"Who cares if the SMS isn't actually doing its job...we've done ours!" Click, end of audit." Now where was that latest edition of the piggy digest...."
This approach to regulation of SMS was taken by Canada and now forms a pretty well known case of what not to do with SMS. Properly implemented SMS is not full self regulation.
Yes organizations are given the flexibility to conduct their operations in the manner they see fit however this is contingent on proper risk management processes.
The regulators responsibility should be to ensure that risk management processes are being carried out correctly.
Correctly done the SMS should be easy to regulate as each stage has obvious outcomes:
EG: Not many reports generated for company size = faulty reporting system.
No action on reports = lack of commitment from management
SMS is not something new and fancy it has been operating in the mining, rail shipping and nuclear power industries for years.