Last Updated on October 27, 2026
Disconnected EHS Systems Fail Audits. Connected Ones Don’t.
Quick answer:
Auditors don’t only check that a record exists. They check whether your records agree with each other. When SDSs, chemical inventory, labels, training records, JSAs, and corrective actions sit in separate tools, versions of drift, evidence goes missing, and the trail from one chemical to one trained employee breaks. A connected platform narrows those gaps, but only when the data and review process behind it are sound. The key facts include:
- Hazard Communication (29 CFR 1910.1200) ranked second on OSHA’s list of most frequently cited standards for FY2025 (Oct. 1, 2024, to Sept. 30, 2025). Preliminary reporting put it at 2,546 citations.
- Preliminary FY2026 data places it second again, at 1,961 citations, which makes it the most-cited general industry standard. Those figures are preliminary and will move.
- Under the 2024 HazCom update, employers must meet the new requirements for substances by November 20, 2026, and for mixtures by May 19, 2028, after OSHA’s January 15, 2026, extension.
- OSHA injury and illness records (29 CFR 1904.33) are kept for five years. Applicable employee exposure records (29 CFR 1910.1020) are generally kept for 30 years.
What does an auditor check?
An auditor follows evidence. They pick one thread, pull it, and see whether it holds one record to the next. A binder full of tidy documents proves very little if nobody can show how those documents relate to the workplace in front of them.
-
The audit trace: one chemical from the shelf to the training record
Say the auditor picks a solvent from a parts-washing station in a maintenance shop. They read the container label first, then ask for the SDS and note how long it takes to produce. Next, they compare the SDS revision date against the supplier's current version, find the product in your inventory, and look for the same product identifier on the chemical list in your written program.
Then they move to work by themselves. Does the JSA for parts cleaning name the gloves and eye protection that SDS section 8 recommends? Did the technician interview get trained in this hazard category, and is there written certification of PPE training? Finally, they ask whether last year's internal audit finding about the eyewash station on that bench was ever closed.
Each handoff is a place for a mismatch. The label says "Danger," while the SDS on file, a 2021 revision, says "Warning." The inventory lists the product under its old trade name. The JSA calls for gloves the current SDS no longer supports. None of these is necessarily a violation by itself, but each one tells the auditor the controls may not be tracking reality, and they'll widen the sample.
-
Regulatory audits vs. ISO 45001 certification audits vs. internal audits
They look similar from the inside, but they answer different questions.
An OSHA inspection is enforcement. A compliance officer measures your workplace against legal standards, usually triggered by a complaint, a referral, a serious incident, or a targeting program. Findings can become citations and penalties. Expect requests for the written HazCom program, SDSs, training records, and the 300 Log.
An ISO 45001 certification audit is conducted by an accredited registrar. It tests whether your occupational health and safety management system conforms to the standard and is actually operating. Gaps are graded as major or minor nonconformities. ISO 45001 isn't law, and certification doesn't prove legal compliance, though the standard does require you to evaluate it.
Internal audits, covered by clause 9.2, are yours. You plan the program, use objective and impartial auditors, and report results to management. They're also the cheapest place to find a broken trail, because nobody has issued a citation or a nonconformity yet.
-
Why "we have the document somewhere" fails as evidence
Existence isn't the test. An auditor wants to know four things about a record. Is it current? Can the person who needs it get to it? Is it tied to the right chemical or the right employee? And does it reflect the conditions that applied at the time in question?
A sign-in sheet that reads "HazCom training, 3/14" with no content outline, no hazard categories, and no trainer name answers none of those. The file may exist and still not prove anything.
What counts as a disconnected EHS system?
A disconnected system is any tool, document, or workflow that stores safety information on its own, with no reliable link to the other places in the same information lives. The link might be a shared identifier, a sync, or a rule that says one change triggers another. Without one, people become the integration layer, and people forget, go on leave, and change jobs.
-
Spreadsheets, shared drives, binders, and email approvals
These fail in familiar ways. The same chemical gets typed into three files. A revised SDS lands in a shared folder, but the binder at the site still holds the old one. The ownership of the inventory sheet is unclear, so nobody feels responsible for it. Approvals live in someone's inbox. When the one person who knows where everything is takes a week off, retrieval takes a week.
-
Point solutions that don't share identifiers
Plenty of companies run a good SDS library, a good learning system, and a good incident tool and still can't connect them. The reason is usually mundane: no common key. The SDS library knows a product by supplier part number, the inventory by a purchasing description, and the training system by a course title. Nothing says these three are the same hazard in the same room, so a revision in one never reaches the others.
-
"Integration by export": CSV handoffs that go stale
Someone exports the inventory every month and uploads it to another system. It works until the Tuesday after the export, when a department brings in a new product. For the next 27 days, the downstream record is wrong, and nobody knows. Exports also drop contexts such as who changed what and when, so the receiving system can't tell a deliberate update from a mistake.
Which audit failures do disconnected systems cause?
Each failure below follows the same order: the requirement, how disconnected systems break it, and what an auditor may find missing.
-
SDS version drift
Requirement: Under 29 CFR 1910.1200(e)(1)(i), the written program must include a list of hazardous chemicals known to be present, using a product identifier that appears on the SDS and the label.
How it fails: The SDS library is updated by one person, the inventory by purchasing, and labels by whoever fills secondary containers. Within a year the three describe slightly different chemicals.
What the auditor finds: A label hazard statement that doesn’t match the SDS, an inventory entry with no matching SDS, or a program list naming products that left the building years ago.
-
Training records that don’t follow hazard changes
Requirement: 29 CFR 1910.1200(h)(1) requires training at initial assignment, and (h)(3) adds training when a new chemical hazard the employees haven’t been trained on enters their work area. ISO 45001 clause 7.2 requires you to keep evidence of competence. Where PPE is involved, 29 CFR 1910.132(f)(4) calls for written certification of PPE training.
How it fails: An SDS is reclassified, but the training content and the completion records still describe the old hazard.
What the auditor finds: Employees who completed a course that never covered the hazard now on the SDS. Note the distinction: retraining is triggered by a new hazard, not by every SDS revision. Refreshing training on a schedule is good practice, not a HazCom mandate.
-
JSAs that reference outdated hazards or PPE
Requirement: ISO 45001 clause 8.1.3 expects changes that affect OH&S performance to be managed. Where respirators are involved, 29 CFR 1910.134 requires a written program and under (k)(5) retraining when workplace changes make earlier training obsolete.
How it fails: The chemical or process changes, and nobody opens the JSA.
What the auditor finds: A JSA that still specifies a cartridge, glove material, or ventilation step based on a product that has been replaced.
-
Corrective actions that die in inboxes
Requirement: ISO 45001 clause 10.2 requires nonconformities to be addressed, causes evaluated, and the effectiveness of actions reviewed.
How it fails: A finding is emailed to a supervisor, who forwards it, and who reassigns it. Nobody owns the deadline, and nobody verifies the fix.
What the auditor finds: Open items from the last audit with no owner or evidence of closure. For a regulator, an unresolved cited hazard can lead to failure-to-abate exposure, which is a separate and costlier problem than the original citation.
-
No version history
Requirement: ISO 45001 clause 7.5.3 requires documented information to be controlled, including version control and retention.
How it fails: Edits overwrite the file. When an incident investigation asks what the JSA said on the day of the injury, the honest answer is “whatever it says now.”
What the auditor finds: Procedures and risk assessments with no revision trail, so you can’t prove what was in force at a given date.
-
Slow retrieval during an inspection
Requirement: 29 CFR 1910.1200(g)(8) requires SDSs to be readily accessible to employees in their work areas during each shift. Electronic access is allowed as long as there are no barriers to immediate access.
How it fails: Having the SDS isn’t the same as being able to produce it. If it takes a supervisor ten minutes and a password reset, or the Wi-Fi is down at the dock, the access requirement is in question. OSHA’s guidance expects a plan for when electronic systems fail.
What the auditor finds: A stopwatch result and a worker who doesn’t know how to look it up.
-
Retention gaps and figures that don’t reconcile
Three separate problems get lumped together here, and they shouldn’t be.
Injury and illness records. Under 29 CFR 1904.33, the OSHA 300 Log, privacy case list, 301 incident reports, and 300 A summary is generally kept for five years after the end of the calendar year they cover.
Exposure records. 29 CFR 1910.1020 generally requires 30 years for applicable exposure records. Notably, an SDS can be discarded if you instead keep a record of the chemical’s identity, where it was used and when, for 30 years. Few organizations track that deliberately.
EPCRA Tier II. Under EPCRA Section 312, facilities over the thresholds report chemical inventories by March 1 each year. If your inventory quantities don’t match purchasing or storage data, the report is hard to defend.
These obligations have different scopes and different clocks. Not every EHS record follows the same retention period, and treating them as one rule leads to both over-keeping and under-keeping.
How does HazCom 2024 raise the stakes right now?
A reclassified chemical doesn't change one document. It can touch labels, the written program, inventory, and training, which is exactly where disconnected systems struggle. With the employer deadline for substances less than a month away, many SDSs are already being revised, since chemical manufacturers' own substance deadline passed on May 19, 2026.
HazCom 2024 compliance dates for substances and mixtures
| Chemical category | Employer compliance date |
|
|
|
|
These dates come from OSHA’s final rule published in the Federal Register on January 15, 2026 (91 FR). Manufacturers, importers and distributors had earlier dates: May 19, 2026 for substances and November 19, 2027 for mixtures. Until the applicable dates, the 2012 or 2024 version of the standard may be followed.
Why one reclassified SDS triggers four downstream updates
Trace one revised SDS through the workplace:
- Labels: Alternative workplace labeling under (f)(6) has to reflect the new hazard of information.
- Written HazCom program: The chemical list and any hazard-specific program content need review.
- Inventory: Product identity and hazard data must still match the SDS.
- Training: If the revision introduces a hazard that employees haven't been trained on, (h)(3) applies.
Not every revision triggers all four. A corrected phone number in section 1 doesn't require retraining. The skill is knowing which changes matter, and that depends on being able to see what the SDS touches.
What does a connected EHS platform fix?
The answer isn't more software. There are fewer places where the same fact is typed twice and clear rules for what happens when that fact changes.
-
One chemical record, shared everywhere
When the SDS, inventory entry, label, risk assessment, and training assignment all point to one chemical identity, there's one record to correct. Duplicate entries and conflicting descriptions mostly disappear because there's nowhere for them to live.
-
Change triggers that flag downstream updates.
When an SDS revision or hazard classification changes, the system flags the labels, JSAs, and training content tied to that chemical for review. To be clear, a flag is a prompt for a person to decide. It isn't automatic compliance.
-
Audit logs and version history by default
Timestamps, approvals, owners, and change history let you reconstruct what was known, who approved it and when. That's what answers the "what did the JSA say that day" question.
-
Retrieval in seconds: mobile SDS access and QR codes
Searchable records, location-based lists, and QR codes in storage areas get a worker or an auditor to the right SDS fast. Electronic access still has to meet the (g)(8) standard of no barriers, so test it offline and with a visitor's phone before the auditor does.
-
From audit findings to verified corrective action
A finding gets an owner, a due date, a verification step, and a closure record. The item can't quietly disappear into an inbox, and the closure evidence is already attached when someone asks.
| Disconnected-system failure | Connected-platform capability | Evidence available to the auditor |
| Conflicting SDS versions | Controlled SDS records and revision history | Current and historical versions |
| Training doesn’t reflect changed hazards | Training assignment and change-alert workflows | Assignment, completion, and applicable training records |
| Outdated JSA or PPE references | Linked risk assessments and review workflows | Current assessment and review history |
| Untracked corrective actions | Assigned CAPA workflow | Owner, deadline, status and closure evidence |
| Missing historical context | Audit logs and version control | Timestamped changes and approvals |
| Slow SDS retrieval | Searchable, accessible digital records | Retrieved SDS and supporting documentation |
| Inventory quantities don’t reconcile | Linked inventory and reporting workflows | Consistent records and reportable quantities |
What "connected" doesn't mean
One login isn't the same as one data model.
A single dashboard can sit on top of five databases that still don't share a chemical identifier. Ask vendors a direct question: if I change this SDS here, what changes there, and how do I see it?
Software doesn't replace a hazard assessment or competent review.
Software holds records, routes work, and gives you visibility. It doesn't assess your hazards, choose controls, deliver training, or verify that the controls work. Those remain the employer's job.
Is your EHS program audit-ready? A 10-question self-check
- Can you pull the current SDS for any hazardous chemical at any site?
- Does your inventory use identifiers that match the relevant SDS?
- Can you confirm workplace labels reflect applicable hazard information?
- Can you list which records an SDS revision affects?
- Can you show required employee training was completed?
- Do JSAs and PPE requirements reflect current hazards?
- Can you trace a corrective action from finding to verified closure?
- Can you retrieve earlier document versions and approvals?
- Are required records retained for the applicable periods?
- Can you reconcile inventory records with regulatory reports?
A "no" or "not sure" marks an area to review. It isn't proof of a violation.
How CloudSDS connects SDS, inventory, training, and JSAs
CloudSDS is built so the chemical is the common thread. SDS Management centralizes safety data with revision control and access. Chemical Inventory ties each product's identity to its location and quantity. LearnLMS assigns and tracks EHS training. GuardianJSA links job safety analyses to hazards and protective measures.
Take one product. It's received and entered into inventory against its SDS and stored in a location the inventory knows. It's then reviewed in a job safety analysis for the task that uses it, and the employees who do that task are assigned the matching training. When the SDS is revised, the people responsible can see which locations, JSAs, and training assignments reference it.
If you'd like to see how your existing chemical records and workflows could connect, we're happy to walk through it with your own data.
Frequently asked questions
1. What is the most common EHS audit finding?
It depends on the industry, the audit scope, and whether it's a regulatory or management-system audit. Without audit data for your own sector, naming one universal answer would be a guess. OSHA's published citation lists are a better guide for regulatory exposure.
2. Can SDSs be kept electronically for OSHA compliance?
Yes. Under 29 CFR 1910.1200(g)(8), SDSs must be readily accessible during each work shift, and electronic access is acceptable if employees face no barriers to immediate access. Plan for outages and train people on how to retrieve them.
3. How long must EHS records be retained?
It varies by record. OSHA injury and illness records are generally kept for five years (1904.33). Applicable employee exposure records are generally kept for 30 years (1910.1020). Other documentation depends on the rule or program that requires it.
4. What's the difference between an EHS audit and an OSHA inspection?
An EHS audit is usually voluntary and run by you or a consultant to find and fix gaps. An OSHA inspection is a government enforcement action that tests compliance with legal standards and can end in citations.
5. Does ISO 45001 require EHS software?
No. ISO 45001 sets requirements for an occupational health and safety management system. It doesn't require any particular tool. Software is one way to meet its documentation and control requirements.
6. How do I prepare for an EHS audit in 30 days?
Fix the scope first, then map the requirements that apply. Reconcile critical records: SDSs, inventory, and labels. Check training and open corrective actions, time how long retrieval takes, and close or document whatever gaps remain.
Train Your Team on Chemical Safety
CloudSDS LearnLMS delivers role-based EHS training with built-in compliance tracking — assign courses, track completions, and prove audit readiness.
Leave A Comment