Organisations conduct audits to verify compliance, identify weaknesses and improve performance. The resulting findings are normally entered into an action system, assigned to responsible persons and monitored until they are closed.
This creates structure and accountability. It can also create a misleading impression of progress. An action may be recorded as completed without the underlying weakness being removed. Documents may have been updated, responsibilities reassigned or training delivered, while working practices remain largely unchanged.
The real value of an audit is therefore not the number of findings raised or closed. It lies in whether the organisation achieves a lasting improvement in performance.
New international guidance on auditing
In May 2026, ISO published the fourth edition of ISO 19011:2026 – Guidelines for auditing management systems. The standard provides guidance on audit principles, management of audit programmes, conducting management-system audits and evaluating auditor competence.
ISO describes audits as tools for improving management systems and processes, meeting regulatory and customer requirements and supporting continual improvement. This places the audit within a wider management process. The audit produces evidence and findings, but management remains responsible for deciding what must change and ensuring that the change is effective.
This distinction is important. Auditors identify gaps based on the available evidence. They do not normally own the operational processes or implement the corrective actions. Lasting improvement depends on what the organisation does after the audit team has completed its work.
When corrective actions do not correct the problem
A 2026 audit by the Norwegian Ocean Industry Authority, Havtil, provides a practical example. Havtil followed up whether Shelf Drilling had corrected regulatory non-conformities concerning barrier and maintenance management on the Shelf Drilling Barsk facility, as previously described during the Acknowledgement of Compliance process.
Havtil concluded that the work had not been completed as planned and that serious regulatory breaches had not been rectified as previously stated. The regulator issued an order requiring the company to correct the non-conformities and present a time-limited and binding plan.
The findings are described in Havtil’s audit report on Shelf Drilling Barsk.
The report also makes an important distinction. Havtil did not consider the work to rectify existing non-conformities to be continual improvement. It regarded this as work necessary to satisfy regulatory requirements.
This is relevant beyond the individual audit. Correcting a regulatory breach restores the required level of compliance. Continual improvement begins when the organisation uses the experience to strengthen its processes and reduce the likelihood of similar weaknesses developing elsewhere.
Effective closure requires verification
A corrective action should address the reason for the finding, not only its visible consequence. Updating a procedure may be necessary, but the organisation should also establish why the previous arrangements were ineffective. The underlying issue may concern responsibilities, competence, planning, resources, supervision or the way operational information reaches management.
Effective closure consequently requires more than documentary evidence. The organisation should verify that the action has been implemented, is understood by the people concerned and works under normal operating conditions.
This may require follow-up interviews, workplace observations, document reviews or a targeted assessment after sufficient time has passed. The form of verification should reflect the significance of the finding and the risk associated with ineffective action.
Recurring findings provide particularly important information. They may indicate that earlier actions addressed individual symptoms without correcting a wider weakness in the management system.
From individual findings to organisational learning
Audit findings are often handled separately by different departments, projects or locations. This can make it difficult to recognise patterns. Several apparently minor findings may point to a common weakness in areas such as contractor follow-up, management of change or operational risk assessment.
Management should therefore consider findings collectively. Information from internal audits, external assessments, regulatory supervision, incidents and operational deviations can provide a broader picture of how the organisation is performing.
The objective is not to keep findings open longer than necessary. It is to ensure that closure represents a verified improvement rather than an administrative milestone.
Bruncell Larsen Strategic Advisory supports organisations with audits, independent assessments, regulatory compliance reviews and follow-up of corrective actions. If you would like assistance in evaluating whether audit findings have produced lasting operational improvement, please contact me.
