Healthy Safety Numbers: 5 Board Decisions That Expose Risk

A board can receive a favorable safety report and still be making decisions with poor visibility of fatal risk. That happens when low injury counts are treated as proof that critical controls are working, even though the report does not show exposure, barrier health, or unresolved exceptions.

The central question is not whether the numbers look healthy. It is whether the board can explain what changed in the work, which controls were verified, and how quickly a serious exposure would be escalated. ISO 45001:2018 requires leadership involvement in the occupational health and safety management system, but a dashboard can satisfy a review ritual without improving the decisions behind it.

Why healthy safety numbers can hide serious exposure

Recordable injuries are important, yet they are backward-looking signals. A plant with 0 lost-time injuries over 180 days may have improved, or it may have experienced few reportable events while high-energy work continued with weak barriers. The number alone cannot distinguish those conditions.

James Reason's work on organizational accidents explains why a harmful event can emerge from several aligned weaknesses rather than one careless act. That logic matters in the boardroom because a favorable outcome can coexist with latent failures in design, supervision, maintenance, contractor control, and escalation.

Andreza Araujo's *Muito Além do Zero*, known in English as *Far Beyond Zero*, makes the same governance point from a practical safety perspective. A zero target can become dangerous when leaders reward the outcome while ignoring the quality of prevention decisions that produced it.

Decision 1: Stop treating TRIR as a control-health score

Total Recordable Incident Rate, or TRIR, describes a class of recorded outcomes. It does not tell the board whether an isolation was tested, a lifting plan was followed, or a temporary repair changed the energy profile of the job. Treating TRIR as a control-health score turns a lagging indicator into a conclusion it cannot support.

The board should ask management to place outcome measures beside evidence of exposure and control performance. A useful review may include TRIR, DART, serious-injury-and-fatality potential, overdue critical actions, verified barrier tests, and the number of work changes that bypassed the normal authorization path.

The distinction is practical. The article TRIR versus critical-control verification and exposure review explains why different evidence answers different governance questions. The board does not need more metrics if the existing ones are being asked to answer the wrong question.

Decision 2: Ask which fatal exposures are active now

A board should be able to name the organization's highest-consequence exposures without waiting for an incident report. Depending on the operation, the list may include mobile equipment interaction, stored energy, confined space entry, work at height, process containment, or structural integrity.

This does not mean presenting a long hazard register. It means identifying the small set of exposure pathways whose failure could produce a fatality or multiple serious injuries, then showing whether the controls for those pathways are present, understood, and dependable during real work.

Ask for the last 30 days of evidence, not only the annual average. Require the report to show how many planned verifications were completed, how many found a weakness, how many weaknesses remain open, and who had authority to stop the task when the control was not ready.

A low event count with rising exposure, repeated overrides, or delayed corrective work should be treated as a decision signal. It is not proof of improvement.

Decision 3: Require proof that critical barriers can hold

A control written in a procedure is not automatically a dependable barrier. The board should ask what proof exists that the barrier works under the conditions in which people actually perform the task, including night work, contractor work, production recovery, and abnormal situations.

For each critical control, the evidence should answer four questions. Is the control specified? Is an owner named? Was the control verified in the field? What happened when the verification found a gap? These questions move the discussion from document presence to operational reliability.

The distinction is developed in Critical Control Explained, which describes the evidence a leader should request before accepting a barrier as dependable. The board should not accept a green status when the evidence is only a signed checklist.

During Andreza Araujo's 25+ years in multinational EHS leadership, the recurring governance challenge has been translating safety intent into decisions that survive pressure. That is why control verification belongs in the executive conversation, not only in the field audit file.

Decision 4: Separate data quality from data volume

A dashboard can contain 20 measures and still provide weak evidence if definitions change between sites, reports arrive late, or supervisors record activities that were never verified. Data quality is a management control because poor information changes which risks receive attention.

Board members should ask whether the organization can trace a reported number to its source, definition, owner, date, and decision. They should also ask whether a missing value is shown as missing or silently converted into a favorable result.

Five checks are useful before a metric enters a board pack. Confirm the definition, test the denominator, review unusual changes, sample the source record, and document the action that the metric triggered. The guide Safety Data Quality Explained expands this review for leaders who need trusted evidence rather than more visual polish.

ISO 45001:2018 calls for monitoring, measurement, analysis, and evaluation, but the standard does not make a weak measure reliable by itself. Governance begins when leaders challenge how the number was produced.

Decision 5: Set an escalation line before the metric turns red

Risk escalation should not depend on a serious injury, a dramatic near miss, or a director's personal alarm. The board should define which conditions require immediate notification, which require a time-bound management response, and which can remain within routine review.

A practical escalation line can combine consequence, exposure, control weakness, and delay. For example, an unverified critical barrier on an active high-energy task should move faster than a minor documentation error, even if the documentation error appears more often in the monthly report.

Risk appetite, risk tolerance, and risk capacity are often used as if they were interchangeable. They are not. The board-level distinction described in Risk Appetite vs Risk Tolerance vs Risk Capacity helps leaders specify when a risk is accepted, when it must be reduced, and when the organization lacks capacity to carry it.

Make the trigger visible. A supervisor should know what to do within 1 hour, an operations manager should know what must be resolved within 24 hours, and the board should know which unresolved conditions cannot pass the next reporting cycle.

A boardroom comparison that changes the question

The table below shows how the same report can lead to different decisions depending on the evidence paired with the outcome metric.

The point is not to discard outcome measures. It is to stop asking them to carry the full burden of assurance. Good governance pairs an outcome with evidence of exposure, control performance, and response quality.

What leaders should review before accepting the report

Before approving a favorable safety report, the chair or lead director should ask management to show the five decisions behind the numbers. Which exposures are active? Which barriers were verified? Which exceptions were accepted? Which data were incomplete? Which escalation thresholds were crossed?

The review should include at least 3 time horizons. The board needs the current month for active exposure, the previous quarter for recurring weaknesses, and the previous 12 months for trends that a single reporting period can conceal.

It should also include one disconfirming question. Ask what evidence would show that the apparent improvement is false. Leaders who can answer that question are less likely to confuse a clean dashboard with a controlled operation.

The test for the next board meeting

Ask one sentence of every safety dashboard: what decision should change because of this number? If no one can answer, the measure is probably reporting activity, history, or administrative completion rather than guiding risk control.

A board does not need to become an audit team. It needs enough evidence to distinguish fewer recorded injuries from fewer dangerous exposures, and enough authority to require action when the difference matters.

That is the governance lesson behind *Safety Culture: From Theory to Practice* by Andreza Araujo. Safety performance becomes credible when leadership choices, field controls, and reported outcomes point in the same direction. If they do not, the board should trust the unresolved exposure, not the reassuring number.

For leaders who want to strengthen this discipline, Andreza Araujo's *Safety Culture Diagnosis: Learn how to do your own* provides a practical route from perception data to management decisions.