On this page
- What a COR Audit Is and Why It Matters
- Earning Your First COR or Keeping the One You Have
- Who Issues COR in Canada: Certifying Partners by Province
- COR With Energy Safety Canada
- COR in Ontario: COR 2020, ISO 45001 and Equivalency
- What Goes Into a Safety Management System
- Preparing for Your First COR Audit
- If You Already Hold a COR
- What Auditors Look At
- Documentation to Have Ready for the Previous 12 Months
- A Practical Workplace Example
- Common COR Audit Mistakes to Avoid
- What an Auditor Expects to See
- The Bottom Line
- Download the Checklist and Records Tracker
- Frequently Asked Questions
- Related Guides and Articles
- How Calgary Safety Consultants Can Help
- Sources
What a COR Audit Is and Why It Matters
A Certificate of Recognition, or COR, shows that an employer's health and safety management system has been audited against an approved standard and met it. In most provinces it's a voluntary program run by the provincial government or workers' compensation board, with certifying partners (usually industry safety associations) that train auditors, review audits and issue or co-sign the certificates.
A COR audit is how you earn the certificate and keep it. An auditor reviews your documents, interviews people at every level and observes the work, then scores each element of the audit standard. In Alberta, for example, you need at least 80% overall and at least 50% in each element to pass a certification audit, and most programs across Canada use similar thresholds.
COR matters for three practical reasons:
- Work. Many owners and prime contractors require COR, or an equivalent, to prequalify. In Newfoundland and Labrador, contractors bidding on government-funded construction of any value need a valid COR letter of good standing, and the Government of Yukon requires COR in its construction tenders.
- Money. COR holders can earn premium refunds or rebates. In Alberta, COR holders can earn a refund of 10% of their industry premium rate from WCB-Alberta's Partnerships in Injury Reduction program in their first year, and 5% in each year they keep the COR. WorkSafeBC pays an incentive worth 10% of base premiums for the parts of the business the COR covers, and Manitoba's SAFE Work Certified program offers a prevention rebate.
- Results. A system good enough to pass a COR audit, year after year, is a system that finds and fixes hazards. That shows up in fewer incidents, fewer claims and smoother client audits.
COR is not proof of legal compliance. Alberta's guidance on health and safety programs reminds employers that they must comply with all applicable legal requirements, even if they aren't part of their formal health and safety program. A COR shows that your system meets the audit standard; the law still applies in full.
Earning Your First COR or Keeping the One You Have
This guide is written for two kinds of employers, and the advice differs a little for each.
- Working toward your first COR. You need a complete health and safety management system, the training your certifying partner requires, and enough records to show the system has been working. The biggest challenge is usually time: records can't be created after the fact.
- Already holding a COR. You need to keep the system running between COR audits, complete each maintenance audit on time and be ready for recertification. The biggest challenge is usually drift: new crews, new sites and new supervisors who were never part of your last COR audit.
Most COR programs run on a three-year cycle. Alberta's COR is valid for three years from the date of issue if the maintenance requirements are met, with a maintenance audit in each of the two years after certification and an external recertification audit before the certificate expires. Employers with little documentation and history may start with a one-year COR. Other provinces and partners follow a similar pattern, with some differences covered below.
Who Issues COR in Canada: Certifying Partners by Province
There's no single national COR body. Each province and territory runs its own program, and in most of them you work with a certifying partner that matches your industry. Your certifying partner decides which audit tool you use, which courses you need, how COR audits are scheduled and what the deadlines are, so choosing the right one is the first decision you make.
| Province or territory | Who runs or certifies COR |
|---|---|
| Alberta | The Government of Alberta, through nine certifying partners: Alberta Association for Safety Partnerships (all industries), Alberta Construction Safety Association, Alberta Food Processors Association, Alberta Forest Products Association, Alberta Motor Transport Association, Alberta Municipal Health and Safety Association, Continuing Care Safety Association, Energy Safety Canada (oil and gas) and Manufacturers' Health & Safety Association. |
| British Columbia | WorkSafeBC, with eight certifying partners: AgSafe, BC Construction Safety Alliance, BC Forest Safety Council, BC Municipal Safety Association, Energy Safety Canada (upstream oil and gas), go2HR, Manufacturing Safety Alliance of BC and SafetyDriven. |
| Saskatchewan | Industry safety associations, including the Saskatchewan Construction Safety Association, Heavy Construction Safety Association of Saskatchewan and Energy Safety Canada, and the Saskatchewan Trucking Association for trucking. WorkSafe Saskatchewan lists the WCB-funded safety associations; check with yours for its COR program. |
| Manitoba | SAFE Work Certified, the provincial standard, delivered through certifying partners: Construction Safety Association of Manitoba, Made Safe, Manitoba Association for Safety in Healthcare, Risk Professionally Managed, Sales and Service Safety Association and the Manitoba Heavy Construction Association's WORKSAFELY program. |
| Ontario | The Infrastructure Health and Safety Association (IHSA), which administers COR 2020. |
| Atlantic Canada (construction) | Construction Safety Nova Scotia, the New Brunswick Construction Safety Association and the Newfoundland and Labrador Construction Safety Association. In New Brunswick, the certificate is renewed each year with an annual audit. |
| Territories | In Yukon, the Government of Yukon's COR program, with Northern Safety Network Yukon as the contact for COR questions. In the Northwest Territories and Nunavut, the Northern Safety Association, which is funded by the Workers' Safety and Compensation Commission. |
The table shows the main certifying partners and isn't a complete list for every industry. In Quebec and Prince Edward Island, check with your provincial industry or construction safety association.
For construction, the Canadian Federation of Construction Safety Associations maintains a national COR standard that member associations follow, with provincial additions on top. A construction COR from one member association can often be recognized in another province through reciprocity, mainly for bidding. Reciprocity is usually temporary and meant for firms without a permanent base in that province. If you set up a permanent base there, or win work in some provinces, such as Ontario, you'll need to meet that province's requirements as well. Check with the certifying partner in the province where the work is before you bid.
Programs also differ in the details. Saskatchewan's construction association, for example, has COR holders submit an annual internal audit and audits them every three years, while small-employer options (SECOR or small COR) use different size limits from one partner to the next. Always work from your own partner's current requirements, not a general rule.
COR With Energy Safety Canada
For oil and gas employers, Energy Safety Canada is the certifying partner in Alberta (all oil and gas industries) and British Columbia (upstream oil and gas), and it's one of the WCB-funded safety associations in Saskatchewan. Its COR pathway sets out the steps: register with your provincial WCB, confirm Energy Safety Canada as your certifying partner, build and implement your health and safety system, choose an Energy Safety Canada certified auditor, register the audit, complete it using the COR audit protocol and pay the certification fee.
Energy Safety Canada's 2023 COR audit protocol has ten elements: management, leadership and organizational commitment; hazard assessment; hazard control; inspections; qualifications, orientation and training; emergency response; incident reporting and investigation; system administration; other affected parties; and the joint health and safety committee and representative. Many of its questions look back over the previous twelve months, such as a sample of the year's incident investigations.
Timing matters with Energy Safety Canada. Maintenance audits should be done by your certificate's anniversary date, and on-site work can't go past December 31 of the maintenance year. Maintenance audits need at least 60% overall. In some cases an approved action plan can replace a maintenance audit, and a management system certification such as ISO 45001 can count toward certification or maintenance, although WorkSafeBC doesn't currently take part in either option.
COR in Ontario: COR 2020, ISO 45001 and Equivalency
Ontario is the province where COR and ISO 45001 are most closely tied together, and it's worth understanding even if you work mainly in the West.
IHSA's COR 2020 was rebuilt as a full health and safety management system that meets the provincial ministry's accreditation standard. According to IHSA's COR FAQs, it adds management system requirements that the older COR didn't have: contractor management, change management and procurement, control of documents and control of records. Those are the same kinds of requirements you'll find in ISO 45001. IHSA's per-element pass mark is also higher than most: at least 65% in each element and 80% overall, plus full marks on items identified as legislated requirements.
Ontario's ministry runs the Supporting Ontario's Safe Employers program, which accredits several management system standards, including ISO 45001:2018 and IHSA COR 2020. Under Ontario Regulation 364/25, public sector organizations that ask construction bidders for a certified health and safety management system must now recognize all accredited systems as equivalent. In practice, a municipality, school board or hospital can't accept only COR and reject an accredited ISO 45001 system, or the other way round.
Two practical points for employers coming from other provinces. First, IHSA's process for recognizing ISO 45001 in place of COR 2020 has changed recently, and IHSA's own documents describe it differently, so confirm the current position with IHSA before you rely on it. Second, an out-of-province COR holder who wins Ontario work can expect to be audited on IHSA's additional COR 2020 requirements. If ISO 45001 is part of your plans, Alberta also lets employers apply for COR equivalency through their certifying partner based on an ISO 45001 certification or another recognized management system certification.
What Goes Into a Safety Management System
A COR audit doesn't test a binder. It tests a health and safety management system, and the COR audit elements are a fairly complete list of what that system needs. Whatever the certifying partner, you'll be audited on some version of the following:
- Management leadership and commitment: a signed policy, defined responsibilities, resources and visible management involvement.
- Hazard assessment: formal hazard assessments, job hazard analyses and field-level hazard assessments that are current and involve workers.
- Hazard control: controls chosen with the hierarchy of controls, safe work practices and procedures, PPE and preventive maintenance.
- Inspections: a schedule, completed inspections and corrective actions that are tracked and closed.
- Qualifications, orientation and training: orientation for every new worker, training records and verified competency.
- Emergency response: site emergency plans, first aid arrangements and drills.
- Incident reporting and investigation: reporting, investigations that find causes, and corrective actions.
- System administration: document and record control, statistics and an annual review.
- Other affected parties and worker participation: contractor and visitor management, and a working joint health and safety committee or representative where required.
Our guide on how to build a health and safety system explains how these pieces fit together, from the policy down to the forms, and why we often build safety manuals and systems to the COR standard for ease of auditing. If you're starting from scratch, start there. If you already hold a COR, use it to check whether your system has kept pace with how your business has grown.
Preparing for Your First COR Audit
For a first COR, preparation is mostly about building the system properly and then giving it time to produce records. A sensible path looks like this:
- Choose your certifying partner and register. Pick the partner for your industry and province, register, and get its current COR audit tool and requirements in writing.
- Complete the required training. Partners set their own training requirements, such as a leadership course for a senior leader or auditor training for the person who will do your internal audits. Confirm exactly what yours requires before you start.
- Compare your system with the COR audit tool. Go through every element and question, and note what's missing, what exists only on paper and what's already working.
- Close the gaps with the people who do the work. Write or fix the programs, practices and forms, and put them into use on every site and crew.
- Let the system run and keep the records. Auditors want to see the system working over time, not a burst of paperwork the month before the COR audit.
- Do a practice COR audit. Have someone audit you the way an external auditor would, including interviews, then fix what they find.
- Schedule the COR audit. Book an approved auditor and plan for interviews, site visits and document requests.
How long does it take? It depends on where you start and on your partner's rules. Alberta's Construction Safety Association, for example, requires a minimum of 12 months of documentation for a three-year certification and at least three months for a one-year certification, and the BC Construction Safety Alliance says there should be at least 6 months of supporting evidence, with 12 recommended. If your system is new, plan on most of a year between building it and earning a three-year COR.
If You Already Hold a COR
Holding a COR is easier than earning one, but it isn't automatic. CORs are often lost through a missed deadline or a system that quietly stopped being used.
- Know your dates. Put every maintenance audit deadline in the calendar the day you receive your certificate. WorkSafeBC, for example, requires COR audits to be completed on-site before the end of each calendar year.
- Close out the last COR audit. The recommendations in your last audit report are the first things the next auditor will check. Track them like any other corrective action.
- Keep the records continuous. Inspections, meetings and drills should happen on schedule all year, not catch up before the COR audit.
- Bring new people and sites into the system. New supervisors, crews and locations need orientation, hazard assessments and records from day one, because they may be in the interview sample.
- Review the system every year. Use the maintenance audit as a real review, not a formality, and act on what it finds.
- Protect your standing. Serious incidents and enforcement action can affect your COR and your incentives. In Alberta, an Employer Review can follow a fatality or serious injury, and the COR is cancelled if its requirements aren't met.
Recertification is a full external audit against the current standard, so treat the year before it like the run-up to a first audit. If your certifying partner has updated its audit tool since your last certification, compare your system with the new version early.
What Auditors Look At
Auditors gather evidence three ways: they review documents, interview people at all levels and observe the work. A strong result depends on all three telling the same story. A procedure that workers can't describe, or an inspection program the auditor can't see in practice, won't score well however good the paperwork looks.
A few things are worth knowing as you prepare:
- The auditor chooses who's interviewed. Under Alberta's audit sampling criteria, for example, samples are based on the size of the company and include a cross-section from senior management to workers, including part-time and casual staff. Anyone could be asked.
- Interviews are usually one-on-one. Auditors keep interviewees' names confidential. Workers are asked about hazards in their job, how they're controlled, their orientation and training, what to do in an emergency and how to report a hazard or incident.
- Records are sampled. Auditors pick samples from across the year to see whether activities happened when they should have, not just recently.
- Every site counts. For employers with several sites, auditors visit a sample, so a weak site can pull down the score for the whole company.
The best preparation for interviews isn't coaching people on answers. It's making sure the system is real: workers who've been through a good orientation, take part in hazard assessments and see hazards fixed can answer the questions honestly and well.
Documentation to Have Ready for the Previous 12 Months
Most certifying partners expect a three-year certification or recertification audit to be supported by about a year of records, and IHSA's COR 2020 program guideline requires evidence created within the 12 months before the audit submission date, with the program in place for at least a year before the first internal audit. The exact period depends on your partner and the type of COR audit, but if you can show the following for the past 12 months, you'll be in a strong position whoever audits you.
| Element | Records to have for the previous 12 months |
|---|---|
| Management leadership and commitment | A current, signed health and safety policy and proof it was communicated; written responsibilities and signed acknowledgements; evidence of managers taking part, such as site visits, inspections and meeting attendance; health and safety objectives and the resources set aside for them; records of enforcing the rules fairly. |
| Hazard assessment | Formal hazard assessments covering all work and sites, with review dates; reviews done when work, equipment or sites changed; job hazard analyses for higher-risk tasks; completed field-level hazard assessments from across the year, signed by the workers involved. |
| Hazard control | Current safe work practices and safe job procedures; PPE requirements, issue and inspection records; preventive maintenance records and equipment certifications; permits such as hot work, confined space or ground disturbance; any monitoring results, such as noise or air testing. |
| Inspections | The inspection schedule; completed planned inspections for every site and month; pre-use equipment inspections; corrective actions assigned, tracked and closed, with follow-up. |
| Qualifications, orientation and training | Orientation records for every new or transferred worker; a training matrix; certificates and tickets; competency assessments; supervisor training records. |
| Emergency response | Emergency response plans for each site; drill and exercise records with lessons learned; first aid assessments, kit inspections and first aider certificates; current emergency contact lists. |
| Incident reporting and investigation | Incident and near-miss reports; investigation reports showing causes and corrective actions; required notifications to the regulator and WCB; incident statistics and trend reviews. |
| System administration | A document control list showing current versions; health and safety statistics; your annual system review; the last audit report and action plan; records showing where documents and records are kept and for how long. |
| Other affected parties | Contractor prequalification, orientation and monitoring records; visitor sign-in and orientation records; communication of hazards to others on site. |
| Committee or representative | Member or representative names and training; meeting minutes; recommendations and the employer's responses; committee inspections. |
If you already hold a COR, keep your last COR audit report, the action plan, your maintenance audit submissions and your letter of good standing with these records. Our free 12-month records tracker, below, lets you tick off each record type month by month, so gaps show up while there's still time to fix them.
Workplace example
A Practical Workplace Example
Situation: Consider a 48-person oilfield maintenance contractor that had held an Energy Safety Canada COR in Alberta for several years. Its maintenance audits had always passed, and recertification was a year away. In that time, the company had grown into Saskatchewan, where it also registered with Energy Safety Canada, added two new crews and promoted three new supervisors. Nobody had looked closely at whether the system had kept up.
Action: Twelve months before recertification, the operations manager asked for a gap review against the current audit protocol, with mock interviews on both sides of the border. It found the new crews were completing field-level hazard assessments, but nobody was reviewing them, nine new hires had no orientation records, and two months of committee minutes were missing. The company assigned an owner to each gap, added a monthly records check to the supervisors' meeting, trained the new supervisors on their responsibilities and ran its emergency drill on the Saskatchewan site as well as in Alberta.
Result: By the time the external auditor arrived, every element had a full year of records behind it, and the workers interviewed on the new crews described the same hazard assessment and reporting process as the long-serving crews. The company passed recertification, kept its incentive refund and went into the next cycle with a monthly check that keeps the records current all year.
Common COR Audit Mistakes to Avoid
- Building the records in the last month. Auditors sample across the year, and a stack of recent paperwork is easy to spot.
- Working from an old COR audit tool. Standards are updated. Prepare against the version your partner will actually use.
- Coaching workers instead of involving them. Rehearsed answers fall apart in an individual interview. Real participation doesn't.
- Forgetting newer sites and crews. The interview and site samples can land anywhere in the company.
- Missing a maintenance deadline. It's one of the most avoidable ways to lose a COR.
- Leaving last year's recommendations open. The next auditor will check them first.
- Treating COR as compliance. Passing a COR audit doesn't cover legal requirements the audit standard doesn't ask about.
- Assuming reciprocity covers new work. Moving into another province can bring new requirements once the work starts.
Audit perspective
What an Auditor Expects to See
From the auditor's side, a well-prepared company is easy to recognize. The documents are current and easy to find, records are spread evenly through the year, and the people interviewed, from the owner to the newest worker, describe the same system the documents describe. Corrective actions from the last COR audit are closed, and the system shows signs of being reviewed and improved, not just maintained.
The companies that struggle usually have good intentions and a good manual, but gaps between the manual and the field: hazard assessments that aren't reviewed, inspections that stopped when a supervisor left, or training that proves attendance rather than competency. Those gaps are much cheaper to find in a pre-audit than in a certification audit.
Each certifying partner uses its own approved COR audit tool, so check the current version for yours. Calgary Safety Consultants helps employers build their systems and prepare for COR and SECOR audits; we don't issue certificates. CORs and SECORs are issued through the applicable certifying partner.
The Bottom Line
Preparing for a COR audit comes down to one idea: build a health and safety management system that's genuinely in use, and keep the records that prove it. Whether you're earning your first COR or keeping one you've held for years, the COR audit rewards the same things: a system that covers every element, a year of steady records and people who can explain how safety works where they are.
Done well, COR pays for itself in incentive refunds, prequalification and fewer incidents. Done at the last minute, it's stressful and fragile. Start early, work from your certifying partner's current requirements and check the system against reality, not just against the paperwork.
Download the COR Audit Readiness Checklist and Records Tracker
Two free downloads go with this guide.
- COR Audit Readiness Checklist (PDF). A three-page checklist with clickable checkboxes: where you are in the COR cycle, the steps for a first COR or a maintenance or recertification audit, and the 12-month documentation list for every element.
- 12-Month COR Records Tracker (Excel). A month-by-month tracker for the records auditors sample, grouped by element. It shows how complete each element is, flags missing months and gives you a summary to review with your supervisors and committee.
- COR Audit Quick Guide (PDF). A two-page summary of how to prepare, with clickable checklists for each step, how auditors gather evidence and the mistakes to avoid.
- 12-Month COR Records Tracker (fillable PDF). The same records on four printable pages, with a clickable box for each month, space for your own record types and a monthly review log.
Click a button to download the file. Adapt each one to your certifying partner's COR audit tool and your own sites and schedules.
About the author
John Duplessis, B.Sc., CRSP
John Duplessis is a Canadian Registered Safety Professional with more than 30 years of occupational health and safety experience in oil and gas, construction, green energy, midstream operations and industrial project work. He is an external auditor with Energy Safety Canada.
