Safety Governance, Management and Professional Ethics

Introduction

Electrical safety is not secured by technical rules alone. A correctly selected circuit-breaker, protective relay, earthing system or insulating barrier can still fail to protect people when responsibilities are unclear, workers are unprepared, contractors are uncontrolled, changes are poorly managed, or production pressure overrides sound judgement. Safety is therefore both an engineering discipline and a governance responsibility.

Safety governance is the system by which an organisation directs, controls and reviews its safety performance. It connects leadership decisions with field work through policy, accountability, competence requirements, risk controls, assurance processes and ethical standards. In electrical engineering, governance applies across design, construction, commissioning, operation, maintenance, modification, decommissioning and emergency response.

The central principle is that safety must be designed into organisational decisions rather than added after an incident. A mature organisation does not ask only, “Did an injury occur?” It also asks whether hazards were identified, whether controls were effective, whether workers could stop unsafe work, and whether weak signals were acted upon.

Learning objectives

By the end of this chapter, a student should be able to:

1. Explain the relationship between safety governance, safety management and technical risk control.
2. Design a safety-management arrangement involving policy, accountability, competence and assurance.
3. Evaluate contractor-control and management-of-change processes.
4. Select meaningful leading and lagging safety-performance indicators.
5. Apply ethical principles to reporting, public safety and production-versus-safety conflicts.
6. Analyse an electrical-safety case and recommend proportionate corrective actions.

1. Governance, management and assurance

Safety governance is concerned with direction and oversight. It answers questions such as:

• What level of risk is the organisation prepared to accept?
• Who has authority to make safety decisions?
• How are resources allocated?
• How does senior leadership know whether controls are working?
• How are legal and professional obligations monitored?

Safety management is the practical system used to implement those decisions. It includes hazard identification, risk assessment, safe operating procedures, training, permit-to-work systems, inspections, maintenance, incident investigation and emergency planning.

Safety assurance is the process of obtaining confidence that the management system is present, implemented and effective. Assurance may include audits, field observations, independent reviews, testing of protective devices and verification of competency.

These concepts are related but not identical. Governance without management produces policies that do not reach the workplace. Management without governance may produce fragmented procedures and unclear priorities. Both without assurance create an appearance of control without reliable evidence.

A useful governance cycle is:

Set direction → identify risk → allocate responsibility → implement controls → verify performance → learn and improve.

The cycle should operate at board, business-unit, project and work-team levels. It should also support worker participation, because employees and contractors often possess the most direct knowledge of changing hazards.

The hierarchy of controls

Electrical risk should be controlled using a hierarchy, with preference given to measures that do not depend heavily on individual behaviour:

1. Elimination: remove the hazardous electrical task or energy source.
2. Substitution: replace equipment or a process with a lower-risk alternative.
3. Engineering controls: isolation, interlocking, guarding, automatic disconnection, residual-current protection and remote operation.
4. Administrative controls: procedures, permits, scheduling, supervision, signs and training.
5. Personal protective equipment: arc-rated clothing, insulating gloves, face shields, helmets and safety footwear.

Personal protective equipment is important but is the least reliable level when used alone. For example, arc-rated clothing can reduce injury severity, but it does not eliminate the initiating fault or guarantee that a worker can withstand the incident energy.

2. Safety policy and organisational accountability

A safety policy should be brief enough to guide decisions and specific enough to be enforceable. It normally states that the organisation will:

• comply with applicable legislation, codes and technical standards;
• identify hazards and reduce risk so far as reasonably practicable;
• provide competent personnel, suitable equipment and adequate resources;
• consult workers and protect those who report hazards;
• investigate incidents and learn from weak signals;
• protect the public, the environment and affected communities; and
• continuously improve safety performance.

A policy is credible only when it is supported by decisions. If a policy promises that work will stop when controls are inadequate, supervisors must have the authority and resources to stop it without retaliation.

Allocation of responsibility

Responsibility should be assigned according to authority, competence and control. Senior leaders are accountable for the system and resources; managers translate policy into operating arrangements; supervisors control work execution; engineers provide technically sound designs and decisions; workers follow procedures, use controls and report deviations. Accountability does not remove the individual duty to act safely, but it prevents safety from becoming “everyone’s responsibility” and therefore nobody’s responsibility.

A responsibility matrix can clarify interfaces:

The matrix should be adapted to local law and organisational structure. “Accountable” means that one role owns the outcome; “responsible” means that a role performs or coordinates the work.

Just culture and accountability

A just culture distinguishes among human error, at-risk behaviour and reckless behaviour. Human error should normally lead to system improvement and coaching. At-risk behaviour may require removal of incentives, improved supervision or disciplinary action. Reckless disregard for a known and substantial risk may require formal sanctions. Treating all failures as individual misconduct suppresses reporting and leaves system weaknesses undiscovered.

3. Competence, authorization and human performance

Competence is more than attendance at a training course. It combines knowledge, practical skill, judgement and the ability to apply them under actual working conditions. Electrical competence is task-specific: a person qualified to operate low-voltage equipment may not be competent to work on high-voltage switchgear, protection systems or live conductors.

A robust competence system includes:

1. Role analysis: identify hazards, tasks and decisions associated with each role.
2. Qualification requirements: specify education, licensing and experience.
3. Practical assessment: observe performance in realistic conditions.
4. Authorization: define exactly what work a person may perform and under whose supervision.
5. Refresher and change training: reassess competence after incidents, equipment changes or extended absence.
6. Records: retain evidence of qualifications, assessments and expiry dates.

Competency should include non-technical skills such as communication, questioning attitude, fatigue management, handover quality and recognition of authority gradients. Many electrical incidents occur not because a worker cannot identify a cable, but because a test result was assumed, a change was not communicated, or a supervisor accepted an incomplete isolation.

A safe work authorization should specify the equipment boundary, energy sources, isolation points, test requirements, permitted activities, responsible person, time limits and conditions for suspension. Authorization is not a substitute for a safe system of work; it is one part of it.

4. Contractor and supply-chain control

Contractors may bring specialist competence, but contracting work does not transfer the principal organisation’s duty to manage risk. The host organisation controls the site, interfaces, emergency arrangements and often the operating information needed for safe work.

Contractor governance should begin before contract award. Prequalification can examine:

• relevant licenses and technical competence;
• safety performance and enforcement history;
• supervision arrangements;
• equipment inspection and maintenance;
• insurance and emergency capability; and
• evidence that workers understand the required language and procedures.

Prequalification should not be reduced to a low injury-rate score. A contractor with few reported injuries may have weak reporting rather than strong performance.

The contract should define technical scope, safety standards, responsibilities, stop-work authority, permit arrangements, incident notification, design changes, competency evidence and audit rights. On mobilisation, the contractor should receive site induction and information about electrical boundaries, arc-flash hazards, isolation points, buried services, emergency contacts and simultaneous operations.

During work, effective control requires coordination meetings, permit verification, field inspections, clear handovers and control of subcontractors. At completion, the host should verify test results, as-built drawings, protective-device settings, labels, temporary equipment removal and outstanding defects.

5. Management of change

Change is a major source of electrical risk because existing procedures and assumptions may no longer be valid. Changes may involve equipment, software, protection settings, voltage level, personnel, work methods, contractors, operating load, legislation or organisational structure.

A management-of-change process should answer:

1. What is changing, and why?
2. Which hazards and energy pathways could be affected?
3. What technical studies or calculations are required?
4. Do protection settings, short-circuit ratings, coordination or arc-flash boundaries remain valid?
5. Are drawings, labels, procedures and training updated?
6. Who approves the change?
7. How will the change be tested and reviewed after implementation?

Temporary changes require the same discipline as permanent changes. A temporary generator, bypassed interlock or altered relay setting can create severe risk precisely because personnel assume that the original design remains in force.

A practical classification is:

The process should prevent “change by drift,” in which many small modifications cumulatively invalidate the original risk assessment.

6. Performance measurement and key indicators

Measurement influences behaviour. If an organisation rewards only output and counts only lost-time injuries, workers may conceal minor events, defer maintenance or avoid reporting hazards. A balanced dashboard combines leading indicators, lagging indicators and qualitative evidence.

Leading indicators measure preventive activity or control health. Examples include:

• percentage of critical protective devices tested on schedule;
• percentage of high-risk work observed in the field;
• overdue corrective actions;
• competency assessments completed before authorization;
• quality of permit and isolation audits;
• hazard reports closed within the agreed time; and
• percentage of management-of-change reviews completed before implementation.

Lagging indicators measure outcomes after a failure. Examples include fatalities, electric shocks, arc-flash events, fires, unplanned trips, property damage and regulatory notices. Lagging indicators are important but insufficient: severe incidents are relatively rare, so their absence does not prove that risk is controlled.

Indicators require definitions and denominators. A rate can be expressed as:

Here, exposure hours are the hours worked or another defined exposure measure, and K is a chosen constant such as 200,000 or 1,000,000. The same definition and constant must be used when comparing periods. Rates should not be interpreted without considering workforce size, task mix, reporting quality and severity.

A strong dashboard also tests the quality of controls. For example, “100% of permits completed” is weak evidence if field sampling shows that isolations were not independently verified. Therefore, quantitative indicators should be supplemented with assurance findings and worker feedback.

7. Assurance, auditing and learning

Assurance operates at several levels. Line management performs routine inspections and reviews. Specialist functions examine technical compliance and competence. Independent assurance tests whether internal reporting is reliable and whether major hazards are adequately controlled.

An audit should have a defined scope, criteria, evidence method and follow-up process. It should examine both documents and actual conditions. A procedure may state that absence of voltage is tested, while field observation reveals that test instruments are not checked before and after use. The difference between written and performed work is a critical assurance finding.

Incident investigation should seek causal relationships rather than a single blameworthy action. Useful questions include:

• What happened and what energy was released?
• Which barriers should have prevented the event?
• Which barriers failed or were absent?
• What information, workload, design or supervision influenced decisions?
• Why was the unsafe condition not detected earlier?
• What corrective action will prevent recurrence, and how will effectiveness be verified?

Corrective actions should follow the hierarchy of controls. “Retrain the worker” may be appropriate, but it is weak when the underlying problem is an inaccessible isolator, ambiguous labelling, inadequate design review or unrealistic production scheduling.

8. Professional ethics and public safety

Electrical engineers owe duties to employers and clients, but those duties are limited by obligations to human life, public safety, the environment and professional integrity. Common ethical principles include competence, honesty, independence of judgement, confidentiality subject to public interest, fairness and avoidance of conflicts of interest.

Ethical reporting

A professional who discovers a serious electrical hazard should first ensure immediate protection where possible, then report through the defined chain. The report should be factual, timely and sufficiently detailed to support action. It should distinguish observed evidence from assumptions.

If internal escalation fails and serious danger remains, the professional may need to use higher management, an independent compliance function, a regulator or another lawful reporting channel. Whistleblowing should not be the first response to a minor disagreement, but neither should organisational loyalty be used to suppress credible evidence of public danger.

Records must not be falsified. Signing a test certificate without witnessing the test, approving incomplete commissioning evidence or altering an incident record is both an ethical failure and potentially a legal offence.

Public safety and environmental responsibility

The public may be exposed to overhead lines, substations, construction sites, electric-vehicle infrastructure, damaged cables and poorly maintained installations. Public protection requires physical security, clear warnings, access control, reliable inspection and rapid response to defects.

Environmental obligations include preventing oil and chemical releases, managing batteries and contaminated materials, reducing fire risk, controlling electromagnetic or noise impacts where relevant, and disposing of electrical and electronic waste through approved systems. Environmental harm can also become a safety issue: a transformer fire, battery thermal runaway or contaminated site may endanger workers and communities.

Production versus safety

Conflicts often arise when a shutdown threatens delivery or revenue. Ethical decision-making should not treat safety as an unlimited veto against all production, but it must recognize that exposing people to uncontrolled serious risk is unacceptable. A structured decision can ask:

1. What is the credible worst-case consequence?
2. Which controls are available immediately?
3. Can work be redesigned, isolated, slowed or rescheduled?
4. Who is exposed, including the public and contractors?
5. Is the decision consistent with law, professional duty and stated policy?
6. Who has authority to accept any residual risk?

Cost and schedule may influence the choice among safe alternatives, but they should not justify bypassing mandatory controls or concealing risk. A worker’s stop-work decision should be protected when based on a reasonable safety concern.

9. Technology and contemporary developments

Digital systems can strengthen governance through computerized maintenance management systems, electronic permits, remote condition monitoring, asset databases and dashboards. Sensors may identify overheating, partial discharge, insulation deterioration or abnormal load before failure.

Artificial intelligence can support anomaly detection, document review and prioritization of maintenance. However, AI outputs are not automatically authoritative. Models may be trained on incomplete data, reproduce historical bias, miss novel failure modes or generate confident but incorrect recommendations. Safety-critical decisions require competent human review, traceable data, validation, cybersecurity controls and clear responsibility for final approval.

Connected electrical assets also create cybersecurity concerns. Unauthorized access to protection, control or building-management systems can cause physical harm. Governance should therefore integrate cybersecurity with electrical safety, including access control, network segregation, patch management, backup, incident response and change approval.

10. Illustrative case: production pressure and an altered protection system

Background

A manufacturing plant experiences repeated nuisance trips on a medium-voltage feeder supplying a production line. A contractor proposes increasing a relay pickup setting so production can continue. The change is made during a night shift, but the short-circuit study, coordination review and arc-flash assessment are not updated.

Problem

The higher setting prevents nuisance tripping but reduces the sensitivity of protection for some faults. Operators are not informed, the relay change is not entered in the configuration register, and the contractor’s authorization expires at the end of the shift.

Analysis

The immediate problem is a technical protection change. The deeper governance failures include inadequate management of change, weak contractor control, poor shift handover, production pressure and absence of independent verification. The organisation has also created an ethical problem: personnel who later sign the commissioning record would be representing incomplete evidence as complete.

Approach and solution

The plant should first place the feeder in a controlled condition and determine whether continued operation is safe. A competent protection engineer should review fault levels, relay curves, coordination, equipment withstand ratings and arc-flash consequences. The original nuisance trips should be investigated rather than merely suppressed. Possible solutions might include repairing the initiating defect, revising coordination throughout the protection scheme, installing suitable equipment or changing operating conditions.

The change should be processed formally, with documented approval, tested settings, independent verification, updated labels and drawings, operator communication and a defined review date. Contractor access and authorization should be checked. If production must stop to restore a safe configuration, management should record the decision as a safety-critical operational decision rather than encouraging informal workarounds.

Outcome

In this illustrative case, the review identifies a deteriorated cable termination as the source of the nuisance trips. Repairing it allows the original settings to be restored. A post-event audit also reveals that several temporary changes were not recorded. The organisation introduces electronic change approval, a two-person verification of protection settings and a rule that no production target can override an unverified protection change.

Learning points

• A successful short-term operational result may conceal increased major-accident risk.
• Protection settings are safety-critical configuration data.
• Technical competence must be combined with authorization and governance.
• Corrective action should address system weaknesses, not only individual behaviour.
• Ethical reporting is essential when records and actual conditions diverge.

Challenges and limitations

Safety-management systems can become bureaucratic. Excessive forms may encourage superficial compliance, while too little documentation prevents traceability. Indicators can be gamed, audits can become predictable, and policies can be copied without reflecting actual risk. Organisations also face uncertainty: not every failure mode is known, and rare catastrophic events provide limited statistical evidence.

These limitations require professional judgement. Procedures should be proportionate to risk, assurance should include field reality, workers should be invited to challenge assumptions, and leaders should examine inconvenient information. Safety maturity is demonstrated not by the absence of bad news but by the ability to discover, discuss and control it.

Best-practice principles

1. Make safety policy visible in resource and scheduling decisions.
2. Assign one accountable owner for each safety-critical outcome.
3. Authorize people for defined tasks, equipment and conditions.
4. Treat contractors as part of the operational system, not as a separate safety universe.
5. Review temporary and permanent changes before implementation.
6. Combine leading indicators, lagging indicators and qualitative assurance.
7. Verify controls in the field, not only in documents.
8. Protect good-faith reporting and stop-work decisions.
9. Use technical independence when production interests may bias judgement.
10. Link corrective actions to the hierarchy of controls and verify their effectiveness.

Chapter Summary

Safety governance establishes direction, accountability and oversight; safety management implements controls; and assurance tests whether those controls work in practice. Effective electrical-safety arrangements require a clear policy, defined responsibilities, competent and authorized personnel, disciplined contractor control, formal management of change, balanced performance indicators and independent verification.

Professional ethics extends beyond compliance. Electrical engineers must report credible hazards, protect the public and environment, maintain truthful records and resist unsafe production pressure. Technical solutions such as protective devices and isolation systems are essential, but their reliability depends on organisational decisions, human performance and governance. Mature safety systems learn from weak signals, distinguish human error from reckless conduct, and continually improve the barriers that prevent harm.

Key Terms

Safety governance: Direction, accountability and oversight of safety performance.

Safety management system: Organisational processes used to identify and control risk.

Safety assurance: Evidence-based verification that safety controls are present and effective.

Accountability: Ownership of an outcome and authority to ensure it is achieved.

Responsibility: Duty to perform or coordinate an assigned activity.

Hierarchy of controls: Preferred order for reducing risk from elimination to personal protective equipment.

Competence: Combination of knowledge, skill, experience and judgement for a defined task.

Authorization: Formal permission to perform specified work under defined conditions.

Contractor control: Processes for selecting, integrating, supervising and evaluating contractors.

Management of change: Structured review of risks arising from technical, organisational or operational change.

Leading indicator: Measure of preventive activity or control condition.

Lagging indicator: Measure of an outcome after an unwanted event.

Assurance audit: Systematic examination against defined criteria.

Just culture: Approach that distinguishes error, at-risk behaviour and reckless conduct.

Stop-work authority: Power to suspend work when controls are inadequate.

Residual risk: Risk remaining after controls are applied.

Professional ethics: Principles governing truthful, competent and socially responsible professional conduct.

Protection coordination: Arrangement of protective devices so the appropriate device operates for a fault.

Review Questions

Short Answer Questions

1. Distinguish safety governance, safety management and safety assurance.
2. Why is personal protective equipment considered the least reliable level in the hierarchy of controls?
3. List four elements that should be included in a competence-management system.
4. What is the difference between a leading and a lagging safety indicator?
5. Why should temporary electrical changes be subject to management of change?

Long Answer Questions

1. Explain how an organisation can translate a safety policy into accountability at senior-management, engineering, supervisory and worker levels.
2. Describe a complete contractor-control process from prequalification through demobilisation.
3. Discuss how a just culture can improve reporting while maintaining accountability for reckless conduct.
4. Explain why safety indicators should combine quantitative measures with field assurance and worker feedback.
5. Discuss the ethical duties of an electrical engineer who discovers that a safety-critical test record is inaccurate.

Analytical / Application Questions

1. A supervisor wants to bypass an interlock for two hours to meet a delivery deadline. Analyse the technical, governance and ethical issues, and recommend a defensible course of action.
2. A plant has no recordable injuries for two years but has increasing overdue maintenance, declining hazard reports and repeated protection-system alarms. Evaluate whether its safety performance is improving and propose indicators for the next management review.
3. A contractor changes a medium-voltage relay setting without updating drawings or informing operators. Develop a management-of-change response that addresses immediate protection, technical verification, authorization, communication and organisational learning.

Multiple Choice Questions with Answers

Question 1

Which function primarily provides direction, accountability and oversight for safety?

A. Safety governance

B. Routine equipment cleaning

C. Personal protective equipment

D. Individual fault finding

Correct Answer: A. Safety governance

Question 2

Which control is highest in the hierarchy of controls?

A. Warning signage

B. Insulating gloves

C. Elimination of the hazard

D. Worker refresher training

Correct Answer: C. Elimination of the hazard

Question 3

What is the principal purpose of management of change?

A. To reduce the number of safety meetings

B. To assess risks introduced by technical or organisational changes

C. To transfer all safety duties to contractors

D. To replace all existing operating procedures

Correct Answer: B. To assess risks introduced by technical or organisational changes

Question 4

Which is a leading safety indicator?

A. Number of electric-shock injuries

B. Number of fatalities

C. Percentage of critical protective devices tested on schedule

D. Value of damage after an electrical fire

Correct Answer: C. Percentage of critical protective devices tested on schedule

Question 5

Why is contractor prequalification based only on injury rates inadequate?

A. Injury rates are never measurable

B. Low rates may reflect under-reporting rather than effective control

C. Contractors do not need safety records

D. Injury rates measure equipment voltage

Correct Answer: B. Low rates may reflect under-reporting rather than effective control

Question 6

A person authorized to operate low-voltage equipment should automatically be considered competent to work on high-voltage switchgear. Is this conclusion correct?

A. Yes, because all electrical work is identical

B. Yes, if the person has used personal protective equipment

C. No, because competence and authorization are task- and system-specific

D. No, because no person can work on high-voltage equipment

Correct Answer: C. No, because competence and authorization are task- and system-specific

Question 7

What is the most ethical response when a professional discovers a serious electrical hazard that remains uncorrected after internal escalation?

A. Delete the evidence to protect the organisation

B. Use an appropriate higher or external lawful reporting channel

C. Ignore it unless an injury occurs

D. Sign the safety certificate anyway

Correct Answer: B. Use an appropriate higher or external lawful reporting channel

Question 8

Which statement best describes safety assurance?

A. It verifies whether safety controls are implemented and effective

B. It guarantees that incidents are impossible

C. It replaces engineering design

D. It focuses only on disciplinary action

Correct Answer: A. It verifies whether safety controls are implemented and effective

Question 9

What should be the first governance response to an undocumented protection-setting change?

A. Accept it if production improved

B. Delete the change from the configuration record

C. Place the system in a controlled condition and perform competent technical review

D. Increase the setting again

Correct Answer: C. Place the system in a controlled condition and perform competent technical review

Question 10

Why should AI recommendations in safety-critical electrical applications receive competent human review?

A. AI systems always require internet access

B. AI may use incomplete data or fail to recognize novel conditions

C. Human review makes testing unnecessary

D. AI cannot process numerical information

Correct Answer: B. AI may use incomplete data or fail to recognize novel conditions