Safety Audits Miss Temporary Changes: 6 Blind Spots That Keep Field Risk Alive

Across more than 250 cultural transformation projects supported by Andreza Araujo, one pattern keeps repeating. A change that was supposed to last one shift ends up living for weeks, and by the time the audit team arrives the checklist still looks tidy enough to pass. That is why temporary changes deserve more attention than most audit routines give them.

In Safety Culture: From Theory to Practice, Andreza Araujo argues that the system reveals itself in what people accept when pressure is real. A temporary change is often the moment when that pressure shows up. The guard is bypassed for a repair, the replacement part is not the one specified, the route is altered, or the permit keeps moving even though the field condition has already changed.

This article focuses on the gap between what the audit records and what the field still carries. If you manage a plant, a maintenance crew, or a high-risk operation, the useful question is not whether the form was completed. The useful question is whether the temporary condition still needs active control, because a short-term exception becomes a long-term hazard the moment the organization stops treating it as temporary.

Key Takeaways

• A clean audit score does not prove that temporary changes are under control.
• Field verification matters because the work often changes after the form is closed.
• If a temporary condition survives more than one shift, it needs a named owner and a review date.
• Audit routines that sample only the tidy areas of the site miss the highest-risk drift.
• Leaders should verify performance under load, not only the presence of paperwork.

Why the audit score misses the real problem

An audit records evidence at a specific moment, while the risk often develops in the hours and days around that moment. That gap matters because the same work can look compliant in the morning and materially different by the evening shift, especially when production pressure, contractor turnover, or maintenance backlog pushes crews to adapt on the fly.

ISO 45001 expects operational control and change management, which means the standard is not asking for a prettier checklist. It is asking whether the organization knows how to keep a changing workplace aligned with the intended control set. Patrick Hudson's maturity model is useful here, because a site that can only show reactive cleanliness on paper is still not demonstrating proactive control.

The table above sounds simple, but the distinction is where many programs drift. James Reason's work is useful because it reminds leaders that the visible error is usually only the final expression of a longer chain, one that includes latent gaps, weak supervision, and control drift that nobody treated as urgent enough to interrupt.

Blind spot 1: temporary changes are treated as exceptions

Temporary changes are often treated as if they are too small to matter. A hose is rerouted, a guard is removed for access, a substitute component is installed, or a route is cleared differently for one task, and everyone tells themselves that the original condition will return soon enough. The problem is that risk does not wait for the site to remember that promise.

The useful test is duration, not intention. If a temporary change survives across a handover, it is no longer just a convenience. It has become a managed condition that needs an owner, an expiry point, and a recheck. Without those three elements, the organization is letting a temporary workaround masquerade as normal work.

That is the trap Andreza Araujo describes in The Illusion of Compliance. Compliance language can hide an uncomfortable truth, which is that people often treat a deviation as safe simply because they have seen it before. Familiarity lowers attention, and lower attention is exactly what lets a temporary condition harden into routine.

Blind spot 2: the field version differs by shift

Day shift and night shift do not always live inside the same control reality. The audit may land when staffing is stronger, the supervisor is more available, and the site looks better prepared. By the time the next shift inherits the work, the verbal handover may have lost the one detail that mattered, which is the control that was never fully restored.

This is why a shift-specific review matters. A control that works only when the most experienced person is present is not a robust control. It is a person-dependent workaround, and person-dependent controls become fragile the moment the crew changes, the contractor rotates, or the pace of work tightens.

For a maintenance supervisor, the practical question is simple. When the handover happens, does the next crew know exactly what is still temporary, who owns it, and what must happen before the job continues? If the answer is vague, the audit has probably captured a stable document while the field continues carrying an unstable condition.

Blind spot 3: the corrective action closes paper, not hazard

Many audit findings close because someone wrote a response, not because the hazard disappeared. A team retrains the crew, updates a checklist, or adds a note to the system, then treats the item as complete while the physical condition remains untouched. That pattern feels efficient, but it leaves the real exposure in place.

James Reason would call this a latent gap in the chain, because the system keeps producing the same exposure while only the paperwork changes. The fix is weaker still when the action is generic. Training can help, but if the temporary condition was created by access, design, or schedule pressure, then a lecture will not restore the barrier that the worksite already lost.

Across Andreza Araujo's executive EHS work, the same lesson keeps appearing. A site can close a finding quickly and still remain vulnerable if nobody asked whether the temporary state had a design owner, a review date, and a real exit path. Closure is not a safety outcome until the field condition has changed.

Blind spot 4: the route samples the clean part of the site

Audit routes often become familiar rituals. The same people walk the same path at the same time of day, and the organization learns which areas are likely to be inspected. Once that happens, the route stops being a diagnostic tool and starts becoming a performance lane.

Field verification has to break that pattern. Go to the less visible area, the awkward boundary, the place where the job changes hands, or the space where the temporary control is easiest to forget. A site that looks orderly on the preferred route may still be managing serious drift in the place that nobody wants to show first.

This is also why one high-quality conversation matters more than five polite walkthroughs. If the audit only confirms what the site already stages, it becomes a mirror for the organization’s confidence rather than a test of its risk control.

Blind spot 5: the control owner is unclear

A temporary change without one named owner is a control that has already started to leak. The EHS team may know about it, operations may benefit from it, and maintenance may have created it, but if nobody is accountable for rechecking and removing it, the risk floats between functions until the next incident forces a decision.

The answer is not more committee language. The answer is a named operational owner who can say yes, no, or stop. That owner should know the expiry date, the follow-up date, and the person who must verify the field condition before the change is extended. If those details are not visible, the control is not really owned.

For a plant manager, this is a useful discipline because it converts temporary work from a vague exception into a managed exposure. It also creates a paper trail that reflects the worksite rather than a paper trail that simply reflects the last meeting.

Blind spot 6: audits verify presence, not performance

Audits are very good at answering whether a document, sign, or barrier exists. They are much weaker at answering whether that barrier still performs when the job gets difficult. A guard can be present, a permit can be filed, and a checklist can be complete while the real barrier is bypassed by the way the task is now being done.

That is the difference between presence and performance. Presence is static. Performance is what happens under pressure, when the temporary arrangement is tested by production, time, weather, fatigue, or supervision limits. A serious safety program needs both, but if it only checks presence it will keep missing the moment where control actually fails.

Bird and Heinrich are still useful here because precursor events matter. If the site keeps seeing the same small deviations around a temporary condition, the audit should treat them as a warning pattern rather than as isolated noise. Repetition is the signal that the control has already started to age out.

What to do in the next 30 days

Start by creating one short temporary-change register that names the owner, the expiry date, the reason for the change, and the exact condition that must be restored. Keep it operational, not bureaucratic. If it cannot be used by a shift supervisor or maintenance lead in the field, it is too abstract to prevent drift.

Then add one cross-shift verification question to every handover. What is still temporary, what changed since the last shift, and what must be checked before the job continues? That habit is small, but it is powerful because it forces the next crew to inherit the risk consciously rather than by assumption.

Finally, make one leader walk a route that the site does not expect. Do not start with the showroom areas. Start where the temporary control is most likely to live, then ask whether the current arrangement still matches the intended barrier. If it does not, close one visible loop and tell the crew what changed so the organization learns that temporary really means temporary.

FAQ

What is the main failure in an audit of temporary changes?

The main failure is assuming that a documented change is still under control just because the audit found a record. Temporary conditions need field verification, because the risk often changes after the document is closed.

Why do temporary changes get missed so often?

They get missed because they are easy to normalize. Once a team has seen the same workaround a few times, it starts to feel ordinary, and ordinary things get less attention than they deserve.

Who should own a temporary change?

An operational owner should own it, usually someone who can act in the field and force a decision if the condition is no longer acceptable. EHS can support the process, but ownership should sit where the work is actually managed.

How can a supervisor verify that a temporary change is still safe?

The supervisor should check whether the condition still matches the original control intent, whether the next shift knows what is temporary, and whether the exit date is visible. If those answers are unclear, the change needs review before work continues.

What is the best sign that an audit is too shallow?

The best sign is when the audit sees records but not behavior. If the form is clean while the field is still adapting around the hazard, the audit is verifying paperwork instead of control performance.

Conclusion

Safety audits miss temporary changes when they mistake stability on paper for stability in the field. The fix is not more decorative compliance. It is sharper field verification, clearer ownership, and a habit of asking whether the current condition still matches the control that was supposed to exist.

That is the line Andreza Araujo keeps drawing in her work and in Safety Culture: From Theory to Practice. If the temporary condition is still alive, it deserves active management. If it has already become normal, then the organization has a bigger problem than the audit revealed.