Corrective Action Closure on a Pressure-Control Finding
During an SMS assessment, an assessor finds that a controller bypassed a high-pressure alarm for six hours during maintenance and did not document the bypass. The operator's corrective action plan proposes: (1) retrain the controller, (2) add the bypass to the shift log, and (3) revise the alarm-management procedure. The assessor notes that two other controllers describe the same practice as normal, the bypass log has not been used in 11 months, and the procedure revision is assigned to the same supervisor who approved the original bypass. Target closure date is 45 days. The operator's SMS element for management of change is rated 'developing.'
1. Evaluate whether the proposed corrective actions address the finding's root cause. What is missing?
Read the worked answer
The plan treats a systemic normalization of deviance as an individual error. Evidence: two other controllers call the practice normal, and the bypass log is unused - that is a cultural and control-design failure, not a training gap.
What the actions get right: revising the procedure and adding a log entry are reasonable control-design fixes.
What is missing:
- Root-cause depth. Retraining one controller will not change a practice three people share. The assessment should require an analysis of why the bypass felt acceptable - unclear authority, production pressure, or a log that is hard to use.
- Independence. Assigning the revision to the supervisor who approved the bypass removes the challenge that would catch the same reasoning again. Assign an independent owner or require peer review.
- Verification of use. A log that sat unused for 11 months needs a monitoring measure (spot checks, periodic reconciliation of alarm events to bypass entries) to prove the control is actually operated, not just written.
- MOC linkage. With MOC rated 'developing,' the procedure change itself needs to flow through MOC so the risk of the change is assessed.
2. The operator wants to close the finding at 45 days. What should the assessor require before accepting closure, and how should 'developing' MOC affect the decision?
Read the worked answer
Do not accept closure on document completion alone. Require evidence of effective implementation, which for this finding means:
- Records showing the revised procedure was issued through MOC and communicated to all affected controllers, not just the one involved.
- At least one monitoring cycle of bypass-log reconciliation showing entries match actual alarm events.
- A sample of controllers able to describe the new authority and logging expectation, confirming the practice changed.
On the 45-day target: procedural revision can plausibly finish, but proving a behavioral control is working needs operational time. Recommend splitting closure - close the documentation actions at 45 days with interim verification, and hold the finding open until the monitoring evidence exists. A 'developing' MOC rating means the change may not get proper risk review or communication, so the assessor should require explicit MOC evidence rather than assume it. Premature closure here would convert a detected weakness back into an undetected one.