Control of Work Explained: 4 Decision Gates That Prevent Unsafe Restart

A job can be fully planned and still be unready to start. The failure usually appears after the plan meets a changed field condition, a delayed isolation, a contractor handover, or pressure to restart before the original controls have been restored.

Control of work closes that gap. It keeps the decision to perform a task connected to the conditions, people, barriers, and authority that exist when the task is performed. The practical test is not whether the paperwork is complete. The practical test is whether the work remains defensible at the point of action.

Control of work is a structured decision system for planning, authorizing, verifying, interrupting, and restarting hazardous work. It makes the boundaries of the task visible, assigns authority for accepting exposure, and requires evidence that critical controls are present before people proceed.

Definition: what control of work actually controls

Control of work manages the conditions around a task, not only the task description. It asks what can change, who can decide, which barriers must be present, and what evidence is required before the next stage begins.

This distinction matters because many organizations treat authorization as a signature event. A supervisor signs a permit, an assessment receives approval, and the work is considered ready. That sequence can fail when the lifting route is blocked, the isolation is incomplete, weather changes, another crew enters the area, or the people performing the task do not understand the remaining exposure.

James Reason’s work on latent failures provides a useful lens. The unsafe restart is often the visible end of a weakness that began in planning, role clarity, maintenance, supervision, or communication. Control of work is valuable because it creates several opportunities to detect that weakness before harm occurs.

Gate 1: scope makes the work boundaries specific

The first gate establishes what the job includes and what it does not include. A useful scope describes the asset, location, energy sources, sequence, interfaces, expected duration, and conditions that would make the plan invalid.

Vague scope creates silent expansion. A maintenance task begins with one component, then absorbs an adjacent repair because access is already available. A contractor completes the planned inspection, then agrees to make an unplanned adjustment. The additional work may be reasonable, but it is not automatically covered by the first decision.

Leaders should ask whether the crew can describe the boundary in field language. If the answer depends on finding the correct document, the scope has not yet become operational. When the work changes, the scope gate must reopen rather than allowing the original authorization to carry the new exposure.

Gate 2: authorization assigns decision rights

Authorization is more than approval from EHS. It identifies the operating leader who owns the decision, the person who controls the worksite, the people who can stop the task, and the authority required to accept any residual exposure.

This gate prevents a common failure in which everyone is involved but nobody is accountable. The permit issuer believes the area owner will decide. The area owner assumes the contractor supervisor is controlling the job. The contractor expects production to confirm the restart. That chain can look collaborative while leaving the critical decision unowned.

A sound authorization record states what has been approved, which controls are mandatory, what conditions require escalation, and who must be contacted when reality no longer matches the plan. It also distinguishes technical advice from operating authority, because the person who identifies a hazard may not be the person who can allocate resources to remove it.

Gate 3: field readiness proves the barriers are present

Field readiness is the point at which the written plan meets the physical worksite. The team checks isolations, guarding, access, equipment condition, competence, communication, weather, simultaneous operations, and any temporary control that the job depends on.

The evidence should be specific enough to challenge. “Area checked” is weak because it does not show what was checked or what would have failed the gate. A stronger record identifies the control, its location, the person who verified it, and the condition that would require the job to pause.

Andreza Araujo’s work across more than 250 cultural transformation projects supports a practical principle here: people judge the organization’s real priorities through the decisions it makes under ordinary pressure. If a leader accepts a missing barrier because the schedule is tight, the field sees the operating rule more clearly than it sees the safety statement.

Gate 4: restart confirmation restores the decision

An interruption changes the status of the work. The crew may have left the area, equipment may have been moved, an isolation may have been disturbed, or another team may have changed the interface. Restart therefore requires a fresh confirmation, even when the task has not changed in name.

The restart owner should confirm what caused the pause, what conditions changed, which controls were affected, and what evidence shows that the work is ready again. A verbal “carry on” is not enough when the original decision depended on a control that may no longer be intact.

This gate also protects workers who raise a concern. A person should know what happens after the stop, who reviews the condition, and how the decision will be communicated. Without that pathway, stop-work authority becomes a slogan that places the personal cost of escalation on the person closest to the hazard.

How control of work differs from nearby tools

The tools are complementary. A control-of-work system becomes fragile when any one document is treated as proof that the entire decision chain is functioning. Leaders can compare this approach with the risk register’s role in keeping exposure visible and with temporary deviation controls when work no longer fits the approved condition.

When leaders should test control of work

Test the system when a task involves high energy, simultaneous operations, contractors, temporary controls, non-routine work, extended interruption, or a restart after an unexpected condition. Those moments expose whether the organization can make a clear decision when the schedule and the hazard are in tension.

Choose one live job and ask four questions. Is the scope still accurate? Does the named decision owner have authority? Are the critical controls visible in the field? If the work stopped now, would everyone know who must confirm the restart? The answers show more than a document audit because they reveal whether the system works under operating pressure.

Control of work is effective when it keeps uncertainty visible until someone with authority resolves it. It is not a promise that every condition will be predictable. It is a disciplined way to prevent an old authorization from becoming permission for new exposure.

Practical checklist for a safer restart

• Confirm that the task scope, location, sequence, and interfaces are unchanged.
• Identify the operating owner and the person authorized to stop or restart the work.
• Verify critical controls in the field instead of relying on the original signature.
• Record what changed during the interruption and which barriers were rechecked.
• Communicate the restart decision to every person whose work is affected.

Andreza Araujo’s book Safety Culture: From Theory to Practice offers a broader view of how visible decisions become cultural evidence. For control of work, the central lesson is direct: a safe restart is not the continuation of yesterday’s approval. It is a new decision supported by current evidence.