In its final report on Alaska Airlines Flight 1282, the NTSB did more than find that four bolts were missing from a door plug. It found that Boeing's corrective actions for the process meant to control that kind of error had been ineffective, despite FAA acceptance, and that compliance problems with that process had been documented for at least ten years.
Corrective actions were raised and accepted. The process still failed. For anyone who manages a findings database, that should be uncomfortable. Our systems are very good at recording that something was done. They are much less good at telling us whether it worked. Two loops that rarely meet Here is the contradiction. An organization can close every finding on time, pass its next audit, show a falling count of open items to its accountable manager, and still carry the same risk that produced the findings in the first place.
This can happen without anyone doing anything wrong. The compliance monitoring function did its job: a root cause was recorded, a corrective action plan was agreed, and evidence of implementation was filed. The authority accepted it. The problem is that implementation and effectiveness are different claims, and the process that closes findings mostly tests the first.
My argument is this. Findings processes ask organizations to demonstrate that corrective actions were implemented, while the SMS separately requires verifying that they work. Where the two loops stay unjoined, closure rates get reported as risk reduction.
What the rules actually ask To be fair to regulators, the rules do not ignore effectiveness. They put it in a different place. Under EASA's air operations rules, ORO.GEN.150 sets out what an operator must do after a finding: identify the root cause, define a corrective action plan, and demonstrate corrective action implementation to the competent authority within an agreed period. That is the findings loop, and its test is implementation.
The effectiveness test sits elsewhere. ORO.GEN.200(a)(3) requires the operator to manage risk, including taking actions to mitigate it and verifying their effectiveness. In the United States, 14 CFR 5.73 requires organizations covered by Part 5 to evaluate the effectiveness of safety risk controls and identify ineffective ones. ICAO Annex 19 asks service providers to validate the effectiveness of safety risk controls, and its Amendment 2, applicable from 26 November 2026, adds links between State safety programmes and service provider SMS. For operators under KCAA oversight, the Civil Aviation (Safety Management) Regulations, 2026 are where to check how Kenya has written these requirements.
So the requirement exists. What the rules do not specify is how a finding raised in the compliance loop gets handed to the risk loop for an effectiveness check. That handover is left to the organization, and the evidence below shows what happens when it does not take place. What it looks like inside an organization Consider a finding of a familiar kind. An internal audit of a maintenance organization finds task cards for a recurring inspection signed off without the required independent inspection.
The corrective action plan is a revised procedure, a briefing to certifying staff, and a reminder in the next recurrent training. The evidence of implementation is the revised procedure, the briefing attendance sheet and the training record. The finding is closed on time.
Nothing in that closure package tells anyone whether the next hundred task cards will be completed correctly. Answering that would take a sample of work done after the fix, taken some weeks later, ideally by someone other than the person who owned the finding.
Now look at how the organization measures itself. The monthly quality report shows open findings, overdue findings and the percentage closed on time. The safety review board sees a green trend. The authority's next audit samples the closure evidence and finds it complete. Every metric in that chain measures the findings loop. None measures the risk loop. The structure reinforces this.
Findings usually belong to compliance monitoring; effectiveness belongs to safety assurance. Even when both sit in one Quality and Safety department, nothing in the rules requires them to share a register, an owner or a meeting. If the same problem reappears a year later, it can easily be logged as a new item with a new number, and the link to the first finding depends on someone remembering it.
That last point matters most. A repeat finding is the clearest signal that a corrective action did not work, and it is the signal our systems are least designed to see.
The evidence
This is not a hypothetical weakness. Three official reviews in the United States describe it at three different levels. At the manufacturer, the NTSB's Flight 1282 report found Boeing's corrective actions for its parts removal process ineffective despite FAA acceptance, across at least ten years of documented compliance problems. It named as a contributing factor FAA surveillance and audit planning that failed to identify and ensure Boeing addressed "repetitive and systemic nonconformance issues". At the airline, the Department of Transportation's Inspector General examined FAA oversight of American Airlines' maintenance in 2021. It found the FAA had closed compliance actions before the carrier had implemented its corrective actions, and had accepted corrective actions without validating their effectiveness.
In 171 of 185 sampled cases, the carrier had either not identified the root cause or attributed it to human factors. At the regulator, a 2024 Inspector General audit found the FAA's compliance system could not determine whether potential repetitive noncompliances had occurred at Boeing.
Research points the same way. A 2021 systematic review by Clare and Kourousis of learning from incidents in aircraft maintenance and continuing airworthiness found the evaluation stage to be a primary bottleneck, and root causation often shallow.
Two cautions.
These are US cases and one review, so they show that the mechanism exists, not how common it is. And none of them suggests that the people involved ignored the rules. They followed a process that counted closure.
Why the loops stay apart
The loops stay apart because each is rewarded separately. Closure has a due date, an owner and an authority waiting for evidence. Effectiveness has none of these. A finding open past its date is a visible failure; a corrective action that quietly did not work stays invisible until the problem returns. Under workload, a compliance function will spend its hours where the deadlines are. Oversight reinforces the same incentive. An inspector can verify a revised procedure in minutes. Verifying that a control changed what happens on the hangar floor takes sampling over time, and inspection visits are short.
The strongest counterargument deserves a fair hearing. Compliance auditing is associated with better outcomes: in IATA's 2025 figures, IOSA-registered airlines had 0.98 accidents per million flights against 2.55 for other airlines. That comparison reflects more than auditing, but it is not nothing. And many findings are documentary; for those, implementation is the fix. I accept both points.
My claim is narrower: findings linked to a hazard, or repeating an earlier one, need an effectiveness check, and nothing in a closure-driven system selects them automatically. What this means by role
Accountable managers: ask for two numbers alongside the closure rate: repeat findings, and closed findings whose effectiveness was verified. If neither exists, the closure rate is describing administration.
Compliance monitoring managers and auditors: when a finding recurs, link it to the original and reopen the root cause instead of raising a fresh item. At closure, schedule an effectiveness sample with a date and an owner who did not close the finding.
Safety managers: bring hazard-linked findings from the compliance register into the risk register, so the control is tracked where ORO.GEN.200(a)(3) or 14 CFR 5.73 expects it to be evaluated.
Flight operations managers: when a finding ends in a revised SOP, use flight data monitoring or line checks to see whether the revised SOP is actually being flown.
Maintenance and continuing airworthiness managers: judge corrective actions by records of work done after the fix, such as completed task cards, not by the revised procedure or the briefing sheet. Regulators and inspectors: accept a corrective action plan only when it states how and when effectiveness will be checked, and sample that check on the next visit. Questions to put to your own records Of our last 20 closed findings, how many had their effectiveness verified by someone other than the person who closed them?
How many findings in the past 24 months repeat an earlier finding, and are they linked in our system? What share of our corrective actions are training, briefings or procedure revisions, and how many were followed by a sample of work done afterwards? Which closed findings relate to a hazard in our risk register, and was the register updated to reflect them?
What does our accountable manager see each month: the closure rate, or evidence that controls work? When did an authority last ask us how we verified that a corrective action was effective, and what did we show? Closing the right loop A findings log with nothing overdue is a record of administrative discipline, and that is worth having. But it answers the compliance question, and a clean answer to that question is easy to mistake for an answer to the safety question.
The fix is not more findings or tighter deadlines. It is a handover: every finding that touches a hazard or repeats an earlier one should leave the compliance loop with a date on which someone will check whether it worked. Until that handover exists, closure records what we did. It says nothing about what changed.
In your organization, what evidence would you accept as proof that a corrective action worked, as distinct from proof that it was implemented?
Source list Seventeen sources were opened or cited; the Used in column shows which ones support the article itself. Pages were checked on 27 September 2026. Source Publisher Date Used in Status
Easy Access Rules for Air Operations (Regulation (EU) No 965/2012, Part-ORO: ORO.GEN.150, .200, .205) EASA Revision 24, March 2026 Article, evidence 1–2 Current
14 CFR Part 5, Safety Management Systems FAA, via eCFR Current text Article, evidence 3 Current
Safety Management Systems final rule Federal Register 26 April 2024 Topic 8 Current
ICAO Safety Management (Annex 19 Amendment 2) ICAO Amendment adopted 23 June 2025 Article, evidence 4 Element wording to verify
Civil Aviation (Safety Management) Regulations, 2026, LN 32 of 2026 Kenya Law 3 March 2026 Article, evidence 5 To verify; page refused access
Major boost for aviation safety as KCAA unveils series of fresh regulations The Eastleigh Voice 2026 Evidence 5 Secondary
NTSB investigation DCA24MA063, Alaska Airlines Flight 1282 (AIR-25-04) NTSB Adopted 24 June 2025 Article, evidence 6 Current
Board Meeting Summary, DCA24MA063 NTSB 24 June 2025 Article, evidence 6 Current
FAA Lacks Effective Oversight Controls To Determine Whether American Airlines Appropriately Identifies, Assesses, and Mitigates Aircraft Maintenance Risks (AV2022004) DOT Office of Inspector General 20 October 2021 Article, evidence 7 Current
FAA's Oversight Processes for Identifying and Resolving Boeing Production Issues Are Not Effective (AV2025002) DOT Office of Inspector General 9 October 2024
Learning from Incidents in Aircraft Maintenance and Continuing Airworthiness Management: A Systematic Review Clare and Kourousis, Journal of Advanced Transportation 2021
Section 103 ODA for Transport Airplanes Expert Panel Review Report FAA February 2024
IATA Releases 2025 Safety Report IATA 9 March 2026
EASA FAQ n.19146: management system versus SMS EASA
Go-Around Decision-Making and Execution Project Flight Safety Foundation
The Nimrod Review UK Government 28 October 2009 Topic 7 Historical
ICAO Safety Management Manual (Doc 9859) ICAO Fourth edition, 2018
