Risk Control and Safe Work Systems

Introduction

Occupational health and safety management is not achieved merely by identifying hazards. Its central professional task is to control risk in ways that are reliable, proportionate, legally defensible, and compatible with productive work. Risk control therefore connects technical safety practice with managerial decision-making, worker participation, procurement, human-resource systems, contractor governance, and organizational learning.

A safe work system is an integrated set of policies, equipment, procedures, competencies, supervision, communication arrangements, and monitoring activities designed to ensure that work is performed within acceptable risk boundaries. It is more than a written procedure. A procedure may describe the intended method, whereas a safe work system also ensures that the method is feasible, resourced, understood, followed, checked, and improved.

For HR professionals, this subject is particularly important because many controls depend on recruitment, training, competence assessment, consultation, staffing, fatigue management, performance management, reporting culture, and the design of work. HR managers also help prevent a common organizational failure: treating safety as the responsibility of a specialist department while operational decisions continue to create uncontrolled hazards.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Apply the hierarchy of controls to workplace hazards.
2. Distinguish engineering, administrative, and personal protective equipment controls.
3. Design and evaluate permits to work and lockout/tagout systems.
4. Conduct a job safety analysis and convert findings into usable controls.
5. Establish effective controls for contractors and outsourced work.
6. Apply management of change to equipment, processes, people, and organizational arrangements.
7. Evaluate the strengths and limitations of risk assessment and safe work systems.
8. Integrate worker participation, assurance, ethics, and continuous improvement into risk control.

1. From Hazard Identification to Risk Control

A hazard is a source or situation with the potential to cause injury, ill health, property damage, environmental harm, or operational loss. Risk is the combination of the likelihood that harm will occur and the severity of that harm. These concepts must not be confused: removing a hazard eliminates its associated exposure, whereas reducing risk usually lowers either exposure likelihood, consequence, or both.

Risk assessment is a decision-support process, not a substitute for action. A simple qualitative model is:

Here, R is a relative risk score, L is a likelihood category, and S is a severity category. The model is appropriate only when the organization has clearly defined scales and applies them consistently. It does not produce a probability of injury unless the likelihood scale has been empirically calibrated. Multiplication is a prioritization convention, not a universal law of risk.

For example, if a team rates likelihood as 4 on a five-point scale and severity as 5 on a five-point scale, the score is:

A score of 20 may trigger urgent action under one organization's matrix, but the same number has no meaning without the matrix definitions and decision rules. High-consequence, low-frequency events require special attention because a low estimated likelihood must not justify weak controls where credible catastrophic outcomes exist.

Effective risk control follows a logical sequence:

1. Define the task, people, equipment, materials, and environment.
2. Identify hazards and exposed persons.
3. Determine how harm could occur.
4. Select controls using the hierarchy of controls.
5. Implement controls before work begins.
6. Verify that controls are present and effective.
7. Monitor conditions and revise controls when circumstances change.

2. The Hierarchy of Controls

The hierarchy of controls ranks control strategies by their typical reliability and independence from human behavior. It is a decision framework, not a rigid rule that prohibits lower-level controls. Multiple layers are often necessary, but lower-level controls should not be used to compensate for a failure to consider higher-level solutions.

2.1 Elimination

Elimination is generally the most reliable control because it removes the exposure pathway. Examples include eliminating work at height through ground-level assembly, eliminating manual lifting through redesign, or eliminating a hazardous chemical from a process. Elimination is often most economical during design, procurement, and capital planning. Once a facility has been built, removing a hazard may be technically or financially difficult, but it should still be considered during redesign and replacement decisions.

2.2 Substitution

Substitution replaces a hazard with a lower-risk alternative. The replacement must be assessed across its full life cycle. A solvent with lower acute toxicity may create greater fire risk; a lighter material may generate more dust; an automated process may introduce stored energy. Substitution therefore requires comparative assessment rather than assuming that a new product is safe because it is marketed as “green,” “natural,” or “non-toxic.”

2.3 Engineering Controls

Engineering controls change the physical design of the workplace or equipment. Examples include fixed guards, interlocks, machine enclosures, isolation systems, ventilation, noise barriers, ergonomic redesign, automatic shut-offs, and remote operation.

Engineering controls are usually more dependable than administrative controls because they do not require workers to remember every instruction at every moment. Nevertheless, they can fail through poor design, bypassing, inadequate maintenance, unsuitable installation, or changes in the process. A guard that is removed for maintenance but not replaced illustrates the difference between a control existing on paper and a control functioning in practice.

Engineering design should consider:

• foreseeable misuse and human error;
• access for cleaning, maintenance, and inspection;
• failure modes and safe states;
• compatibility with production requirements;
• alarm visibility and audibility;
• maintenance and testing requirements; and
• interaction with other equipment and contractors.

2.4 Administrative Controls

Administrative controls modify behavior, work organization, or information. They include safe operating procedures, competency requirements, job rotation, exposure time limits, scheduling, supervision, signage, training, inspections, emergency plans, and pre-task briefings.

Administrative controls are essential but vulnerable to production pressure, turnover, language differences, fatigue, normalization of deviance, and procedural overload. A procedure cannot control risk if workers cannot access it, understand it, or perform it under actual operating conditions. Documents should therefore be task-specific, concise enough to use, and validated by competent workers who perform the job.

2.5 Personal Protective Equipment

PPE is the last line of defense. It is valuable when hazards cannot be eliminated or adequately controlled by other means, during non-routine work, and as supplementary protection. PPE programs require hazard assessment, correct selection, fit, compatibility, training, inspection, cleaning, storage, replacement, and enforcement.

PPE has important limitations. It may fail through poor fit, incorrect use, damage, discomfort, incompatibility, or failure to wear it. Respiratory protection, for example, requires selection for the contaminant, concentration, oxygen conditions, work rate, and duration. A respirator does not make an oxygen-deficient atmosphere safe unless it is specifically designed and approved for that condition; ordinary air-purifying respirators cannot supply oxygen.

3. Designing Safe Work Systems

A safe work system aligns four elements: the physical work environment, the work design, the people performing the work, and the organization that governs the work. It should answer five questions:

1. What can cause harm?
2. What controls prevent or limit the harm?
3. Who is responsible for each control?
4. How is control performance verified?
5. What happens when conditions differ from the plan?

3.1 Job Safety Analysis

A job safety analysis (JSA), also called a job hazard analysis, decomposes a task into logical steps, identifies hazards at each step, and specifies controls. The objective is not to list every imaginable danger. It is to identify credible hazards and define controls that workers can apply.

A practical JSA process is:

1. Select a task, particularly one that is new, high-risk, frequently performed, or associated with incidents.
2. Assemble a competent team including workers who perform the task.
3. Break the task into observable steps without making the list excessively detailed.
4. Identify hazards, energy sources, exposure routes, and potential consequences.
5. Select controls using the hierarchy.
6. Assign responsibility and define verification requirements.
7. Communicate the JSA through briefing and, where appropriate, field demonstration.
8. Review it after incidents, near misses, process changes, or significant deviations.

A JSA should not become a paper ritual. If the documented sequence differs from actual work, the gap is evidence that the system requires redesign, not simply more discipline from workers.

3.2 Safe Operating Procedures and Critical Controls

Safe operating procedures describe normal work, while critical-control standards identify controls whose failure could produce fatal or catastrophic outcomes. Critical controls should be specific, observable, and verifiable. “Work safely” is not a critical-control standard. “Guard interlock tested before operation and prevents machine start when guard is open” is more useful.

Organizations should distinguish between leading indicators, such as completed control-verification checks, and lagging indicators, such as injury rates. A low injury rate may reflect effective prevention, underreporting, limited exposure, or chance. Consequently, assurance should examine whether controls are actually functioning rather than relying only on injury statistics.

4. Permits to Work

A permit to work is a formal authorization system for hazardous or non-routine work. It establishes what work is allowed, where and when it may occur, hazards and precautions, responsible persons, required isolations, atmospheric tests, interfaces with other work, and conditions for suspension or close-out.

Common permit categories include hot work, confined-space entry, electrical work, excavation, line breaking, work at height, and energy isolation. A permit does not make unsafe work safe. It is an administrative coordination and authorization tool that must be supported by physical controls.

A robust permit process includes:

• clear scope and work location;
• identification of hazards and simultaneous operations;
• confirmation of competence and authorization;
• required isolations and testing;
• atmospheric monitoring where applicable;
• emergency and rescue arrangements;
• start, expiry, suspension, and handover rules;
• field verification by an authorized person; and
• formal closure and restoration of the workplace.

Permits can fail through “permit fatigue,” copying old information, unclear authority, excessive complexity, or treating a signed form as proof that controls exist. Digital permits may improve traceability and coordination, but digitization does not correct poor hazard analysis. Permit systems should be audited in the field, not only reviewed for completion rates.

5. Lockout/Tagout and Control of Hazardous Energy

Lockout/tagout (LOTO) prevents unexpected energization, start-up, or release of hazardous energy during servicing and maintenance. Energy may be electrical, mechanical, hydraulic, pneumatic, thermal, chemical, gravitational, radiation-related, or stored in capacitors, springs, elevated loads, or pressurized systems.

A generic LOTO sequence is:

1. Prepare: identify all energy sources and the authorized workers.
2. Notify affected employees.
3. Shut down equipment using the normal stopping procedure.
4. Isolate every energy source using appropriate disconnecting devices.
5. Apply personal locks and tags.
6. Release, restrain, or block stored energy.
7. Verify isolation using an appropriate test, including a try-start where safe and a return-to-service check for test instruments.
8. Perform the work.
9. Inspect the area, reinstall guards, account for tools and personnel, and confirm readiness.
10. Remove locks according to the authorized procedure and notify affected employees before re-energization.

The principle is that each authorized worker controls their own personal lock. Group lockout requires a clearly governed system in which every worker has equivalent personal protection. Tags alone generally communicate a warning but do not physically prevent operation; their use must comply with applicable law and the organization's energy-control standard.

The most serious LOTO failures arise from incomplete energy inventories, inadequate verification, shared keys, unauthorized removal of locks, unclear shift handover, and confusing control-circuit isolation with isolation of the energy itself.

6. Contractor and Interface Controls

Contractors may bring specialized competence, but they also create interface risks. The host organization controls the workplace, while the contractor controls aspects of its work. Neither party can safely transfer all responsibility to the other.

A contractor-management system should include:

1. Prequalification based on relevant competence, supervision, safety performance, resources, and legal compliance.
2. Clear contractual allocation of responsibilities without attempting to contract away statutory duties.
3. Exchange of hazard information before work begins.
4. Verification of licenses, training, medical fitness where lawful and relevant, and equipment condition.
5. Site induction and task-specific orientation.
6. Permit, isolation, emergency, and communication arrangements.
7. Coordination of simultaneous operations.
8. Field supervision and assurance proportional to risk.
9. Incident and near-miss reporting covering both host and contractor personnel.
10. Performance review and corrective action at completion.

Contractor selection based solely on the lowest price can create unsafe incentives. Conversely, demanding excessive documentation without field verification creates administrative burden without effective control. Procurement, HR, operations, and safety functions should jointly define proportionate requirements.

7. Management of Change

Management of change (MOC) is a structured process for evaluating and controlling risk before a change is introduced. Changes may involve equipment, chemicals, software, production rates, staffing, organizational structure, work schedules, suppliers, procedures, or regulatory requirements. Temporary changes deserve the same discipline as permanent changes because they are often poorly documented and may persist indefinitely.

An effective MOC process asks:

• What is changing and why?
• Which hazards, energy sources, exposures, and interfaces may change?
• Does the change alter emergency response or maintenance requirements?
• Are new competencies, staffing levels, or supervision needed?
• Do procedures, drawings, training, permits, and PPE requirements require revision?
• Has the workforce participated in the assessment?
• Who authorizes implementation, and what conditions must be met?
• How will the change be commissioned, monitored, and closed?

A useful distinction is between replacement-in-kind and substantive change. Replacing a component with one having identical specifications may be replacement-in-kind; replacing it with a different material, capacity, control logic, or operating range may require MOC. Organizations should define this distinction carefully to avoid both under-control and unnecessary bureaucracy.

MOC is closely related to organizational change. A reduction in staffing, increased overtime, remote supervision, or altered reporting lines can change risk even when no machine is modified. HR data and workforce consultation are therefore essential inputs to MOC.

8. Human Factors, Participation, and Organizational Culture

Controls operate through human activity, so human factors must be designed into the system. Relevant factors include workload, fatigue, attention, usability, language, literacy, interfaces, alarm design, competence, incentives, and social pressure.

Worker participation improves hazard recognition because workers possess practical knowledge about variability, workarounds, equipment behavior, and the effects of production demands. Participation should be meaningful: workers need access to information, time to contribute, protection from retaliation, and feedback about how their concerns were handled.

A just and learning-oriented culture distinguishes human error, at-risk behavior, and reckless behavior. This does not mean ignoring accountability. It means examining whether system design, training, supervision, equipment, incentives, and workload made the unsafe action more likely. Disciplining workers for bypassing a guard while rewarding the production achieved through that bypass is ethically and operationally inconsistent.

9. Applied Case: Solvent Transfer in a Manufacturing Plant

Background

The following is an illustrative case. A manufacturing plant transfers a flammable solvent from drums to a blending vessel. Operators report strong odors, occasional spills, and difficulty reading the drum labels. Contractors perform periodic pump maintenance.

Problem

The initial risk assessment recommends gloves, goggles, training, and a warning sign. A near miss occurs when a hose disconnects under pressure. Investigation identifies several weaknesses: the transfer pump has no automatic shut-off, the hose coupling is incompatible with one drum type, bonding is inconsistently applied, and maintenance personnel do not use a formal energy-isolation procedure.

Analysis

The original assessment over-relied on PPE and administrative controls. The hazard pathway includes flammable vapor, chemical contact, static ignition, pressure, and stored energy. The team conducts a JSA with operators, maintenance personnel, engineering, and the contractor supervisor.

Approach and Solution

The revised controls are:

• substitute a less hazardous solvent where product quality permits;
• install a closed transfer system with compatible keyed couplings;
• add level detection and automatic pump shut-off;
• provide local exhaust ventilation at the connection point;
• establish bonding and grounding verification;
• create a hot-work and line-breaking permit process;
• implement LOTO for pump maintenance, including pressure release and electrical isolation;
• revise labeling and chemical information in languages understood by the workforce;
• train and assess operators through practical demonstration;
• prequalify the maintenance contractor and coordinate isolations;
• verify critical controls through field inspections.

Outcome

The plant records fewer spills and odor complaints, but management recognizes that improvement cannot be inferred solely from the absence of injury. It therefore tracks coupling inspection, shut-off testing, ventilation checks, isolation verification, near-miss reporting, and worker feedback. A later change to pump capacity triggers MOC rather than being treated as routine maintenance.

Learning Points

The case demonstrates that effective control requires a layered system. PPE remains necessary, but it is not the primary solution. It also shows why contractor controls, LOTO, JSA, permits, engineering design, and MOC must operate as connected processes rather than isolated forms.

10. Governance, Ethics, and Contemporary Practice

Safety governance requires clear accountability from the board or senior leadership to frontline supervision. Leaders should allocate resources, set realistic production expectations, review critical-control performance, and ensure that workers can report hazards without retaliation. Compliance is a baseline, not the entire definition of responsible safety management. Organizations should also consider dignity, privacy, fairness, accessibility, and the protection of vulnerable workers.

Technology can support risk control through digital permits, sensor-based monitoring, proximity alerts, computer vision, wearable devices, and predictive analytics. However, technology introduces privacy, surveillance, cybersecurity, bias, and reliability concerns. An AI system that predicts risk from historical incident data may reproduce underreporting or discriminatory work allocation. Automated alerts can also create alarm fatigue. Human review, transparent governance, validation, and a clear statement of system limitations are essential.

Contemporary practice increasingly emphasizes resilience: the capacity to anticipate, monitor, respond, and learn under variable conditions. Resilience does not mean accepting unsafe variability. It means designing systems that remain safe when demand changes, equipment degrades, staffing fluctuates, or unexpected events occur.

Challenges and Limitations

Risk-control programs commonly encounter the following challenges:

• economic pressure to prioritize short-term output;
• excessive reliance on PPE and training;
• poorly designed or unreadable procedures;
• weak participation by workers and contractors;
• incomplete energy inventories;
• temporary changes that become permanent;
• conflicting responsibilities at organizational interfaces;
• measurement focused on injury counts alone;
• normalization of deviations from the safe method; and
• digital systems that document activities without improving control quality.

The remedy is not simply more rules. Organizations should simplify where possible, strengthen high-value engineering controls, test critical controls in the field, learn from near misses and normal work, and integrate safety into design, procurement, staffing, maintenance, and performance management.

Best-Practice Checklist

A mature safe work system generally:

• applies elimination and substitution before relying on PPE;
• uses competent workers and supervisors in risk assessment;
• identifies critical controls and verifies them visibly;
• treats permits as authorization and coordination systems, not paperwork;
• isolates all hazardous energy and verifies zero-energy conditions;
• manages contractor and host interfaces jointly;
• reviews changes before implementation;
• includes workers in design and evaluation;
• measures both control performance and outcomes; and
• learns from success, failure, near misses, and work-as-done.

Chapter Summary

Risk control is the practical core of occupational health and safety management. The hierarchy of controls prioritizes elimination, substitution, engineering controls, administrative controls, and PPE, while recognizing that layered controls are often necessary. Engineering controls generally provide more reliable protection than controls dependent on memory or compliance, but they require sound design, maintenance, and verification.

Safe work systems connect hazard assessment with procedures, competence, supervision, permits, energy isolation, contractor management, and management of change. JSAs translate tasks into observable steps and controls. Permit-to-work systems coordinate hazardous non-routine work but cannot replace physical safeguards. LOTO protects workers from unexpected energization and requires complete energy identification, isolation, release of stored energy, and verification. Contractor safety depends on shared information and coordinated control rather than contractual transfer of responsibility. MOC ensures that changes in technology, processes, staffing, suppliers, and organization do not introduce unmanaged risk.

Graduate-level practice requires critical judgment: risk scores are decision aids rather than objective measurements, injury statistics are incomplete indicators, and digital or AI tools must be governed ethically. Effective safety management is therefore a socio-technical activity involving design, leadership, worker participation, organizational learning, and continuous assurance.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and severity of harm.

Hierarchy of controls: A ranked framework for selecting risk controls from elimination to PPE.

Elimination: Removal of the hazard or exposure.

Substitution: Replacement of a hazard with a less hazardous alternative.

Engineering control: A physical or technical measure that isolates people from a hazard.

Administrative control: A work rule, procedure, schedule, training activity, or organizational measure that changes how work is performed.

Personal protective equipment: Equipment worn or used by a person to reduce exposure to a hazard.

Job safety analysis: A systematic decomposition of a task into steps, hazards, and controls.

Permit to work: Formal authorization and coordination for specified hazardous work.

Lockout/tagout: A process for isolating and controlling hazardous energy during servicing.

Stored energy: Energy retained in equipment after normal shutdown, such as pressure, heat, gravity, or electrical charge.

Critical control: A control whose failure could result in fatality or catastrophic harm.

Contractor management: The process of selecting, coordinating, supervising, and evaluating external work providers.

Management of change: A formal process for assessing and controlling risks arising from change.

Human factors: The interaction of people with tasks, equipment, environments, and organizational systems.

Leading indicator: A measure of preventive activity or control performance.

Lagging indicator: A measure of an outcome that has already occurred, such as an injury.

Worker participation: Meaningful involvement of workers in safety decisions and improvement.

Review Questions

Short Answer Questions

1. What is the main purpose of the hierarchy of controls?
2. Why is PPE considered the last line of defense?
3. What is the difference between a hazard and a risk?
4. Identify four essential steps in a lockout/tagout process.
5. Why should temporary changes be included in management of change?

Long Answer Questions

1. Explain each level of the hierarchy of controls and discuss its relative reliability.
2. Describe how a permit-to-work system should be designed for confined-space entry.
3. Explain the relationship among JSA, safe operating procedures, critical controls, and field verification.
4. Analyze the responsibilities of a host organization and a contractor in managing workplace risk.
5. Discuss how HR policies concerning staffing, competence, fatigue, and performance incentives can affect safety controls.

Analytical / Application Questions

1. A warehouse plans to replace manual pallet movement with powered vehicles. Apply the hierarchy of controls and identify hazards that may be introduced by the change. Explain how MOC should be used.
2. A maintenance worker is injured after a machine starts unexpectedly while a contractor is repairing it. Analyze the likely LOTO failures and design a corrective system.
3. A plant has excellent PPE-compliance records but recurring chemical exposures. Critically evaluate what this suggests about its risk-control strategy and recommend improvements.

Multiple Choice Questions with Answers

Question 1

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Elimination

D. Warning sign

Correct Answer: C. Elimination

Question 2

A risk score is calculated as R = L × S. If likelihood is rated 3 and severity is rated 4, what is the relative score?

A. 7

B. 12

C. 1

D. 34

Correct Answer: B. 12

Question 3

Which statement best describes a permit to work?

A. It replaces the need for engineering controls

B. It is formal authorization and coordination for specified hazardous work

C. It guarantees that an incident cannot occur

D. It is used only for routine office tasks

Correct Answer: B. It is formal authorization and coordination for specified hazardous work

Question 4

What must occur after hazardous energy has been isolated in a LOTO procedure?

A. The worker should immediately restart the equipment

B. The isolation should be verified before work begins

C. The warning tag should be removed

D. The machine should be returned to production

Correct Answer: B. The isolation should be verified before work begins

Question 5

Which is an engineering control?

A. Annual safety training

B. A warning poster

C. A machine guard interlock

D. A disciplinary policy

Correct Answer: C. A machine guard interlock

Question 6

What is the principal purpose of a job safety analysis?

A. To assign blame after an incident

B. To decompose work into steps, hazards, and controls

C. To calculate payroll costs

D. To replace all emergency planning

Correct Answer: B. To decompose work into steps, hazards, and controls

Question 7

Which change most clearly requires management of change?

A. Replacing identical printer paper

B. Changing a pump's capacity and control logic

C. Reordering standard office stationery

D. Repeating an unchanged daily inspection

Correct Answer: B. Changing a pump's capacity and control logic

Question 8

Why are contractor interfaces a significant safety concern?

A. Contractors are never legally responsible for their work

B. Host and contractor activities may create shared hazards and coordination gaps

C. Contractors cannot use engineering controls

D. Contractors are exempt from permits

Correct Answer: B. Host and contractor activities may create shared hazards and coordination gaps

Question 9

Which is a limitation of relying primarily on PPE?

A. PPE always removes the hazard at its source

B. PPE can fail through poor fit, damage, incompatibility, or non-use

C. PPE never requires training

D. PPE eliminates the need for maintenance

Correct Answer: B. PPE can fail through poor fit, damage, incompatibility, or non-use

Question 10

Which is generally a leading indicator?

A. Number of completed critical-control verification checks

B. Number of lost-time injuries last year

C. Total compensation paid after incidents

D. Number of occupational diseases diagnosed

Correct Answer: A. Number of completed critical-control verification checks