Board Review vs Critical-Risk Review vs Field Escalation: Which Forum Catches Fatal Risk

Fatal risk often becomes visible before it becomes an incident. A serious near miss appears in a shift log. A contractor repeats the same permit deviation. A critical control is marked verified although the field condition says otherwise. The signal exists, but it enters the wrong leadership forum and loses force before anyone with authority changes the work.

The practical thesis is that board reviews, executive critical-risk reviews and field escalation routines are not interchangeable. The board should test governance and risk appetite. The executive critical-risk review should test whether controls are functioning in high-consequence work. Field escalation should interrupt the task when the exposure is current. When these forums blur, leadership either discusses fatal risk too late or pushes operational decisions into rooms that cannot see the job.

Across 25+ years in executive EHS roles, Andreza Araujo has seen that senior leaders rarely lack meetings. They lack decision clarity. In Safety Culture: From Theory to Practice, she treats culture as repeated decisions under pressure, which means a leadership forum matters only when it changes authority, resources, control verification or work execution. A meeting that admires a dashboard while the field keeps improvising is not governance. It is distance with slides.

Evaluation Criteria For Leadership Forums

Choose the forum by the decision that must be made, not by the seniority of the people available. A board review is too slow for a live exposure. A field escalation is too narrow for capital allocation. An executive critical-risk review may be the right place for repeated control weakness, but it will fail if the people in the room cannot change maintenance priority, contractor conditions, shutdown timing or production sequencing.

Use six criteria. First, define whether the signal is current, repeated, systemic or strategic. Second, identify who owns the control that is failing. Third, decide whether the decision requires immediate work interruption, cross-functional action or governance oversight. Fourth, check whether field evidence is available, since executive confidence without evidence is a poor barrier. Fifth, name the time limit for action. Sixth, document what changed after the forum met.

ISO 45001:2018 expects leadership participation, consultation and incident response, but it does not decide the forum design for each company. James Reason's work on latent failures helps explain why this matters. Serious events rarely come from one bad choice at the end of the chain. They emerge when earlier decisions about design, staffing, maintenance, supervision and control verification align badly. Leadership forums must be designed to see those earlier decisions before the last person touches the hazard.

Option 1: Board Safety Review

A board safety review is strongest when the decision concerns governance, risk appetite, accountability and capital discipline. It should ask whether the organization is accepting a level of fatal risk that contradicts its declared standards. It should also test whether safety information is clean enough for directors to challenge the business, rather than merely hear reassurance from management.

The board forum is especially useful for SIF exposure trends, overdue critical capital, contractor governance, repeated high-potential events, major regulatory exposure, executive incentives and safety budget decisions. The related article on board safety oversight questions before the next SIF expands this director-level lens.

The failure mode is abstraction. Board papers often compress field risk into green indicators, polished narratives and lagging rates. A low TRIR can sit beside weak isolation, poor line breaking, unreliable contractor supervision or known machine-guarding gaps. If directors only see aggregate injury rates, they may believe safety is improving while fatal exposure is concentrating.

Use the board review as the lead forum when the question is whether the enterprise is funding, governing and holding leaders accountable for high-consequence risk. Do not use it to decide whether a specific job restarts tomorrow morning. The board should set the expectation that live exposure is escalated immediately, while systemic recurrence returns to the board with evidence, owner, investment decision and due date.

Option 2: Executive Critical-Risk Review

An executive critical-risk review is strongest when the organization needs a cross-functional decision on high-consequence work. It should bring operations, maintenance, engineering, EHS, procurement and site leadership together around field evidence, not around a generic dashboard. The question is whether critical controls are present, functioning and owned by someone with authority to act.

This forum fits repeated permit-to-work deviations, failed isolation verification, bypassed interlocks, overdue pressure-equipment actions, unstable contractor performance, fatigue risk in high-risk tasks and weak restart readiness after shutdown. The guide on running an executive critical-risk review in 45 minutes gives the operating rhythm for this kind of meeting.

The strength is decision compression. A plant manager can change production timing. Maintenance can change priority. Engineering can confirm whether a temporary control is defensible. Procurement can challenge a contractor condition. EHS can test whether the evidence supports restart. When those roles meet around the same exposure, the forum can remove the gaps that one function alone cannot close.

The failure mode is theater. If the review becomes a monthly presentation of percentages verified, overdue actions and color-coded risk registers, it will look mature while missing the job that is drifting today. Critical-risk review only works when leaders ask for samples, photographs, permit evidence, supervisor notes, failed checks, repeated deviations and decisions that were changed because the evidence was uncomfortable.

Option 3: Field Escalation Routine

A field escalation routine is strongest when the exposure is current and the decision must interrupt, slow, redesign or stop the task. It belongs at the workface, where supervisors, workers, contractors and EHS can see the control condition before the job proceeds. The routine should be fast, explicit and protected from retaliation.

This forum fits missing isolation confirmation, changed scope, unsafe access, weather change, line-of-fire exposure, unclear lift conditions, conflicting permits, scaffold concerns, fatigue signs, alarm conditions or any weak signal that makes the crew uncertain about a critical control. The articles on seeing real field risk during a gemba walk and closing the loop after stop work support this field-level practice.

The strength is immediacy. A field escalation does not wait for the next committee, monthly dashboard or executive calendar. It protects the people who are facing the hazard now. In more than 250 cultural transformation projects supported by Andreza Araujo, one repeated pattern is that workers judge leadership by what happens when field reality contradicts the plan. If the work continues anyway, the formal forum loses credibility.

The failure mode is containment without escalation. A supervisor may solve the immediate condition and restart safely, but the repeated pattern never reaches executives. The company then treats each weak signal as local variation, even though the same permit gap, contractor pressure or maintenance delay is appearing across areas. Field escalation must have a route upward when the same exposure repeats.

Decision Matrix

The matrix separates the three forums by the decision they are competent to make. The point is not to rank one forum as superior. The point is to prevent fatal risk from entering a room that lacks either speed, evidence or authority.

The management rule is direct. Live exposure needs field escalation. Repeated or cross-functional exposure needs executive critical-risk review. Strategic tolerance of fatal risk needs board challenge. A company that sends all three questions to the same forum will either overreact administratively or underreact operationally.

Recommendations By Context

For directors, the best move is to request a fatal-risk agenda that separates injury frequency from high-consequence exposure. Ask which critical risks have weak control verification, which actions are overdue because of capital or staffing constraints, and which repeated events indicate that the business is accepting a risk it has not formally approved. The article on safety budget cuts that expose risk can help frame those questions when resources are under pressure.

For CEOs and senior executives, the priority is to install a critical-risk review that can make decisions during the month, not merely explain performance after the month closes. The review should receive field evidence, test control quality, assign owners and decide whether production sequencing, contractor terms or maintenance priority must change.

For plant managers, the practical test is whether field escalation has a protected path. If a supervisor stops a task because a critical control is uncertain, the organization should know who verifies the control, who approves restart and when repeated signals move upward. Without that path, the plant becomes dependent on individual courage instead of system design.

For EHS managers, the task is translation. Field signals must be written in operational language, executive reviews must receive evidence rather than slogans, and board papers must show governance exposure without drowning directors in technical detail. This is one reason Andreza Araujo's safety culture work connects leadership cadence with field verification, because culture is visible when information moves to the right decision level before harm occurs.

Traps That Send Fatal Risk To The Wrong Forum

The first trap is treating board attention as a substitute for operational control. A director can ask the right question and approve investment, but the board cannot verify a lockout, inspect a confined-space atmosphere or decide a restart condition at the workface. Governance must require operational proof, not replace it.

The second trap is treating executive review as a reporting meeting. When the agenda is built around completed actions, lagging indicators and reassuring percentages, leaders do not see the unresolved exposure. A critical-risk review should spend more time on failed checks, repeated deviations and contested restart decisions than on the parts of the system already working.

The third trap is leaving field escalation local forever. Supervisors often solve practical problems quickly, which is valuable, but repeated local fixes can hide systemic weakness. If five crews escalate the same permit confusion in different weeks, that is no longer a local issue. It belongs in the executive review, and possibly in the board packet if resources or governance are blocking correction.

The fourth trap is confusing speed with informality. A field escalation can be fast and still disciplined. It needs a named owner, evidence of the condition, a restart rule and a record of whether the signal was isolated or repeated. Without those elements, the organization may restart safely today while losing the pattern that should have changed tomorrow's planning.

Where To Start In The Next 30 Days

Start by reviewing the last ten high-potential events, serious near misses or critical-control failures. For each one, mark where the signal first appeared, which forum received it, what decision was needed and what decision actually changed. The mismatch will usually be visible. Some issues went too high and became abstract. Others stayed too low and became invisible.

During week one, define the trigger for field escalation. During week two, define the trigger for executive critical-risk review, especially repeated or cross-functional control weakness. During week three, define what reaches the board, including fatal-risk exposure, overdue governance decisions and resource constraints. During week four, test one live example through all three routes and check whether evidence, owner, time limit and decision are clear at each level.

The goal is not to add more meetings. The goal is to make each forum protect a different kind of decision. When live exposure goes to the field, repeated control weakness goes to executives and strategic tolerance goes to the board, leadership becomes faster where it must be fast and more demanding where it must govern.