How to Build a 6-Gate Risk Acceptance Review for Non-Routine Maintenance

Risk acceptance is often treated as a signature at the end of a form. That is too weak for non-routine maintenance, because the decision to proceed depends on changing conditions, incomplete information, and controls that may not be ready when the work team arrives.

This guide shows an EHS manager, maintenance manager, or operations leader how to build a six-gate risk acceptance review for non-routine maintenance. The review is designed to make the decision visible, assign ownership, and stop a weak control package from becoming an accepted exposure.

The central idea is simple. Risk acceptance should be a managed decision with evidence, not a permission slip that transfers uncertainty to the crew. ISO 31000:2018 provides a useful basis for treating risk as part of decision-making, while ISO 45001:2018 requires organizations to manage hazards, operational controls, and change in a planned way.

What you need before starting

Choose one decision owner who can authorize the work, pause it, or require additional controls. Gather the work scope, the current risk assessment, the permit or authorization requirements, isolation information, contractor details, emergency arrangements, and the evidence that critical controls are available.

Keep the review proportional to the exposure. A short review may be enough for a controlled task with familiar hazards, while simultaneous operations, process isolation, confined space entry, lifting, energized work, or work at height may require several technical owners. The review should be completed close enough to the start that the decision reflects current conditions.

Step 1: Define the decision boundary

Write exactly what is being accepted. The boundary should identify the task, equipment, location, time window, work group, interfaces, and conditions that would make the decision invalid.

A weak statement says that maintenance will be performed safely. A usable boundary says that a contractor will replace a valve on Line 4 during the planned isolation window, with operations controlling the isolation and maintenance controlling the worksite. The second statement gives the team something that can be checked.

Verification is complete when the decision owner can explain where the review applies and where it does not. If the scope changes, the review returns to the appropriate gate instead of being treated as a permanent approval.

Step 2: Describe the serious exposure

Do not begin with a list of every conceivable hazard. Start with the credible serious outcomes that could change the decision. Ask what could kill, permanently injure, release hazardous energy, or create an uncontrolled escalation if the planned controls fail.

Connect each outcome to the mechanism that could produce it. For example, a stored-pressure release may depend on an isolation that is incomplete, a drain path that is blocked, or a verification step that was assumed rather than performed. This makes the review operational instead of theoretical.

James Reason's work on latent failures is relevant here because serious events often reflect weaknesses that were already present in design, planning, supervision, or maintenance. The review should therefore examine the conditions around the task, not only the action of the person nearest the hazard.

Step 3: Name the critical controls and their owners

List the controls that must work for the exposure to remain tolerable. Include engineering controls, isolation boundaries, permits, competent supervision, monitoring, exclusion zones, rescue arrangements, and communication rules when they are material to the decision.

Assign one owner to each control. The owner is responsible for showing its status, explaining any limitation, and escalating if the control is unavailable. Shared responsibility can sound collaborative while leaving nobody accountable at the moment the work starts.

Use a control table with four questions. What is the control supposed to do? Who confirms it? What evidence will be accepted? What happens if it is unavailable? A control that has no owner or no response condition is not ready for acceptance.

Step 4: Test the evidence at the worksite

Review documents, then verify the conditions that documents cannot prove. A signed isolation certificate does not by itself prove that the equipment is in the expected state. A training record does not prove that the assigned person can perform the task under the current conditions.

Ask the control owner to show the evidence. This may include a field verification, an equipment status, a test result, a current drawing, a gas reading, a barrier inspection, or a direct conversation with the person who will execute the control. Record the time and the person who provided the confirmation.

The control-of-work decision gates should support this review, not replace it. The important question is whether the evidence describes the worksite that exists now.

Step 5: Challenge the plan against change and pressure

Ask what has changed since the work was planned. Consider weather, staffing, shift handover, production demand, adjacent work, equipment condition, contractor familiarity, access, fatigue, and any deviation from the original sequence.

Then test the pressure around the decision. Would the work still proceed if the deadline moved by one shift? Can the supervisor pause without personal consequences? Who receives bad news when a critical control is late? These questions expose whether the formal decision is supported by real authority.

Andreza Araujo's safety leadership work consistently connects credibility with what leaders do when operational pressure appears. A risk review is credible only when the organization is prepared to delay work rather than lower the standard quietly.

Step 6: Record acceptance, conditions, and the next review

The final decision should state whether the work is accepted, rejected, or accepted only with defined conditions. Write the conditions in observable terms, assign owners, and set the point at which the decision will be revisited.

A condition such as “maintain awareness” is too vague to verify. A stronger condition identifies the required action, the responsible person, and the evidence. For example, work may start only after operations confirms zero energy at the defined test point, the supervisor reviews the result with the crew, and the permit displays the current isolation boundary.

Close the review by recording unresolved questions, the next checkpoint, and the authority for stopping the task. A decision that cannot be revisited when conditions change is not risk management. It is a one-time assumption.

How to know the review is working

Measure the quality of decisions, not the number of forms completed. Review whether risk acceptance records identify serious exposure, named control owners, current evidence, clear conditions, and a response when a control is unavailable.

Look for recurring patterns. Are the same controls accepted with the same missing evidence? Do reviews happen after the work has already started? Are supervisors escalating changes, or are they rewriting the plan to preserve the schedule? These signals show whether the review is improving decisions or simply adding administrative activity.

Use the findings to improve planning, design, competence, and supervision. When a gate fails repeatedly, the organization should fix the condition that makes the gate necessary rather than asking reviewers to become more vigilant.

Final checklist for a six-gate risk acceptance review

• The task boundary identifies the work, location, people, interfaces, and invalidating changes.
• The serious exposure is connected to a credible mechanism and consequence.
• Every critical control has one accountable owner and an accepted verification method.
• Evidence is checked against current field conditions, not only against records.
• Operational pressure, staffing, simultaneous work, and change are discussed openly.
• The decision records acceptance status, conditions, unresolved questions, and the next review point.

A strong risk acceptance review does not make hazardous work disappear. It makes the decision to proceed more honest. When the boundary is clear, the serious exposure is understood, the controls have owners, and the evidence is current, leaders can decide with discipline. When those conditions are absent, the safest decision is to pause and improve the work package before exposure begins.

For further guidance on practical safety leadership and risk decisions, explore Andreza Araujo's books and resources.