DROPS Audit Question Set

A survey answers a question about physical condition: is this item secured, is that retention fitted, is this fixing sound. Those questions have determinate answers and a competent person can settle them by looking.

A Scheme is not a physical thing. It is a set of arrangements — risk assessments, zone controls, training, registers, inspections, records, and the habits of the people carrying them out. Asking whether those arrangements work is a different kind of question, and it cannot be answered by examining hardware. A survey can tell you that a bracket was unsecured. It cannot tell you why your system allowed it to be.

The Recommended Practice requires independent inspection before start-up and at least every three years thereafter. Between those points, crews rotate, contractors change, equipment is installed and removed, procedures are revised, and operations move. A survey is a photograph of the equipment. It is not a record of whether the arrangements held in the intervening period.

A survey is commissioned for a location and reports on that location. A Dropped Object Prevention Scheme is a company arrangement applied across locations. An organisation can hold a set of good survey reports and still have no view of whether its Scheme is applied consistently — or of where it is being applied well.

That second point is easily missed. Where oversight across locations is absent, good practice at one site is not noticed, and therefore never reaches the sites that need it. An assessment at company level finds strengths as well as gaps, and the strengths are usually the fastest route to closing the gaps.

Section 3.1 states that, in addition to examining equipment, auditors test the implementation of the site’s governing Dropped Object requirements. That is an assessment of a management system, and the Recommended Practice places it inside the independent inspection.

The DROPS Common Guidelines for Independent Dropped Object Surveys set out what a surveyor should be competent in: survey and inspection technique, structural integrity assessment, rope access, safe working at height, permit to work, tools-at-height systems, reliable securing, safe bolting, lifting and cargo handling, moving and dynamic equipment, drilling equipment, safety alerts, task risk assessment, hazard reporting, and the asset’s own DROPS arrangements. Fifteen subjects, all of them necessary, and none of them a method for assessing a management system.

The distinction matters practically, because it determines who can check an assessment once it has been made. Most of the fifteen themes rest on conditions a competent surveyor can establish during a visit they are already making.

• Verifiable during a survey: inspection programmes, equipment at height, reliable securing, working at height, tubular handling, lifting and hoisting, shipping and transport, zone management, and much of equipment design. Registers can be compared against what is installed; completed checklists can be read; barriers, signage, tethers and kit can be seen.
• Not verifiable during a survey: the management system itself, roles and responsibilities, the interface with other companies, assurance, human performance, and parts of risk assessment. A surveyor can confirm that a bridging document exists. Whether it is any good, and whether the roles in it match who actually does the work, is a different judgement.

These are two different jobs rather than a choice between two kinds of person. Chapter 12 sets out how each is best performed.

DROPS inspection completed by site personnel. Action items are tracked to closure by the assessment owner, and assessors are competent once they have received the appropriate level of training.

This is the level closest to the work and the one that can be performed most often. It is also the level with the least distance from what it examines.

DROPS inspection completed by a company representative from outside site operations, who has completed DROPS Focal Point training or is a recognised subject matter expert. Action items are tracked to closure by the auditee.

The distance here is organisational rather than contractual. Someone from another part of the same company satisfies this level. For organisations with more than one location it is the cheapest useful independence available, and it is the level most often missing entirely.

Independent inspection or survey performed by a qualified external auditor, or by internal auditors from outside the business unit being audited, every three years or when the company deems it appropriate. Action items are tracked to closure by the auditee.

This is the level the industry already provides, and the only one with an established market. The first two have no published method at all, which is what these guidelines set out to supply.

Each of the three levels carries the same obligation: action items are tracked to closure. It appears three times in one short section of the Recommended Practice, and it is the requirement most often unmet. An assurance activity that produces findings nobody closes has documented a problem rather than addressed one.

An arrangement is assessed on whether it reliably happens, not on whether it has been documented. A company whose crews do the right thing without a written procedure is not in the same position as a company that does nothing, and a company with a thorough manual that nobody follows is not compliant.

Documentation does not disappear from the assessment — it becomes evidence. Where the Recommended Practice requires a specific record, register or checklist, that record is itself the requirement and its absence is a genuine shortfall. Elsewhere, documents are how a claim is demonstrated rather than the thing being claimed.

Where the person carrying out the assessment also selects the rating, the wording of the levels is the only thing standing between an assessment and an opinion. "Some requirements met" measures nothing. "Rated tethers are required, available and used on every job at height, with a tool count completed before and after" measures something.

Every question therefore carries four level descriptions written as observable conditions specific to that question. No two questions share level descriptions, because descriptions general enough to be reused stop discriminating.

Each theme carries its own rating. Those ratings are not combined into a single figure, and no pass mark is published.

A single number would conceal the one theme that matters. An organisation with thirteen strong themes and one absent control would present well, and it is precisely that organisation which most needs to know. A single number also invites the reader to answer for the score rather than for the truth, which defeats the purpose of assessing yourself at all.

Each section of the Recommended Practice contains a normative Recommended Practice block and a supplementary Additional Guidance block. The guidance is largely worked examples of how to satisfy the requirement above it — section 2.4 introduces its guidance as examples of the application of the hierarchy of controls.

Questions are therefore written against the requirement, and the guidance is used to describe what meeting it usually looks like. A risk register is the common way of tracking identified risks and the status of actions; it is not itself the requirement. An organisation meeting the requirement another way is compliant — provided it can demonstrate it. Without that condition, "we do it differently" becomes an answer to every question.

The higher the rating claimed, the more the instrument asks to be shown. A rating of 0 or 1 requires nothing to be proved; there is no incentive to overstate a weakness. A rating of 2 or 3 opens the detailed questions for that theme, and every one of them is then answered.

They are all answered because otherwise reducing a rating becomes a way of escaping the questions, and because the detailed answers are the useful output. An assessment that stops at the first problem found produces one gap instead of the list.

Different levels of an organisation know different things. Head office knows what has been established. Site management knows whether it is implemented. The people doing the work know whether it is real. Asking all three the identical question produces a guess at two of the three levels.

So a requirement may carry more than one question, each written for what that level can actually know, and the answers are recorded separately. Chapter 10 sets out how this works and why the differences between the answers are the most useful thing an assessment produces.

A self-assessment is not a substitute for independent verification, and it is not a lesser version of it. It is the step before it. Assessing yourself first drives improvement before anyone external arrives, and it makes the verification that follows shorter and cheaper, because the verifier is not spending the first day establishing facts the organisation could have supplied.

This is the sequence the wider industry already uses for contractor assessment: the organisation completes the assessment, and a client or third party verifies it against the same instrument.

Every theme that applies to an organisation applies in full. What varies with size and complexity is the depth of the arrangements, not the list of them. A small operator is not excused from zone management; it will simply have a simpler way of doing it, and that simpler way may be entirely adequate.

The instrument therefore prescribes what must be demonstrated and never how it must be arranged. An assessment that marks a small organisation down for the absence of machinery it does not need has measured the wrong thing.

Self-assessment is not one activity. A crew reviewing its own task, a site assessing itself, a group from elsewhere in the company assessing a site, and an external auditor are four different degrees of distance, and the first three all count as self-assessment when viewed from outside the organisation.

Every assessment should therefore record who performed it — the people who run the work, another part of the same company, or an external party. That single field changes how the whole result should be read, and it costs nothing to capture.

Establish what is being assessed — a site, a business unit, or the company — which themes apply, and which carry the most risk in this operation. Record who is performing the assessment and at what distance from the work. Chapter 9 covers this.

Answer the fifteen theme questions. For many organisations this is the whole assessment, and it should be treated as a complete piece of work rather than a preliminary. Read all four level descriptions before choosing; if two seem to fit equally, the lower one is the honest answer.

For every theme rated 2 or 3, work through the detailed questions and gather what each asks to see. This is where the time goes, and it is where an assessment stops being an opinion. Answers that cannot be evidenced are not wrong — they are simply answers at a lower level than was claimed.

Look back at the theme rating beside the detailed answers underneath it, and decide whether it still stands. Record both the original rating and any revision.

Order the results with the lowest ratings first, using the risk weighting from scoping to separate themes that scored the same. Name the strongest themes as well: they are usually where the capability to fix the weakest ones already exists.

Assign each gap an owner and a date. An assessment whose findings are not tracked to closure has not met the requirement that produced it.

Have the assessment checked by someone at greater distance from the work — another part of the company, or an external party. Chapter 12 sets out who can verify what.

Few organisations will complete an assessment in one exercise, and there is no need to. Taking one theme at a time, over months, is a legitimate way to do this and often a more realistic one. Themes belong to different people — lifting to whoever owns lifting, training to the HSE function, inspection to the technical side — and assigning a theme to its natural owner works better than one person pursuing fourteen colleagues.

It also protects the effort. An organisation that has completed three themes properly has three themes of value. One that abandoned a long document part way through has none.

• Scope once, and rate all fifteen themes before splitting anything up. That is an hour or two and it produces a complete picture immediately. The detailed work then rotates underneath a result that already exists, rather than the result waiting on the last theme.
• Take the themes in the order scoping produced — lowest rated first, weighted by the themes identified as carrying most risk. Working through in chapter order means the theme that matters most may be examined last.
• Date each theme and show the dates. Fifteen themes assessed across a year is not a snapshot; the organisation changed underneath it. That is perfectly acceptable so long as nobody reads it as a picture taken on one day.

The fifteen theme questions are cheap to repeat, so re-rating them at the end of a cycle gives a current picture while the detailed work continues to rotate. That comparison — the same fifteen questions a year apart — is more informative than any single assessment.

Two things to watch. Weaknesses that cut across themes — the same gap appearing in inspection, assurance and management of change — are among the most useful findings an assessment produces, and they are hard to see when those themes are examined months apart. And one theme a month becomes one a quarter and then stops. Both are manageable provided the result always states what has been examined, what has not, and when each was done.

Reassess on a defined cycle, and whenever the Scheme, the organisation or the operation changes materially. Comparing your own result year on year is considerably more informative than comparing it with another organisation’s, because the same people are applying the same standard to themselves.

The question behind every rating is whether the arrangement can be relied on. Three things have to be true, and they fail independently: the arrangement has to exist, it has to be followed, and it has to still be followed a year later.

Each level marks how many of those hold. A procedure that exists and is not followed is rated 1, not 2 — the document is real but the arrangement is not. Practice that is genuinely followed but written nowhere is also rated 1, for the opposite reason: it holds today and there is nothing to make it hold after a crew change.

Level 2 on every theme that applies, and level 3 on the themes identified during scoping as carrying the most risk. An organisation at level 3 across every theme has either an unusually mature Scheme or an unusually generous view of itself, and the detailed questions exist to establish which.

Two answers sit outside the scale, and they are not interchangeable.

• Not applicable. Set during scoping, with a one-line reason. It does not count as a zero and does not appear in the priority list. Because there is no overall score, marking themes not applicable is the only remaining way to flatter a result, which is why the reason is required.
• Not examined. The theme or question was not looked at. A legitimate answer; the report states how much was examined and how much was not.

Neither is a failure, and neither should be avoided out of a sense that a complete sheet looks better. A result that honestly records what was not applicable and what was not examined is more useful than one that guesses.

• Head office knows what has been established — whether the arrangement exists, what it requires, whether it is current.
• Site management knows whether it is implemented — whether it happens here, whether the records are complete, who does it.
• The people doing the work know whether it is real — what happens on a night shift when the job is behind and nobody is watching.

Those three correspond exactly to the three ways a requirement fails: never established, established but not implemented, implemented but not maintained. Asking at one level tells you about one of the three.

A requirement may therefore carry up to three questions, each written for what that level can actually know. Asking the identical question at every level produces a guess at two of them. Tool tethering, as an example:

• Head office: what does your working at height procedure require for tethering and tool inventories, and how is it kept current?
• Site management: which kit is in use here, are pre-job and post-job counts completed, and can you produce the last three?
• The crew: what do you take up, what do you clip it to, and what happens if something does not come back down?

One requirement, three questions, three answers recorded separately. Not every question needs all three levels — many are properly answered at one — and each question states who it is for.

An assessment answered at more than one level produces something no single respondent can: the difference between what the organisation believes, what its records show, and what its people experience. That difference is the point of asking, and which difference appears tells you what kind of problem you have.

• Head office describes an arrangement the site does not recognise — it was established and never implemented.
• Site records show compliance the crew does not describe — records without practice, or a supervision gap.
• The crew describes good practice head office knows nothing about — sound informal practice with no system behind it. Valuable, and fragile: it will not survive a crew change, and it handles unfamiliar situations badly.

Each level is best reached a different way, and the organisation does not have to perform all three itself.

• Head office is the easiest to assess internally. It is largely a matter of reading your own documents and knowing when they were last revised.
• Site management is where an external surveyor already is. Records, completed checklists, registers against installed equipment — this is most of what a verification visit covers anyway.
• The people doing the work is the level most often skipped, and the one where someone outside the reporting line has a real advantage. A crew answering in front of their supervisor tends to agree with their supervisor. A guided conversation, or an external party, does not carry that difficulty.

Record how and where each level was asked, and how many people took part. This is a factual note rather than a judgement, and it lets whoever reads the result weigh it properly.

These guidelines do not recommend anonymous responses. In a crew of eight an anonymous answer about a particular job is identifiable from its content, so anonymity is difficult to deliver honestly. More importantly, requiring people to be anonymous in order to be candid accepts that candour is unsafe, and works around the problem instead of addressing it.

The condition for gathering the third level is therefore that the organisation makes honest answers safe, and is seen to. That is a statement about the organisation, not about the instrument. Where an organisation is not prepared to make that commitment, the workforce level should not be attempted — asking people to take a personal risk on the assessor’s behalf is not a reasonable thing to do.

Most organisations will not reach all three levels the first time, and an assessment answered at one level is legitimate. It simply says less, and the result should state how many levels were consulted so that nobody mistakes its reach.

Adding a second level is usually the single largest improvement available to a self-assessment, and it costs nothing but the willingness to hear a different answer.

Order the themes by rating, lowest first, using the risk weighting from scoping to separate equal ratings. The first page should show where to start rather than a summary.

Report the strongest themes too. This is not to soften the result: where oversight across a company is thin, organisations are frequently unaware of what they do well, so it never reaches the places that need it. If your inspection programme is strong and your zone management is weak, the people who built the first are the best available resource for the second — and that only helps if the result says which is which.

Give the differences between levels their own place in the result, together with what was done about each. They are the least comfortable part of an assessment and the most informative.

A self-assessment is a reasonable thing to share, and in contractor assessment across the wider industry the organisation’s own assessment is routinely provided to the client alongside any verification.

What makes it credible is candour rather than the ratings. An assessment claiming the top level everywhere tells a reader very little, because anyone can claim it. One that says we are at level 1 on management of change and level 2 on zones, and here is what we are doing about both is difficult to dismiss and difficult to fake — claiming to be worse than you are carries no advantage.

Because the assessment already exists, verification can be targeted. Sample the themes rated 3. Investigate where the levels of the organisation disagreed. Note what was marked not examined. The verifier is never required to decide what good looks like — they are asked to confirm or refute specific statements.

That distinction matters for who can do the work. Assessing a management system is an open-ended judgement requiring audit competence. Establishing whether a stated claim is true is much closer to what a competent surveyor does routinely, and most claims in this instrument are physically checkable: whether tethers are rated for the tools in use, whether a register matches what is installed, whether the last three pre-lift checks are complete and within date, whether a zone is barricaded and signed.

Most organisations already engage an inspection or survey company, and already have them on site periodically. That visit is the natural place for most of the verification to happen, and both parties frequently miss it.

Following the split in chapter 3, verification divides into two pieces of work rather than requiring one person to do everything.

• The themes resting on physical conditions and records can be verified by a competent surveyor working from a checklist derived from the organisation’s own answers, during a visit already being made.
• The themes resting on judgement — the management system, roles, interfaces, assurance, human performance — need someone who can read a management system and interview people. Where that is not available, those themes remain self-declared and should be labelled as such.

The most valuable output of verification is not a second set of ratings. It is the difference between what the organisation declared and what the verifier found, together with the verifier’s view of how reliable the answers were.

That difference cannot be produced by a self-assessment at any level of effort, and it is the specific thing an external party adds. An organisation whose self-assessment proves accurate has demonstrated something about itself that no rating conveys.

The Recommended Practice sets independent verification at least every three years. Beyond that minimum, a sensible interval depends on how well the organisation’s own assessment has been performing. An organisation whose self-assessment reliably surfaces real problems needs outside confirmation less often than one whose assessment keeps coming back clean.

Much of what an assessment needs is already written down somewhere in the organisation. Upload the working at height procedure, the lifting management system, the bridging documents, the inspection schedule, and the assistant can locate what each question asks for and show you where it found it.

Two uses, and the second is the more valuable. It can shorten the retrieval — telling you in seconds whether your procedure specifies rated tethers, requires a tool count, or names who authorises restarting when an item is unaccounted for. And it can tell you what the Recommended Practice asks for that your documents do not mention, which is difficult to see by reading your own material.

Chapter 10 sets out why the third level — what the people doing the work actually experience — is the one most often skipped, and the hardest to gather honestly. A guided conversation addresses part of that difficulty.

A crew member can work through the questions relevant to their role in a few minutes, in their own words, and the assistant can follow up where an answer is vague or interesting — which a paper form cannot do, and which is where the useful detail sits. It also scales. Interviewing thirty people is impractical; letting thirty people each have a short conversation is not.

The conditions in chapter 10 apply in full. Answers are attributed, the organisation is expected to make honest answers safe, and where it will not, this activity should not be undertaken.

Answers gathered at different levels, at different times and by different people are only useful if they end up together. The assistant records what it gathers against the question it belongs to, so that an assessment assembled over several weeks and several sites produces one coherent result rather than a folder of documents.

Holding it in one place is what makes two things possible that are otherwise manual. Comparing the answers from different levels of the organisation, which chapter 10 identifies as the most useful output of an assessment. And comparing this year against last year, which is the comparison that tells an organisation whether it is improving.

It matters more again where an assessment is worked through in stages, as chapter 7.8 describes. A theme completed in March and a theme completed in October are only a single assessment if something holds them together, keeps each one dated, and can still show at any point what has been examined and what has not. Otherwise a staged assessment becomes fifteen separate documents that nobody assembles.

Where the same record holds both an organisation’s own assessment and a verifier’s findings, the difference between them can be produced directly rather than assembled by hand. Chapter 12 identifies that difference as the real output of verification.

It also makes the verification visit more efficient. A checklist generated from the organisation’s own answers tells the verifier which specific claims to test, rather than leaving them to work out what to examine after they arrive.

An assistant can find, prompt, follow up and record. It cannot decide what good looks like, and it should not propose a rating: the person answering selects the level, and an assistant that suggests one first has anchored the answer it was supposed to gather.

Nor does any of this alter what a self-assessment can establish. The limits described in the next chapter are properties of the organisation, not of the method, and no tool removes them.

Do you use a certified tools-at-height kit, and does it cover locking systems for removable attachments, tethers rated to tool weight, approved carrying pouches, engineered clips for radios and gas detectors, and carabiners designed against accidental rollout?

Is a pre-job and post-job inventory checklist completed for work at height, and can you produce completed ones?

When an item logged out does not return, does that task stop and the area get searched — and if the item cannot be found, does the Person in Charge have to authorise resuming?

Are tools and equipment transferred to and from height in secure, approved pouches rather than carried, pocketed, or hauled loose?

Are radios, gas detectors and other personal equipment secured with engineered clips?

Does the work conform to your company’s own working at height procedure, and does that procedure cover dropped objects specifically?

If the crew doing this work changed next month, would the arrangement still hold?

For tools of five kilos or more, is the work specifically risk assessed, are securing points positioned above the work site — and when a lanyard has arrested a falling tool, do both the lanyard and the tool come out of service until they have been inspected?

For powered tools used at height, is the supply cable or air hose secured at both ends, is retention attached to the tool body rather than to the cable, are sockets and extensions pin-locked, and are batteries locked in place?

Where work at height is done on electrical installations, are the lanyard and its attachment points insulated to the same standard as the tool grips, and are those tools kept for that work rather than used generally?

Are at-height tools kept in a secure storage facility, stored so that a glance shows what is missing, and does the person responsible check the facility and the register at the end of every shift?

Is the tethering equipment inspected and certified — tools drop tested, lanyards batch tested, and written acceptance and rejection criteria available where the tools are kept?

Are exclusion and restricted access zones defined for your operation — Black for total exclusion, Red for permanent restricted access, Yellow for temporary restricted access, Green for open access?

Are zones and their access points clearly marked with physical barriers and signage that states the specific risk, rather than a generic warning?

Is an authority identified for each zone, with responsibility for controlling entry established, delegated and communicated?

Do the zone rules apply to everyone at the location — service partners, visiting contractors and visitors — and do they know?

When a zone is established, is emergency access and escape considered, so that people are not prevented from getting out?

When a temporary zone is established, are people at the location notified so they do not enter it accidentally — and is it removed deliberately when the work ends?

When operations in an area change, is the zone classification revisited?

Are no-entry zones identified in the permit to work, and are restricted zones established automatically during operations that require them, such as tripping?

Were your zones derived from a structured review of the areas — with prior incidents, layout drawings, equipment manuals, anti-collision details and operating procedures in front of the people doing it — or were they drawn from knowledge of the site?

Has the review identified where people habitually stand and work in each area — and where a standard position sits in harm’s way, has it been moved rather than fenced?

Was the draft zone map physically checked on the ground before it was approved, and are zone maps displayed at the access points to the areas they cover?

Do you run all three of the assurance methods the standard names — self-verification by site personnel, company-verification from outside site operations, and independent verification?

Do site personnel complete DROPS inspections as self-verification, and are the action items tracked to closure by the assessment owner?

Does someone from outside site operations verify the site’s scheme, and are they DROPS Focal Point trained or a recognised subject matter expert?

Is independent verification carried out every three years or as your risk requires — by an external auditor, or by internal auditors from outside the business unit being audited?

Does your assurance verify that your contractors’ work conforms to the practices and procedures that apply to them, not only your own?

Where you work alongside other companies, does your assurance evaluate the scheme that was actually agreed in the bridging document?

Are the people carrying out assurance at each level competent for it, and can you show how that was established?

When did an assurance action last pass its due date, and what happened as a result?