How a 19-Country EHS Network Made Technical Dissent Usable

In a 19-country EHS network, technical dissent becomes useful when people can challenge a risk decision, local leaders retain responsibility for the response, and the organization can show what changed after the concern was raised. The case is not about flattening authority. It is about making authority answerable to evidence.

Initial scenario

When Andreza Araujo served as Director SHE LATAM at Unilever, her operating context covered 19 countries, 30,000 employees, 34 factories, and more than 60 distribution centers. That scale creates a psychological-safety problem that a single-site program cannot solve with a poster or an annual survey. A concern can be technically correct, locally inconvenient, and still disappear between the person who raised it and the leader who owns the decision.

The central risk is not disagreement itself. The risk appears when disagreement has no recognized route into operational control. A supervisor may hear a maintenance engineer question a release decision, while the country team sees the issue as a local matter and the regional team receives only a polished summary. By the time the concern reaches a formal review, the evidence has been softened by hierarchy, time pressure, or the desire to show alignment.

Psychological safety in an EHS setting is not permission to disregard standards, production commitments, or decision rights. It is the ability to raise a credible concern without being punished for raising it, while the organization still expects the concern to be specific, testable, and connected to a real risk.

Why did local authority matter?

A multi-site network cannot centralize every safety decision without creating delay and distance from the work. Local leaders see the equipment condition, contractor interface, staffing pressure, and work sequence that a regional committee may never observe directly. Local authority is therefore part of the control system, provided that its decisions remain visible and reviewable.

The common mistake is to frame central governance and local ownership as opposing choices. In practice, the stronger arrangement gives each level a defined job. The site decides within its operating knowledge, the country team tests whether the decision exposes a repeated pattern, and the regional function identifies themes that deserve a common response. This is consistent with the argument in Andreza Araujo's work on safety culture transformation, where culture is read through decisions and routines rather than declared values.

Local ownership also protects dissent from becoming theater. When every concern is escalated automatically, people learn that reporting produces bureaucracy rather than a better decision. When nothing is escalated, local discretion becomes a shield against scrutiny. The operating design must make both the first response and the escalation threshold explicit.

The decision

The decision was to treat technical dissent as an input to management control, not as a personality issue. That required a change in the question leaders asked after a concern was raised. Instead of asking whether the person was being difficult, the useful question became whether the operation could demonstrate that the risk had been understood, owned, and controlled.

This shift is close to the discipline described in Safety Culture: From Theory to Practice, where maturity is visible in the quality of choices made under pressure. It also follows James Reason's distinction between active failures and latent conditions. A front-line concern can reveal a weakness in planning, supervision, design, or governance long before an incident makes the weakness undeniable.

The decision did not remove authority from plant or country leaders. It attached three conditions to authority. The owner had to state the decision, explain the evidence used, and define what would trigger review. Those conditions made disagreement operational because they converted an opinion into a traceable decision record.

How did technical dissent become usable?

Technical dissent becomes usable when it arrives in a form that another leader can test. A statement such as "this job feels unsafe" may be an important opening, but it does not yet tell the decision-maker which barrier is weak, which exposure is changing, or what evidence would confirm the concern.

The practical response is to help the person describe the concern without forcing them to win an argument. A supervisor can ask which task step changed, which control is expected to work, what was observed, and what would happen if the work continued. These questions preserve the worker's voice while giving the operation something that can be checked in the field.

That is different from demanding perfect language before action. A psychologically safe system does not require a technician to produce a finished risk assessment during a time-critical concern. It requires the leader who receives the concern to protect the pause, clarify the evidence, and close the loop. The speak-up to verified-control workflow makes this handoff visible by connecting voice, ownership, and field verification.

Execution across the network

Execution in a network of this size depends on a shared operating rhythm rather than a single centralized script. The shared element is the decision logic. Each site can use its own language and meeting structure, but the organization should still be able to answer the same questions when a concern is reviewed.

First, the receiving leader acknowledges the concern and states whether the work will pause, continue with an interim control, or move to a defined escalation route. Second, the owner records the evidence that supports the decision. Third, the leader explains the response to the person who raised the concern. Fourth, the operation verifies whether the selected control exists where the work occurs.

This rhythm prevents two forms of silence. The first is the silence of fear, where people stop raising concerns because the messenger is blamed. The second is the silence of futility, where people speak but never learn what happened. Both forms damage trust, although only the first is usually visible in a survey.

Managers also need a disciplined response to technically wrong concerns. A concern can be mistaken without being misconduct. The leader can explain the evidence, correct the assessment, and still reinforce that raising the issue was appropriate. That response teaches the team that accuracy matters and that honest uncertainty is not a career risk.

What changed in the measurable operating picture?

The verifiable result of this case is not an invented enterprise-wide percentage. It is the scale at which the EHS leadership problem had to be solved: 19 countries, 30,000 employees, 34 factories, and more than 60 distribution centers. A model that works only when one leader personally knows every supervisor is not a network model.

The measurable test is whether the organization can trace a concern across levels without losing its technical meaning. A regional leader should be able to see the original issue, the local decision, the evidence used, the escalation rule, and the field check that followed. That chain is more informative than a rising count of reported concerns because volume alone does not show whether the organization responds well.

For a C-level audience, this changes the dashboard question. Instead of asking only how many concerns were reported, ask how many received an owned response, how many resulted in a verified control change, how long unresolved concerns remained open, and which repeated themes crossed site or country boundaries. These indicators describe the reliability of the management response, not the confidence of the reporting channel alone.

What lessons generalize beyond Unilever?

The first lesson is that psychological safety needs a decision architecture. A value statement cannot define who responds, what evidence is required, or when a local issue becomes a network issue. Those rules must be designed into normal management work.

The second lesson is that local ownership and challenge are compatible. The person with decision authority should not be insulated from technical questions. At the same time, a person who raises a concern should not become the de facto owner of fixing the system. The organization must keep responsibility with the role that controls the work.

The third lesson is that response quality matters more than channel variety. A hotline, survey, app, and open-door policy can all coexist while people remain silent if managers dismiss concerns or fail to explain decisions. A smaller number of channels, followed by visible and technically serious responses, can produce stronger evidence.

The fourth lesson is that scale magnifies ambiguity. In a single plant, an informal correction may be enough to restore a control. Across many sites, that same correction can remain local and leave sister operations exposed. The network needs a way to recognize repeated signals without turning every site into a branch office of the central function.

What should an operation apply now?

A plant or regional EHS team can apply the case without copying Unilever's structure. Start by selecting one decision type in which technical dissent matters, such as non-routine maintenance, contractor work, process change, or an emergency response. Define the receiving role, the minimum evidence to capture, the pause or interim-control rule, and the person responsible for closing the loop.

Then review five recent concerns. Do not begin by judging whether the original employee was correct. Check whether the operation can show what was raised, who decided, what evidence was used, what happened in the field, and whether the person who spoke received an explanation. Missing links reveal the weakness in the response system.

Finally, take the recurring themes to the operating review. A concern that appears in several sites is not merely a communication issue. It may point to a common procedure, training gap, design weakness, or production condition that deserves a decision above the local level. This is where manager behavior after bad news becomes a safety control rather than a culture slogan.

If your operation needs to turn this logic into a practical leadership routine, Andreza Araujo's team works at the intersection of engineering, creativity, and care.

Conclusion

The Unilever case shows that psychological safety in a large EHS network is not created by removing hierarchy. It is created when hierarchy can receive technical challenge, preserve local ownership, and make the resulting decision visible from the point of work to the regional review.

For leaders, the test is direct. When someone challenges a safety decision, can the organization show what happened next? If it can, dissent has become evidence. If it cannot, the network may be aligned in language while remaining disconnected in control.