Going Digital Before a COR Audit: What Auditors Accept and What They Flag

An auditor doesn’t care whether your inspection record is paper or pixels. They care whether it exists, whether it’s dated, and whether the worker you’re about to interview knows it happened.

Published: October 1, 2026

COR, the Certificate of Recognition, is a Canadian program that certifies a contractor’s health and safety management system through an external audit, with internal maintenance audits in the years between. It’s run province by province by the construction safety associations: IHSA in Ontario, ACSA in Alberta, BCCSA in British Columbia. The audit instruments differ, but every one of them asks the same three things of your records: show me the document, show me it’s being used, and let me ask your people about it.

This post is about the documentation part, and specifically about what changes when COR audit documentation moves off paper before the audit. It covers what auditors accept as evidence, which audit elements lean hardest on records, how a digital record changes what an auditor sees, what still trips contractors up, and how the AuditSoft integration fits. Corfix is a safety management and worker enablement platform for construction contractors across North America, and this post is written from what we’ve watched customers go through on the platform. For the program itself, start with our complete guide to COR and COR audits and the five-step preparation checklist. This post picks up where those leave off. For the full case for moving safety processes off pen and paper, see our guide to pen and paper versus Corfix.

What does a COR auditor accept as evidence?

A COR auditor accepts three kinds of evidence for every element, and expects to see all three: documents, interviews and observation. IHSA’s COR 2020 audit tool describes its verification techniques as documentation review, interviews of managers and workers, and observation of the workplace; ACSA’s audit tool asks auditors to confirm each element’s criteria through the same three methods. The documents prove the system exists. The interviews prove people know about it. The observation proves it’s happening.

Within each element, IHSA’s tool follows a consistent shape. There’s a policy question, which asks whether senior management has stated the expectation in writing. There’s a procedure question, which asks whether a written procedure covers everything the element requires, and the procedure itself gets attached to the audit. Then there are implementation questions, which ask for evidence that the element is in place and working the way the procedure says. That last group is where records live, and it’s where most of the scoring happens.

Scoring is strict and specific. In Ontario, an IHSA COR 2020 audit requires a minimum of 80% overall and at least 65% on each of the 14 elements and three sub-elements. In Alberta, certification and renewal audits require 80% overall with no element below 50%, and the internal maintenance audits in the two years between must score at least 60% overall. British Columbia’s program through BCCSA runs on the same three-year rhythm, with Small COR and Large COR streams and internal auditors permitted for maintenance. The per-element floors matter more than they look: a strong overall score doesn’t carry a weak element.

Which COR audit elements lean hardest on records?

The elements that ask “did this happen, when, and who was there?” lean hardest on records. Using IHSA’s 14 COR 2020 elements as the map (ACSA’s and BCCSA’s instruments group things differently but ask for the same kinds of proof), the records-heavy elements are the ones where a completed form, dated and attributed to a worker and a project, is the evidence:

The other six elements (Health and Safety Policy; Controls; Procurement and Contractor Management; Company Rules; Legislation and Other Requirements; Management Review and Management of Change) lean more on written policy and procedure, on interviews, and on evidence that management reviews the system. Digital records help there too, mostly by making the review possible: a management review that looks at inspection completion rates across every site is a different conversation from one that looks at a stack of binders.

Two of IHSA’s COR 2020 requirements deserve a separate mention because they’re about records as records. COR 2020 added control of documents and control of records as requirements, alongside contractor management and change management. Control of documents is about making sure people are working from the current version of a procedure or form. Control of records is about making sure completed records are kept, retrievable and protected. A paper system can satisfy both, but it has to work at it; a system with one current copy of every template and every completed record stored where it was created satisfies them by default.

How do digital records change what the auditor sees?

Digital records change three things the auditor sees: completeness, attribution and retrieval. On paper, a hazard assessment is a sheet with a date someone wrote and a signature someone scrawled. In Corfix, every completed form is stored by project, date and worker, so the same assessment arrives with the project it was done on, the day it was submitted and the worker who submitted it, and none of that depends on anyone remembering to write it down.

Completeness is the one contractors underestimate. An auditor sampling inspection records against your procedure’s schedule is checking for gaps, and on paper a gap looks like a missing sheet, which could mean the inspection didn’t happen or could mean the sheet is in a truck. Digitally, a gap is a gap. That cuts both ways: it means you can’t hide a missed inspection, and it means you’ll see it yourself weeks before the auditor does, because the office sees submissions as they arrive. One COR-certified contractor in Ontario saw form submissions rise fourfold after moving its program onto Corfix, once the office could see what wasn’t coming in, and cut internal audit preparation from three months to two weeks.

Retrieval is where the audit day itself changes. An auditor asks for the last six months of equipment inspections on a specific project. On paper, someone goes to find the binder for that project, assuming the records were filed under that project and not under the one the foreman called it. Digitally, the records are filtered by project and date and exported in a few clicks. The auditor’s question gets an answer in the time it takes to ask the next one, and the internal auditor preparing the self-audit gets the same speed for every element, which is where the three-months-to-two-weeks figure comes from.

What digital records don’t change is the other two kinds of evidence. The auditor still interviews your workers, and a worker who can’t describe the hazard assessment process will cost you points however clean the records are. The auditor still walks the site, and a crew without the PPE their procedure specifies will cost you points too. Records are one leg of three. Going digital makes that leg strong; it doesn’t make the other two optional.

What still trips contractors up?

What trips contractors up, on paper or digital, is distance between the written procedure, the records and the interviews. The procedure says weekly site inspections; the records show them most weeks; the foreman says “when we have time.” Each of those three is scored, and a gap between any two of them is what an auditor is trained to find. Going digital doesn’t close that gap by itself. It makes the records leg honest, which means the gap shows up as a records problem the office can see and fix before the audit, rather than as an interview surprise on the day.

A few patterns come up repeatedly in the move from paper to digital before an audit:

• Procedures written for the old forms. The hazard assessment procedure describes a three-page paper form with a supervisor countersignature, and the digital form that replaced it has a different structure. The auditor reads the procedure, then looks at the records, and they don’t match. Update the procedure when you update the form, and attach the current version to the audit.
• Records that exist but aren’t organized by element. The digital system stores everything, which is the point, but the internal auditor still has to find the inspection records for the Workplace Inspections element and the training records for Training and Communication. Decide before the self-audit which records answer which element, and name your forms so that mapping is obvious.
• A clean year one and a thin year two. Certification audits get everyone’s attention. The internal maintenance audits in years two and three are where programs drift, and a maintenance audit still has to clear its floor (60% overall in Alberta; IHSA requires the annual internal audit to receive a Letter of Good Standing). Digital records make year two visible in the dashboard rather than discovered in the binder.
• Half the program on one system and half on another. Forms in one app, certifications in a spreadsheet, toolbox talks on paper, incidents in email. Each is a separate place the auditor has to be walked through and a separate place a record can go missing. A contractor that nearly doubled in size prepared for COR on Corfix after years of editable Word templates and scanned PDFs its safety manager described as controlled chaos, and it was the consolidation that made the difference.
• Scanned paper treated as digital. A scanned PDF of a handwritten inspection is a digital file, but it carries none of the attributes above: no reliable date, no worker, no project unless someone typed it into the filename. It’s paper with extra steps. The audit value comes from records created digitally at the point of work.

How does the AuditSoft integration fit?

AuditSoft is the audit software several certifying partners use to conduct COR audits, including IHSA for its COR 2020 audit, so the internal auditor’s job is partly a job of attaching evidence to questions inside AuditSoft. Corfix’s integration with AuditSoft is live, and it lets the auditor pull records from Corfix into the audit as evidence rather than exporting, saving, renaming and uploading them one at a time.

The practical effect is on the self-audit. For each implementation question, the internal auditor needs evidence that the element is working, and the evidence is usually a set of completed records. With the records already in Corfix by project, date and worker, and the integration in place, attaching them to the question is the short step rather than the long one. Our safety features page covers how forms, certifications, binders and incidents are stored, and the integration page is the canonical reference for what connects to what.

What the integration doesn’t do is write the procedure, train the workers or walk the site. The auditor still needs all three kinds of evidence. The integration removes friction from the one kind that lives in records.

When should you go digital relative to the audit?

Go digital early enough that the records the auditor samples were created in the digital system rather than migrated into it. Certifying partners expect to see records covering a real period of operation before a certification audit; ACSA, for example, expects a minimum of three months of health and safety documentation before the first certification audit, and IHSA’s program guideline sets its own requirements for how long the management system must be running. Check your partner’s guideline for the window, then work backwards from the audit date and add margin.

Roll out crew by crew rather than all at once, following our guide to digitizing construction safety forms, with one adjustment for COR: start with the forms that answer the records-heavy elements in the table above, because those are the records the auditor will sample. Hazard assessments, inspections and toolbox talks first; everything else after.

If the audit is close and the paper program is what you have, don’t try to convert the back catalogue. Audit the paper records as they are, note the gaps honestly, and run the digital system from now forward so the maintenance audits in years two and three are built on records that carry their own dates. The two anonymized results above both came from contractors who made the switch ahead of certification rather than trying to rebuild history. You can read more in our customer stories.

FAQ

Does COR certification require digital records?

No. COR audits accept paper records, and the standard is the same either way: documentation that shows each element is in place, supported by interviews and observation. Digital records make the documentation easier to produce, date, attribute and retrieve, which matters for the records-heavy elements and for the internal maintenance audits in years two and three, but a well-kept paper system can pass. The audit tool measures whether the system works, not what it’s written on.

Can records from safety software be used as COR audit evidence?

Yes. Auditors verify implementation through documentation review, and a completed digital form, inspection, toolbox talk or incident report is documentation. Records that carry their own date, worker and project are easier for an auditor to sample against a procedure’s schedule than paper sheets. Where the certifying partner uses AuditSoft, records can be attached to the audit questions as evidence, and Corfix’s AuditSoft integration lets them be pulled in directly.

What score do you need to pass a COR audit?

It depends on the province. IHSA’s COR 2020 audit in Ontario requires at least 80% overall and 65% on each of its 14 elements and three sub-elements. In Alberta, certification and renewal audits require 80% overall with no element below 50%, and the internal maintenance audits in the two years between must score at least 60% overall. Check your certifying partner’s current guideline, since instruments and thresholds are set per province.

How long is a COR certificate valid?

Three years, provided the maintenance requirements are met. The pattern is the same across IHSA, ACSA and BCCSA: an external certification audit in year one, internal maintenance audits in years two and three, and an external recertification audit in year four. In Ontario, IHSA issues a Letter of Good Standing for years two and three when the annual internal audit is completed. Missing a maintenance audit puts the certificate at risk.

Does COR certification reduce injuries?

Research suggests an association. A University of British Columbia study led by Dr. Chris McLeod, commissioned to evaluate IHSA’s program and published in the Journal of Safety Research in 2026, compared COR-certified Ontario firms with similar non-certified firms and found certification associated with a 28% lower lost-time injury rate and a 20% lower high-impact injury rate, with no change in no-lost-time injuries. Earlier studies in British Columbia and Alberta found smaller associations.

Sources

• IHSA, Steps to Achieve COR: the 14 elements of the COR 2020 audit tool, the three-year cycle and the Letter of Good Standing.
• IHSA, COR FAQs: COR 2020 requirements including control of documents and control of records.
• IHSA, COR 2020 Program Guideline.
• AuditSoft, Getting Started with AuditSoft for Ontario IHSA COR 2020 Audit: element structure (policy, procedure, implementation), verification methods and minimum scores (80% overall, 65% per element).
• Government of Alberta, Maintain or renew a COR: three-year validity, 60% maintenance threshold, 80% overall and 50% per element for renewal.
• Alberta Construction Safety Association, COR Process: three months of documentation before the first certification audit; maintenance audit requirements.
• Alberta Construction Safety Association, COR Audit Tool: verification through documentation, interviews and observation.
• BC Construction Safety Alliance, The COR Process: three-year validity with annual maintenance audits; Small COR and Large COR.
• McLeod, C. et al., Does having a certified occupational health and safety management system lead to a greater injury rate reduction? An evaluation of the Certificate of Recognition program in Ontario, Canada, Journal of Safety Research, 2026. Research brief and full report: IHSA.
• Institute for Work & Health, Study finds COR employers have lower rates of serious injuries (British Columbia study).
• Corfix customer results: see customer stories.

Where to go from here

COR asks the same three questions of every element, and records answer only one of them. Going digital before the audit makes that answer complete, attributable and quick to produce, and it shows you your own gaps while there’s still time to close them. Update the procedures when you update the forms, map your records to the elements before the self-audit, and don’t let year two drift.

Corfix is a safety management and worker enablement platform for construction contractors across North America. Safety forms, certifications, toolbox talks, digital binders and incident reporting run from one app, every record is stored by project, date and worker, and the AuditSoft integration pulls that evidence into the audit. Onboarding and training are included. To see how a COR self-audit looks when the records are already where they should be, request a demo, or read the full case for going digital in our guide to pen and paper versus Corfix. Pricing is on the pricing page.