Critical Control Explained: 4 Proofs That a Barrier Can Hold

F7 glossary for EHS managers, supervisors, and risk owners

A critical control is a barrier that must prevent or limit a serious exposure. It matters when a task can create a serious injury or fatality, because a general list of precautions may hide the one barrier whose failure changes the consequence.

This explanation uses four practical proofs. A control should be present, functional, understood, and durable under the conditions in which work actually takes place.

A critical control is a specific barrier linked to a credible serious exposure. It may be engineered, procedural, physical, or organizational, but its value depends on evidence that it is present, performs its protective function, is understood by the people who rely on it, and remains reliable when work changes.

What does a critical control mean?

A critical control is not simply the most important item on a risk assessment. It is the barrier whose failure would allow a serious exposure to reach a person or would remove a necessary limit on the consequences. The control can be a verified isolation, a guard, a fall-prevention system, a separation distance, a tested interlock, or a decision gate that stops work when conditions are not met.

James Reason’s work on latent failures, especially Managing the Risks of Organizational Accidents (1997), helps explain why the final unsafe moment is not the whole control story. Design, planning, maintenance, supervision, and decision rights can determine whether a barrier is available before the worker reaches the exposure.

Andreza Araujo’s safety work applies the same discipline to culture and risk. Her book Safety Culture: From Theory to Practice treats declared values as credible only when daily routines and decisions support them. A critical control therefore needs more than a procedure reference. It needs observable evidence.

4 proofs that a critical control can hold

1. Presence

The first proof is simple. The barrier exists at the point where the exposure can occur, and it is available before work begins. A fall-prevention anchor, isolation point, machine guard, or exclusion zone that is missing, bypassed, or unavailable has already failed this test.

Presence includes the correct specification and location. A control that exists in a storeroom, on a drawing, or in a checklist is not protecting the task until it is installed or available where the work requires it.

2. Function

The second proof is performance. The barrier performs the action that separates the person from the energy, substance, movement, or condition that can cause harm. A closed valve is not proof of isolation if stored energy remains. A guard is not proof of protection if it can be defeated during normal access.

Verification should connect the control to a test. That may involve a zero-energy check, a functional alarm test, a measured separation, a load rating, or a documented inspection whose result is clear enough for the next decision.

3. Understanding

The third proof is shared understanding. The people who perform, supervise, and authorize the task know what the control protects, how to recognize a failed condition, and which decision follows. This is where a short teach-back can reveal a gap that a signature cannot.

Andreza Araujo’s emphasis on behavior and risk perception is useful here because workers may see the same barrier differently from the person who wrote the procedure. Ask the person closest to the task to explain the failure signal in plain language, then check whether the escalation route is usable within the next few minutes.

4. Endurance

The fourth proof is endurance. The control remains dependable across shifts, handovers, maintenance, weather, staffing changes, simultaneous work, and production pressure. A barrier that works only during a planned demonstration is not a dependable barrier.

ISO 45001:2018 supports this systems view by requiring organizations to manage operational controls, change, competence, and monitoring as connected parts of the OH&S system. Endurance asks whether those parts still support the critical control after the plan meets the field.

How can leaders differentiate the four proofs?

The table separates four questions that are often collapsed into one audit result. A control can be present but nonfunctional, functional but misunderstood, or effective on day one but unreliable after a handover. Leaders should record the weakest proof because that is where the exposure remains open.

For a deeper review, compare this glossary with six distortions that hide weak controls and the four consequence checks that keep SIF exposure visible.

When should a critical control review be used?

Use the four-proof review before high-risk work, after a serious near miss, during management of change, when a control has failed, or when favorable metrics are not supported by field evidence. It is also useful when a risk owner is accepting residual risk and needs to show which barrier makes that decision reasonable.

Across 25+ years of EHS leadership, Andreza Araujo has connected safety performance with the choices that leaders make visible. Her experience across more than 250 cultural transformation projects reinforces a practical point. The number of controls in a register says less than the quality of the few barriers that matter most.

Start with one exposure, one control, and four questions. If the evidence is weak, do not rename the weakness as acceptable residual risk. Restore the barrier, clarify the decision, and verify the result in the work area. Andreza Araujo’s books and safety resources provide further guidance for connecting culture, leadership, and prevention.