What to Do After a Safety Audit

After a safety audit, add a named owner and a check for recurrence to each finding before marking it closed. On 18 November 1987, the King’s Cross Underground fire killed 31 people. The investigation found that earlier fires had already exposed shortcomings that managers had failed to address fully. That history makes follow-through a practical concern after an audit, even when repairs appear complete.

A safety audit is a structured review of whether an organisation’s safety arrangements meet stated requirements and work in practice.

Check each safety audit fix on site

Start with the finding itself. Keep the original description beside the proposed corrective action, so the person checking the fix can see what it must achieve. Identify the work area and the people exposed to the hazard. Where someone faces immediate danger, control that exposure at once. A future completion date does not make the current work safe.

Then agree who will do the work and who can accept the evidence that it worked. These roles can belong to different people. The manager arranging a repair may need a competent specialist to check its performance. A safety adviser can help define the check, while the operating manager remains responsible for the work under their control. Before appointing a contractor for the work, the follow-up to contractor safety prequalification checks whether supplier-level evidence covers the proposed crew and site controls.

IOSH’s guidance on health and safety auditing recommends recording changes, reviewing updated policies and communicating results to leaders and workers. Use those records to show what changed at the workplace. A revised procedure needs a check of how people use it. A repaired control needs evidence that it performs its intended task. In food production, a HACCP plan connects those checks to stop and restart decisions.

Keep the distinction between the audit and the underlying risk assessment clear. The audit can identify a missing inspection. The assessment helps establish what that inspection needs to detect and what action its result should cause. If the finding changes the understanding of the hazard, review that assessment before accepting the fix. Before authorizing work after a job hazard analysis, check other tasks sharing the work area.

Close a safety finding when the required control has been checked in use. Keep any limits on that check visible. An observation on the day shift may leave the night shift unexamined. A test with an unloaded machine may leave normal operating conditions untested. State these limits in the closure record rather than letting a checked box imply wider evidence.

This is also the practical distinction between accountability and responsibility. Allocating the task tells someone to act. Accepting closure requires someone to judge the result. The closure record must identify who accepted the evidence and what they actually checked.

Safety audit records show which repairs were checked

An action register gives the audit findings a usable route into daily work. Managers can see an unfinished task and ask why it has stalled. A record of the evidence lets another person revisit the closure decision later. These are useful functions, especially where several departments must contribute to one corrective action.

A completion date also gives workers a basis for challenging progress. A worker who still encounters the defect can compare that experience with the record. Keep the reporting route available after closure. Otherwise the people using the control may have no simple way to tell its owner that the accepted fix has stopped working.

HSE’s guidance on monitoring and reporting says that boards need routine reports and information about relevant events between formal reviews. Apply that principle to audit follow-up. Serious unresolved findings need attention from someone with authority to supply resources or change the work. They should not wait silently for the next audit.

A closed finding should remain traceable to the evidence that justified closure. The register can preserve that evidence without pretending it lasts indefinitely. Decide which conditions would weaken it. A change in equipment or work arrangements may require a new check even though the original action was completed correctly.

Consider this illustrative closure record. The test of the repaired guard has been witnessed. The other claims require separate checks before the manager can rely on them.

The difference matters when deciding whether to resume work or keep a temporary restriction. Read more on following a workplace risk assessment. Evidence of one completed repair must not conceal the conditions needed to keep that repair effective.

Use the Walk to decide what evidence can close a safety finding and what signal should reopen it. Start the Walk →

What allowed small fires to remain routine at King’s Cross?

The Department of Transport’s Fennell investigation traced the disaster to a fire beneath a wooden escalator. Smoking continued despite a ban introduced in 1985. A lighted match could reach accumulated grease and debris beneath the steps. Gaps had been observed about two weeks before the disaster. Burn marks showed that earlier fires had started and gone out.

The report’s wider finding concerned how London Underground used previous warnings. Chapter 13 described recurring recommendations from earlier internal fire inquiries. There was no system to ensure that findings received proper consideration at the appropriate level. Senior managers had not adequately considered many recommendations. Fennell called for a continuing safety program assessed against actual performance.

This case does not establish that a formal safety audit had been completed before the fire. It documents earlier inquiries and a failure to carry their lessons into action. Chapter 14 proposed stronger safety auditing. The lesson for audit follow-up is an inference: finding a problem cannot protect people unless someone checks the response and acts on returning warning signs.

A small incident can require a new decision even when the last incident caused no serious injury. The previous outcome cannot establish that the next event will remain small. A root cause analysis helps investigate why something happened. Its conclusions still need a person who checks whether the conditions can develop again.

The chain illustrates a possible follow-up failure, rather than a reconstruction of a particular audit at King’s Cross. A repair is completed, checks become less frequent, and a warning no longer reaches the person who can change the work. The failure begins before the next serious incident. That gives monitoring a specific purpose: detect the return of unsafe conditions while action can still reduce exposure.

For a manager reviewing closed findings, the useful question is whether a comparable warning would reach the right person today. The follow-up process must reopen the issue when the evidence for closure no longer holds.

Set the signal that will reopen a closed finding

Add a recurrence field to the existing action register. For each finding that needs continued attention, describe an observable condition that would challenge closure. Use a failed control check or a missed safety-critical inspection where these relate to the original problem. Avoid a general instruction to remain vigilant. The person receiving the warning needs to know which condition matters.

Name the person who checks that signal and the person who decides the response. Set the check interval according to how quickly unsafe conditions could return. Where a control can deteriorate within a shift, a monthly register review cannot provide timely warning. Where a change in equipment affects the control, check it before the changed work starts. The check after a near-miss investigation also needs evidence that the proposed control works for the next task.

OSHA’s program evaluation guidance calls for checking that corrective actions prevent recurrence. It also asks employers to consider whether changes in equipment or work practices require changes to the program. Use that distinction in the register: scheduled checks address gradual deterioration; a defined change can trigger a review immediately.

The signal needs a response rule. State who receives the report and how soon they must act. Specify any temporary restriction needed while the finding is reviewed. The purpose of monitoring is to support that decision. A warning collected in a dashboard cannot do this unless someone has both the duty and authority to respond.

Use the Universal Decision-Making Method to connect the closure decision to the conditions being relied on. Record the evidence for continuing work and the point at which it needs reconsideration. A Decision Record can preserve that reasoning when a safety finding requires a consequential operating decision.

Keep the finding closed only while the checks support the decision to continue the work. If the signal fires, reopen it and review the affected control. That may require a new repair or a different way of working. Record the new evidence before closing it again, so the next owner can see why the decision changed.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.