Have worked in many organisations, predominantly local authorities. One thing I realised very early on was that these are difficult to treat as 'one organisation' (from H&S perspective at least). The only way is to approach as a collection of diverse departments / services (from schools, to refuse collection, to enforcement officers, to pool lifeguards, to social workers, to office staff, to vehicle workshops, to construction, etc etc.). Risk profiling even by departments was often still too variable; for example, one such included FM (caretaking, kitchen staff, cleaners) alongside a lot of procurement and policy staff. You can probably establish the risk profiles broadly yourself, in terms of potential. The question would then be how well do the risks get managed - I assume this is the purpose of the second part - a questionnaire. As we know - potential does not equate to actual - controls make the difference. I would map the organisation in a visual way, and 'risk colour' the various sub-divisions. So the refuse and arbo team would be red, the office workers green. This should help determine priorities, perhaps audit frequencies if you are into that. "degree of attention for H&S". Any broad based audit will provide a question bank, but you will have to work with it to get it to 'fit' such a collection. There is no alternative but to build (not invent!) your own version of the wheel. If we could all use the same wheel, we would be rather pointless automatons. What about turning your company safety policy 'statements' into questions. Eg: "we will comply with legislation / standards" could provide such questions as: "what standards apply to this area? How do you know? How do you ensure?". It may not work well, depending on how it is written. I am not that clear on what the questionaire part is actually for. Does this help at all?