Fable
One day's physical exam and half a year of medical records
In the south of the city there was a granary that took government orders exclusively. The government required the granary to undergo regular safety audits: whether fire precautions were adequate, whether the moisture barrier was damaged, whether in-and-out records were traceable. In the first year, the auditor came for a day and checked the placement of fire equipment, the construction drawings of the moisture barrier, and the record standards of the ledgers. At the end of the day, the auditor wrote in the report: safety control design compliant. The granary got its pass and kept taking orders.
The next year, an old inspector was replaced. The old inspector said: I do not only look at drawings; I want to see the daily duty records for the past six months, the weekly equipment inspection ledgers, and the moisture measurement data for the moisture-proof layer after every rain. He spread the granary's six months of operating records on the table and checked them one by one. The result showed that the moisture-proof layer did meet the standard in design, but in the past six months there had been four times after heavy rain when humidity exceeded the standard for more than two days before it was handled; the positions of firefighting equipment had not changed, but half of the fire extinguishers were expired and had not been replaced.
The old reviewer wrote two conclusions in the report. First: the security control design is compliant—consistent with the first year's conclusion. Second: the security controls failed multiple times during the past six months of operation—this was information that was not in the first year's report. The granary's pass was downgraded and could only be restored after submitting evidence of remediation.
Only then did the granary owner realize that the "design compliance" report he received two years ago proved only one thing: the blueprints were correct. It did not prove that staff were operating according to the blueprints, that equipment was being maintained on schedule, or that anyone checked humidity on rainy days. Design compliance is not operational compliance.
The boss, having learned a painful lesson, split the remediation into two phases. Phase one: replace all remaining fire extinguishers, install automatic humidity alarms, and make the design flawless. Phase two: hire a full-time safety officer responsible for daily inspection records, equipment expiry alerts, and rainy-day emergency procedures. The cost of phase two was more than ten times that of phase one—the equipment itself isn't that expensive; what's truly costly is proving every day that the controls are still effective. That relies on a continuous chain of operational evidence, not a one-off design document.
Half a year later, the old inspector came again, reviewed the complete six months of operating records, and wrote the final conclusion in the report: safety controls met compliance standards at both the design and operational levels. The granary's permit was restored, and it obtained a higher-tier order qualification than the previous year.
Later, when the boss shared lessons with peers, he said only two things: a report on compliance by design can be produced in three days. For a report on compliance in operations, without more than half a year of real data, no one dares to sign.
Later the warehouse chief stored the two sets of reports in separate cabinets: design reports got green tags, operations reports got blue tags. When negotiating orders, the government office had to check the blue tags first; a warehouse with only green tags could only take the loosest scattered orders with the lightest safety requirements.