Can audits verify system effectiveness if its findings rarely require verification of field controls?
This question emerged from my latest study which analysed 448 corrective actions from 65 HSE audits, from 16 independent auditing firms.
Shared under an open access licence.
Although virtually all the audits described their scope as both implementation AND effectiveness, only 14 actions (3.1%) targeted the effectiveness of field risk controls. In contrast, 364 actions (81%) were administrative.
So…did auditors look at field controls? If they did, were the controls so effective that no improvements were raised? Were they supposed to have looked at them?
Of course, a limitation of corrective actions is that they only illuminate the issues that were formally converted into organisational obligations, but nevertheless provide a useful insight into what audit processes seemingly ask organisations to improve.
My findings suggest that this sample of audits were what I called ‘superficially trapped’. They remained concentrated on local paperwork, project-level processes and visible site conditions, with no actions directed at company management or higher organisational levels.
Essentially, the actions tended to remain at the same level where the problems were observed, even when those problems may indicated broader organisational weaknesses.
Perhaps audits should, at least on occasion, benefit from asking:
· Which critical controls were physically inspected or tested?
· Which evidence demonstrated their effectiveness?
· Did the corrective action address the source of the risk or mainly its documentation?
· Did the action also investigate if it’s a systemic issue?
· Who has the authority, or obligation, to escalate the action beyond the audited project?
I think in all, audits can be thorough against their criteria while still producing improvements that are operationally narrow.
Check out the paper and I’d love to see your thoughts.
PS. Check out my YouTube: https://youtube.com/@safe_as_pod?si=V2dbdmW–WbnhzA9
Shout a coffee: https://buymeacoffee.com/benhutchinson
#safety #auditing #iso45001 #iso19011 #sms #ccm #criticalcontrols
