Safety Norms: Energy Management and Audit

1Purpose, Scope, and Safety Principles

These norms set minimum expectations for energy management and audit activities, including site surveys, utility bill analysis, equipment performance testing, measurement and verification, and recommendations to clients or internal managers. Their purpose is to protect people on site, protect financial and personal data, and keep findings accurate enough to support sound decisions.

Three principles apply throughout. First, no task proceeds beyond the authority and competence of the person performing it. Second, a finding is not reported as verified until the evidence supports it. Third, anyone who sees an unsafe condition or suspicious transaction stops work and escalates it rather than fixing it quietly. A norm is a mandatory rule. A recommendation is good practice that the local procedure may adapt.

• Mandatory: Every engagement has a written scope approved by the engagement lead before fieldwork starts.
• Mandatory: Where local law, a utility program, or a client contract sets stricter rules, the stricter rule applies.

2Roles, Competence, and Accountability

The energy manager or engagement lead owns the audit scope, approves the measurement plan, and signs off findings. The site contact arranges access and confirms plant conditions. Field auditors collect data and perform only tasks they have been trained and authorized to do. A qualified electrician or licensed engineer must perform live electrical work, panel opening, and equipment isolation. Auditors without that qualification observe from a safe distance and do not operate controls. A separate reviewer checks calculations and savings claims before issue.

Competence is demonstrated, not assumed. Records should show training in site safety, instrument use, data handling, and the organization's conflict-of-interest and confidentiality rules. Where a jurisdiction requires a specific license or certification for a task, confirm the requirement with the competent authority. This guidance does not establish that any particular credential is required.

• Mandatory: No auditor operates breakers, disconnects, or process controls without written authorization from the site electrical or operations authority.
• Mandatory: Auditors may not approve their own invoices, savings calculations, or vendor recommendations.
• Recommended: Name a deputy for each role so that work continues when a person is absent.

3Hazards, Risks, and Risk Assessment

Energy audit hazards fall into physical, electrical, thermal, environmental, and financial integrity categories. Physical hazards include slips on plant floors, falls from ladders or platforms during boiler or roof inspections, and struck-by risks around fans, pumps, and compressors. Electrical hazards include arc flash at switchgear, shock from energized panels, and damage to meters caused by wrong range settings. Thermal hazards include hot pipes, steam leaks, exhaust, and surfaces above safe touch temperatures. Tanks, ducts, and pits are confined spaces with atmospheric and engulfment hazards.

Information and financial hazards are often overlooked. Utility account numbers, floor plans, security layouts, and employee records can be misused. Savings figures can be inflated to win contracts or incentives, and vendors may offer inducements that shape recommendations. Risk should be rated with a documented method, such as likelihood multiplied by severity on a five-point scale, and reviewed before each visit. Energized work, confined space entry, and work at height require a specific written plan and must not proceed on auditor judgment alone.

• Electrical: treat every panel as energized until a qualified person verifies de-energized status by an approved method.
• Confined space: no entry without a permit issued by the site authority and atmospheric testing by a trained person.
• Financial: any savings claim above the threshold in the engagement plan requires independent review.
• Data: no bills or meter data leave the approved environment without written approval.

4Preventive Controls and Safe Work Practices

Prevention starts before arrival. Each site visit needs a pre-visit brief that identifies hazards, required permits, protective equipment, contacts, assembly points, and the person authorized to stop work. Auditors must not work alone in electrical rooms, on roofs, in pits, or in confined spaces; a second person with a working communication device must be present. Walkthroughs follow the site's permit-to-work system. Where no such system exists, high-risk tasks do not begin.

Measurement work must follow safe methods. Clamp-on meters and data loggers are installed only on de-energized or approved circuits, using rated instruments and insulated tools. Thermal imaging is performed from a safe distance without opening enclosures. Auditors never bypass interlocks, guards, or lockout devices to obtain readings. If a reading cannot be taken safely, the gap is recorded as a limitation and the measurement is not forced.

Financial control safety protects the integrity of the audit. Segregation of duties means the person who collects data does not also approve the savings model, and the person who prepares a project invoice does not approve payment. Access to utility accounts, billing portals, and incentive applications is granted by role, logged, and reviewed. Changes to baselines or adjustment factors require a written reason and a second approver. Fraud prevention includes verifying vendor identities against company records, declaring conflicts of interest before engagement, declining gifts or hospitality that could influence a finding, and using bank details only from verified vendor master data. For example, if a contractor asks that payment go to a new account, the auditor records the request and escalates it to finance for call-back verification using a known number.

• Mandatory: Obtain a permit before any work on energized equipment, in confined spaces, or at height.
• Mandatory: Never alter source meter data, bills, or baselines to match expected results.
• Mandatory: Separate data collection, savings calculation, review, and payment approval among different people.
• Recommended: Sample a share of bills and invoices in each engagement and reconcile them to meter data.

5Equipment, Environment, Information, and Protective Safeguards

Protective equipment is selected from the site hazard assessment and the manufacturer's instructions for the specific instrument or task. Typical items include safety footwear, hearing protection near loud plant, high-visibility clothing, task-rated gloves, and eye protection. Arc-rated clothing is used only where the site's energized-work assessment requires it. Ratings and suitability must be confirmed with the supplier and the site safety lead. Protective equipment is never the only control where isolation or removal of the hazard is possible.

Instruments must be calibrated and inspected before use. Damaged leads, cracked housings, and expired calibration mean the item is removed from service and tagged. Environmental controls cover heat and cold exposure during long surveys, ventilation in plant rooms, and refrigerant or insulation materials found during inspections, which must be reported rather than handled by auditors. Information safeguards require that energy data, facility layouts, and personal information be stored on approved systems with role-based access and encryption where available. Privacy obligations vary by jurisdiction and should be verified with a qualified adviser. Personal devices do not store client data unless approved in writing. Photographs of security systems or server rooms are taken only with permission.

• Mandatory: Use calibrated, inspected instruments only; tag and remove defective equipment.
• Mandatory: Keep client and employee data on approved systems; do not upload it to unapproved tools.
• Recommended: Maintain a site list of confidential areas that require escort and prohibit photography.

6Incident Reporting, Emergency Response, and Escalation

Any injury, electrical contact, near miss, property damage, data exposure, or suspicious financial activity must be reported to the engagement lead and the site safety contact the same working day, or immediately if a hazard is ongoing. Anyone may stop work when they believe there is imminent risk. Work does not restart until the hazard is controlled and the responsible authority agrees.

In an emergency, call the local emergency number or site emergency service first, then secure the area and account for personnel at the assembly point. Auditors do not attempt rescue in confined spaces or on energized equipment unless trained and equipped to do so; they summon trained responders. Suspicious activity, including altered meter data, requests to change payment details, pressure to adjust savings figures, or unexplained access to billing systems, is escalated to compliance or internal audit. Do not confront the individual or investigate independently. Preserve relevant files and messages without altering them.

• Mandatory: Report all incidents and near misses; reporting alone is not a disciplinary matter.
• Mandatory: Escalate suspected fraud to compliance or internal audit without delay.
• Recommended: Conduct a short root cause review after each event, with corrective actions assigned to named owners.

7Records, Training, Inspection, and Review

Accurate records make energy findings defensible and protect the people who produced them. Each engagement keeps a file containing scope, risk assessment, permits, calibration records, raw data, version-controlled calculation workbooks, assumptions, review sign-offs, and the final report. Corrections are made by adding a signed note of change, never by overwriting original data. Retention periods should follow organizational policy and applicable legal requirements, which vary by jurisdiction and must be verified.

Training covers site safety orientation, electrical awareness appropriate to the role, instrument use, confidentiality, conflict-of-interest rules, and fraud red flags. Refresher training follows procedure changes or incidents. Supervisors review a sample of completed audits for permits, sign-offs, data trails, and savings claims. Lessons learned feed back into the risk assessment template and this document. These norms should be reviewed at the end of each engagement cycle and whenever regulations, standards, or client contracts change.

• Mandatory: Maintain a complete audit file for every engagement, including the correction trail.
• Recommended: Use a standard reconciliation sheet linking meter data, bills, and reported savings.

Implementation checklist

• Confirm permit, authorization, and competence for every task before arriving on site.
• Treat all panels and circuits as energized until a qualified person verifies they are de-energized.
• Work in pairs in electrical rooms, on roofs, in pits, and in confined spaces.
• Use calibrated instruments and tag any defective equipment out of service immediately.
• Keep client and employee data inside approved systems and never share it informally.
• Separate data collection, calculation, review, and payment approval among different people.
• Verify any change to vendor bank details through a known contact before payment.
• Record every change to baselines or assumptions with a reason and a second approver.
• Report incidents, near misses, and suspicious activity the same working day.
• Confirm applicable laws, standards, and client rules with qualified professionals before use.