Safety Leadership, Culture, Communication, and Training

Introduction and strategic context

Employee health and safety are often described as compliance responsibilities, but at graduate-management level they are better understood as strategic capabilities. An organization’s safety performance reflects how it allocates resources, designs work, manages operational variability, learns from weak signals, and balances production with protection. Human-resources professionals are central to this system because they influence selection, onboarding, competence, performance management, leadership development, employee voice, labor relations, and organizational change.

Safety leadership concerns the actions through which leaders establish priorities, allocate resources, model standards, remove barriers, and hold people accountable. Safety culture refers to the shared assumptions, values, norms, and practices through which safety is interpreted and enacted. Safety climate is the more immediate, measurable perception employees hold about whether safety is genuinely prioritized in their work environment. Communication and training connect leadership intent with operational behavior, but neither can compensate for unsafe work design, inadequate staffing, defective equipment, or contradictory incentives.

The central managerial challenge is therefore not simply to persuade employees to behave safely. It is to create conditions in which safe work is feasible, expected, supported, reported, and continuously improved.

Learning objectives

By the end of this chapter, students should be able to:

1. Distinguish safety culture, safety climate, safety leadership, and safety management systems.
2. Diagnose strengths and weaknesses in an organization’s safety climate using qualitative and quantitative evidence.
3. Design leadership-accountability and employee-participation mechanisms.
4. Explain stop-work authority and the conditions required for it to be credible.
5. Construct a competency-based safety training and assurance system.
6. Apply behavior-informed interventions without blaming workers for system failures.
7. Design communication practices that support reporting, learning, and operational control.
8. Evaluate ethical, legal, technological, and governance implications of safety decisions.

Core concepts and distinctions

Safety culture

Safety culture is the pattern of shared meanings and practices concerning risk, prevention, learning, and responsibility. It is not a slogan, a poster campaign, or an employee-attitude score. Culture is visible in what the organization routinely rewards, tolerates, funds, investigates, and discusses.

A mature culture has several characteristics:

• leaders treat safety as a core value and operational condition, not a competing objective;
• employees can report hazards and incidents without retaliation;
• work is designed around foreseeable human capabilities and limitations;
• learning focuses on system improvement as well as individual accountability;
• production pressure is managed rather than transferred silently to workers;
• contractors, temporary employees, and vulnerable groups receive equivalent protection.

Culture is dynamic. A merger, new production target, labor shortage, leadership change, or serious incident may alter the practical meaning of safety even when formal policies remain unchanged.

Safety climate

Safety climate is the shared perception, at a particular time and within a particular group, of how safety is prioritized and enacted. It is narrower and more proximal than culture. Climate can be assessed through surveys, interviews, observations, reporting patterns, and operational indicators.

A climate survey might examine whether employees believe that:

• supervisors respond constructively to hazard reports;
• staffing and schedules permit safe work;
• managers follow the same rules as employees;
• training is relevant and reinforced;
• near misses lead to visible corrective action;
• employees have authority to pause hazardous work.

Climate measures are useful but imperfect. A high score may reflect social desirability, fear of consequences, or a recently completed campaign. A low score may identify genuine distrust, but it may also reflect temporary disruption. Sound diagnosis triangulates survey data with interviews, observations, records, and outcomes.

Safety leadership

Safety leadership includes both formal and informal influence. Senior executives establish priorities and resources; middle managers translate them into operating systems; supervisors shape daily decisions; and peer leaders influence local norms. Transformational leadership can create shared purpose, while transactional leadership clarifies standards and consequences. Neither is sufficient alone. High-risk work requires inspirational commitment as well as disciplined controls, verification, and follow-through.

Effective leaders demonstrate four forms of accountability:

1. Outcome accountability: monitoring injuries, exposures, incidents, and control effectiveness.
2. Process accountability: verifying inspections, maintenance, competency, corrective actions, and emergency readiness.
3. Learning accountability: ensuring that reports are analyzed and lessons are shared.
4. Moral accountability: protecting people even when doing so creates delay, cost, or reputational difficulty.

A weak system frequently confuses accountability with blame. Accountability asks whether a person had authority, information, resources, competence, and a reasonable opportunity to act. Blame assumes that the worker’s choice is the primary cause without examining the conditions that shaped it.

Safety management systems

A safety management system integrates policy, planning, hazard identification, risk control, competence, communication, assurance, incident learning, and continual improvement. A useful logic is:

Plan: identify hazards, legal duties, objectives, resources, and responsibilities.

Implement: establish controls, train people, communicate requirements, and manage change.

Check: inspect, audit, measure climate, review reports, and test emergency arrangements.

Improve: investigate, correct, learn, and revise the system.

This cycle resembles Plan–Do–Check–Act, but the model should not be treated as a paperwork sequence. Its value depends on whether information travels upward and whether decisions change in response.

Diagnosing safety climate and culture

A multi-method diagnostic design

A graduate-level diagnosis should answer three questions:

1. What do people believe? Use anonymous surveys, interviews, focus groups, and listening sessions.
2. What do people do? Use field observations, work-as-done studies, permit reviews, and behavioral sampling.
3. What does the system produce? Examine incidents, near misses, exposure measurements, absenteeism, turnover, maintenance backlogs, overtime, corrective-action aging, and audit findings.

The following table illustrates a diagnostic framework.

Survey interpretation

Survey results should be analyzed by work group, role, shift, tenure, employment status, and location where sample sizes and confidentiality permit. Aggregated averages can conceal risk concentrations. Results should be interpreted with response rate, missing data, question wording, and organizational events in mind.

A simple response rate is:

The rate is descriptive, not a guarantee of representativeness. Nonresponse bias occurs when those who do not respond differ systematically from respondents. For example, temporary workers or employees on night shifts may be underrepresented.

A climate index may be formed by averaging several items measured on the same scale, but this is defensible only when the items represent a coherent construct and the scale has been examined for reliability and validity. A high internal-consistency coefficient does not prove that a measure is valid; items can be highly correlated yet measure the wrong thing.

Leading and lagging indicators

Lagging indicators include recordable injuries, lost-time cases, illness, property damage, and regulatory notices. They are important but delayed, relatively rare, and influenced by reporting practices. Leading indicators include completed control verifications, hazard-removal time, quality of pre-job briefings, participation rates, competency demonstrations, maintenance completion, and the proportion of corrective actions closed effectively.

No indicator is inherently leading in every context. A target such as “zero incidents” may suppress reporting. A target such as “100% training completion” may encourage attendance without learning. Indicators should therefore be tested for validity, gaming risk, and connection to actual control performance.

For organizations using the U.S. OSHA-style total recordable incident rate, a common descriptive measure is:

The constant 200,000 represents 100 full-time employees working 40 hours per week for 50 weeks. TRIR is a standardized rate, not a probability and not a direct measure of culture. It should not be compared across industries or work processes without considering exposure, reporting rules, workforce composition, and case severity.

Building leadership accountability

Accountability is strongest when it is designed into governance rather than left to personal motivation. A practical architecture contains the following elements.

Clear duties and decision rights

Policies should identify who owns risk, who may authorize work, who verifies controls, and who can stop or restart an operation. Responsibility must be matched with authority and resources. Assigning a supervisor responsibility for confined-space safety while denying maintenance support or staffing flexibility is nominal accountability, not real accountability.

Visible field leadership

Leader walkarounds are valuable when they involve inquiry rather than inspection theater. Useful questions include:

• What could seriously harm someone here?
• Which controls are essential, and how do we know they are working?
• What makes the safe method difficult today?
• What concerns have employees raised that remain unresolved?
• If production pressure increased, which control would be most vulnerable?

Leaders should close the feedback loop by communicating what they heard, what they decided, and why.

Fair accountability

A just-accountability approach distinguishes among human error, at-risk behavior, reckless behavior, and system-induced conditions. Human error calls for redesign, simplification, coaching, or improved defenses. At-risk behavior may require understanding incentives, normalization, and supervision. Reckless disregard may justify disciplinary action, but only after a fair investigation. The categories are not excuses; they are tools for proportionate response.

Integrated performance management

Safety should appear in role expectations, promotion criteria, manager reviews, and incentive design. However, individual injury quotas and punitive reporting targets can create perverse incentives. Better measures assess control quality, learning behavior, timely correction, and support for employee voice. Safety performance should never be reduced to whether a person happened to avoid an injury during a reporting period.

Employee participation and stop-work authority

Participation is more than consultation after decisions have been made. It includes hazard identification, risk assessment, procedure design, investigations, training evaluation, emergency planning, and control verification. Participation improves information quality because employees possess tacit knowledge about work variability, equipment limitations, and practical workarounds.

Effective participation requires:

• protected time and access to information;
• representation of shifts, contractors, languages, and vulnerable groups;
• training in hazard recognition and consultation skills;
• transparent responses to suggestions;
• protection against retaliation;
• feedback on implementation and nonimplementation.

Stop-work authority

Stop-work authority is the legitimate right and practical ability to pause work when a person reasonably believes that a serious and uncontrolled hazard exists. It should apply regardless of rank and should include a defined process for assessment, correction, and restart.

A credible process has five stages:

1. Pause: stop or isolate the activity when safe to do so.
2. Notify: inform the responsible supervisor or control room.
3. Assess: jointly evaluate the hazard and existing controls.
4. Correct: eliminate the hazard or implement adequate controls.
5. Restart and learn: authorize restart, document the event, and share lessons.

The organization must distinguish a good-faith stop from misconduct. If every pause is treated as insubordination, the formal authority is meaningless. At the same time, stop-work systems need clear escalation rules so that disagreement does not become indefinite operational paralysis.

Competency systems and safety training

Training versus competence

Training is an intervention; competence is the demonstrated capacity to perform safely under specified conditions. Completion records show exposure to instruction, not mastery. A competency system should define:

• the task and associated hazards;
• required knowledge, skills, judgment, and physical or cognitive capabilities;
• prerequisites and authorization limits;
• learning methods;
• assessment criteria;
• supervision requirements;
• refresher or reassessment triggers;
• records and expiry controls.

Competence may be assessed through written tests, oral questioning, simulation, observation, practical demonstration, and performance in abnormal conditions. Assessment should resemble the real work. A perfect multiple-choice score does not establish competence to diagnose a malfunction under time pressure.

Instructional design

Effective safety learning is task-specific, risk-based, and reinforced at the point of work. A robust design sequence is:

1. conduct a task and learner analysis;
2. define observable performance outcomes;
3. select controls and critical behaviors;
4. provide explanation, demonstration, practice, and feedback;
5. assess performance against explicit criteria;
6. transfer learning through supervision, tools, and job design;
7. evaluate whether risk controls improved.

The “critical behaviors” must not be presented as a substitute for engineering or administrative controls. Personal protective equipment and attention-based behaviors are generally weaker controls than elimination, substitution, engineering safeguards, and well-designed work systems.

Training evaluation

Evaluation should consider at least four levels: learner reaction, learning, behavior or transfer, and organizational results. The levels are related but not interchangeable. Employees may enjoy a course without learning; they may learn without being able to apply it because equipment or incentives obstruct transfer; and injury outcomes may remain unchanged because the training addressed a minor contributor.

Behavior-informed interventions without worker blame

Behavioral safety can contribute to prevention when it is grounded in systems thinking. Observation programs may identify barriers, feedback patterns, and opportunities to improve work design. They become dangerous when they imply that incidents are mainly caused by careless individuals or when observation data are used for punishment.

A sound behavioral intervention follows this sequence:

• identify the hazardous exposure or undesired event;
• analyze antecedents, task conditions, equipment, workload, and incentives;
• define a small number of observable behaviors linked to effective controls;
• remove barriers and redesign the environment;
• provide timely, respectful feedback;
• monitor both behavior and system conditions;
• revise the intervention when it does not produce improvement.

Behavioral data should be used diagnostically. If workers repeatedly bypass a guard, the initial question should be why: Is the guard incompatible with the task? Is it defective? Does it cause production delays? Is maintenance unavailable? Discipline may be appropriate for deliberate, reckless conduct, but it should not replace root-cause analysis.

Communication as a control system

Safety communication is not merely the transmission of information. It is a control process through which risk information is created, interpreted, verified, and acted upon.

Vertical, horizontal, and external communication

Vertical communication carries policy, priorities, escalation, and feedback between organizational levels. Horizontal communication connects teams, shifts, contractors, and functions. External communication includes regulators, emergency services, suppliers, and affected communities. Failures often occur at boundaries: shift handovers, contractor interfaces, language transitions, maintenance-production coordination, and organizational changes.

High-reliability communication practices

Useful practices include structured handovers, read-backs for critical instructions, pre-job briefings, permit-to-work discussions, standardized terminology, visual controls, multilingual communication, and escalation protocols. Communication must be designed for noise, fatigue, interruption, low literacy, and abnormal conditions.

A message is not complete merely because it was sent. The sender should verify that the receiver understood the requirement and can act on it. Psychological safety is equally important: employees must be able to raise uncertainty, challenge authority, and report bad news without humiliation or retaliation.

Applied case: NorthRiver Components

The following is an illustrative case designed for educational analysis.

Background

NorthRiver Components operates three plants producing precision metal assemblies. Its lost-time injury rate has declined for two years, and senior management reports high training completion. Nevertheless, near-miss reporting has fallen sharply, overtime has increased, and maintenance backlogs have grown. A climate survey shows that employees respect their immediate supervisors but do not believe that production and safety receive equal priority.

Problem

A temporary employee suffered a hand injury while clearing a jam on an automated press. The investigation initially concluded that the employee failed to follow lockout procedures. Interviews revealed that the written procedure did not describe the actual machine configuration, the isolation point was poorly labeled, and supervisors had informally tolerated manual clearing to avoid line stoppages. The temporary employee had completed an online module but had not demonstrated the task under supervision.

Analysis

The event involved several layers: inadequate equipment labeling, a procedure–practice gap, production pressure, weak contractor integration, and an assessment system based on completion rather than competence. The declining near-miss rate was misinterpreted as improvement, although interviews suggested that employees had stopped reporting because previous reports produced little visible action.

Approach and solution

NorthRiver established a cross-functional review involving operators, maintenance staff, engineering, HR, and temporary-worker representatives. It redesigned the jam-clearing process using engineering safeguards and verified isolation points. It rewrote the procedure with employee participation, introduced practical authorization assessments, and prohibited unsupervised work for newly assigned temporary employees until competence was demonstrated.

The plant manager introduced a monthly control-verification review rather than an injury-target review. Supervisors were evaluated on action closure, quality of pre-job discussions, and response to concerns. A stop-work process was launched with explicit nonretaliation protection. Near-miss reports were categorized by severity potential and followed by visible feedback to reporting employees.

Outcome

After six months, reporting increased, corrective-action closure improved, and practical assessments identified several competence gaps that online completion records had missed. Production interruptions initially increased because defective safeguards were being corrected, but unplanned downtime later declined. The organization did not claim that the improvements proved a single causal effect; it continued monitoring exposure, control reliability, and employee perceptions.

Learning points

The case demonstrates that safety climate can deteriorate while traditional outcome indicators appear favorable. It also shows that leadership accountability must include conditions of work, that temporary workers require equivalent protection, and that training is meaningful only when it produces verified capability. Most importantly, investigation should examine why a reasonable person could have found the unsafe method normal or necessary.

Governance, ethics, and contemporary developments

Safety decisions involve ethical duties beyond legal compliance. Employers have responsibilities of prevention, transparency, nondiscrimination, confidentiality, and respect for human dignity. Reporting systems should protect personal information while preserving enough detail for learning. Investigations must avoid retaliation, stereotyping, and premature attribution of fault.

Regulatory requirements vary by jurisdiction, but commonly include employer duties to provide safe systems of work, information, training, supervision, consultation, incident reporting, and records. Organizations operating internationally should not assume that legal compliance in one jurisdiction establishes an adequate global standard. HR professionals should coordinate with occupational-health specialists, safety professionals, worker representatives, and legal advisers.

Digital tools can support learning through mobile reporting, sensor-based exposure monitoring, virtual reality practice, and analytics. Artificial intelligence may help classify reports, identify recurring themes, or detect patterns in maintenance and exposure data. These tools introduce risks: surveillance may undermine trust; algorithms may reproduce historical bias; automated alerts may generate fatigue; and sensitive health data may be misused. AI should support—not replace—professional judgment, worker participation, privacy safeguards, and human review. Data minimization, access controls, transparent purposes, retention limits, and challenge mechanisms are essential.

Contemporary safety leadership increasingly addresses psychosocial risks, climate-related heat exposure, remote and hybrid work, aging workforces, supply-chain fragmentation, and the use of contingent labor. These issues reinforce a central principle: safety is a property of the whole work system, not a department-owned activity.

Best-practice implementation roadmap

A practical implementation sequence is:

1. Establish executive intent, governance, and nonretaliation commitments.
2. Diagnose climate and culture using multiple evidence sources.
3. Map critical risks, decision rights, interfaces, and vulnerable work groups.
4. Strengthen the hierarchy of controls before expanding behavior campaigns.
5. Create meaningful participation and stop-work mechanisms.
6. Define competency profiles and replace completion-only training with demonstration.
7. Improve handovers, escalation, reporting, and feedback loops.
8. Align performance management and incentives with control quality and learning.
9. Use leading and lagging indicators cautiously, checking for gaming and bias.
10. Review outcomes, employee perceptions, and control effectiveness continuously.

Challenges and limitations

Culture cannot be changed quickly through communication campaigns. Surveys can be manipulated or misunderstood; incident rates can be unstable in small populations; observations can alter behavior; and participation can become symbolic. Leadership turnover may weaken continuity. Excessive metrics can create administrative burden and encourage gaming. Standardization can improve reliability but may suppress local knowledge if applied rigidly. Conversely, local discretion can support adaptation but create uncontrolled variation.

The appropriate response is not to abandon measurement or procedures, but to combine standardization of critical controls with informed local adaptation. Claims about improvement should be cautious, based on triangulated evidence, and open to disconfirmation.

Chapter Summary

Safety leadership is the organizational practice of setting priorities, allocating resources, modeling standards, enabling voice, and learning from risk. Safety culture concerns shared assumptions and practices; safety climate concerns employees’ current perceptions of those practices. Climate diagnosis is strongest when surveys are combined with interviews, observations, operational data, and control verification.

Leadership accountability should address outcomes, processes, learning, and moral responsibility. Fair accountability distinguishes human error, at-risk behavior, reckless conduct, and system-induced conditions. Employee participation improves risk information when it is protected, representative, resourced, and followed by feedback. Stop-work authority is credible only when workers can pause work without retaliation and when the organization has a clear assessment, correction, restart, and learning process.

Competence is demonstrated capability, not training completion. Effective learning is task-specific, practical, assessed, supervised, and reinforced by work design. Behavior-informed interventions are valuable when they remove barriers and improve controls, but they are harmful when they blame workers for system failures. Communication functions as a safety control through reliable handovers, read-backs, escalation, psychological safety, and feedback. Technology and AI can strengthen assurance, but governance must protect privacy, fairness, participation, and human judgment.

Key Terms

Safety culture: Shared assumptions, values, norms, and practices concerning safety.

Safety climate: Shared perceptions of how safety is prioritized and enacted at a particular time.

Safety leadership: Influence and action that establish priorities, resources, standards, and learning.

Safety management system: Integrated arrangements for planning, implementing, checking, and improving safety.

Just accountability: A fair approach that distinguishes error, at-risk behavior, recklessness, and system conditions.

Employee participation: Worker involvement in identifying risks, designing controls, and evaluating safety.

Stop-work authority: The right and ability to pause work when a serious uncontrolled hazard is suspected.

Competence: Demonstrated capacity to perform a task safely under specified conditions.

Near miss: An event that caused no harm but had the potential to do so.

Leading indicator: A measure of preventive activity or control performance.

Lagging indicator: A measure of harm or loss that has already occurred.

TRIR: A standardized recordable incident rate based on cases and hours worked.

Psychological safety: A shared belief that people can speak up or report concerns without interpersonal punishment.

Hierarchy of controls: Preference for elimination and stronger controls before administrative measures and PPE.

Behavioral intervention: A structured effort to influence observable behavior and its conditions.

Competency assessment: Evaluation of knowledge, skill, judgment, and performance against defined criteria.

Work-as-done: How work is actually performed, including adaptations and workarounds.

Safety communication: The exchange and verification of information needed to control risk.

Near-miss reporting: Submission of information about events with potential for harm.

Control verification: Evidence that a specified risk control exists and functions effectively.

Review Questions

Short Answer Questions

1. Distinguish safety culture from safety climate.
2. Why is training completion an inadequate measure of competence?
3. Identify two conditions required for credible stop-work authority.
4. What is the difference between a leading and a lagging indicator?
5. Why should safety investigations examine work-system conditions?

Long Answer Questions

1. Explain how HR professionals can build leadership accountability without creating a blame-oriented culture.
2. Discuss a multi-method approach to diagnosing safety climate and culture, including its limitations.
3. Design a competency-based safety training system for a high-risk operation.
4. Explain how employee participation and psychological safety influence organizational learning.
5. Critically evaluate the use of behavioral safety programs in relation to the hierarchy of controls.

Analytical / Application Questions

1. A plant reports zero lost-time injuries but has declining near-miss reports, high overtime, and unresolved maintenance findings. Diagnose at least three plausible explanations and propose an evidence-gathering plan.
2. Design a stop-work process for a construction project involving employees, contractors, and multiple shifts. Specify authority, escalation, restart, documentation, and nonretaliation provisions.
3. An organization wants to use AI to analyze employee health and safety reports. Develop governance safeguards addressing privacy, bias, human review, transparency, and employee participation.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes safety climate from safety culture?

A. Climate concerns legal compliance, while culture concerns training completion.

B. Climate concerns current shared perceptions, while culture concerns deeper shared assumptions and practices.

C. Climate concerns injury rates, while culture concerns only leadership behavior.

D. Climate is permanent, while culture changes daily.

Correct Answer: B. Climate concerns current shared perceptions, while culture concerns deeper shared assumptions and practices.

Question 2

What is the strongest evidence that an employee is competent for a hazardous task?

A. The employee completed an online module.

B. The employee signed the safety policy.

C. The employee demonstrated the task safely under specified conditions.

D. The employee has worked for the organization for six months.

Correct Answer: C. The employee demonstrated the task safely under specified conditions.

Question 3

Which action most directly supports credible stop-work authority?

A. Disciplining employees who pause production without supervisor approval.

B. Allowing good-faith pauses without retaliation and defining a restart process.

C. Requiring all concerns to be submitted after the task is complete.

D. Limiting stop-work authority to senior managers.

Correct Answer: B. Allowing good-faith pauses without retaliation and defining a restart process.

Question 4

Why can a decline in near-miss reports be difficult to interpret?

A. Near misses are never useful safety information.

B. Fewer reports may reflect reduced hazards or reduced willingness to report.

C. Near misses are legally required to increase every year.

D. Near-miss data measure only training quality.

Correct Answer: B. Fewer reports may reflect reduced hazards or reduced willingness to report.

Question 5

In the TRIR formula, why is 200,000 commonly used?

A. It represents 200,000 incidents permitted annually.

B. It represents 100 full-time employees working 40 hours per week for 50 weeks.

C. It converts hours into minutes.

D. It measures the average cost of an injury.

Correct Answer: B. It represents 100 full-time employees working 40 hours per week for 50 weeks.

Question 6

Which response best reflects just accountability after a worker bypasses a machine guard?

A. Automatically terminate the worker.

B. Ignore the event because no injury occurred.

C. Examine equipment, incentives, workload, supervision, and the worker’s decision before determining a proportionate response.

D. Blame the training department exclusively.

Correct Answer: C. Examine equipment, incentives, workload, supervision, and the worker’s decision before determining a proportionate response.

Question 7

Which is a leading indicator?

A. A completed control-verification inspection.

B. A lost-time injury.

C. A diagnosed occupational illness.

D. A regulatory penalty already imposed.

Correct Answer: A. A completed control-verification inspection.

Question 8

What is the principal limitation of training-completion metrics?

A. They are impossible to calculate.

B. They demonstrate attendance but not necessarily learning, transfer, or competence.

C. They measure only injury severity.

D. They always produce statistically invalid results.

Correct Answer: B. They demonstrate attendance but not necessarily learning, transfer, or competence.

Question 9

Which communication practice is especially useful for critical instructions?

A. Assuming silence means understanding.

B. Using read-backs or closed-loop confirmation.

C. Communicating only through annual policy documents.

D. Restricting information to managers.

Correct Answer: B. Using read-backs or closed-loop confirmation.

Question 10

Which use of AI in safety management is most consistent with responsible governance?

A. Automatically disciplining employees identified by an algorithm.

B. Replacing worker consultation with predictive analytics.

C. Using AI to identify patterns while retaining human review, privacy safeguards, and transparent purposes.

D. Collecting all available health data indefinitely.

Correct Answer: C. Using AI to identify patterns while retaining human review, privacy safeguards, and transparent purposes.