Audits & Hierarchy of Control & the folly of paperwork

When audits identify gaps, how often are fixes just more paperwork?

My recently published solo study mapped 448 corrective actions from 65 HSE audits (>16 independent auditing firms) against the hierarchy of control.

~86% of actions targeted ‘soft’ fixes (admin, paperwork and PPE). About 81% were admin alone, mostly incomplete documents: missing signatures on documents, non-compliant templates etc.

For ‘hard’ fixes: engineering controls were at 6.9%, elimination 4% (but primarily minor issues like slip and trip hazards), 3.3% for isolation, and zero for substitution.

To be fair though, audits are built around documented criteria, so an admin focus is expected – it’s the easiest thing for auditors to see on the day.

But I think a core issue is the scale of it, the limited field verification of controls, and how rarely audits commented on the effectiveness of critical systems.

Audits can find substantive gaps in how a system is designed, implemented and used – but then translate the fixes at the same admin layer where the issue was found. As in, a missing signature gets a signature, a weak poorly used plan gets revised but still remains a poorly used plan, and critical hazards remain unblemished.

And these improvements may rarely travel outside of that specific project or location.

Interestingly, this isn’t unique to audits. Liberati & colleagues found 83% of risk controls from healthcare investigations were administrative too.

It seems that whether we’re investigating or auditing, structural and social factors (and probably more) pull efforts towards the weaker end of the hierarchy.

Now, a limitation of my study is that it only looked at documented issues. Could it be that the most critical issues had already been eliminated, or that the most effective controls already implemented? Possibly. But it’s not likely to wholly explain the pattern since so many studies find similar paperwork biases.

One modest suggestion – classify audit corrective actions by control strength. If 8/10 of your fixes are admin or weakly connected to the underpinning hazard (image below), this may illuminate what your assurance processes are configured to see, or perhaps more importantly, not see.