How to Prepare for a Client Compliance Audit as a Cleaning Business

A client compliance audit is either a moment that confirms your business is well-run, or the moment you realise your documentation is not as solid as you assumed. The difference between those two outcomes comes down almost entirely to preparation.

This guide covers what compliance audits look for, how to prepare your documentation, and how to use audit performance as a tool for winning and retaining contracts.

Key Takeaways

• Client audits assess your systems and documentation, not just the quality of cleaning on the day — a pristine site with incomplete records will still generate findings.
• Training records are consistently the area most likely to produce a non-conformance: every operative on the site must have current certificates retrievable quickly. See what certificates each operative should hold.
• RAMS must be site-specific and reviewed within the last 12 months — generic or undated assessments are a common audit failure across cleaning businesses of all sizes.
• A clean audit history, used explicitly in tenders and contract renewals, is one of the most underused commercial advantages in the cleaning industry.

What is a compliance audit and who runs them?

A compliance audit is a formal review by a client (or a third-party auditor acting on their behalf) of whether your cleaning service meets the standards set out in the contract. It is not primarily about the quality of the cleaning on the day of the audit, though that matters. It is about whether you have the systems, records, and processes in place to deliver consistently.

Audits are most common in:

• NHS trusts and healthcare facilities (governed by the NHS National Standards of Healthcare Cleanliness 2021)
• Local authority contracts
• Schools and educational institutions
• Food retail and food production sites
• Large commercial property management clients
• Facilities management companies managing contracts on behalf of building owners

Many of these clients conduct audits quarterly or annually. Some do unannounced spot checks. The frequency depends on the contract value and the sensitivity of the environment.

What auditors typically assess

Every client has their own audit format, but most compliance audits cover the same core areas.

Audit area	What auditors check	Most common failure	Fix before the audit
Training records	Named certificates for every operative on site, current and dated	Records missing for some staff; expired certificates	Pull dashboard, identify gaps, complete outstanding training
RAMS	Site-specific assessments reviewed within 12 months	Generic, undated, or off-the-shelf templates	Update with site name, client, and review date
COSHH	SDS for every product in current use; operative training records	Outdated SDS; products no longer used still in folder	Remove old SDS, download current versions, confirm trained
Quality control	Completed inspection sheets with trend data	Blank records or inspections scheduled but not done	Complete outstanding inspections, log results
Incident records	RIDDOR-notifiable incidents with HSE reference numbers	Verbal reports never documented	Log all incidents; check RIDDOR obligation for each

Training records

This is consistently the area that catches cleaning businesses out. Auditors ask to see training records for the operatives assigned to their site. They are looking for:

• Evidence that each operative has completed the required training
• Certificates with the operative’s name, course title, and completion date
• Confirmation that training is current (not expired)
• Any specialist training required for the site (clinical cleaning, food hygiene, high-level cleaning)

If you cannot produce training records within a short time, or if records are incomplete for some operatives, expect a non-conformance. On healthcare contracts, a training gap can trigger a formal remediation requirement. For a full breakdown of the training requirements specified in commercial contracts, that guide covers every clause type.

Risk assessments and method statements (RAMS)

Auditors check that you have produced RAMS for the cleaning tasks carried out on their site. This includes:

• A general risk assessment covering the cleaning environment
• Task-specific assessments for higher-risk activities: washroom deep clean, floor polishing, high-level work, biohazard response
• Evidence that the RAMS have been reviewed in the last 12 months

RAMS that are generic, undated, or clearly not site-specific are a common finding in audits. The HSE provides guidance on suitable risk assessment formats that can inform what a compliant assessment should include.

COSHH assessments and product information

The client will expect you to hold COSHH assessments for every cleaning product used on their site. This includes:

• Product safety data sheets (SDS) for each product
• A completed COSHH assessment showing hazard classification, PPE requirements, and first aid measures
• Evidence that operatives have been trained on the specific products used

Some clients also ask for product approval: they want to know which cleaning chemicals are being used on their premises and to have approved them in advance. For detailed guidance on what COSHH training must cover, see that guide.

Quality control records

Auditors look for evidence that you are actively monitoring cleaning standards, not just reacting when clients complain. They want to see:

• Completed quality control inspection sheets for the site
• A scoring record showing audit results over time
• Evidence of any issues raised and the corrective actions taken
• Sign-off records confirming that periodic or deep cleans have been completed

A blank quality control record is a major red flag. It suggests you are not inspecting your own work.

Incident and near-miss records

If anything has gone wrong on site, it should be in your records. Auditors sometimes check for incidents that were reported verbally but never documented. They also check whether your incident response process was followed correctly. RIDDOR-notifiable incidents must appear in your records with HSE reference numbers — see the RIDDOR reporting guide for cleaning businesses for which incidents are notifiable.

Staff conduct and PPE

On some audits, particularly in healthcare and food environments, the auditor will observe operatives at work. They are looking at:

• Whether staff are wearing correct PPE for the task
• Whether colour-coding is being followed
• Whether the cleaning sequence is correct (high to low, clean areas before dirty areas)
• Professional conduct on site

A single operative using the wrong colour cloth in a clinical area can result in an audit failure even if everything else is in order.

How to prepare in advance

The week before a scheduled audit (or as ongoing practice for unannounced ones) should include the following.

Pull up your training records. Check that every operative currently assigned to the site has current certificates for all required training. If anyone is missing a certificate or their training has expired, address it before the audit. Most audit frameworks allow you to submit an action plan for outstanding training, but it looks significantly better to present a complete set of current records.

Review your RAMS. Check the date on each risk assessment. If any are more than 12 months old, update them. Check that they reference this specific site and client. Generic RAMS from a template library, with no site-specific content, will not pass scrutiny.

Check your COSHH folder. Ensure you have current safety data sheets for every product currently in use on the site. If your supplier has updated an SDS, download the current version. Remove SDS sheets for products you no longer use, so auditors are looking at a current, accurate record.

Review your quality control records. Confirm that inspection sheets are completed and up to date. If you have monthly or quarterly inspections scheduled, make sure they happened and were recorded. Look at the most recent results and address any outstanding actions before the audit.

Brief your supervisor. The site supervisor should know the audit is happening, what the auditor will be looking for, and where all the documentation is held. They should be able to answer questions about the cleaning schedule, staffing, and any recent incidents or complaints.

Do a site walkthrough. Walk the site as you would during a quality control inspection. Check for anything that could be raised as a cleaning standard issue on the day: overlooked areas, equipment not stored correctly, PPE not available on site.

Responding to audit findings

Even well-prepared businesses receive findings in compliance audits. What distinguishes strong operators from weak ones is how they respond.

A finding should receive:

An immediate acknowledgement. Do not dispute the finding in the audit meeting unless it is factually incorrect. Accept it, note it, and confirm that you will address it.

A written response with a timeline. Most audit frameworks ask for a corrective action plan: what the finding was, what you will do to address it, who is responsible, and by what date it will be complete.

Follow-up evidence. If the finding was about a missing training certificate, the follow-up evidence is a copy of the certificate once the training has been completed. If it was about a RAMS that needed updating, the follow-up is the updated document. Close the loop in writing.

A process review. If the same finding appears in multiple audits, or if a finding reveals a systematic gap (for example, new starters regularly working on the site before training is complete), fix the underlying process, not just the individual instance.

Turning audit performance into a commercial advantage

Cleaning businesses that perform well in compliance audits should use that performance actively.

Mention audit performance in tenders and pitches. If your last audit received a high compliance score or a commendation from the client, reference it in future proposal documents. Specific evidence of audit performance is more persuasive than general claims about quality. For more on how to structure your approach to winning NHS and local authority contracts, see that guide.

Ask for the audit report. Some clients issue formal audit reports with scores and findings. Ask for a copy. Keep it. If you address all the findings, ask for confirmation in writing. This creates a documentary trail of consistent, improving performance.

Use it for contract renewals. When a contract comes up for renewal, a clean audit history is evidence that you have delivered. Frame the conversation around your compliance record, not just the price.

Share it internally. Use good audit results to acknowledge the team. Use poor results as a learning tool. Staff who understand why compliance matters are more likely to follow procedures consistently.

The businesses that fail audits

Based on what cleaning companies consistently report, audits tend to go badly for businesses that:

• Treat documentation as a one-time exercise rather than an ongoing discipline
• Have training records for some staff but not others
• Use generic, undated, or clearly off-the-shelf RAMS rather than site-specific documents
• Have a quality control process on paper but do not actually conduct the inspections
• Leave audit preparation until the day before, rather than maintaining it continuously

The good news is that all of these are fixable. A cleaning business with 10 to 50 staff does not need a large compliance team. It needs a consistent process for maintaining training records, reviewing RAMS annually, logging quality control inspections, and briefing supervisors before audits.

Getting those basics right will put you ahead of the majority of competitors bidding for the same contracts.

CleanOS Training provides the training records, certificates, and documentation that auditors look for. Seven compliance-aligned courses covering every training requirement in this article. Dashboard showing completion status for every member of your team, with certificates ready to produce on request. Book a free demo.