Risk is Not Just a Number
A SIZA audit is not simply about identifying findings and assigning a risk rating. The risk rating is intended to help suppliers, auditors and buyers understand the significance of a potential issue and the level of attention it requires.
When determining risk, auditors consider factors such as the severity, the likelihood of recurrence, and the extent and potential impact of an issue. Two findings may appear similar on paper but present very different levels of risk depending on the circumstances. For example, a missing environmental record may require corrective action, but a poorly managed chemical waste area that creates a risk of worker exposure and environmental contamination may require much more urgent attention.
For suppliers, understanding the reason behind a risk rating is important. The objective is not simply to achieve a lower-risk audit outcome, but to identify the issues that could have the greatest impact on people, the environment and the business. Corrective action should therefore address the root cause of the finding rather than only fixing what the auditor observed on the day.
What Does this Look Like in Practice?
Consider a chemical waste area where containers are not properly labelled or stored. The immediate response may be to move the containers and clean the area before the audit is completed. While this addresses the visible problem, it does not necessarily address why it happened. A stronger corrective action would examine the underlying system: Are employees trained in chemical waste handling? Is there a clearly designated and suitable storage area? Are responsibilities assigned? Are containers routinely inspected? Is waste removed through an appropriate process? By addressing these questions, the supplier reduces the likelihood that the same issue will recur.
The same principle applies to social audit findings. If worker records show that overtime limits were exceeded, simply correcting a few payroll entries may not be enough. The supplier should consider why the overtime occurred and whether staffing levels, production planning, working-hour controls or supervisor practices contributed to the issue. In this way, the corrective action becomes an opportunity to strengthen the business system rather than simply correcting a document or record.
SIZA encourages a practical, improvement-led approach to risk. A risk rating should be viewed as a tool for prioritising improvement, not simply as a number attached to an audit report. When suppliers understand their risks and take meaningful action, compliance becomes part of the way the business operates rather than something done only in preparation for an audit. A useful question for every supplier is therefore: “If this issue is left unresolved, what could happen, to whom, and how likely is it to happen again?” This helps move the focus away from simply closing a finding and towards understanding the real risk and taking action that makes a lasting difference.
SIZA subscribers can access practical resources through the MySIZA platform.
For more questions, contact the SIZA office at 021 852 8184 or email Werner@siza.co.za.
