Safety Culture

How to Diagnose Compliance Theater Before the Next Audit in 30 Minutes

A practical safety-culture routine for leaders who want to find out whether audit readiness is real or only appears when someone announces a visit.

By 8 min read
corporate environment depicting how to diagnose compliance theater before the next audit in 30 minutes — How to Diagnose Comp

Key takeaways

  1. 01Compliance theater appears when a site looks ready for an audit but cannot show the same control during ordinary work.
  2. 02A repeated finding should be traced from the report into the field, then into the handover, until the real control is visible.
  3. 03Corrective action is weak if it changes only the tracker or the file and leaves the work itself untouched.
  4. 04Leaders should reward field proof, not audit cosmetics, because language and incentives train the next behavior.
  5. 05A 30-day anti-theater review should test whether the control still exists when nobody is preparing for observation.

Compliance theater starts when a site can look organized for an audit and still leave the same risk untouched in normal work. The test is simple. If the team only sharpens the file when the audit is near, the file is doing more work than the control.

On Headline Podcast, this is the kind of issue that matters because it shows whether leadership changed the work or only the appearance of the work. Across 25+ years in multinational EHS and more than 250 cultural transformation projects, Andreza Araujo has seen the same pattern repeat. Sites become very good at being observed, but they stay weak at being safe when nobody is watching.

In A Ilusão da Conformidade, Andreza argues that the real measure of a system is what happens when no one is watching. That is the thesis here. An audit should reveal control, not create it. James Reason's lens helps explain why, because the visible finding is only the last layer of a much older decision pattern.

What you need before starting

Before you begin, gather three things. First, the last two audit reports. Second, the corrective action log with owners and dates. Third, one live work area where the same type of finding should be visible if the control is real. You also need one supervisor, one worker, and enough time to walk the field without a meeting interrupting the test.

This is not a paperwork review. It is a field proof check. The routine looks for the gap between what the organization says in the review room and what it actually does in the area where the work runs. If the gap is large, the audit system may be healthy while the operating system is not.

Step 1: Pick one recurring finding and follow it into the field

Start with one finding that has appeared more than once. It might be housekeeping, access control, permit quality, handover quality, or a missing verification step. Do not start with the biggest finding in the report. Start with the most repeated one, because repetition tells you where the organization has learned to live with a weakness.

Walk that finding to the place where it should be obvious. If the report says a barrier is in place, stand where the worker stands and look for the barrier. If the report says a control is checked every shift, ask the shift owner to show the last real check. The field should confirm the file without drama. If it does not, the system is selling appearance.

Andreza Araujo's point in Cultura de Segurança: Da Teoria à Prática is useful here. Culture shows up in repeated decisions, so a repeated finding tells you what the organization tolerates when the audit ends.

Step 2: Compare what the file says with what the shift actually does

Read the report and the corrective action log first, then ask the supervisor to describe the same issue without seeing the paper. The mismatch between the two stories is often the first sign of compliance theater. If the file is precise and the shift story is vague, the file may have been polished after the event instead of before the work.

Look for language that sounds complete but tells you nothing about the control. Phrases like "checked," "reviewed," and "addressed" can hide a weak action when they never name the owner, the method, or the field proof. A control is real when someone can show it, repeat it, and explain why it still works on a difficult day.

This is where James Reason helps. Latent conditions often sit underneath a clean report, so the issue is not that the report is false. The issue is that the report may be describing the organization the audit wants, not the one that exists during ordinary production.

Step 3: Trace one corrective action until it either changes the work or stalls

Pick one corrective action and follow it from finding to owner to closure. Ask a single question at each stage. Who owns it. What changed. How was the field verification done. If the answer keeps shifting from person to person, the action is probably moving around the system without changing the work itself.

Good corrective action has a visible trail. The work area changes, the supervisor can point to the change, and the worker can explain why the old condition no longer exists. Weak corrective action has only a closing date and a checkbox. That is not closure. It is paperwork with a finish line.

Across more than 250 projects, Andreza Araujo has seen that the fastest way to spot compliance theater is to ask for the before and after in the field. If nobody can show the after, the action is still a promise.

Step 4: Test whether the supervisor can explain the control without the form

Ask the supervisor to explain the control as if the form did not exist. The point is not memory. The point is ownership. If the supervisor can only read the form back to you, the control may live in the template instead of in the job.

Then ask the worker the same question. If the worker and supervisor give different answers, the site has not converted the correction into a shared operating habit. That gap matters because the audit may see one version while the work continues under another version.

On Headline Podcast, the useful question is always whether the decision survives the room. If the control disappears when the paperwork is removed, it was never a control. It was a document.

Step 5: Watch the handover, because theater survives shift change

Many audit improvements die at handover. The outgoing shift knows what the audit team wanted. The incoming shift knows only what the work demands. If the handover does not name the risk, the control, and the next verification point, the system has not really changed.

Stand at the handover and listen for vague reassurance. "It is all sorted" is not a handover. Neither is "the audit was fine." The incoming supervisor needs the live condition, the open risk, and the exact check that should happen next. Without that, the old weakness simply returns under a new shift name.

That is why compliance theater survives so well. It does not need to fool everyone forever. It only needs to last until the next handover, when attention drops and the file stops being the center of gravity.

Step 6: Look for leader language that rewards appearance more than control

Listen to how leaders talk about the finding. If they praise the team for "getting ready for the audit" without naming the field change, they may be rewarding appearance. If they talk about the binder before the barrier, they are training people to focus on the wrong object.

In A Ilusão da Conformidade, the warning is that systems become convincing when they are inspected, not when they are used. That is why language matters. People repeat the language they are rewarded for, and reward structures often teach them to prepare for observation instead of to maintain control.

The practical test is easy. Ask whether the leader can say what changed in the field, not just what looked better in the audit room. If that question creates silence, the leader may be managing image more carefully than risk.

Step 7: Check whether the finding changed work design or only filing discipline

Some corrections improve the file and leave the work untouched. That is a weak win. Real improvement changes task design, supervision, timing, access, or verification. If the answer was only a new checklist, a tighter folder, or a sharper review meeting, the work may still be vulnerable.

Use a simple comparison. If the same person still does the same task in the same way, but now completes a better form, the organization improved administration. If the route, sequence, authority, or check point changed, the organization improved control. Do not confuse the two.

This is one place where Andreza's project record matters. In more than 250 cultural transformation projects, the durable gains came when the work changed, not when the report changed. The file followed the field, never the other way around.

Step 8: Close the loop with a 30-day anti-theater review

Finish by setting one 30-day review date for the same finding. Not to check the paper again, but to ask whether the field still shows the change. If the answer is no, reopen the issue and redesign the control. If the answer is yes, confirm which part of the change now belongs to the routine rather than to the audit preparation.

Give the review three questions. What changed. Who can prove it. What would make the control fail on a bad day. Those questions move the team away from celebration and toward verification. That is where a mature safety culture begins to separate itself from cosmetic readiness.

As Andreza Araujo writes in Cultura de Segurança: Da Teoria à Prática, culture is not a banner. It is the repeated decision. If the 30-day review does not change the decision, the site is still performing safety instead of running it.

What you see Compliance theater Real control
Audit prep The team scrambles when notice arrives The work is already stable before the audit
Corrective action Closed in the tracker, invisible in the field Visible in the work area and explainable by the owner
Handover General reassurance Named risk, named control, named next check
Leadership language Focus on looking ready Focus on changing the work

Final checklist for leaders

  • One recurring finding has been traced into the field, not only the report.
  • The supervisor and the worker can explain the control without reading the form.
  • The corrective action changed the work, not only the tracker.
  • The handover names the live risk and the next verification point.
  • The 30-day review checks field reality, not audit cosmetics.

FAQ

How do I know if my site has compliance theater?

Look for a site that becomes organized only when an audit is near. If the team can fix the file quickly but cannot show the same discipline in normal work, the appearance is stronger than the control.

Is a clean audit report enough proof of control?

No. A clean report may show that the team prepared well for observation. It does not prove that the control survives handover, production pressure, or an ordinary shift with no auditor present.

What is the fastest first step?

Pick one repeated finding and walk it into the field. Ask the supervisor to show the control where the work happens. If nobody can show it, the correction is still living in the paperwork.

Why is training alone not enough?

Training can help people describe the issue, but it does not change the control unless the work itself changes. If the task, sequence, authority, or verification step stays the same, training only makes the weakness easier to describe.

Who should own the anti-theater review?

The leader who controls the work should own it, with EHS supporting the method and verification. If ownership sits only with the audit team, the review will drift back toward documentation instead of operations.

For leaders who want the next conversation to end with a field decision, not a prettier binder, stay with Headline Podcast and use the next audit as a test of reality rather than a test of appearance.

Topics safety-culture audit-readiness compliance-theater field-verification leadership headline-podcast

Frequently asked questions

How do I know if my site has compliance theater?
Look for a site that becomes organized only when an audit is near. If the team can fix the file quickly but cannot show the same discipline in normal work, the appearance is stronger than the control.
Is a clean audit report enough proof of control?
No. A clean report may show that the team prepared well for observation. It does not prove that the control survives handover, production pressure, or an ordinary shift with no auditor present.
What is the fastest first step?
Pick one repeated finding and walk it into the field. Ask the supervisor to show the control where the work happens. If nobody can show it, the correction is still living in the paperwork.
Why is training alone not enough?
Training can help people describe the issue, but it does not change the control unless the work itself changes. If the task, sequence, authority, or verification step stays the same, training only makes the weakness easier to describe.
Who should own the anti-theater review?
The leader who controls the work should own it, with EHS supporting the method and verification. If ownership sits only with the audit team, the review will drift back toward documentation instead of operations.

About the author

Andreza Araújo

Safety Culture Expert | Senior EHS Executive

Andreza Araújo is a safety culture expert and senior EHS executive with more than 25 years of experience in environment, health and safety. She is a Civil Engineer and Occupational Safety Engineer from Unicamp, holds a Master's degree in Environmental Diplomacy from the University of Geneva, and completed sustainability studies at IMD Switzerland. Andreza has served in Global Head of EHS roles in Fortune 500 environments, leading cultural transformation programs across multinational operations. She has represented Brazil as a speaker at the United Nations in Paris and has spoken at the International Labour Organization in Turin. She is the author of more than 16 books on safety culture in Portuguese, Spanish, English and German. Her work has earned more than 10 EHS awards, including two recognitions from Indra Nooyi, former PepsiCo CEO.

  • Civil & Safety Engineer (Unicamp)
  • M.A. Environmental Diplomacy (University of Geneva)
  • Sustainability Cert (IMD Switzerland)
  • People Management & Coaching (Ohio University)
  • UN Paris speaker representative for Brazil
  • ILO Turin speaker
  • LinkedIn Top Voice
  • Indra Nooyi PepsiCo CEO recognition (2x)

Documentaries

Watch Andreza's documentaries

Three productions on safety culture, organizational failure and the human lessons behind major disasters.

Podcasts

Listen to Andreza's podcasts

She hosts three shows on safety leadership, EHS and organizational culture, in English and Portuguese.

Summarize with AI