Corrective actions: distinguish completed tasks from verified closure

Topics: oil and gas corrective action tracking, EHS action closeout, audit corrective action workflow, corrective action evidence

Why "100% closed CAPA" dashboards mask unmitigated plant hazards

Every oil and gas facility generates hundreds of corrective and preventive action (CAPA) items annually from Process Hazard Analyses (HAZOP / LOPA), OISD external safety audits, PNGRB T4S technical inspections, and incident investigations under DGMS Oil Mines Regulations 2017. Corporate EHS dashboards routinely report 98% on-time CAPA closure, yet subsequent audits or repeat near-misses reveal that the hazard on the plant floor remained unchanged.

This disconnect happens when EHS tracking software treats task completion as synonymous with verified risk reduction:

1. The "Purchase Order or Memo" Closure Fallacy: Following a hydrocarbon pump seal leak investigation, Action CAPA-2026-0412 requires upgrading the single mechanical seal on Pump P-204A to a dual pressurized API Plan 53B seal system. The assigned project engineer raises a Purchase Requisition for the seal kit, attaches the PO PDF, and clicks COMPLETE. In reality, the seal cartridge sits in warehouse stock awaiting a unit shutdown six months later, while the EHS register reports the fire hazard as CLOSED.
2. Procedure Revision Without Operator Walkthrough or P&ID Alignment: A HAZOP action requires adding an interlock bypass administrative control and updating the unit startup Standard Operating Procedure (SOP). The process engineer uploads a draft Word document to a shared folder and closes the action—before the updated SOP has been approved through Management of Change (MOC), before the control-room graphics have been updated, and before panel operators have been briefed across all four shift teams.
3. Self-Closure Without Independent Verification: When the same supervisor who is measured on "Zero Overdue Actions" holds system permission to transition an action from OPEN directly to CLOSED, schedule pressure incentivizes premature administrative closure with weak or missing evidence.

Takeaway: The Action Owner can only declare a task executed (TASK_COMPLETED_PENDING_VERIFY); transitioning the finding to VERIFIED_CLOSED requires an independent Authorised Verifier who inspects commissioned field evidence.

Designing the four-state CAPA verification model

To align plant corrective action tracking with OISD safety management standards, PNGRB T4S, and DGMS Oil Mines Regulations 2017, the CAPA register replaces binary OPEN / CLOSED flags with four explicit states and hard role-based access controls (RBAC):

1. OPEN_IN_PROGRESS (or DEFERRED_WITH_INTERIM_MITIGATION)

• Assigned to a named Action Owner with a target execution date.
• Turnaround Deferral Rule: If a hardware corrective action physically requires a unit shutdown (e.g., welding a nozzle on a live flare header), the Action Owner may not mark the CAPA "Completed by raising a turnaround work order." Instead, the CAPA transitions to DEFERRED_TO_TURNAROUND_WITH_INTERIM_CONTROL, linked directly to the open Turnaround Work Order ID and requiring a signed Interim Risk Mitigation Plan (such as clamp installation and weekly ultrasonic thickness monitoring) approved by the Technical Authority.

2. TASK_COMPLETED_PENDING_VERIFICATION

• Once the physical modification is commissioned in the field, the Pre-Startup Safety Review (PSSR) is signed, or the procedure training is completed across all shifts, the Action Owner uploads the required Evidence Artifacts and sets the status to TASK_COMPLETED_PENDING_VERIFICATION.
• RBAC Enforcement: The system blocks any user where current_user_id == action_owner_id (or a direct subordinate of the Action Owner) from executing the VERIFY_CLOSE transition.

3. REOPENED_DEFICIENT_EVIDENCE

• The Authorised Verifier (Process Safety Engineer, Lead Inspection Authority, or Internal OISD Auditor) inspects the submitted evidence against the Action Type Evidence Matrix:
  • Hardware / Engineering Modification (MOC): Requires (a) Commissioned EAM Work Order (TECO), (b) Signed PSSR certificate, and (c) Red-lined / As-built P&ID update reference. Raising a Purchase Order or storing parts in the warehouse is rejected (REOPENED_DEFICIENT_EVIDENCE).
  • Safeguard / Interlock Change: Requires (a) Signed loop proof-test sheet (As-Left PASS) and (b) Updated Cause & Effect (C&E) matrix revision.
  • Administrative / Procedure Change: Requires (a) Approved controlled document ID in DMS and (b) LMS attendance sign-off proving >= 95% completion across all operating shifts.

4. VERIFIED_CLOSED (and VERIFIED_EFFECTIVE for Tier-1 Actions)

• Only when the Authorised Verifier confirms that the physical or operational control is active in the field does the action transition to VERIFIED_CLOSED. For Tier-1 high-consequence actions, the system automatically schedules a T + 90 day Effectiveness Verification Task to confirm the fix has not been bypassed or degraded in routine operation.

Illustrative example (hypothetical scenario): quarterly review of 150 "completed" plant CAPAs

Illustrative scenario notice: All site volumes, defect counts, error rates, engineering hours, and INR (₹) figures below are hypothetical scenario assumptions constructed to demonstrate the control math and workflow gating. Any time or cost reductions represent modeled process/capacity estimates under these assumptions, not achieved client benchmark savings or guaranteed cash realization.

Consider a refinery and terminal complex where action owners submitted 150 corrective actions as TASK_COMPLETED_PENDING_VERIFICATION during Q3 across three risk tiers (45 Tier-1 High-Consequence PSM/OISD actions, 65 Tier-2 Medium-Risk actions, and 40 Tier-3 Low-Risk housekeeping/minor actions):

• During independent verification by the Process Safety and Technical Authorities across all 150 submitted actions:
  • 114 actions (76.00%) pass independent evidence verification on first submission (VERIFIED_CLOSED or advanced to 90-day effectiveness monitoring).
  • 36 actions (24.00%) are rejected and reopened (REOPENED_DEFICIENT_EVIDENCE) because task activity did not equal verified hazard closure:
    1. 15 actions (41.67% of rejections): "Paper/PO Closure" — spare parts ordered or turnaround work order created in SAP PM, but physical hardware modification not yet installed on the unit -> Reclassified to DEFERRED_TO_TURNAROUND_WITH_INTERIM_CONTROL only after formal Management of Change (MOC) and Technical Authority risk assessment with verified interim risk-mitigation controls (12 cases; never via an automatic status change) or returned for immediate field installation (3 cases).
    2. 12 actions (33.33% of rejections): "Draft Procedure / Missing Shift Training" — SOP text edited, but operators on Shifts C and D had not completed walkthrough sign-off -> Held open until 100% shift walkthrough completed.
    3. 9 actions (25.00% of rejections): "Incomplete Engineering Proof" — mechanical repair executed, but PSSR checklist, weld NDT report, or red-lined P&ID attachment was missing from the MOC package -> Reopened for engineering documentation completion.
• 90-Day Effectiveness Check on Tier-1 Actions: Out of 34 Tier-1 actions that passed initial verification (VERIFIED_IN_PLACE), the T + 90 day field effectiveness walkdown confirms 31 actions (91.18%) operating effectively (VERIFIED_EFFECTIVE_CLOSED) and catches 3 actions (8.82%) where newly installed sample-cooler drain valves had plugged in heavy vacuum-residue service, triggering immediate engineering redesign before a loss-of-containment event could occur.

Takeaway: Independent closure verification prevented 36 uncommissioned or incomplete actions (24.0%) from being falsely reported as closed risks on the plant safety dashboard.

Technical implementation: corrective action verification record schema

{
  "capa_id": "CAPA-O067-2026-0412",
  "source_type": "OISD_EXTERNAL_SAFETY_AUDIT",
  "source_finding_ref": "OISD-AUD-2026-F19",
  "risk_tier": "TIER_1_HIGH_CONSEQUENCE",
  "functional_location": "CDU1-PUMP-204A",
  "hazard_description": "Single mechanical seal on hot light-gas-oil pump P-204A lacks secondary containment.",
  "action_execution": {
    "action_owner_id": "ENG-PROJ-312",
    "execution_completed_at_utc": "2026-10-12T16:00:00Z",
    "submitted_status": "TASK_COMPLETED_PENDING_VERIFICATION",
    "linked_moc_id": "MOC-CDU1-2026-088",
    "linked_eam_work_order_teco": "WO-2026-66419",
    "pssr_certificate_id": "PSSR-2026-088-SIGNED",
    "as_built_pid_revision": "PID-CDU1-042-REV9"
  },
  "independent_verification": {
    "verifier_id": "PSM-AUTH-004",
    "verifier_role": "Lead Process Safety Authority",
    "segregation_of_duties_verified": true,
    "verified_at_utc": "2026-10-15T11:20:00Z",
    "verification_outcome": "VERIFIED_IN_PLACE_AWAITING_EFFECTIVENESS_REVIEW",
    "effectiveness_review_due_date": "2027-01-13",
    "reopen_reason_code": null
  }
}

Acceptance tests and operational readiness thresholds

Summary and next actions

1. Separate TASK_COMPLETED from VERIFIED_CLOSED in the EHS system: Restrict Action Owners to submitting execution completion (TASK_COMPLETED_PENDING_VERIFICATION) and reserve final closure (VERIFIED_CLOSED) for an independent Authorised Verifier.
2. Ban "closed by raising a work order or PO": If a corrective action must wait for a future turnaround to be physically installed, classify it as DEFERRED_TO_TURNAROUND_WITH_INTERIM_CONTROL with a documented compensatory risk measure rather than marking it closed.
3. Enforce action-type evidence checklists: Require commissioned EAM TECO records, signed PSSR certificates, and as-built P&ID revisions for hardware changes, and multi-shift walkthrough sign-offs for procedure changes.
4. Mandate 90-day field effectiveness walkdowns on Tier-1 findings: Verify that high-consequence process safety and statutory corrective actions remain active and un-bypassed after 60 to 90 days of live plant operation.