It's a complex process.
Generally, if we find non-compliance, we ask the organization for a corrective action plan. If we found something wrong with their plan, they would have to come back to us and tell us how they're going to fix it. We also want them to look at the root cause of that failure; not only what the solution is, but also why they ended up with that situation in the first place, and what they are doing to improve their plan to make sure it doesn't happen again.
If we see continued non-compliance, or if the corrective action plan doesn't yield the results we hoped, we can then move to, as Mr. Eley pointed out, such things as enhanced monitoring, or to other enforcement actions, such as administrative monetary penalties.