Turning a failed audit into a plan, not a panic

A failed audit lands badly. The instinct is either to argue with it or to scramble at everything it raised at once, and neither response helps. An audit that finds problems has done its job. The building was already in that condition before the auditor arrived; all that has changed is that you now know. The task from that point is not to feel caught out but to convert a list of findings into a plan that fixes the dangerous things quickly, schedules the rest sensibly, and leaves a record showing you acted reasonably. That is a manageable process, provided you resist the urge to treat every finding as equally urgent.

A finding is information, not a judgement

It helps to separate the emotional weight of the word "failed" from what an audit actually produces, which is a set of observations against a standard. Some of those observations describe immediate danger. Most describe drift, deferral or paperwork gaps. The auditor's role is to record what they saw, not to rank your competence. The manager's role is to decide what to do with each item and in what order. Treating the report as data rather than as a report card is the first move, and it is the one that makes the rest of the work calm rather than frantic.

Triage before you act

The single most useful thing you can do with a list of findings is sort it by risk and effort before touching any of it. A finding that puts people in immediate danger and takes an hour to fix is not in the same category as a documentation gap that takes a week to resolve and threatens nobody today. A simple triage looks like this.

The discipline is to act on immediate items the same day and to be honest that the bottom of the list can wait. Spreading panic evenly across all findings means the dangerous ones get the same attention as the trivial ones, which is exactly the wrong outcome.

Make safe first, remediate second

For anything in the immediate band, the first action is interim mitigation, not a perfect fix. If a fire door is failing on an escape route, the question is what controls reduce the risk today, while the proper repair is arranged. Where a building falls under specific recurring duties, those duties do not pause because an audit failed; for high-rise residential buildings the monthly checks required by the Fire Safety (England) Regulations 2022 still apply throughout. Document the interim measure as carefully as the eventual repair, because the period between finding a hazard and fixing it is exactly the period a regulator will ask about.

Build the plan, then own it

Once triage is done, the findings become a remediation plan. Each item needs four things: an owner, a target date, a current status, and the evidence that will close it. Without an owner, an action drifts. Without a date, it never becomes urgent. Without tracked status, you cannot tell the plan from a wish list. And without closing evidence, you cannot prove later that the work was done.

A workable plan tends to share these features:

• Sequenced by risk, so the dangerous items lead and the cosmetic ones trail.
• Owned by named people, not by a team or a job title that everyone assumes means someone else.
• Dated with realistic targets, because a plan full of dates you will miss is worse than one with honest ones.
• Visible to whoever needs assurance, so the people accountable can see progress without chasing it.
• Closed with evidence, so a finished action leaves proof rather than a verbal "that's sorted".

Prove that you acted reasonably

Regulators and, in the worst case, courts do not expect perfection. They expect a responsible person who found a problem to have acted reasonably and promptly. The record that shows the sequence, finding to interim measure to repair to sign-off, is what demonstrates that. A failed audit followed by a clear, dated remediation trail is a defensible position. The same failure followed by silence and a quiet fix months later is not. This is the same logic we set out in an audit trail a regulator can follow without you: the value is in the followable history, not the single tidy document.

Close the loop and reset the baseline

A remediation plan is not finished when the last item is fixed. It is finished when the audit is re-run, or at least the failed items re-checked, and the building's record is updated to show the new, better position. That re-check becomes the clean baseline the next year of work hangs off. If you skip it, you carry forward an audit on file that still says "failed", which helps nobody and confuses the next person to read the building's history.

This is the shape SAMRISK is built to hold: findings that become owned, dated actions, a calendar that chases them, and a sign-off that resets the baseline once they are closed. You can see how that connects on the audits and risk assessments pages. A failed audit is uncomfortable, but it is also the most useful thing an audit can do, provided what follows is a plan rather than a panic.