Control Drift: 5 Myths That Keep Risk Assessments Stale

A risk assessment can remain signed, current in the database, and wrong for the work. When a control changes, a crew is replaced, or production pressure compresses the task, the risk picture can drift without any field event forcing a review.

Control drift is the widening gap between the protection a risk assessment describes and the protection the operation can actually deliver. This article examines five myths that allow that gap to grow, then translates each correction into a decision for EHS managers, risk owners, and frontline supervisors.

Why control drift deserves a separate review

Risk management is not complete when a hazard has been scored. It is complete when the organization can explain which control protects people, who owns it, what evidence shows that it works, and what change would trigger a new decision. ISO 31000:2018 describes risk management as an integrated process, which means the assessment cannot be detached from operations, governance, and review.

Andreza Ara�jo makes the same distinction in A Ilus�o da Conformidade, whose central warning is that a completed requirement can create false confidence when it is no longer connected to the work. A form may prove that an assessment existed at one point. It cannot prove that the barrier still holds under current conditions.

The practical question is not whether the score changed. It is whether the exposure, control, decision rights, or evidence changed. If any of those four elements moved, the assessment may need a new decision even when the risk matrix displays the same color.

Myth 1: A risk assessment stays valid until its review date

A calendar date is an administrative boundary, not proof that the operating risk is stable. A review scheduled every 12 months can miss a change that occurred after 12 hours, particularly when a contractor, temporary control, new material, or altered production sequence enters the task.

The myth survives because expiry dates are easy to audit. The harder test is whether the assumptions behind the assessment are still true. HSE guidance on managing risk places emphasis on identifying hazards, deciding who may be harmed, and reviewing controls, rather than treating the document as a permanent authorization.

Replace the date-only rule with four triggers: a change in equipment, a change in people or competence, a change in task sequence, and a control failure or near miss. A supervisor does not need to rewrite every paragraph. The supervisor does need authority to reopen the decision before work continues.

Myth 2: A lower score proves that the risk was reduced

A lower score can reflect a real improvement, but it can also reflect a softer severity estimate, a different assessor, or a control that was assumed rather than tested. The number describes the assessment method. It does not independently verify the condition in the field.

Suppose a confined-space assessment moves from 16 to 8 after a ventilation control is added. The reduction is meaningful only if the ventilation capacity, alarm response, inspection interval, and rescue route are defined and evidenced. Four pieces of paperwork should not be mistaken for four functioning safeguards.

NIOSH places elimination and engineering controls above administrative controls and personal protective equipment because controls that depend less on perfect human action usually provide stronger protection. A score should therefore be challenged when the claimed improvement comes mainly from instructions, reminders, or presumed compliance.

Myth 3: The risk owner is the person who completed the assessment

The author of an assessment may understand the hazard, yet authorship does not create authority over the equipment, staffing, budget, or operating decision that keeps the control effective. When those responsibilities are blurred, the EHS function becomes accountable for a condition it cannot change.

An effective risk owner is the role that can allocate resources, change the work, accept residual risk within defined limits, or stop the activity. The person who enters the data can support that decision, but should not silently inherit it.

Use a two-part record. Name the operational owner and name the technical adviser. Then record the evidence that each role must provide before the task starts. This arrangement makes escalation visible when a control needs design work, procurement, maintenance, or a staffing change.

Myth 4: More controls always mean less risk

Five weak controls do not automatically outperform one well-designed control. A long action list can conceal the fact that every item depends on the same supervisor noticing the same deviation during a busy shift.

Control quality depends on independence, reliability, detectability, and recovery. If a permit, toolbox talk, observation, and checklist all depend on the same rushed conversation, they may be four descriptions of one fragile administrative layer rather than four independent barriers.

Ask what changes the exposure if the first control fails. If the answer is another reminder to perform the same action, the assessment has accumulated activity rather than protection. The critical-control verification method offers a useful adjacent test because it asks for evidence that a barrier can hold under operating conditions, not merely evidence that someone listed it.

Myth 5: Frontline challenge means the risk assessment process has failed

A challenge from the person performing the work is often the earliest evidence that the assessment has lost contact with reality. Treating that challenge as resistance teaches people to preserve the document instead of improving the control.

Technical disagreement becomes useful when the organization separates the person from the problem, records the changed condition, and routes the decision to someone with authority. The aim is not to approve every objection. The aim is to ensure that a credible concern receives a reasoned response before exposure is normalized.

For supervisors, the response can fit in three questions. What changed since the assessment? Which control is now harder to execute? What evidence would allow the work to continue safely? The answers should update the decision log, not disappear into a verbal exchange.

Andreza Ara�jo's book Make The Difference: Be a Leader in Health & Safety treats leadership presence as an operating responsibility. That principle matters here because a supervisor who receives a challenge and returns with a visible decision strengthens the control system, while a supervisor who dismisses it protects the paperwork instead.

What to do now when control drift is suspected

Start with one high-consequence task rather than a full-system campaign. Compare the last approved assessment with the current work in five fields: exposure, control, owner, evidence, and decision trigger.

• Mark each field as unchanged, changed, unknown, or no longer applicable.
• Escalate every unknown that affects a serious-injury or fatality exposure.
• Test the critical control under the same conditions in which the work occurs.
• Record the decision, the owner, and the next verification time.
• Close the review only when the operating condition, not just the document, is clear.

A useful governance cadence is a 30-day review for newly changed controls, a 90-day review for recurring drift, and an immediate review after a control failure or material change. Those intervals are decision prompts, not substitutes for judgment.

For a practical next step, compare this review with the risk-acceptance gate for frontline supervisors and the stale-risk-picture test for risk registers. Together, they help connect assessment, ownership, and verification.

Turn risk assessments into decisions that survive operational change. Explore Andreza Ara�jo's safety leadership resources for practical methods that connect culture, control, and accountability.

Conclusion: the assessment is only as current as the control

Control drift begins when the organization treats an assessment as a finished product instead of a living decision. A current date, a lower score, a longer control list, or a completed signature cannot replace evidence that the barrier still works.

The corrective move is specific. Reopen the assessment when the exposure, control, owner, or evidence changes, then require a decision that the operation can verify. That is how risk management moves from document maintenance to protection that people can rely on.