Anonymised, illustrative composite. An Ontario mechanical subcontractor failed its first COR® audit on two elements it had never separately tracked — and passed the second by fixing exactly those two, not the whole programme.
At a glance
A mechanical subcontractor with a clean injury record and a functioning safety programme booked its first COR® audit expecting a formality. Per IHSA's own COR® page, “IHSA is the ‘Authority having Jurisdiction’ to grant COR® in the province of Ontario,” and the national standard behind the certificate is explicit: “Minimum 65% in each element and an overall audit score of 80%.”
The firm's programme looked complete on paper — a policy manual, a hazard assessment process, inspection routines — but nobody had audited any single element in isolation before the real auditor did.
The overall score came back at 76%, four points under the 80% floor. On its own that would have been a near miss. What actually failed the audit was narrower: Training Records scored 58% and Emergency Preparedness scored 61%, both under the 65% per-element minimum. A firm can clear 80% overall and still fail COR® outright if even one element sits under 65% — the two thresholds are independent, and this firm tripped both at once on the same two elements while every other element scored between 80% and 92%.
First audit: overall 76% (below the 80% floor); Training Records 58% and Emergency Preparedness 61% (both below the 65% floor). Five months of rework followed, aimed only at those two elements. Second audit: overall 84% (above 80%); Training Records 79% and Emergency Preparedness 74% (both above 65%). Every other element had already been passing on the first attempt and was left alone.
COR® does not average a weak element into a strong overall score and call it compliant. The 65%-per-element floor exists precisely so that a firm cannot offset a genuinely undocumented programme area — here, training records and emergency preparedness — with strength elsewhere. IHSA's page notes the certificate “is nationally trademarked and endorsed by participating members of the Canadian Federation of Construction Safety Associations,” and that the programme “began in Alberta more than 20 years ago” before being adopted, with the same 65/80 structure, across the country.
IHSA publishes no flat fee for COR® auditing — its own page directs cost questions to a named contact — but it does state that “IHSA requires pre-payment” for audit review. A failed audit is therefore not free to repeat: every attempt is a paid attempt, and a firm that treats its first audit as a formality is paying twice for the same finding, on top of whatever tender cycle was waiting on the certificate.
The rework built exactly two things: a training-records system that logged toolbox talks, certifications and refreshers against named workers instead of a generic binder, and a written emergency-preparedness plan with drills logged and dated rather than described in general terms. Passing the second audit did not require rebuilding the programme the firm already had — it required documenting the two pieces nobody had been auditing on their own.
A documented, dated log is the same fix that mattered in how a scaffold inspection log stopped a shutdown and in how a training matrix caught forty expired tickets — three different regulatory regimes, the same underlying lesson: a programme that exists but is not separately tracked scores like a programme that does not exist.
The training records that scored 58% were not actually missing — they existed, written in a site supervisor's personal notebook rather than a system anyone else could pull from. Toolbox-talk attendance, WHMIS refreshers and equipment-specific sign-offs were all genuinely happening; none of it was retrievable in a form an auditor, or a new supervisor covering someone's vacation, could use. A programme that exists only in one person's notebook is functionally identical, to an auditor, to a programme that does not exist.
The same was true of emergency preparedness: fire-drill dates lived in a shared calendar invite that had since been deleted, not in a record anyone could reproduce on request. Neither gap would have shown up in a walkthrough of the site — both only became visible when someone asked for the paper trail behind what everyone already knew was happening.
A 30-minute call is enough to tell you whether AI pays for itself here.
