Typically an oversight body audits the safety process from time to time.
Typically, (in my experience) an oversight body only audits the documents which indicate that an operator has a safety process.
One of the major omissions in SMS is the process or at least the depth of process which investigates incidents and mishaps (thus lack of data or inaccurate data). These are the low level events which are often the precursors to more serious problems, but are rarely investigated in sufficient depth to identify the underlying contributor factors.
I cite the very good UK CAA (EASA) system of mandatory reporting (MOR). Again, my experience with several operators suggests that only a first level of investigation was used to close the report. This could be the reporters perception of the event (opportunity for flawed perception), that of the operator (opportunity for operational bias – keep the good name), or the safety/QA department – usually under time pressure or not equipped/experienced to undertake an in-depth analysis.
More surprising was the acceptance of this process by the CAA, where only rarely was there any follow up or questions to the manufacturer (aircraft or component) and apparently no independent investigation by the CAA; it was a data gathering system apparently without validation. Yet MORs were used as the basis for many safety initiatives; – flawed data?
There are similarities with ASRS, where the reward of immunity from punishment in the event of a transgression is often seen as immunity from investigation. Where there is some follow up, the process is also depends on the integrity/ability of reporter, who in keeping with human nature, may well provide reports/answers to match those expected by the question/industry e.g. altitude bust - ‘I was distracted’ – because that is an expected / acceptable answer without the difficulty of further explanation or deeper analysis.
Note the alleged erroneous safety assessment / report by NASA – they are involved with ASRS.