Occupational Safety Foundations, Law and Governance

Introduction and Context

Occupational safety is the systematic prevention of work-related injury, ill health, property damage, environmental harm and unacceptable operational disruption. In mechanical engineering, safety is not an additional administrative activity; it is a design, production and maintenance requirement. Engineers influence safety through equipment selection, guarding, layout, energy isolation, pressure-system design, automation, procurement and supervision.

Modern occupational safety has developed from prescriptive rules—such as requirements for guards and protective equipment—towards risk-based management systems. Contemporary practice combines three elements:

1. Legal compliance: meeting binding legislation, regulations, licences, codes and notices issued by competent authorities.
2. Professional and ethical responsibility: preventing foreseeable harm even where legislation is incomplete or enforcement is weak.
3. Systematic management: establishing policy, leadership, worker participation, risk control, learning and continual improvement.

This chapter uses the International Labour Organization (ILO) principles and ISO 45001 as internationally useful reference frameworks. Since occupational-safety law differs between countries, the legal examples are presented as principles rather than as a substitute for the legislation of a particular jurisdiction.

Learning Objectives

After studying this chapter, the learner should be able to:

• explain the foundations and objectives of occupational safety;
• distinguish the responsibilities of employers, workers, supervisors, designers and contractors;
• interpret the role of national legislation, regulators, ILO principles and ISO 45001;
• apply due diligence and the hierarchy of controls to workplace risks;
• explain safety policy, consultation, documentation and permit-to-work systems;
• analyse contractor safety and corporate accountability;
• evaluate ethical problems involving production pressure, reporting and compliance;
• propose a practical governance structure for an industrial workplace.

1. Foundations of Occupational Safety

1.1 Hazard, risk and harm

A hazard is a source or situation with the potential to cause injury, ill health, damage or other loss. Examples include an unguarded rotating shaft, stored hydraulic pressure, noise, combustible dust, an energized electrical conductor and a poorly designed manual-handling task.

Risk is the combination of the likelihood of an unwanted event and the severity of its consequence. A simple qualitative model is:

Likelihood describes how probable exposure or occurrence is; consequence describes the possible extent of harm. This expression is a decision aid, not a universal scientific law. It should not be used to justify precise numerical comparisons when the scales are subjective. Risk assessment must also consider exposure frequency, duration, number of persons exposed, existing controls, human factors and uncertainty.

A low-frequency event can still require urgent control if its consequence is catastrophic. Conversely, frequent minor events may indicate weak controls and a deteriorating system. Risk assessment therefore supports, but does not replace, engineering judgement.

1.2 Accident, incident and near miss

An incident is an event arising from work that could or does result in injury, ill health, damage or loss. An accident is commonly used for an incident that produces harm, while a near miss produces no harm but had the potential to do so. Treating near misses as learning opportunities is valuable, provided reporting does not become punitive or bureaucratic.

The immediate cause of an event is rarely the complete explanation. For example, a worker’s hand injury may involve a missing guard, inadequate procurement, poor maintenance, production pressure, weak supervision and an ineffective inspection system. Good investigation looks beyond individual blame to underlying and organisational causes.

1.3 Prevention philosophy

The central principle is to control risk at its source. Personal protective equipment (PPE) is important, but it is generally less reliable than elimination, substitution or engineering control because PPE depends on correct selection, fit, use, maintenance and worker behaviour.

The hierarchy of controls is commonly ordered as follows:

1. Elimination: remove the hazardous task or material.
2. Substitution: replace it with a less hazardous alternative.
3. Engineering controls: isolate people from the hazard through guarding, enclosure, ventilation, interlocks or automation.
4. Administrative controls: use procedures, training, scheduling, signs, supervision and access control.
5. PPE: protect the individual with helmets, eye protection, gloves, respiratory protection or other equipment.

Controls are often combined. For example, a solvent may be substituted, local exhaust ventilation installed, exposure time limited, workers trained and respiratory protection provided during exceptional work.

2. Legal and Institutional Foundations

2.1 National legislation

A national occupational-safety system usually contains several layers:

The exact names differ by country. Engineers must identify the competent authority, applicable sectoral regulations, mandatory inspections, reporting thresholds, records-retention periods and requirements for occupational-health surveillance. A compliance register should identify each obligation, its responsible owner, evidence of compliance, review date and status.

Legal compliance is a minimum condition. Compliance alone does not prove that risks are tolerable, because legislation may not address every technology, interaction or foreseeable misuse. A responsible organisation applies the precautionary principle where uncertainty and potential harm are significant.

2.2 ILO principles

ILO occupational-safety principles emphasise prevention, decent work, worker participation, competent advice and the responsibility of governments, employers and workers. Important themes include:

• national policy and institutional coordination;
• employer responsibility for safe work systems;
• worker information, instruction, training and supervision;
• consultation and participation without retaliation;
• protection against hazardous exposure;
• reporting, inspection and investigation;
• occupational health services and emergency preparedness.

ILO instruments include conventions, protocols, recommendations and codes of practice. Their legal status depends on national ratification and implementation. Even where a particular instrument is not legally binding domestically, its principles can inform professional practice and ethical decision-making.

2.3 ISO 45001 as a management-system framework

ISO 45001 specifies requirements for an occupational health and safety management system (OH&S MS). It follows a plan–do–check–act logic and is compatible with the broader ISO high-level structure. Its major themes include:

• context of the organisation;
• leadership and worker participation;
• planning and risk-and-opportunity assessment;
• support, competence, awareness and documented information;
• operational control and emergency preparedness;
• performance evaluation;
• improvement, corrective action and continual learning.

ISO 45001 certification is not a guarantee that no accident will occur. It demonstrates that an organisation has been audited against specified management-system requirements. A weak system can still produce impressive documentation; therefore, effectiveness must be judged through field conditions, worker experience, control performance and outcomes, not certificates alone.

3. Duties, Responsibilities and Due Diligence

3.1 Employer responsibility

The employer normally controls resources, processes and working conditions and therefore carries the primary duty to provide a safe workplace. Core responsibilities include:

• identifying hazards and assessing risks;
• providing safe plant, systems of work and competent supervision;
• maintaining equipment and safety-critical controls;
• providing information, instruction, training and PPE;
• consulting workers and representatives;
• preparing for emergencies;
• reporting legally notifiable events;
• monitoring performance and correcting deficiencies;
• controlling contractors and visitors.

The employer’s duty is generally broader than simply responding to complaints. It includes anticipating foreseeable hazards and verifying that controls work in practice.

3.2 Worker responsibility and rights

Workers have duties to take reasonable care of themselves and others, follow lawful procedures, use equipment correctly, report hazards and defects, cooperate with investigations and attend required training. Workers should not bypass guards, defeat interlocks or misuse PPE.

These duties do not transfer the employer’s primary responsibility to workers. Workers should have the right to receive information, raise concerns, participate in consultation and refuse or withdraw from imminently dangerous work according to applicable law and procedure, without retaliation. A mature safety culture distinguishes good-faith reporting from deliberate misconduct.

3.3 Supervisors, engineers and managers

Supervisors translate policy into daily control. They allocate competent personnel, verify permits, inspect work areas, respond to deviations and stop unsafe work. Engineers have additional influence because design decisions can eliminate hazards before construction or operation. Managers determine priorities through budgets, production targets, staffing and promotion criteria.

A useful responsibility model assigns each critical control a named owner, required standard, verification method, frequency and escalation route. Responsibility must be matched with authority and resources; assigning accountability without decision power is ineffective.

3.4 Due diligence

Due diligence is the continuing, reasonable and demonstrable effort to prevent harm. It commonly includes:

1. understanding applicable legal and technical requirements;
2. identifying foreseeable hazards;
3. implementing proportionate controls;
4. appointing competent persons;
5. allocating resources;
6. communicating requirements;
7. monitoring and auditing performance;
8. learning from incidents, inspections and changes;
9. correcting deficiencies promptly.

Due diligence is evidence-based. Useful evidence includes risk assessments, maintenance records, competence records, inspection results, consultation minutes, permit audits, corrective-action closure and management reviews. A signed procedure that is not implemented is weak evidence.

4. Safety Policy, Planning and Documentation

4.1 Safety policy

A safety policy should be concise, authorised by senior leadership and communicated to all relevant persons. It should express commitment to:

• preventing injury and ill health;
• complying with applicable obligations;
• eliminating hazards and reducing risks;
• consulting and enabling worker participation;
• providing resources and competence;
• continual improvement.

The policy should reflect the organisation’s activities and risk profile. Posting it on a wall is insufficient; leadership decisions, procurement, production planning and performance reviews must demonstrate its meaning.

4.2 Risk assessment and change management

A practical risk assessment process defines the task, identifies hazards, identifies exposed persons, evaluates existing controls, selects additional controls using the hierarchy, assigns actions and verifies residual risk. Assessments should be reviewed after incidents, process changes, new equipment, new chemicals, organisational changes or evidence that controls are ineffective.

Management of change is essential because modifications can introduce hazards not present in the original design. It should address technical, procedural, human, legal and emergency implications before the change is released.

4.3 Documented information

Documents provide instruction and evidence, but excessive paperwork can obscure critical controls. Important records may include:

• legal registers and permits;
• policies, risk assessments and safe-work procedures;
• design reviews and safety requirements;
• training and competence records;
• inspection, testing and maintenance records;
• chemical inventories and safety data sheets;
• emergency plans and drill results;
• incident reports and corrective actions;
• contractor evaluations;
• audits and management reviews.

Documents should be controlled for approval, revision, access, retention and disposal. Workers need the current operational instruction at the point of work, not merely an archived file.

5. Consultation, Communication and Participation

Consultation is a control mechanism, not a ceremonial meeting. Workers often understand task variability, equipment defects and informal workarounds better than senior managers. Effective consultation allows workers to influence risk assessment, procedure design, PPE selection, incident investigation and change decisions.

A functioning consultation process includes accessible information, trained representatives, regular meetings, feedback on reported issues, protection from retaliation and visible action. Communication must account for language, literacy, disability, shift work, temporary employment and contractor status.

A useful distinction is:

• information: management provides facts;
• consultation: workers provide views before a decision;
• participation: workers share influence in identifying and controlling risks.

Organisations should measure not only meeting frequency but also response time, issue closure, workforce trust and the quality of reported hazards.

6. Permit-to-Work and Operational Control

A permit-to-work (PTW) is a formal authorisation for specific high-risk work during a defined period and under defined controls. Typical permits cover hot work, confined-space entry, electrical isolation, work at height, excavation, line breaking and work on hazardous substances.

A sound PTW process normally includes:

1. description and location of work;
2. hazard identification and risk assessment;
3. isolation and lockout/tagout requirements;
4. atmospheric testing where relevant;
5. required competence and PPE;
6. simultaneous-operation checks;
7. emergency and rescue arrangements;
8. authorisation by responsible persons;
9. handover, suspension and close-out.

A permit does not make hazardous work safe by itself. It formalises communication and confirms that prerequisites have been met. The permit issuer and performing authority must understand their roles, and field verification is necessary. A common failure is treating a permit as a signature exercise while isolations, gas tests or rescue resources are absent.

7. Contractor Safety and Supply-Chain Governance

Contractors may face unfamiliar hazards, language barriers, time pressure and unclear authority. The principal organisation should manage contractor safety across the lifecycle:

• prequalification based on competence and safety performance;
• clear scope, risk allocation and minimum requirements;
• design and tender-stage hazard review;
• induction and task-specific training;
• verification of licences, supervision and equipment;
• coordination of simultaneous work;
• permit and isolation integration;
• field inspection and performance feedback;
• incident reporting and shared learning;
• fair close-out and performance evaluation.

Contracting out work does not necessarily contract out legal or moral responsibility. A company that selects the lowest-cost contractor while ignoring foreseeable safety deficiencies may retain substantial accountability. Procurement should consider lifecycle safety, maintainability, competence and total risk—not only purchase price.

8. Ethics, Corporate Accountability and Safety Culture

Safety ethics concerns the duties owed to workers, contractors, communities and future stakeholders. Ethical principles include respect for human dignity, non-maleficence, fairness, transparency, competence and stewardship.

Typical ethical conflicts include suppressing near-miss reports to protect performance statistics, authorising overtime despite fatigue, accepting defective safety devices to meet delivery dates, or presenting incomplete information to regulators. The ethical response is to protect people, disclose material risk, escalate concerns and seek technically sound alternatives.

Corporate accountability operates at several levels:

• individual: competent actions and honest reporting;
• operational: effective controls and supervision;
• managerial: adequate resources and realistic targets;
• board level: governance, risk oversight and assurance;
• external: legal compliance, public reporting and stakeholder responsibility.

A just culture distinguishes human error, at-risk behaviour and reckless behaviour. Human error calls for learning and system improvement; deliberate reckless conduct may require disciplinary action. If every failure is punished, reporting declines and hidden risk increases.

Leading indicators—such as overdue critical maintenance, quality of inspections, hazard-report closure and worker participation—should complement lagging indicators such as injuries. Injury rates alone can be misleading because they are affected by workforce size, reporting behaviour and random variation.

9. Technology and Digital Governance

Digital tools can improve safety through sensor-based condition monitoring, electronic permits, access control, training systems, computerised maintenance and exposure monitoring. Artificial intelligence can assist with trend detection, image-based PPE checks or predictive maintenance.

However, technology introduces risks: false alarms, biased models, privacy intrusion, cyberattacks, automation complacency and unclear accountability. AI should support—not replace—competent human judgement. The organisation must validate accuracy, define escalation rules, protect personal data, retain audit trails and ensure that workers understand how decisions are made. A sensor cannot compensate for a missing guard, and a dashboard cannot substitute for field verification.

10. Applied Case: Boiler-Maintenance Contractor (Illustrative)

Background

A manufacturing plant hires a contractor to repair a steam boiler during a short shutdown. The work involves confined-space entry, stored pressure, hot surfaces, electrical energy and possible residual chemicals.

Problem

Production management wants the boiler returned to service two days early. The contractor’s supervisor proposes using the plant’s general maintenance permit rather than a confined-space permit. A gas detector is available but its calibration status is unclear. Workers report that the isolation valve leaks slightly, but the concern is not recorded because the shutdown schedule is tight.

Analysis

The hazards are not controlled merely because the boiler is “out of service.” Stored pressure and thermal energy may remain; the leaking valve invalidates the assumption of isolation. The proposed permit is inadequate because it does not establish atmospheric testing, rescue arrangements, isolation verification or competent entry control. The pressure to accelerate work creates an organisational hazard: production objectives are competing with safety-critical prerequisites.

Approach and solution

The plant stops the entry and appoints a competent permit coordinator. The isolation plan is reviewed, valves are positively isolated or blinded where required, energy sources are locked and verified, and the boiler is drained, depressurised, cooled and tested. The detector is replaced or calibrated. A confined-space permit specifies continuous monitoring, communication, an attendant, rescue capability, entry limits and emergency arrangements. Contractor and plant personnel conduct a joint briefing. Work proceeds only after field verification.

The leaking valve is repaired before entry. The shutdown schedule is revised and the decision is escalated to senior management. The plant later reviews procurement, contractor prequalification, permit design and management-of-change arrangements.

Outcome

No injury occurs, but the near miss reveals weaknesses in isolation assurance, contractor integration, equipment calibration and production governance. The organisation records the event, communicates the learning and tracks corrective actions to completion.

Learning points

• A permit is effective only when its prerequisites are real and verified.
• Contractor control is a shared operational responsibility.
• Schedule pressure is a risk factor requiring management control.
• Worker reports can identify latent failures before an accident.
• Due diligence requires evidence of implementation, not only signed forms.

11. Implementation Framework for a Mechanical-Engineering Workplace

A practical implementation sequence is:

1. establish the legal and organisational context;
2. obtain leadership commitment and publish a meaningful policy;
3. identify hazards across design, construction, operation and maintenance;
4. involve workers and contractors in assessment;
5. apply the hierarchy of controls;
6. define competence, responsibilities and critical-control owners;
7. establish procedures, permits and emergency arrangements;
8. provide resources, training and supervision;
9. inspect, measure and audit both paperwork and field conditions;
10. investigate events for system causes;
11. review performance at management level;
12. improve controls and verify closure.

The system should be proportionate to risk. A small workshop does not require the same administrative structure as a refinery, but it still requires effective machine guarding, electrical safety, emergency planning, competence and maintenance. The test is whether significant risks are controlled and whether the organisation can demonstrate that fact.

Challenges and Limitations

Safety governance faces several persistent challenges. Laws may overlap or leave gaps; standards may be misapplied; contractors may have unequal resources; safety performance data may be incomplete; and certification may encourage document-focused compliance. Human behaviour is influenced by fatigue, incentives, workload and organisational culture. Risk assessments can become generic and fail to reflect real tasks.

No framework eliminates uncertainty. ISO 45001, ILO principles and national law provide structures, but competent professionals must interpret them in context. Effective safety is therefore a sociotechnical activity involving engineering, law, management, psychology, ethics and worker knowledge.

Contemporary Developments and Best Practices

Important current directions include stronger attention to psychosocial risks, climate-related heat exposure, ageing workforces, remote and hybrid work, supply-chain accountability, process safety, safety by design and worker data rights. Organisations increasingly integrate occupational safety with environmental, quality and enterprise-risk governance.

Best practice includes designing out hazards early, using critical-control verification, protecting stop-work authority, involving workers in decisions, learning from normal work as well as failures, auditing contractor interfaces and reporting honestly to leadership. Safety should be treated as a condition of reliable production rather than as an obstacle to production.

Chapter Summary

Occupational safety is founded on prevention, risk control and respect for human life. National legislation establishes binding duties, while ILO principles provide internationally recognised guidance and ISO 45001 offers a structured management-system model. Employers retain the primary responsibility for safe systems of work, but workers, supervisors, engineers, contractors and senior leaders each have defined responsibilities.

Due diligence requires more than written policies: it requires competent people, resources, consultation, verification, documentation and continual improvement. The hierarchy of controls prioritises elimination and engineering solutions over administrative controls and PPE. Permit-to-work systems, management of change, contractor governance and emergency planning are essential for high-risk work. Ethical leadership demands honest reporting and resistance to production pressures that undermine safety. Effective governance combines legal compliance, technical competence, worker participation and corporate accountability.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and consequence associated with a hazard.

Incident: A work-related event that could or does result in harm or loss.

Near miss: An incident that causes no harm but had the potential to do so.

Hierarchy of controls: The preferred order for selecting risk controls, from elimination to PPE.

Due diligence: Demonstrable, continuing effort to identify and control foreseeable risks.

Competent person: A person with suitable knowledge, training, skill and experience for a defined task.

Occupational health and safety management system: An organised framework for managing safety risks and improving performance.

ISO 45001: An international standard specifying requirements for an OH&S management system.

ILO: The International Labour Organization, a tripartite international body concerned with work and labour standards.

Consultation: A process in which workers are invited to provide views before decisions are made.

Participation: Worker involvement that includes meaningful influence over safety decisions.

Permit-to-work: Formal authorisation controlling defined high-risk work for a specified period.

Lockout/tagout: A method of isolating and identifying hazardous energy before work begins.

Management of change: A process for assessing and controlling risks introduced by modifications.

Contractor: An external organisation or person engaged to perform work or provide services.

Critical control: A control essential to preventing a fatality, serious injury or major loss.

Just culture: An approach that encourages learning from error while addressing reckless conduct.

Compliance register: A controlled list of applicable obligations, responsibilities and evidence.

Safety culture: Shared values, beliefs and behaviours concerning safety in an organisation.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and a risk.
2. List the five levels in the hierarchy of controls.
3. What is the purpose of a permit-to-work system?
4. State four elements of employer due diligence.
5. Why is worker consultation important in risk management?

Long Answer Questions

1. Explain how national legislation, ILO principles and ISO 45001 complement one another.
2. Discuss the responsibilities of employers, workers, supervisors and engineers in a mechanical workplace.
3. Explain why legal compliance alone may not constitute adequate safety performance.
4. Describe the contents and governance requirements of an effective safety policy and documentation system.
5. Analyse the advantages and limitations of contractor safety management.

Analytical / Application Questions

1. A machine operator reports that an interlock is frequently bypassed to prevent production stoppages. Analyse the immediate and underlying causes and propose controls using the hierarchy of controls.
2. Develop a permit-to-work strategy for maintenance inside a process vessel containing possible toxic residues. Identify isolation, competence, monitoring, rescue and close-out requirements.
3. A company has excellent injury statistics but numerous overdue maintenance actions and low near-miss reporting. Evaluate whether its safety performance is satisfactory and recommend leading indicators and governance actions.

Multiple Choice Questions with Answers

Question 1

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative instruction

C. Elimination of the hazard

D. Worker supervision

Correct Answer: C. Elimination of the hazard

Question 2

What is the primary purpose of due diligence in occupational safety?

A. To transfer legal responsibility to workers

B. To demonstrate continuing and reasonable prevention of foreseeable harm

C. To eliminate the need for risk assessment

D. To replace national legislation with company policy

Correct Answer: B. To demonstrate continuing and reasonable prevention of foreseeable harm

Question 3

Which statement best describes ISO 45001?

A. A method for calculating injury frequency rates

B. A criminal law applicable in every country

C. A specification for an occupational health and safety management system

D. A permit required for confined-space entry

Correct Answer: C. A specification for an occupational health and safety management system

Question 4

Which activity is most appropriate before confined-space entry?

A. Issuing a general attendance sheet only

B. Verifying isolation, atmospheric conditions and rescue arrangements

C. Providing gloves without testing the atmosphere

D. Allowing entry if the task is behind schedule

Correct Answer: B. Verifying isolation, atmospheric conditions and rescue arrangements

Question 5

Why should near misses be reported?

A. They provide opportunities to identify weaknesses before harm occurs

B. They are always evidence of worker misconduct

C. They replace equipment inspections

D. They prove that risk is zero

Correct Answer: A. They provide opportunities to identify weaknesses before harm occurs

Question 6

Which is an example of an engineering control?

A. A warning poster

B. A training session

C. A machine guard with an interlock

D. A disciplinary rule

Correct Answer: C. A machine guard with an interlock

Question 7

What does management of change address?

A. Only changes in employee salaries

B. Risks introduced by technical, procedural or organisational modifications

C. The replacement of all legal requirements

D. Only changes made after an accident

Correct Answer: B. Risks introduced by technical, procedural or organisational modifications

Question 8

Which statement about contractor safety is most accurate?

A. All safety responsibility transfers automatically to the contractor

B. Contractor safety is unrelated to the principal organisation’s operations

C. The principal organisation should control interfaces and verify contractor competence

D. Contractors do not require induction if experienced

Correct Answer: C. The principal organisation should control interfaces and verify contractor competence

Question 9

Which practice best supports a just safety culture?

A. Punishing every human error

B. Suppressing reports that may affect performance statistics

C. Distinguishing normal error from reckless behaviour while encouraging learning

D. Ignoring repeated deliberate bypassing of safeguards

Correct Answer: C. Distinguishing normal error from reckless behaviour while encouraging learning

Question 10

Which item is strongest evidence of due diligence?

A. A signed policy that workers have never seen

B. A certificate displayed in reception

C. Verified controls, competent supervision, records and corrective-action follow-up

D. A low injury count without any other information

Correct Answer: C. Verified controls, competent supervision, records and corrective-action follow-up