How an Unowned Risk Became an Executive Decision: An Anonymized Case Study

The work was scheduled, the permit was signed, and the risk register showed an owner. Yet when a temporary condition changed the task, nobody could say who had the authority to stop the job or approve a safer alternative. The risk was documented, but the decision was not owned.

This anonymized case study is drawn from recurring patterns observed across safety and cultural-transformation work. It does not describe a named company or claim a universal result. Its value is diagnostic. When a risk remains open because each role assumes that another role will decide, the organization has a management problem before it has an incident problem.

Initial scenario: the risk had a record but no owner

The operation had a mature-looking risk process. Assessments were available, control descriptions were written, and supervisors knew where to find the relevant documents. The difficulty appeared during a planned maintenance task that encountered a temporary configuration in the field.

The temporary condition did not fit the original task plan. The supervisor could pause the work, but could not authorize a design change. Engineering could propose a modification, but did not control the schedule. The EHS representative could advise, but did not own production rescheduling. A manager could accept the delay, although the manager expected the supervisor to resolve the matter locally.

That arrangement created a familiar illusion. Every function participated, so the organization appeared to have shared accountability. In practice, shared accountability became distributed uncertainty. The risk sat between roles, where a document could remain current while the operating decision remained absent.

The first diagnostic used the logic of decision authority in safety risk acceptance. It asked a simple question for each control. Who can identify the failure, who can stop the work, who can restore the control, and who can accept the remaining exposure?

The decision: replace a broad discussion with four precise questions

The review did not begin by asking why the team had failed to follow the procedure. That question would have directed attention toward individual compliance before the organization understood the decision structure. Instead, the review separated four issues that had been compressed into one risk-register entry.

• What exposure exists now, not only what exposure was expected during planning?
• Which control should prevent the exposure, and what evidence shows that it is available?
• Who has authority to change the task, the schedule, the design, or the staffing?
• What decision must be made before the work can continue?

This separation changed the tone of the meeting. The supervisor was no longer asked to solve a design problem with a stop-work instruction. Engineering was no longer asked to carry an operational decision without access to the schedule. The manager was no longer given a general warning that could be acknowledged without action.

The case became a decision with a boundary. Continue only if the control is restored and verified. Modify the work if the original control cannot be restored. Escalate when the required change sits outside the authority of the people closest to the exposure.

Execution: field evidence came before executive escalation

Executive attention was not the first intervention. The team first collected evidence at the point where the task had changed. That step mattered because a risk review based only on the written assessment would have repeated the same abstraction that allowed the gap to persist.

The field review compared the planned control with the control that workers could actually use. It checked the physical arrangement, the sequence of work, the temporary equipment, the isolation boundary, and the communication between the people responsible for the task. It also asked what would happen if the schedule tightened later in the shift.

The findings were not dramatic. That was part of the difficulty. The control existed in principle, yet it depended on a condition that was no longer stable. The risk assessment had not become false because the team ignored it. It had become incomplete because the work had moved beyond the assumptions on which the assessment was based.

The review used the same evidence discipline recommended in control reliability evidence tests. A control deserves confidence when it is present, correctly used, effective against the credible exposure, and verified under the conditions in which the work actually occurs.

Measured result: the organization could see where the decision stopped

The measured result was not a promised reduction in incidents. No responsible case study should convert one recovered decision into a forecast for every operation. The result was a clearer operating boundary, which can be tested and audited.

After the review, the risk record identified four separate owners instead of one vague name. The supervisor owned the immediate pause and field confirmation. Engineering owned the technical change. The operations manager owned the schedule and resource decision. The executive sponsor owned the decision when the exposure crossed the agreed authority limit.

The team also recorded the evidence required to close the loop. A risk was not considered controlled because a revised document had been uploaded. The record needed confirmation that the control was installed, that the people using it understood the changed sequence, and that the worksite remained consistent with the decision.

This distinction is central to critical-control verification. A dashboard can show that a review occurred, while the field still carries the original exposure. The stronger measure is whether the decision changed the condition that created the risk.

What changed in leadership behavior

The most important shift was not that leaders attended a longer meeting. It was that they stopped treating escalation as a sign that the local team had failed. Escalation became the correct route when the decision required authority that the local team did not possess.

That change protects supervisors from two opposite pressures. One pressure tells them to solve every problem locally, even when they lack the resources to do so. The other tells them to escalate every uncertainty, which floods senior leaders with concerns that should be resolved at the worksite.

A usable system distinguishes uncertainty from authority. A supervisor can often identify a control failure and pause work. The same supervisor may not be able to redesign equipment, change a contracted scope, or accept a residual exposure. Clarity about that boundary makes escalation faster and more legitimate.

Across 25+ years of multinational EHS work, and in more than 250 cultural-transformation projects, Andreza Araujo has emphasized that culture becomes visible when a decision carries a cost. A safety value is tested when the safer option requires time, money, redesign, or a difficult conversation with production.

Why the original risk process looked stronger than it was

The process failed in ways that are common in organizations with extensive documentation. First, the risk register treated ownership as a field to complete rather than authority to exercise. Second, the control description was not linked to evidence that could be checked after the work changed. Third, the escalation route existed in policy but not in the moment when the supervisor needed it.

These weaknesses can coexist with good intentions. People may care deeply about safety and still work inside a system that rewards closure more visibly than control reliability. A closed action, a completed review, or a signed permit can look decisive while the underlying exposure remains unresolved.

The practical correction is to make the decision chain visible. Every serious risk should have an owner who can act, a control that can be verified, an authority limit that can be understood, and a response when the work no longer matches the plan.

Lessons for EHS and operations leaders

This case offers five lessons that transfer across sectors without pretending that every exposure is the same.

1. Do not confuse a named person with a functioning owner. Ask what decision that person can make without waiting for another role.
2. Review changed conditions at the worksite. A risk assessment is a model of work, not proof that the model still matches reality.
3. Separate stopping authority from recovery authority. The person who pauses a task may not control the redesign needed to restart it.
4. Escalate a defined decision. Senior leaders can act faster when the request states the exposure, the control gap, the consequence, and the authority required.
5. Close the loop with field evidence. A revised document is an input to verification, not the verification itself.

These lessons also help leaders avoid blame. James Reason's work on latent conditions remains useful here because a visible frontline hesitation can reflect an invisible design problem in authority, resources, or work planning.

What to apply in your operation this month

Select one recurring risk that appears in meetings but returns in the field. Do not begin with the most complex risk in the business. Choose one where the exposure is understood well enough to trace, but the decision repeatedly waits between functions.

Map the four roles used in this case. Identify who sees the exposure, who can stop the work, who can change the condition, and who can accept the remaining risk. Then observe one real task and compare the map with what people actually do when the plan changes.

At the next review, require one decision rather than another general status update. If the control is reliable, show the evidence. If it is not reliable, name the action and the person with authority to complete it. If the authority is missing, take the issue to the leader who can change the condition.

The purpose is not to create another layer of approval. It is to prevent a known exposure from becoming invisible simply because it sits between organizational roles. Risk management becomes credible when the person who owns the decision can be found before the work reaches the point of no return.

FAQ about unowned safety risks