The VCA audit process
The VCA audit is the moment when it is determined whether your company meets the VCA requirements. The audit is carried out by an accredited certification body that is recognised by the SSVV . The SSVV is the foundation that manages the VCA scheme. Many companies see this as an exam, but with the right preparation it is a structured process you can get through well.
This article takes you through the whole audit process: what happens, what the auditor looks at, and how you can prepare. The aim is to make the audit as predictable as possible, so you know what to expect.
A VCA audit is more practical than many other certification audits. On the construction site or work location, the auditor checks whether safety rules are actually being followed.
The VCA audit process in brief
| Part | What happens? | Result |
|---|---|---|
| Initial audit | Documentation and practical check | Certification decision |
| Interim audit | Annual check | Certificate maintained |
| Re-audit | Full reassessment after 3 years | Certificate renewed |
The VCA audit sequence step by step
As with ISO certifications, VCA follows a cycle of audits that spans three years.
The initial audit
The initial audit is the first audit you undergo to obtain the certificate. In this audit, the whole VCA system is assessed: all requirements from the checklist are tested.
The initial audit has two parts: a documentation review and a practical check. The documentation review can take place before the practical check, but both parts are often carried out on the same day.
The interim audit
After certification, the auditor returns every year for an interim audit, also called a surveillance audit. This audit is shorter than the initial audit and checks whether you still meet the requirements.
At the interim audit, not all requirements are tested again. The auditor looks at a selection of requirements, checks whether deviations from earlier audits have been resolved, and looks at any changes in the company.
The recertification audit
After three years, you must be fully certified again. The recertification audit is similar to the initial audit: the whole system is reassessed. After successful completion, a new three-year cycle begins.
Plan the recertification audit well before your current certificate expires. If your certificate expires before the recertification audit is completed, you are temporarily not certified.
Preparing for the VCA audit
Good preparation is half the work. Start weeks in advance, not days.
Check the diplomas
The first check is the validity of the safety diplomas. Make an up-to-date overview of all employees with their diplomas and expiry dates. Check whether the required percentage of employees holds a valid diploma.
Make sure you can show the diplomas. The auditor wants to see the original diplomas or copies. You can also check diplomas in the VCA register of the SSVV .
Check the records
Go through the records the auditor will want to see:
- Toolbox talk records for the recent period
- Incident records
- Workplace inspection records
- Equipment inspection records for work equipment
Are the records complete? Is there enough history? The auditor wants to see that processes are followed consistently, not only in the week before the audit.
Check the documentation
Make sure the required documentation is up to date:
- VGM policy (for VCA**)
- RI&E and task risk analyses
- Procedures and work instructions
- Overview of diplomas and certificates
- Objectives and monitoring (for VCA**)
Have documents been revised recently where this was necessary? Do the version dates match?
Inform employees
Tell employees that an audit is coming. Explain the purpose and what they can expect. The auditor may speak to any employee. They should know what VCA is and how the company approaches safety.
Reassure employees: it is not a personal exam. The auditor wants to know how safety works in practice, not whether individual employees know every rule by heart.
Arrange practical matters
Arrange the practical matters:
- A room where the auditor can work
- The necessary documents and records to hand
- Availability of key people (management, KAM coordinator, managers)
- Access to a work location where the auditor can see the work in practice
If the practical check takes place at a client’s site, arrange permission in advance.
Carry out an internal check
Go through the VCA checklist yourself as a dress rehearsal. Would you pass the audit if it were held today? Which points are vulnerable? Tackle problems before the real audit takes place.
Internal VCA audit: do it yourself or outsource?
For VCA** and VCA Petrochemie, an internal audit is mandatory: you test your own system at least once a year before the external auditor comes. For VCA*, it is not a strict requirement, but it is sensible as a dress rehearsal. The main question is whether you do this yourself or outsource it.
Doing it yourself is possible, provided the person carrying it out is independent of the work they assess. In practice, for VCA**, the KAM coordinator or prevention officer often carries out the internal audit. A director cannot objectively assess their own safety policy, so that role is ruled out. From VCA 2026/6.1, the requirements for independence and spread of internal audits are tightened: one person who checks everything is no longer enough.
Outsourcing to an external advisor makes sense if you do not have a suitable internal person, or if you want a fresh perspective. An external advisor often sees blind spots that you overlook. It costs more, but often gives a sharper audit. Read more about costs on costs and timeline.
| Aspect | Do it yourself (KAM/prevention) | Outsource (external) |
|---|---|---|
| Costs | Internal hours only | Advisory rate, often per day part |
| Independence | Provided it is not your own work | Fully independent |
| Knowledge of the standard | Own experience | Specialist knowledge |
| Fresh perspective | Limited | Large |
| Suitable for | Companies with a KAM coordinator | Small teams, first time, complex organisations |
What the auditor checks per chapter
The VCA checklist is divided into chapters. Below, you can see for each chapter what the auditor looks at and what evidence they want to see. Use this as a quick preparation checklist. The requirements per level are covered in more detail on the requirements page.
| Chapter | What the auditor looks at | Evidence you prepare |
|---|---|---|
| VGM policy and organisation | Policy, tasks, management involvement | Signed VGM policy, management review (VCA**) |
| Risk management | RI&E, task risk analyses, LMRA | Current RI&E, TRAs, examples of completed LMRAs |
| Training and information | Diplomas, toolbox talks, instructions | Diploma register, toolbox records with signatures |
| Awareness and behaviour | Safety culture, addressing others | Meeting notes, examples from practice |
| Work preparation | Work permits, project plans | Permits, VGM project plans (VCA**) |
| Purchasing and subcontracting | Requirements for suppliers and subcontractors | Contract agreements, checks on diplomas |
| Work equipment | Inspections of tools and equipment | Inspection records, inspection stickers |
| Incidents and monitoring | Reporting, recording, analysis | Incident register, analyses, measures taken |
During the audit
The VCA audit follows a fixed pattern. Knowing what to expect helps you stay calm.
Opening meeting
The audit begins with an opening meeting. The auditor introduces themselves, explains the purpose and approach of the audit, and confirms the scope. You get the chance to ask questions and report any particular points.
This is also the moment to discuss any changes in the company. Has anything changed since the previous audit or since the application? New activities, new locations, reorganisations? The auditor needs to know.
Documentation review
In the documentation review, the auditor checks the documentation and records. The auditor looks at:
- The diploma register and the validity of diplomas
- The VGM policy and objectives (for VCA**)
- The RI&E and any task risk analyses
- Records of toolbox talks, incidents and inspections
- Inspection records for work equipment
- Other required documents
The auditor asks questions to understand how the system works. Who is responsible for what? How are records kept? How are deviations handled?
Practical check
The practical check is the visit to the work location. This may be your own office or workshop, but also a location where you are carrying out work at that time.
The auditor observes the work and pays attention to:
- Use of personal protective equipment
- Tidiness and order of the workplace
- Condition of work equipment and tools
- Safe working methods
- Barriers, signage and safety measures
The auditor speaks to employees at the work location. Typical questions are:
- What work do you do here?
- What risks are there?
- What would you do if an incident happened?
- Have you recently attended a toolbox talk? What was it about?
- Do you have a valid VCA diploma?
The aim is to verify that employees know what they are doing and that safety is genuinely alive on the shop floor.
Interviews with key people
Alongside conversations at the work location, the auditor also holds interviews with key people: management, the KAM coordinator, managers. These conversations go deeper into safety management.
For VCA**, the auditor wants evidence of management involvement. Management must be able to explain how they are involved in safety and which decisions they have taken in this area.
Closing meeting
At the end of the audit, the auditor holds a closing meeting. In this meeting, the findings are presented and explained.
The auditor states whether any deviations were found and how serious they are. You get the chance to ask questions and clarify any unclear points.
The auditor also gives an indication of the result: is certification possible, and if so, under which conditions?
Findings and deviations in the VCA audit
The auditor classifies findings into different grades.
Conformity
Conformity means that you meet the requirement. This is the desired result. Most findings are hopefully conformities.
Observation
An observation is not a deviation, but it is a point of attention. The auditor has seen something that could be improved, but it does not conflict with the requirements.
Observations do not block certification. You are not obliged to act on them, but it is sensible to take them seriously. Observations that are not addressed can still lead to deviations at a later audit.
Minor deviation
A minor deviation is a shortcoming that does not fundamentally undermine the effectiveness of the VCA system. Examples:
- A diploma has recently expired (and the retake is already planned)
- A record is incomplete
- A procedure is not entirely up to date
Minor deviations do not block certification immediately. You receive a deadline, usually 90 days, to correct the deviation and provide evidence to the certification body.
Major deviation
A major deviation is a serious shortcoming that puts the effectiveness of the system at risk. Examples:
- A large part of the employees do not have a valid diploma
- Critical records are missing entirely
- The VGM policy is missing although it is required
- Demonstrably unsafe work is taking place
A major deviation blocks certification until it is resolved. This may require a follow-up visit from the auditor to verify that the measure is effective.
One major deviation is enough to block certification. Several minor deviations together can also be treated as major if they point to a systematic problem.
Resolving VCA deviations
If deviations have been found, you must resolve them to obtain or keep the certificate.
Analyse the cause
Start by analysing why the deviation occurred. What went wrong in the process? Why was it not found sooner? Fixing only the symptom is not enough; you must address the underlying cause.
Take corrective measures
Take measures to correct the deviation and to prevent it from recurring. If the deviation is that an employee does not have a valid diploma, the measure is not only that the employee takes the exam. The measure is also that you improve the monitoring process for diplomas.
Document and provide evidence
Document the corrective measures and gather evidence that they have been carried out. This can be the new diploma, the adjusted record, the revised procedure, or the report of the improvement meeting.
Send the evidence to the certification body within the set deadline. The body assesses whether the measures are adequate.
For major deviations
For major deviations, the certification body may require a follow-up visit to verify that the measures are effective. This means extra costs and delay, but it is important to get this right.
Tips for a successful VCA audit
A good audit is about openness and evidence. A few points that make a difference:
- Be honest and open. If something is not in order, admit it and explain what you are doing about it. The auditor values self-awareness more than defensive behaviour.
- Give concrete answers. Not “yes, we record incidents”, but “here is our incident register, these are the two near misses from this month”. Evidence convinces.
- Know your own system. Make sure the person supporting the audit knows where the documentation is and how the processes work. Searching during the audit does not inspire confidence.
- Take notes. Record findings and feedback so you can act on them afterwards.
- Learn from the audit. An auditor looks with a fresh, critical eye and spots areas for improvement that you may miss yourself.
Choosing a VCA certification body
VCA audits are carried out by certification bodies that are recognised by the SSVV . The SSVV keeps a list of recognised bodies.
Accreditation and recognition
Choose a body that is recognised by the SSVV. Only recognised bodies may issue VCA certificates that are registered in the official VCA register.
Well-known certification bodies for VCA in the Netherlands are Kiwa , TÜV , DNV , Bureau Veritas , and LRQA .
Compare quotes
Request quotes from several bodies. Prices can vary, as can availability and approach. Do not compare on price alone; also look at the body’s experience in your sector and its reputation with other companies.
Combining with other certifications
If you also have or want ISO 9001 or other certifications, it can be efficient to choose the same certification body. Combined audits save time and costs.
What if you fail?
Not passing is unpleasant but not the end of the world. It means there is work to do before you can be certified. First analyse what went wrong: was it the implementation, the documentation, or the understanding of the requirements?
Then make a concrete action plan with responsibilities and deadlines. Once the deviations have been resolved, plan a follow-up audit that focuses on the problem areas, not the whole system. Most companies that fail on the first attempt pass on the second.
Working on practically from here
Make your preparation concrete with the VCA audit checklist for evidence. Use the matrix to link documents, records and workplace examples together.
More information
- VCA step-by-step plan – The whole process from start to certificate
- VCA requirements – The checklist explained
- Frequently asked questions – Answers to practical questions