hazards identified under 6.1.2 and the controls chosen under 8.1.2. It requires objectivity and impartiality of the audit process, and it requires the relevant results to reach workers and their representatives, an obligation the quality standard does not carry.

The lower left plaque, “Records are not the work”, names the practical lesson. A quality system leaves its evidence as a by-product of operating; a safety system produces a parallel set of documents about the work, thickest where the exposure is thinnest. An owner who wants to know what the audit programme is built to find can sort the last report into findings about documents and findings about conditions. An auditor who wants the ramp rather than the binder asks which equipment people quietly avoid, and why.

The plaque at the lower right, “Audit where harm lives”, is not an instruction to stop reading documents. A property on the same coast tried that and stopped examining the hazard identification that decides whether conditions are found at all. The paper in the manager’s hands is not wrong. It is simply not where the brake is.

Subchapter 3.2 · Verona, Italy

Setting: Verona, Italy

The card is set in the back-of-house lift lobby of a converted palazzo. The steel doors of the goods lift stand open. A young banqueting porter in a black waistcoat, sleeves rolled, leans his weight into a tall rack of stacked banquet chairs, red seats on gilt frames, and pushes it across the threshold. To the left a laundry attendant in a pale-blue tunic waits with both hands on a wire cage of bagged linen. To the right the quality and safety coordinator, in a navy suit with a radio in her hand, watches the rack go in. Her expression is not alarm but the attention of somebody seeing an ordinary arrangement for the first time.

That is the meaning of the title. Ilaria Bonetti had worked in the building for four years and audited it sixteen times, and she had never been inside it after seven in the evening. On an August night in the opera season, covering for a sick duty manager, she found the late supper service at full production, the banqueting team breaking down the conference floor, the laundry running its night cycle, and at a quarter to two one goods lift carrying chair racks and linen cages alternately, because there is only one. The upper plaques record both halves of the discovery: “Quarter to two, one lift” and “Never audited after seven”. Her hazard identification named all three; her programme had been built from her calendar.

Clause 9.2 of ISO 45001:2018 requires an audit programme that includes frequency, methods, responsibilities, consultation, planning requirements and reporting, and that takes into consideration the importance of the processes concerned and the results of previous audits. Importance is already recorded in the hazard identification under 6.1.2. Consultation and participation under 5.4 reach the planning of the programme, and the people who work the unaudited hours are the only reliable witnesses to them. A new outlet, a season or a refurbishment is grounds for the programme to move.

The lower left plaque, “The hazard has hours”, turns this into something an owner can check in twenty minutes. Lay the programme beside the roster and mark the hours it visits; in most hotels the marks fall between nine and five on weekdays, forty of a hundred and sixty-eight. A scope that says “laundry” is satisfied by a cold room at eleven in the morning. Evidence that the requirement is met is a programme whose reasons are written beside each audit, and which visibly moved when the building changed.

The lower right plaque, “Programme by shift, not month”, should not be read as an instruction to move every audit to the night. A property on the same river tried it and lost sight of its daytime contractors and deliveries, while the night crew came to feel watched. The lift in the card serves two departments that never meet. The programme’s task is to be there when they do.

Subchapter 3.3 · Belfast, Northern Ireland

Setting: Belfast, Northern Ireland

The card stands in a guest corridor closed for refurbishment. The plaster is patched and bare, dust sheets cover the stacked furniture, work lamps on yellow stands light the far end, and behind the two figures rises an empty scaffold tower.

The scaffolding contractor, grey-haired and weathered, in an orange high-visibility jacket, holds his white hard hat under one arm and opens his other hand in the gesture of a man asking something he assumes has a simple answer. The compliance manager, in a dark-green jumper, holds a ring binder open across her forearm and runs a finger down a page of ruled rows. The rows are full; the one she is looking for is not there.

The title names exactly that absence. During the refurbishment of the third floor in Belfast, the contractor asked Aoife Mulholland who was holding the duties for the shared workplace, and the register had no entry at all, not even one marked non-applicable. The plaque at the top left records his question; the one at the top right, “Ninety-six per cent conformant”, records the figure she had reported for four years. Reading the forty-one entries properly for the first time, she found six that belonged to a different kind of operation and nothing on the conference floor as an assembly space or on the two workers under eighteen taken on in June.

Clause 9.2 of ISO 45001:2018 requires the criteria and scope to be defined for each audit, and asks whether the system conforms both to the organisation’s own requirements and to the standard. Clause 6.1.3 requires the organisation to determine and have access to up-to-date legal requirements and other requirements, to determine how they apply and what must be communicated, and to take them into account. A register satisfies the first of those verbs at most. It is a record of a determination, and like any determination it is a legitimate object of audit.

The lower left plaque, “Audit the register itself”, is the practical consequence. An owner can ask who compiled the register, from what, what has been added since and what triggered each addition. An auditor can take five activities the property actually performs and look for the entry that covers each. The obligations accepted voluntarily, in a client’s contract, a brand standard or an undertaking to an insurer, are usually held in other offices and belong in the same exercise.

The lower right plaque, “A list is not compliance”, carries its own limit. The internal auditor tests the process that finds obligations, not the law itself; the finding is that no process would have produced the entry, not that the property is in breach. Nor is the answer a longer register. In the card the binder is perfectly kept. What it lacks is the question the contractor brought in from outside.

Subchapter 3.4 · Granada, Spain

Setting: Granada, Spain

The card is set in the housekeeping store of a converted convent, under a whitewashed vault. Metal shelving holds containers and spray bottles. On the wall at the left hangs a grey dosing station, its hoses dangling slack and dry. Below it a room attendant in a lilac tunic and blue nitrile gloves pours blue concentrate from a jerrycan into a spray bottle over the sink, looking up at the man beside her.

He is the visiting colleague, in an open-necked white shirt, his arm extended towards the idle station. Beside him the deputy general manager, in a charcoal suit, holds a few stapled sheets and looks from the station to the sink. Her expression is the one the title describes: a question was always available, and she was not the person who could ask it.

Nuria Delgado had written most of the safety system in Granada, including the chemical procedure for housekeeping, and she had audited that store three times. The procedure said dosing station, the room contained a dosing station, and the station had been out of service since the previous autumn while the team adapted by decanting at the sink. The two upper plaques, “Station out since autumn” and “Why decant at the sink”, are the visitor’s finding reduced to its parts. He came from a sister hotel under the group’s new reciprocal arrangement, had spent eleven years in kitchens, and in a day and a half produced six findings, every one in a section she had written or in work she had never done.

Clause 9.2 of ISO 45001:2018 does not require an independent auditor. It requires auditors to be selected and audits conducted so as to ensure the objectivity and impartiality of the audit process, which is why the lower right plaque reads “Impartial process, not person”. Competence falls under clause 7.2, which applies to the auditor like any worker whose work affects performance: the property determines what the role needs, ensures it, and retains evidence. The finding itself touches 8.1.2, since a failed engineering control had quietly become a gloved hand over a sink, and nothing in the procedure said what to do when the station stopped.

The lower left plaque, “The author cannot see it”, is not an accusation. The gap in a document is invisible to its writer in the way a missing word is invisible to the person who wrote the sentence. An owner can mark the last two reports for findings in sections the auditor authored and findings in work the auditor has never done; empty columns are the measure of the problem. A written arrangement, a second reader or a reciprocal visit turns an impossibility into something that can be shown.

The limit runs the other way. A property in the same group handed its audits to the heads of department and lost independence entirely. The visitor in the card is useful precisely because the store is not his. He points; the people who work there do the rest.

Subchapter 3.5 · Rotorua, New Zealand

Setting: Rotorua, New Zealand

The card shows a plain committee room with timber-panelled walls, a jug, water glasses and closed folders on the table. Four people sit round it. The safety coordinator, silver-haired, in a navy cardigan, holds up a single printed page ruled into an empty grid and turns it towards the others, listening rather than speaking.

Across from her a spa therapist in a white treatment tunic is answering, one open hand extended. Beside her an older maintenance assistant in a dark-green work shirt sits with his hands clasped, turned towards her, waiting his turn. At the right a young pool attendant in a teal polo shirt listens. The page is the audit programme, and for the first time in three years it has been shown to anybody.

The title is the question Gail Mercer put to her committee in Rotorua in August. She had always asked what was dangerous, and received sensible answers about chemicals, hot water and slip resistance. This time she asked where they would send an auditor, and at what hour. The therapist named the treatment block on a still morning, when the smell sits in the corridor and nobody has measured it. The pool attendant named the four o’clock changeover, two hundred arrivals in forty minutes. The maintenance assistant named the bore head, not because it was dangerous but because, as the upper right plaque records, in eleven years nobody from the office had gone up there.

Clause 5.4 of ISO 45001:2018 requires consultation and participation at all applicable levels across the development, planning, implementation, performance evaluation and improvement of the system, and it gives non-managerial workers particular emphasis on a list of matters that includes the planning, establishment, implementation and maintenance of the audit programme.

It also requires mechanisms, time, training and resources, timely access to relevant information, and the determination and removal of obstacles to participation. Clause 9.2 closes the circuit by requiring relevant audit results to be reported back to workers and their representatives. The lower left plaque, “Ask about the programme”, points to a sentence most properties never read to the end.

In practice the change is one agenda item worded differently, and then the same question asked where the programme never goes: the night briefing, the contracted crew in their changing room, the seasonal intake six or eight weeks into the peak. The evidence an auditor would look for is not an attendance list but two lines in the programme itself, recording who was consulted and what changed as a result.

The lower right plaque, “Attention, not only hazards”, names the difference between the two questions, and its limit. Asking where to look is not an invitation to collect grievances; a property on the same lake did that and audited its staff room instead of its bore head. Mercer’s page is empty in the card because the answers had not yet been written into it. They were in the room all along.

Subchapter 3.6 · Udaipur, India

Setting: Udaipur, India

The card is set in the inner courtyard of a haveli in the half-light before dawn. The flagstones shine wet from hosing, lit by work lamps on yellow tripods. At the left edge stands the white wall of a banqueting marquee; against the old ochre render at the right rises a decorators’ bamboo scaffold, empty. The safety coordinator, in a maroon kurta with a grey shawl round her shoulders, holds a thick ring binder open on her forearm and bends to look at the ground with a troubled frown. Crouched beside a grey junction box a lighting technician in a dark work jacket points down at the wet stone in front of him, where the temporary supply leaves the box, and explains. She has the register; he has the courtyard.

The title is the fact that the register did not know. Priya Rathore’s register in Udaipur held two hundred and forty assessed hazards, reviewed annually for six years. She audited it in February by sampling twenty entries and confirming their controls. In November the property hosted eleven weddings in twenty-three days, with decorators working through the night, a marquee contractor, lighting crews running temporary distribution across courtyards washed at five in the morning, and a fireworks operator. On two occasions the fireworks and marquee crews, employed by different companies, worked above and below each other on the same terrace. The upper plaques state the proportion: “Two hundred and forty entries”, “None about the weddings”.

Clause 6.1.2 of ISO 45001:2018 requires a hazard identification process that is ongoing and proactive, and it names what that process must take into account: routine and non-routine activities, how work is actually performed, past incidents inside and outside the organisation, emergencies, changes, social factors, and the people with access to the workplace, contractors and visitors included. Those last words reach the decorators and the marquee crew directly, and clause 8.1.4 governs contractors once inside. The audit under 9.2 examines whether the process is effectively implemented, and here lies the logical difficulty: sampling a register verifies only what the process already found.

Hence the lower left plaque, “Find what the list missed”. The auditor takes the register into one department for an hour and, instead of sampling it, looks at the work and asks whether each thing seen is in the document; three missing hazards are a finding about the process. The clause’s own list of categories can be laid against the register in ten minutes. Two further questions cost nothing: whether the methodology discriminates, and whether any rating has ever moved because a control was found not to work.

The lower right plaque, “Non-routine work counts”, has a limit as well. A property elsewhere answered a narrow register by opening it to everything and buried the few lethal hazards among eleven hundred entries. A register is an instrument of attention. In the card it is held open and full, and the technician is pointing at what it never contained.

Subchapter 3.7 · Antalya, Turkey

Setting: Antalya, Turkey

The card shows a pool bar before opening. Behind it lie a pale stone deck, rows of empty white loungers under furled parasols, and the turquoise water of the pool. On the granite counter sit a grey plastic crate of clean tumblers and a ring binder lying open on ruled pages. The internal auditor, in a cream blouse and beige trousers, holds a single glass tumbler up at eye level and turns her other palm upward. The bar supervisor, in a white short-sleeved shirt, leans on the counter with both hands and considers the glass rather than the binder. Nothing in the scene is broken, which is part of the point.

The title is the question Deniz Arslan did not ask in May and did ask in August. The glass file at the resort outside Antalya ran to five years: two procedures, seasonal training and refreshers, non-slip footwear, signage, a spotting round. Her May audit found every control in place and wrote that they were implemented and effective, which was true of each one. When she asked whether glass had to be at the pool at all, the answer came within a day: polycarbonate had been considered once, in the first year, and rejected by a food and beverage director. Nobody had written it down, and the director had left three years later. The upper left plaque, “Five years of procedures”, describes what accumulated on top of that vanished decision.

Clause 8.1.2 of ISO 45001:2018 requires a process for eliminating hazards and reducing risks using a stated order: elimination, substitution, engineering controls and reorganisation of work, administrative controls including training, and personal protective equipment last. Because it is a process with a sequence, it is auditable under 9.2. The difficulty is evidential. A control at the fourth rung reached after the first three were examined is indistinguishable, in the file, from one reached by starting there. The standard does not require the reasoning to be documented, but a consideration that left no trace is, to anyone who was not present, the same as one that never happened.

So the lower left plaque, “Ask the top rung first”, gives the auditor a method. Classify each control by rung; in Antalya five controls turn out to be repetitions of one rung, all failing together when somebody is tired at the end of a shift. Then ask what happened to elimination, and open the third rung, where rostering and sequencing outrank any briefing. An owner can ask who chose each control, since the rung often matches the chooser’s authority.

The lower right plaque, “Record what was rejected”, sets the limit. The auditor does not decide what the resort serves; a commercial reason may justify not taking a rung, never an inadequate control. Two written lines would have kept the decision alive. The guests on that deck walk barefoot, and no control in the binder reaches them.

Subchapter 3.8 · Phuket, Thailand

Setting: Phuket, Thailand

The card shows a human resources office: cream walls, a filing cabinet, a desk lamp, a shelf of grey box files. The human resources manager, seated, in a purple blouse and rimless glasses, rests her hand flat and firm on a closed dark binder and looks up with an expression that is courteous and immovable at once. Standing across the desk, the safety officer, in a white shirt, holds out a single ruled page on which one line carries a small tick and nothing else; her other hand is open, palm upward, in a request. The composition rests on the two hands. One holds a closed record of every hour worked in the resort; the other offers the whole of what the safety system knew about those hours.

The title is precise. Kanya Phromkaew audited fatigue and workload at a resort on the west coast of Phuket and, by ordinary method, found nothing: a single register entry, “Workload, rated low”, written four years earlier and reviewed annually since; heads of department who said everybody was coping. When she asked the food and beverage manager what the rating was based on, he said judgement. When she asked for the restaurant’s clocking data, human resources replied in the words of the upper right plaque, “Timesheets are confidential”. Once the general manager released the data, the quarter showed forty-one returns to work within nine hours, concentrated on seven people who also dominated the minor injury log and accounted for four of six mid-season resignations.

ISO 45001:2018 defines ill health to include mental and cognitive as well as physical condition, and clause 6.1.2 names workload, work hours, victimisation, harassment and bullying among the factors hazard identification must take into account. Clause 8.1.2 places reorganisation of work above training, which for this hazard means the roster itself: a minimum turnaround, a ceiling on consecutive days, no close followed by the next open. ISO 45003:2021 offers guidance on psychological health and safety, without adding any requirement.

The lower left plaque, “The evidence is in payroll”, states the shift in method. Fatigue leaves no scene for an auditor to stand in front of; it leaves records, kept to the minute for other purposes. The request names four datasets, pseudonymised where the law requires it, and the lower right plaque supplies the one word that decides whether they show anything: the last peak, not the last quarter. A refusal is itself the first finding, since a hazard the standard names cannot be assessed. Interviews ask about the task, never about how anybody feels.

The limit is firm. The audit examines rosters, records and the process, never a person’s health, and a pattern set beside another pattern shows coincidence, not cause. A neighbouring property answered such a finding with mood questionnaires and lost its injury reporting. The tick on the officer’s page is not wrong. It simply stands where four years of evidence should be.

Subchapter 3.9 · Marseille, France

Setting: Marseille, France

The card is set in a service corridor behind a plant room, under flat white ceiling tubes and runs of insulated pipe. Two people have stopped close together. The duty supervisor from engineering, in a navy work jacket, speaks low, one hand half raised. The quality and safety manager, in a grey blazer, holds a closed black notebook and a pen against her chest and listens without writing. Just behind them a heavy grey fire door stands propped open by a small wooden wedge on the floor. The card holds two kinds of evidence: something said, and something seen.

The title is literal. In Marseille the supervisor told Nadia Belkacem that the isolation of the chilled water circuit was routinely done without the second person the procedure requires, and the upper left plaque keeps his words. She wrote it as a nonconformity. At the closing meeting the chief engineer produced the permits for the eleven isolations of that year, and, as the upper right plaque records, every one was countersigned. She would not name her source, and the finding was withdrawn. Eighteen months later it proved correct: the signatures were being collected together at the end of the week. In the same audit she had seen the wedged fire door, judged it outside her scope, and written nothing. It was in the same place the following February.

Clause 9.2 of ISO 45001:2018 requires defined criteria and scope, an objective and impartial process, reporting to managers and relevant results to workers, and retained evidence of the programme and its results. It says almost nothing about how evidence is weighed; that is professional convention, on which ISO 19011:2026 offers guidance only. What the standard does fix is consequence. A finding enters the nonconformity and corrective action process under 10.2, so its strength decides whether it is accepted or resisted, and because results reach workers, a finding that identifies its source closes the channel it came from.

The lower left plaque, “Corroborate before writing”, gives the method. Testimony is real evidence chiefly of where to look. The auditor asks for the permits, examines when they were signed rather than whether, and writes a documentary finding that depends on nobody’s word and points at nobody. An owner reading the report can ask, of each finding, how it is known: told, read, seen, re-performed, or absent.

The lower right plaque, “Record what you saw”, answers the other half. A short standing section for observations outside the scope costs two lines and spares the auditor the choice between breaking the method and leaving a wedge under a door. The opposite rule, no finding without a document, confines the audit to the part of a hotel that produces paper. The manager in the card is right not to write yet, and would be wrong not to write later.

Subchapter 3.10 · Maastricht, Netherlands

Setting: Maastricht, Netherlands

The card is set at the staff entrance of a converted warehouse before dawn: brown brick, a single wall lamp, a steel door held open on a warmly lit corridor. The safety coordinator, in a dark wool coat, stands at the door with a clipboard and adds a stroke to a small tally. Coming in past her are two people whose clothes are not the hotel’s. A cleaner in a dark-blue tunic smiles a greeting. Behind her a maintenance technician in a grey work jacket glances at the clipboard with mild curiosity. Nobody here is on the list the coordinator usually samples from, and that is why she is counting them.

The title is the arithmetic that undid three years of careful work in Maastricht. Sanne Vermeulen sampled ten per cent of everything. In her third year she added a column to her own notes and found that over four audits she had interviewed forty-seven people, forty-six of them on the payroll. On an ordinary Tuesday about a hundred and ten people work in the building, roughly forty of them employed by the three contractors. The upper plaques state both halves: “Forty-six of forty-seven” and “A third not on payroll”. The same pattern held for night permits, build periods and the second seasonal intake. Her sample was clean; her frame was the set of documents she could reach.

ISO 45001:2018 does not prescribe sampling, but clause 9.2 requires the programme to take into consideration the importance of the processes concerned, which is in effect a stratification instruction, and requires the scope of each audit to be defined. In a hotel a scope that names only a department leaves the hour, the season and the employer undefined. Clause 6.1.2 places people with access to the workplace, contractors among them, inside hazard identification, so the contracted cleaner is inside the audit population whether or not her training file is in the building.

The lower left plaque, “Define the population first”, is the cheapest discipline in the chapter: two lines before any selection, naming the population the audit concerns and the list it is drawn from. Where the two differ, the gap is visible in advance. Where no list exists, the frame can be a place and an hour, which is what the card shows: standing at the staff entrance between five and six enumerates everybody who arrives, by employer, without a single record. An owner can then compare the proportion of people in the building by employer with the proportion the audit spoke to.

The lower right plaque, “Ten per cent of what”, carries the limit too. A sample weighted towards exposure supports conclusions only about what it reached, and the report must say so. A property in the same city weighted so hard towards contractors that its kitchen went unexamined for two years. The tally on the clipboard is short. It is the first honest count of who was actually there.

Subchapter 3.11 · Funchal, Madeira

Setting: Funchal, Madeira

The card stands on the pool terrace at the foot of a white hotel block. Rows of balconies rise behind, and two climbing ropes hang straight down the facade to anchors at terrace level, with nobody on them. The quality manager, in a light-blue blouse, holds a thick tabbed binder open in both hands and puts a question to the man facing her: a rope access technician in grey overalls, harness and white helmet, who answers with an open palm. To the right the duty manager, in a dark suit, shades his eyes and looks up at the balconies, unsure what he is supposed to be watching. The title belongs to the binder, the only object in the frame that says nothing about the terrace beneath it.

This is the Funchal case at the moment it became visible. Teresa Câmara’s file was complete and current: registration, insurance, technician certificates, equipment inspections, method statement, a plan for a suspended casualty. She audited it in April and found nothing wrong, because nothing was. What it did not contain was the hotel: who stops the work when the wind rises, who closes the twenty-two balconies below the working face, who controls the pool terrace underneath. In the third year a subcontracted crew arrived and the Thursday duty manager had never seen the operation. «A crew nobody had met» marks the point at which an arrangement resting on familiar faces quietly ceased to exist.

ISO 45001:2018 deals with this in clause 8.1.4. Procurement control is what properties do well. The contractors requirement asks for coordination: risks identified and controlled in both directions, from the contractor’s activities to the organisation’s workers and from the organisation’s activities to the contractor’s, and the property’s own requirements met by contractors and their workers. Outsourced functions need a defined type and degree of control. Hazard identification under 6.1.2 already names people with access to the workplace. An internal audit under clause 9.2 that examines only the binder has verified the supplier, not the property.

«Audit the meeting point» turns this into method. Divide the file into two piles, about them and about the boundary; in most properties the second is empty. The evidence that the requirement is met is a one-page interface arrangement naming each boundary decision and who holds it, an audit held while the ropes are live, usually at night or on a Sunday, and a question at the gate about whose employee this is and who briefed him on this building.

«Coordinate, not just select» also guards against the opposite error. A property on the same island imposed its own procedures wholesale, lost two of three long-standing contractors and ended with a cheaper provider and a thinner file. Coordination is not absorption.

The duty manager’s raised hand is the honest picture of what remains when the hotel’s knowledge has never been written down: a capable man, looking in the right direction, with nothing to tell him what to do.

Subchapter 3.12 · Macau

Setting: Macau

The card is set in a staff canteen, the serving counter closed behind a lowered metal shutter, empty tables receding under a half-lit ceiling. At the nearest table sits the duty engineer in a dark-blue overall, one hand pressed to his forehead, a radio and a paper cup in front of him, his face drawn with exhaustion. The safety manager, in a creased dark trouser suit, leans towards him with a clipboard under her arm and an open hand, asking a question she should not have to ask at this hour. At the next table a fire warden in a black uniform and orange vest sits upright with her radio raised, tired but still listening. The title is literal: this is the second day, and nobody planned for it.

The scene is the Cotai tower during the typhoon, when the property did what it was supposed to do and sheltered rather than evacuated. «Thirty-one hours inside» is the duration; «Twenty-six hours on duty» is the duty engineer’s share of it. Ada Cheong’s plan was a good plan about guests. Its people appeared only as roles, warden, sweep, liaison, never as a population that must sleep and eat. The canteen closed at its usual hour because the kitchen team had not been relieved either, and two of the three tower wardens had been due to finish at eleven. Eleven years of drills never showed this, because a drill lasts eleven minutes and nobody has to be fed.

Clause 8.2 of ISO 45001:2018 is longer than hotels read. It concerns potential emergency situations, a wider phrase than evacuation. It requires the planned response to be periodically tested and exercised, two words, neither meaning a full evacuation, and revised in particular after real events. It reaches all workers, contracted staff included, and asks that the needs and capabilities of relevant interested parties be taken into account, which covers a warden at hour nineteen as surely as a guest in a wheelchair. An internal audit under clause 9.2 that reviews plan, matrix, drill reports and certificates as one bundle judges the average; the event judges the minimum.

«Test the weakest link» is the practical answer. The response is a chain, detection, decision, alarm, communication, sweeping, counting, sustaining, re-entry, and each link can be examined on an ordinary night without waking a guest. The auditor asks who relieves the wardens at hour twelve and hour twenty, where people who cannot leave will sleep, who feeds them, who is the second duty engineer. The answers are the evidence.

The limit lies in the counter-case: a property in the region answered its own typhoon with unannounced night drills, woke two hundred guests and lost the whole programme. Testing a capability does not mean staging the disaster.

«Plan for the responders» is the plaque that breaks the pattern. It moves the plan’s attention from the people being protected to the people doing the protecting, and only that shift gives a plan its second day.

Subchapter 3.13 · Portland, Oregon

Setting: Portland, Oregon

The card is set in a basement laundry of brick walls and heavy timber posts, fluorescent tubes overhead, front-loading washers down one side and shelves of folded linen down the other. The concrete floor glistens with water. On the brick wall a grey distribution panel stands open, breakers and wiring exposed, its metal cover leaning against the wall beneath it. A few metres away a room attendant in a grey tunic and hairnet feeds sheets into a washer, unaware of anything unusual. In the foreground the compliance manager, in a navy fleece, writes in a notebook and looks up at the panel with alarm held in check. The title describes what happens next. The finding she is writing will be correct, and it will take eleven days to reach anybody who can refit the cover.

This is Marcy Lindholm’s audit in the converted warehouse in Portland, at six in the morning because the programme had at last been built around the hours. «Cover off for three weeks» is the history: a contractor left it after an unfinished alteration. «Eleven days to arrive» is the route the finding then took: photographed, graded major, drafted over the weekend, reviewed under the impartiality arrangement, issued on Thursday, read on Friday by a chief engineer who refitted the cover within the hour. Every step was good practice. The missing step was one no procedure asked for.

ISO 45001:2018 makes room for it. A nonconformity is simply the non-fulfilment of a requirement; major, minor and observation are conventions the standard does not contain. Clause 10.2 asks the organisation to react in a timely manner, controlling and correcting, and only then to evaluate the need to eliminate causes: one fast limb, one slow. Clause 9.2 requires audit results to be reported to relevant managers, an obligation about the audit rather than the only permitted route for what it finds. Clause 7.3 makes workers aware that they may remove themselves from imminent and serious danger, and an auditor is a worker.

«Tell the duty manager now» is the practical answer, and it needs a decision from the general manager rather than the auditor. One written sentence establishes a second channel: a condition that could seriously harm somebody, with people exposed now, goes to the duty manager at once so that people are kept away and a competent person makes it safe. The auditor touches nothing, but tells the person exposed and the supervisor, and records the time.

The limit is the counter-case. A property in the same market opened such a channel and saw it filled with burnt bulbs and parked trolleys until duty managers stopped answering. «Some findings cannot wait» is a threshold, and it holds only if applied strictly in both directions.

The panel was closed within the hour of the report being read. Nobody has yet asked why a contractor could leave a cover against a wall for three weeks, and that slow limb is still waiting.

Subchapter 3.14 · Santiago, Chile

Setting: Santiago, Chile

The card shows a windowless meeting room: plain walls, a dark coat on a stand, a wooden cabinet, a desk lamp, a cup of coffee and a pen at the far end of a long table. Across the table lies a wide arc of thin cardboard folders, every one closed, fanned like a hand of cards nobody has played. The safety coordinator, in a burgundy cardigan over a cream blouse, leans over them. One hand rests flat on a small squared pile she has drawn out of the arc; the other reaches for the folder at its near end. She looks like somebody watching a pattern assemble under her fingers. The title is the pile: six folders, six events, one ramp, and nothing on any cover to say so.

This is Camila Vergara in Providencia, reading as a set the twenty-three investigations she had already read one by one over eighteen months. Each had been prompt, signed by the head of department and closed with an action. Together they said what none could. Nine causes named the injured person. Fourteen actions were training, eleven of them retraining the person who had been hurt, which «Retrained, eleven times» compresses. Six events concerned the service ramp between basement kitchen and banqueting floor, investigated by four different heads of department, none of whom had seen the series. No record showed a non-managerial worker taking part in deciding what to do.

Clause 10.2 of ISO 45001:2018 makes the set an obligation rather than a curiosity. The organisation evaluates, with the participation of workers, the need for corrective action to eliminate root causes so that the incident does not recur or occur elsewhere, acts in accordance with the hierarchy of controls in 8.1.2, and reviews effectiveness. Clause 5.4 emphasises non-managerial participation in investigating incidents and determining corrective actions, which is more than being interviewed. Training sits on the fourth rung. For the internal auditor under clause 9.2, investigations are evidence, not records: the property’s own account of why its system failed.

«Read them as a set» costs an afternoon. Take the last twenty investigations and count causes naming a person, actions that are training, events sharing a location, and records of a non-managerial worker in the decision. The counts are unarguable because they are the property’s own words, and they show where next year’s audit programme should go. A further check needs no expertise: the near miss on the same task that never received a file.

«Would it survive the person» is the plaque that breaks the pattern, because it is a question rather than a count. A cause that would still be true with somebody else on the ramp is a cause; one that would not describes an individual. The counter-case shows the limit: a property in the same city banned human error as a cause and gained only a new vocabulary.

The ramp does not care who is on it, and in eighteen months nobody had asked it anything.

Subchapter 3.15 · Kotor, Montenegro

Setting: Kotor, Montenegro

The card is set in a small office in an old stone building on the first morning of the season. Daylight falls across rough walls; dust sheets still cover a chair and hang half pulled from a grey filing cabinet; a closed laptop sits at the edge of the desk. The new safety coordinator, in a light-grey blazer, holds open a binder with six coloured tabs, one hand flat on a page of empty ruled rows, and turns towards the door with a puzzled frown. In the doorway stands an older maintenance man with white hair and a grey moustache, in a faded blue work jacket, holding a ring of keys and smiling knowingly, like a man who could answer if anybody asked. The title names what is missing between them: the binder came back in May, and the reasons that made sense of it went home in October.

This is the hotel below Kotor after Jelena Radulović. Over three seasons she had turned a calendar into an instrument: the laundry at six because the linen shift starts at five, the cleaning crew after midnight, weight in July and August when the headcount triples. Her successor inherited a clear programme and thorough reports and could see none of the reasoning; by September it had become an annual sweep by clause, nine to five. «One season after she left» measures how long judgement lasts when it lives in a person. «Never told what was found» belongs to the man in the doorway: twenty-odd permanent staff returned every year and had received no finding in three seasons, because every report went upward.

ISO 45001:2018 addresses both failures. Clause 9.2 requires audit results to be reported to relevant managers and, unlike the quality standard, relevant results to workers and their representatives. Clause 9.3 makes them an input to management review, whose outputs include decisions on changes and resources. Clause 5.4 asks for timely access to clear, understandable information about the system, and a successor who cannot see why the programme says what it says has instructions without their purpose.

«Write the reasons down» is a matter of minutes: a second column beside each programme entry recording why it is there and when that reason was last true, a one-page handover written for a stranger before the building closes, and a carried-forward line naming findings that wait for a decision rather than for work. An owner can test the result by asking a room attendant what the last audit found.

«Report to those who stay» reverses the convention. In a seasonal hotel management turns over and the workforce returns, so the downward report is also where the audit history is kept. The counter-case marks the limit: circulating the full report to everybody taught heads of department to manage the audit rather than the risk.

The man with the keys has been holding the answer all along. Nobody wrote it down for him, and nobody wrote it down from him.

Subchapter 4.1 · Bridgetown, Barbados

Setting: Bridgetown, Barbados

The card is set in a small first-floor office with white walls and a plain wooden table. Tall louvred shutters stand folded open on the right, and beyond them, in bright morning light, rows of white loungers are lined up on pale sand and a wooden jetty runs out into shallow water. The certification auditor, an older man in rimless glasses and a pale-blue short-sleeved shirt, has one hand by a single ruled sheet. The quality and safety manager, in a navy blouse, keeps a hand on a closed black binder. Both have turned towards the shutters, and her face is that of somebody seeing for the first time what she walks past every day. The title is the composition: the sheet on the table and the beach through the window, in one frame, and only one of them mentioned in the other.

This is the west-coast property outside Bridgetown on the first morning of initial certification. Shanice Greaves had spent «Four months on the building»: plant rooms labelled, chemical store reorganised, fire doors adjusted, training matrix complete. The auditor spent the morning on two questions, what the organisation considers its workers and what the certificate proposes to cover. The scope, drafted by a consultant eighteen months earlier and never read again, covered accommodation, food and beverage and conference services. It did not cover the beach, run under concession by a company with «Thirty-one people outside», on the property’s land and, as far as any guest can tell, in its uniform.

The rules sit on two levels. ISO 45001:2018 clause 4.3 requires the organisation to determine the boundaries and applicability of its system, including activities within its control or influence that can affect its OH&S performance; hazard identification under 6.1.2 already reaches contractors and people in the vicinity. On the certification side, ISO/IEC 17021-1:2015 requires the body to satisfy itself that the scope is appropriate rather than record what it is given, and to certify in two stages, with the decision taken by somebody who was not at the table. Audit time follows IAF MD 5, and IAF MD 22 asks the body to consider legal compliance status without acting as a regulator.

«Read your own scope» is a four-minute exercise. Read the sentence that will appear on the certificate, then walk the property looking for the first activity it does not describe: the concession, the leased restaurant, the contracted car park, the staff transport. For each exclusion the property should hold its own written reasoning before the opening meeting.

«Scope is a decision» cuts both ways. A property elsewhere in the region wrote a scope wide enough to include staff residences, a supplying farm and a third-party fleet, and spent a year contracting for control it had never needed. The scope should describe what the organisation controls or influences, no less and no more.

Nothing in the plant rooms mattered that Monday. What mattered was a sentence nobody had read and a shoreline everybody could see.

Subchapter 4.2 · Kanazawa, Japan

Setting: Kanazawa, Japan

The card is set in a windowless hotel kitchen in even white light: pale wooden counters, stacks of dark lacquered trays, rows of painted ceramic bowls, a tiled wall. In the centre stands a commercial slicer, switched off, its transparent blade guard in place. The certification auditor, grey-haired, in steel-framed glasses and a dark suit, has bent down level with the machine and runs two fingers along the edge of the guard with practised care. Behind the counter the senior chef, head shaved, in whites, rests a hand on the steel and watches with patient puzzlement. Beside him the quality manager, in a grey suit, holds a closed clipboard against her chest and looks uncertain. The title explains the posture: the man studying the slicer learned to look in a car plant, and the slicer is the one thing in this building that resembles one.

This is Mariko Andō’s hotel in Kanazawa, a modern tower joined to a traditional wing, with a kaiseki kitchen, floor-level service, a communal bath that opens at five in the morning and long-tenured staff. Three accredited bodies quoted within a few per cent, and the winner won on reputation and coverage. The auditor, «Twenty years in automotive», was rigorous and well prepared. He raised nine nonconformities, three on kitchen guarding judged by machine-shop expectations and two on missing work instructions for tasks done the same way for two decades, and «Nine findings, all accepted» records the response. He never reached the bath house at five with one attendant, the seasonal intake, the retail concession or the contracted night cleaning.

The relevant rules bind the body. Under ISO/IEC 17021-1:2015 it determines the competence required for each technical area and deploys personnel who have it; ISO/IEC TS 17021-10:2018 sets out the competence specific to OH&S auditing. Audit time follows a documented method under IAF MD 5, in which shift working raises complexity. The body may not consult on what it certifies, and it monitors its auditors, including through witnessed audits. On the property’s side, ISO 45001:2018 clause 8.1.4 brings the purchase of certification under procurement control like any other service.

«Ask who will walk your floors» is the practical consequence. A property cannot choose its auditor, but it can ask in writing, before appointment, about the sector background of the person intended, previous work in accommodation, continuity across the cycle, and whether the days reflect three shifts and seasonal peaks. At the closing meeting it can ask of each finding which requirement it fails and what evidence would have shown conformity, with a complaints and appeals route behind both questions.

«Sector shapes the questions» carries its own warning. A property in another prefecture appointed an auditor from hotels and received three comfortable years and two minor findings. What a property needs is somebody who understands a hotel and is not fond of one.

The guard under his fingers was probably adequate. The bath house was the question nobody in that kitchen thought to ask.

Subchapter 4.3 · Accra, Ghana

Setting: Accra, Ghana

The card shows a quality office in early afternoon light, a slatted blind on the left, a grey filing cabinet, a closed laptop on a dark desk. Leaning against the chair behind the desk is an empty gilt picture frame. The quality and compliance manager, in a mustard-yellow blouse, holds a single certificate in both hands: a thin printed border, a few lines and, at the bottom, an oval where a mark sits. She reads it, stunned. Facing her, a colleague in a dark-grey suit holds out a buff folder thick with a returned tender submission, his expression grave. The title is the oval on the sheet. The mark it refers to is genuine; it simply refers to a different standard.

This is Adjoa Mensah’s property near the airport in Accra, which sought certification because an energy company required it of its suppliers and filled much of the conference floor. Fourteen months of work, a certificate in the lobby, then «The tender came back». The issuing body was accredited, but for quality management systems; its occupational health and safety certification lay outside that accreditation, which «Accredited for something else» states plainly. Nothing had been forged or misrepresented. The proposal had stated the accreditation on a line nobody read as a limitation, and the property re-certified with another body eight months later.

ISO 45001:2018 says nothing about accreditation, but two clauses reach this case. Clause 8.1.4 brings the purchase of certification under procurement control, and clause 6.1.3 requires legal and other requirements to be determined and kept up to date, which includes a client contract specifying certification under a particular accreditation. The chain itself sits outside the standard: a body operating under ISO/IEC 17021-1:2015 is assessed by an accreditation body for stated schemes, whose published scope does not extend beyond them, and mutual recognition makes the certificate usable abroad. IAF MD 1 (multi-site sampling) and IAF MD 2 (transfer between bodies) cover the occasions when a property’s position can shift without the property changing.

«Two minutes on the register» is nearly the whole practical answer. Before appointment, one email asks whether the body’s accreditation scope covers this standard and under which accreditation body, and the public register confirms it. A property already certified should be able to name the accreditation body, the scheme and the register entry from its own file, with the client’s requirement recorded in the obligations register. When a letter announces a merger or transfer, the check is repeated.

«Accreditation is per scheme» is the plaque that breaks the reader’s assumption, and it has a limit. A property on the same coast, burned by this problem, bound itself to the body its largest client named, overpaid for two cycles and later learned the client had broadened its criteria years before. The requirement should be re-established each cycle.

The empty frame is the right image to end on: the certificate was never false, but the wall it hung on promised more than the document did.

Subchapter 4.4 · Malmö, Sweden

Setting: Malmö, Sweden

The card is set in a long guest-floor corridor on a June afternoon, warm ceiling lights receding over patterned carpet, wooden doors closed on either side. Housekeeping trolleys stand along the wall, loaded with folded linen and unlabelled bottles. Further down, a room attendant in a dark headscarf and grey tunic lifts a sheet from her trolley; nearer, a young colleague in the same tunic steers another towards a door. In the foreground the surveillance auditor, bearded, in a navy blazer, holds a ruled agenda sheet and looks down the corridor, concerned. Beside him the operations manager, in a black trouser suit, has a hand at her chin and follows his gaze. The title is the sheet in his hand: an agenda built from a number written months earlier, held up against a corridor that number never contained.

This is the conference hotel in Malmö and Elin Sandgren’s honest answer to a form. In January the field asked for employees within the scope; she filtered payroll and typed «Forty-eight declared». The second stage came in a quiet November. At the June surveillance, which she had deliberately placed in the season, the building held «A hundred and twenty present»: payroll, twenty-six seasonal contracts, twenty-nine room attendants and four supervisors from the housekeeping contractor, eleven in the spa, agency cover in the kitchen. The auditor spent his day and a half on conferences and kitchens and never reached housekeeping, the largest population on the site.

The rules bind the body. IAF MD 5 determines audit time from the effective number of personnel within the scope, part-time hours converted to full-time equivalents and seasonal staff counted at the level typically present in high season, then adjusted for shifts, languages and contracted interfaces, with reductions capped and justified. Surveillance is normally about a third of the initial duration, so one wrong figure runs through the whole cycle, and ISO/IEC 17021-1:2015 requires the time and its justification to be available to the client. For an OH&S system the count follows control rather than contract, the same perimeter ISO 45001:2018 draws when it brings contractors inside hazard identification under 6.1.2 and coordination under 8.1.4.

«Count the building» is an afternoon’s work. Pick a weekday in the busiest week, count heads by category across every shift from rotas and contractors’ allocation sheets, and record a peak and a trough figure, each with its month. Name every contracted population with a sentence on who directs its work, send the declaration in writing, and ask how the duration was reached. Then check that the agenda puts hours where the risk is.

«Count at the busiest season» has a limit. A property that overcorrects, declaring every lift engineer and delivery driver, buys days that go where the declaration sends them rather than where the risk lies.

Forty-eight was accurate on the day it was typed. It described a building that exists in November, and the auditor was standing in the one that exists in June.

Subchapter 4.5 · Lima, Peru

Setting: Lima, Peru

The card is set in a lift lobby on a closed guest floor, the carpet under plastic sheeting, steel lift doors behind. A plywood hoarding runs across the corridor, its narrow access door open onto bare concrete, stacked plasterboard and a stair wrapped in plastic. The first-stage auditor, in a camel jacket, tortoiseshell glasses and a white visitor’s hard hat, has one hand on the edge of the door and looks through it. Beside her the project lead, in a dark-blue suit, holds out a thick white ring binder, eager and a little anxious. Just inside the doorway a contractor’s worker in a yellow hard hat, high-visibility vest and gloves holds a coil of cable and returns the auditor’s look. The title is the space between the binder and the door: everything written is on one side, and the work nobody had written about is on the other.

This is the business hotel in Lima on the sixth of February. Since June Rocío Paredes had built a clause-by-clause manual, nineteen procedures and a hazard register of four hundred and sixty entries. The auditor read, then walked, and by four in the afternoon she had established an absence. «Two offices audited»: the internal audit programme had covered two administrative departments in January. The management review was scheduled for after certification. «Committee never met»: constituted in September, never convened. And the thirty-one men working the closed floors, with a hoist up the outside of the tower, appeared nowhere in the register.

The rules bind the body. ISO/IEC 17021-1:2015 requires initial certification in two stages and gives the first a specific purpose: to understand scope, sites and processes, to examine the status of internal audit and management review, to plan the second stage and to judge readiness. Its findings are areas of concern that may become nonconformities later. For an OH&S system the site itself is part of what must be seen, since a hoist cannot be assessed from a file. The readiness questions map onto ISO 45001:2018: hazards identified across the whole scope under 6.1.2, contractors coordinated under 8.1.4, consultation under 5.4 that has taken place, and an internal audit under 9.2 and management review under 9.3 already held.

«Readiness, not inspection» changes how a property prepares. Operating departments should be audited while they operate, the review held before certification, the register extended to temporary works, and the inconvenient parts of the site shown on purpose. A concern about consultation is answered by a meeting that happens, not by a procedure about meetings.

«Stopping early costs least» reverses the general manager’s reading: one auditor day replaced four days of a second stage that could not have concluded. The limit runs the other way too, since a property that waits for perfection may spend eighteen months being sure of the wrong scope.

In Lima nothing was wrong, and nothing had yet happened. The binder held the description; the open door held a system that had not begun.

Subchapter 4.6 · Abu Dhabi

Setting: Abu Dhabi

At two in the afternoon the light on the service side of the resort is hard and white, and the only shade lies under the canopy beside the grey doors of the equipment store. Three people stand in it. The lead auditor holds a black notebook closed against his side and turns his free hand palm upward towards a low white plastic stool that nobody is using. The outdoor supervisor, in khaki and a wide-brimmed hat, answers with an open hand. Hessa Al Nuaimi, who has run the system for two years, listens with her hands folded. Behind them stand a blue water container with a white tap and a few folding chairs.

The stool is the whole card. It is where, for three summers, men who felt unwell in the afternoon were sat down, given water and sent back to light duties or home, by a supervisor doing something humane and broadly sensible. None of it was written anywhere, so the first-aid record for forty-two outdoor workers showed nothing, and the property put that zero at the top of its summary for the auditors. The plaque at top left states the figure; the one beneath it turns it round. Zero is a question about where the recording threshold sits, and here it sat above everything the work produced.

Two sets of obligations meet at this spot. ISO 45001:2018 requires the organisation, under clause 9.1, to determine what is monitored and measured and to evaluate the effectiveness of the system, and under clause 9.3 to bring that evaluation to a management review that asks whether objectives were met and controls are adequate. ISO/IEC 17021-1:2015 requires the certification body, at the second stage, to evaluate implementation and effectiveness at the sites and during the activities in scope. A posted rest schedule answers the first of those words and is silent on the second. Hence the single major nonconformity raised in Abu Dhabi concerned neither heat nor water nor rest, but monitoring that could not establish effectiveness and a review that had read an absence of data as a positive result.

The plaques on the right carry the practical lesson. “Rest planned, never recorded” names the commonest conformity artefact of a hot-climate property, a schedule that records intention. “Proof it worked last Tuesday” names what should stand beside it: a dated record of rest actually taken, one column on a sheet the supervisor already carries. The auditor’s question is the one asked here, without weight, of the person who does the work, and a category as plain as felt unwell, rested, returned or sent home changes what leadership can see.

The remedy brings its own discomfort. Once the outdoor operation began to record, it produced eleven first-aid entries in its first summer, and somebody had to explain that eleven was an improvement on zero. Nobody in Abu Dhabi had been hurt and nobody had lied. The stool simply held information the system had never asked for.

Subchapter 4.7 · Cebu, Philippines

Setting: Cebu, Philippines

The room is small and windowless, lit from the ceiling, a brown door closed behind the table. Two people sit across from each other and nobody else is present. The lead auditor, a Filipino man in his early fifties with greying hair and glasses, wears an embroidered barong; his index finger rests on one row of a large register lying open between them, its pages ruled into empty cells, while his eyes have already left the page for the face of the young woman opposite. She wears a pale-blue work uniform, her hair tied back, her hands clasped on the table, and she is answering him with a frank, slightly anxious expression. A closed blue folder lies at her elbow.

The card is built on a reversal. Twenty-eight workers in seven departments had answered correctly, privately and without a manager, and their answers were so close in construction that by the ninth interview the auditor was listening to a text he had already read in the induction slide deck. The plaque at top left records that uniformity; the one at bottom left draws the only conclusion it supports. Consistency shows that a common source exists, and nothing more. So the auditor turned to facts that could be checked, and two of the nine people asked about the March drill said they had never taken part in one, having started in May. The register recorded both as trained in March: “Trained before she was hired”.

For Maricel Abellana’s property the nonconformity fell under clause 5.4 of ISO 45001:2018, which obliges the organisation to consult non-managerial workers, to enable their participation and to remove or minimise the barriers to it, including fear of reprisal. On the certification side, ISO/IEC 17021-1:2015 and IAF MD 22 place on the body the duty to interview workers under conditions it controls: a sample it selects, in private, without the line manager, in a language the worker uses, with the right to decline. The finding named the structural condition, a hundred and forty six-month contracts renewed on the word of the supervisor being described, and not the briefing.

The practical lesson sits in the plaque at bottom right. Interviews are strongest where they can be tested against induction dates, drill registers and shift rosters, and a property whose records are accurate will find its people corroborating them. The useful preparation is therefore not rehearsal but accuracy, together with four plain sentences that inform without scripting, and a rule that no department’s interview performance is ever discussed at a management table.

None of this makes interviews worthless; under a standard that requires participation they are indispensable, and the property that forbids all mention of the audit merely produces a frightened silence in place of a chorus. The point is narrower. When every answer agrees, the auditor reaches for a date, and in Cebu a date was enough to show that the system had reached everybody with a script.

Subchapter 4.8 · Banff, Alberta

Setting: Banff, Alberta

A January afternoon in the maintenance store of the resort above Banff: grey metal shelving, cardboard boxes, a concrete floor and a high window full of snow-light. In the middle of the bare wall a full-body fall-arrest harness hangs from a single hook, dark with damp, a few drops gathering on the floor beneath it. The lead auditor, white-haired, with a white moustache and a grey fleece, points at it with his whole arm. Dana Kirkwood, who has managed the system for four years, does not look at the harness; she looks at him, uneasy. A technician in navy overalls leans one hand on the workbench and looks across at the hook. At the corner of the bench lies a pad of permit forms, closed.

The harness matters for what it contradicts. Nothing had been recorded as work at height for eleven weeks, yet the equipment had plainly been used. It had: two men had gone onto the roof over the east wing at six in the morning to clear an ice dam before the doors opened, tied on, and raised no permit. The plaque at top left gives the observation; the one at top right gives the reason it took two rejected responses to reach. The permit required the technical director’s signature, and the technical director was not on the property before eight. The system asked for something that could not exist at the hour the work had to be done, and the work won.

ISO 45001:2018 frames the response in clause 10.2: react to the nonconformity and correct it, evaluate with the participation of workers the need to eliminate its causes, investigate, determine whether similar nonconformities exist or could occur, and review the effectiveness of what is done. The permit was a requirement the property had imposed on itself under its operational controls, which is enough for a major finding. ISO/IEC 17021-1:2015 binds the certification body to require cause analysis, corrections and corrective actions within a defined period, and to verify their effectiveness before the finding is closed.

The plaque at bottom left is the hinge of the card. Retraining the technician and then all eleven technicians were true statements and neither was a cause, because a cause that still depends on somebody being careful has not been found. The test a manager can apply to any draft is simple: if this were removed, could the outcome still occur in the hands of someone tired, rushed or new. The accepted answer changed the authorisation route, so that a trained deputy could issue permits outside the director’s hours, and was proved by fourteen permits in six weeks, seven raised before eight.

That is the meaning of “Fix every morning after”. A correction deals with this morning; a corrective action deals with the condition that will produce the next one. The extension found the same missing signature waiting in confined space entry, hot work and electrical isolation, and that discovery, not the harness, is what the certificate was worth.

Subchapter 4.9 · Warsaw, Poland

Setting: Warsaw, Poland

The plant floor beneath the Warsaw hotel is a corridor of grey air-handling units and lagged ducts under fluorescent light, shared with the owner of the building. Three people in hard hats stand at its edge and all three are smiling. The hotel’s duty engineer, fair hair tied back, points to a wall-mounted permit board with plain cards in its slots. Opposite her the owner’s contractor, in grey overalls and a blue helmet, holds up a padlock with a blank tag, the half of an isolation that belongs to someone else. Between them the lead auditor, in a dark suit and a white visitor’s helmet, reads the stapled arrangement between hotel and owner. Under his arm, pressed against the pages, his black notebook stays closed.

That closed notebook is the card. Everything in the picture happened: ninety minutes on the plant, the arrangement read, the permit interface tested, the engineer and the contractor both heard, and an auditor who left entirely satisfied. What reached the report was four lines saying that arrangements for shared premises had been sampled and found satisfactory. Eleven days after the closing meeting, a reviewer who had never been to Warsaw asked Joanna Michalak for the evidence behind that sentence, because in a property sharing plant with a third party it was the point on which the decision turned.

The plaque at bottom left states the rule that makes certification worth buying. Under ISO/IEC 17021-1:2015 the decision is taken by the body, on the audit information, by people who did not take part in the audit and who are competent for the scheme, which for ISO 45001 means competent in occupational health and safety and not only in management systems. The report must carry evidence for its conclusions, not the conclusions alone, and the certificate takes effect from the decision rather than from the last day on site. On the property’s side the plant floor is where ISO 45001:2018 becomes demanding: clause 8.1.4 requires coordination with contractors so that hazards arising from their work and from the organisation’s own are identified and controlled.

For a manager the practical consequence is that, as far as the decision is concerned, the report is the property. Whatever was shown in a corridor and not written down does not exist for the reviewer. The legitimate move is to note, during the audit, what was examined in the two or three areas that carry the real risk, and then to read the draft as a stranger would, asking whether it says what was looked at and not only that it was fine. Correcting a fact is proper; asking to edit a judgement is not. Nothing should be announced outside the building until the decision is in writing.

None of this criticises the auditor or the reviewer. The audit was sound and the certificate was issued. The plaques record a distance the property had not measured: “Unwritten means unseen”, and at the review the only thing present is the page.

Subchapter 4.10 · Melbourne, Australia

Setting: Melbourne, Australia

Dusk on the rooftop of the Melbourne hotel, before the bar opens. The sky behind the glass balustrade has turned violet, the back bar is lined with unlabelled bottles, and a young bartender with dark curly hair polishes a wine glass and glances across. At the pale stone counter the recertification auditor, silver-haired, in a dark linen jacket, rests her index finger on a long sheet of paper. It carries one drawn line and nothing else: no axes, no figures, only a series of sharp crests with long flat stretches between them, and her finger lies on a flat stretch. Bronwyn Teague, in charcoal, looks down at it with the expression of somebody recognising her own handwriting. Beside the sheet lies a ruled form with every field empty.

The line is the property’s own three years, plotted by month instead of totalled. Fourteen internal audits in the cycle, eleven of them in the six weeks before each of three audit dates; two hundred and thirty worker reports, a hundred and fifty-one in the same windows. As totals both were respectable; as a shape they showed a system that ran when it was about to be looked at. The plaque at bottom left gives the method, and the one at top right gives the price: during one of the flat stretches a rooftop bar seating a hundred and forty opened, with outdoor work at height above a public street, and nineteen maintenance workers were moved onto a contract while staying in the same plant room. In the nineteenth month nothing in the building was asking.

The normative frame has two sides. ISO 45001:2018 requires the organisation to manage change under clause 8.1.3, to control outsourced processes under clause 8.1.4, to run internal audits at planned intervals under clause 9.2 and to improve continually under clause 10.3. ISO/IEC 17021-1:2015 sets the cycle: a first surveillance no later than twelve months from the certification decision, surveillance at least once a calendar year, and a recertification that evaluates performance across the whole period and the changes that have occurred. The duty in the plaque at bottom right reaches the property through its certification agreement: changes to activities, sites, scope or the system are notified without delay.

The practical reading is short. A clean surveillance tells a board that the sampled parts were sound on the day; recertification judges the period, and it can be passed only by a system that was running in between. Plotting five series over thirty-six months takes an afternoon. A monthly question, minuted in one line, about what has opened, closed, moved or been outsourced takes two minutes.

The counter-case is the property that flattens its line by quota and audits the kitchen in February because February is its turn. Flatness is a symptom of a healthy programme, not its aim. In Melbourne the lapse that followed lasted eleven weeks and cost more than the whole cycle of auditing.

Subchapter 4.11 · Honolulu, Hawaiʻi

Setting: Honolulu, Hawaiʻi

A back office at the start of a morning, lit by a frosted pane high in the wall. Grey shelves carry rows of identical blank-spined binders. At the desk the certification body’s auditor, black hair in a low bun, reading glasses, grey cardigan, has two documents open side by side and rests a hand on each, reading one against the other. Behind her Noelani Medeiros, who built and ran the system, draws a single thick binder out of the row and turns to look at the auditor, her face sober. At the edge of the desk a telephone sits with its handset in the cradle. Nothing in the room refers to what happened, and that is deliberate.

The two documents are the special audit in miniature: what the property said its process was, and what its investigation actually did. The binder is the certification agreement, which had sat in a shared drive in a folder created fourteen months earlier and had been read once, at signature. A worker was seriously injured in the seventh month of the second year; the card, like the subchapter, says nothing more about the event. What it shows is the silence that followed. The response inside the property was competent and humane, counsel advised caution, the family was supported, and nobody told the certification body. It learned in the sixth week from a corporate client asking whether the certificate still stood. Two plaques at the top hold that sequence.

The certificate was retained because the system had worked. ISO 45001:2018 asks, under clause 10.2, that incidents be investigated with the participation of workers, causes determined, similar risks sought elsewhere and evidence retained, and the body’s questions followed from that and from clauses 6.1.2 and 8.1: was the hazard identified, were the determined controls in place, did the investigation follow the property’s own procedure, what changed afterwards. All four answers were sound. The major nonconformity concerned the agreement. Under ISO/IEC 17021-1:2015 the organisation must inform the body without delay of matters affecting its ability to keep meeting the requirements, and for accredited OH&S certification IAF MD 22 requires the agreement to name a serious incident expressly. The body may then audit at short notice and, where it has grounds, suspend.

The plaque at bottom right is the practical answer. The obligation has to live where it will be met at two in the morning by a duty manager who has never read the agreement: on the escalation list, between the insurer and the owning company, with a name, a number and one factual line. Counsel should be asked the notification question once, in advance.

None of this ranks the certificate above the person who was hurt; beside a serious injury it is a small matter. The card makes a narrower point. The certificate was never endangered by the event, and it took four months of work to recover from six weeks in which a decent organisation forgot one telephone call.

Subchapter 4.12 · Kuala Lumpur, Malaysia

Setting: Kuala Lumpur, Malaysia

Nine in the morning in the group marketing office in Kuala Lumpur, daylight through a tinted window, a white table covered in sales material. There is a stack of glossy brochures with a pool on the cover, a box of business cards, three brown banqueting folders, a ruled rate sheet, a closed laptop. Every item carries the same small empty oval in one corner. Suriani Rahim, in a dusty-pink hijab and a dark blazer, stands and holds up one business card between two fingers so that the oval faces the room. Across the table the group marketing manager, seated, a brochure open on a banqueting hall, looks up at the card in plain bewilderment.

The oval is drawn empty. What it stands for is how far the real one had travelled in fourteen months: from a high-resolution file emailed by somebody in operations with a note saying the hotel was now certified, to a group brochure describing three hotels, a website line about a certified safe hotel operator, business cards at all three properties, a spa page, and in two places the accreditation symbol standing alone. Nobody meant to mislead. Nobody had sent the marketing department the rules, because the rules lived in a certification agreement read once, at signature.

The plaque at bottom left is the principle. A management system certificate attests a system within a stated scope; it does not attest a service, a facility or an outcome. ISO 45001:2018 asks the organisation, under clause 4.3, to determine the scope of its system and keep it available as documented information, but nothing in the standard translates that scope into the language of a brochure. The rules on the mark come from ISO/IEC 17021-1:2015 and the certification agreement: use only within the certified scope, never on anything implying product or service conformity, never an accreditation symbol alone, and cease all claims at once on suspension. The body must control use of its marks, act on misuse, and make the status of every certificate publicly accessible. Hence the weight of the plaque at top right: the register showed the property as suspended for eleven weeks and recorded status, not reasons.

The practical remedy is the plaque at bottom right, and it takes an afternoon. An inventory of every place the mark appears, each with a named owner; one sentence in ordinary words naming the building covered and stating that no other may use the mark, sent with the artwork every time; and a single test for each use, whether the mark stands beside the organisation or beside something being sold.

The severity can look disproportionate for a logo. It is not. The party harmed by a misstated certificate is neither the body nor the property but the client who chose suppliers on the strength of it, and in this case that client was the one who asked.

Subchapter 4.13 · Montréal, Quebec

Setting: Montréal, Quebec

A head office above a winter street in Montréal, snow on the trees beyond the tall window. On the wall hang five photographs in identical dark frames, at exactly the same height: a nineteenth-century stone hotel with steep roofs, a glass tower, a red-brick corner building with an awning, a modern glass-fronted conference building, and a low grey industrial block with loading bays. Geneviève Charest, in a burgundy dress and grey cardigan, holds the returned application open in one hand and points along the row with the other. The group finance director, grey-bearded, in a navy suit, holds a closed black binder and looks up at the pictures.

The row is the argument. Hung identically, the frames leave nothing to compare but the buildings, and the buildings have almost nothing in common. A boutique with no food service and a block housing a production kitchen and an industrial laundry for four other properties are not the same working environment, and for occupational health and safety the hazard, not the process, is what a sample must represent. The plaque at bottom right states the condition. The plaque at top right states the discovery that settled the application before any auditor visited anything: a major nonconformity open for eleven weeks in Ottawa, raised, answered and returned within that property, and unknown at the centre until a reviewer in another city read a report.

ISO 45001:2018 applies to the organisation as it defines itself, with a scope under clause 4.3 covering what lies within its control or influence across every site it includes, and with one internal audit programme under clause 9.2 and one management review under clause 9.3. The certification rules add conditions. IAF MD 1 requires, for multi-site certification, a central function that receives and analyses information from all sites and has authority to require corrective action at any of them, a single system, and sites similar enough to sample, with higher-risk sites audited individually. IAF MD 2 governs transfer: a pre-transfer review, no transfer of a suspended certificate, an open major finding verified as corrected before the accepting body issues anything, and the existing cycle continued rather than restarted.

The plaque at bottom left gives the practical test, and it is not documentary. A group should ask whether its centre has, in the past year, required a property to do something it did not want to do, and whether it happened; whether any finding from any source reaches the centre within a stated period; and whether it has run the pre-transfer review on itself before applying. Montréal answered those questions over twenty-two months, after which four sites were sampled and the laundry was visited every year.

The card does not say the group was wrong to want one certificate. The saving was real and the brief was correct. It says that a group certificate covers one organisation occupying several buildings, and that the difference shows in how fast a finding travels.

Subchapter 4.14 · Jeddah, Saudi Arabia

Setting: Jeddah, Saudi Arabia

A meeting room on the first floor of the Jeddah hotel, mid-afternoon. Through the wide window, softly out of focus, a row of white coaches stands parked on the forecourt below. Hanan Nassif, in a black abaya and hijab, leans across the table and holds out a single sheet of ruled paper towards the lead auditor, her face urgent. He sits back, grey-bearded, in a light-grey suit and an open-collared shirt, and does not take it. Both his hands lie flat on the table, one of them resting on a closed notebook,, his expression courteous and settled. At her elbow a dark bound report lies shut.

The title is her question, and the card gives its centre to the answer. On the first afternoon of the second stage the auditor had established that the property’s hazard identification did not cover the coach forecourt at all: forty minutes of intense vehicle movement before dawn in pilgrimage season, porters working between reversing coaches, not a line about it anywhere. The gap was real and Hanan accepted it at once. Then she asked what to write, asked him to look at the draft she had made that morning, and asked him to recommend somebody who could help. The plaque at top left records the three refusals. The plaque at top right records what lay behind them: the readiness review bought fourteen months earlier from a sister company of the certification body, which had identified gaps, specified what to implement and been followed, and was therefore consultancy whatever it was called.

On the property’s side the gap belongs to clause 6.1.2 of ISO 45001:2018, which requires hazard identification to be ongoing and proactive and to take account of routine and non-routine activities and the way work is organised. On the body’s side ISO/IEC 17021-1:2015 makes impartiality the foundation. A body may not provide management system consultancy, nor may any entity under its organisational control, and where a related organisation has done so and the relationship is an unacceptable threat, the body may not certify that system until a minimum period has passed. The sheet the auditor will not touch and the report he never ordered are the same rule seen from two sides: nobody can objectively evaluate their own work.

The plaques along the bottom carry the practical sense. Questions about the requirement, the evidence examined, what was not found and whether a document is needed at all are always answered, fully and at no charge; the last alone would, on the property’s own estimate, have removed four of its nineteen procedures. Questions about solutions go to someone structurally unconnected to the certifier, and one email before purchase establishes who that is.

Hanan read the refusals as obstruction by a supplier already paid. A week later the same rule, applied by the body’s impartiality committee, cost her seven months and a second full audit. The boundary exists for the reader of the certificate, who will never sit at this table.

Subchapter 4.15 · Johannesburg, South Africa

Setting: Johannesburg, South Africa

A procurement office in Johannesburg at sunset, warm orange bars of light falling through a slatted blind. There is no hotel anywhere in the frame. Refilwe Mothibi, in a rust-coloured blouse and gold-rimmed glasses, sits at a wide desk holding a single certificate at reading distance; it carries a thin border, three ruled lines near the top and a large blank space beneath them, and she studies it with a frown of slow reconsideration. Across the front of the desk lie four supplier files. Three are thin. The fourth is a thick ring binder full of ruled record sheets, and a young colleague in a white shirt leans in from behind her and points at one of its pages.

The plaque at top left names the first certified property, whose scope covered conference and accommodation and excluded the spa run under concession, where her staff on long assignments spend more of their time. The plaque at top right names the fourth, which held no certificate and sent, when asked, a hazard register that included its own contractors, twelve months of incident and first-aid entries, drill records stating what had failed, and committee minutes showing three decisions changed because somebody objected. Between them sat a second certificate from a body accredited only for quality, and a third, sound in every respect, whose last surveillance was eleven months old.

The plaque at bottom left is the principle of the volume. A certificate makes four claims: who assessed, under what accreditation, over which activities and sites, and on what date. ISO/IEC 17021-1:2015 requires it to identify the organisation, the scope, the standard and the body, and requires the body to make certification status publicly accessible. ISO 45001:2018 describes intended outcomes, the prevention of work-related injury and ill health and the provision of safe and healthy workplaces, but it sets no performance criteria of its own. Under clauses 6.1.3 and 9.1.2 it requires the organisation to determine and evaluate its compliance obligations, which is not the same as certifying compliance. What an accredited certificate does establish is real: hazards identified, controls operated, workers consulted, the system audited and reviewed, failures investigated, all confirmed by an assessor whose competence is defined and whose impartiality is protected.

The plaque at bottom right gives the reader’s method. Ask for the scope statement in full, the date of the last assessment and the accreditation scope of the issuing body, which a public register settles in two minutes; then ask for twelve months of the property’s own reporting, by month and department, and read its shape. A property can send that page before anyone asks.

The opposite error is to conclude that certification proves nothing, and to replace an independent assessment of a system with a private inspection of a morning. Refilwe did not. Her framework became one page longer, which is the distance between requiring a document and reading it.