Why completing an audit is not the same as having good governance

The false reassurance of a completed audit

I have seen services with folders full of completed audits that still repeat the same errors month after month. The forms were completed, percentages were calculated and boxes were ticked, yet the underlying practice did not improve. That is monitoring without governance. The purpose of an audit is not to produce a document. It is to identify whether a system is safe and effective, then trigger action when it is not.

Follow the full trail

A strong audit trail answers six questions: what was checked, what was found, what risk did it create, what action was agreed, what evidence shows completion, and how was effectiveness reviewed? If any part is missing, the organisation may be unable to demonstrate that it understood or controlled the issue. This is especially important when findings relate to medication, missed visits, safeguarding, recruitment or care planning.

• What was checked — scope, sample size and date
• What was found — the specific finding, not a score alone
• What risk it created — for which people, and how severe
• What action was agreed — owner, deadline, priority
• What evidence shows completion — a document, not a verbal assurance
• How effectiveness was reviewed — the repeat check and its result

Avoid actions that cannot be measured

Actions such as 'staff reminded', 'monitor going forward' or 'manager to review' are rarely enough. They do not identify who is responsible, when the task will be completed or what evidence will prove the change. A stronger action might require a defined sample, a completion date, a named owner, targeted retraining and repeat observation or audit. Specificity makes accountability possible.

Look for recurrence and patterns

An isolated recording omission may require correction and feedback. Similar omissions across several staff members may indicate unclear guidance, weak induction, poor supervision or a system design problem. Governance should therefore examine themes across audits, incidents, complaints, compliments, safeguarding concerns, missed calls and workforce information. Different data sources often describe the same underlying weakness.

Close actions only when evidence supports closure

I am cautious about marking an action complete because someone says it has been done. Completion should normally be evidenced: an updated document, attendance record, competency assessment, meeting note, screenshot, revised process or audit result. High-risk actions should also be tested later. A new process may work for a week and then fade when pressure increases. Re-audit converts a promise into assurance.

The lesson

Good governance is a continuous loop: identify, understand, act, evidence, review and learn. A compliance system should make that loop visible. If an auditor or inspector can follow the journey from finding to sustained improvement without relying on verbal explanation, the evidence is doing its job.