How to Build a Field Risk Escalation Matrix in 10 Days

A field risk escalation matrix is a decision tool that tells the frontline exactly when a risk must move from local control to supervisor, EHS, operations, engineering, or executive authority. It is not another risk matrix. A risk matrix estimates exposure, while an escalation matrix decides who must act when the work no longer matches the assumptions that made the task acceptable.

The thesis of this guide is direct: many companies do not fail because nobody saw the weak signal. They fail because the weak signal stayed trapped at the lowest level of authority. A missing guard, a changed lift path, a bypassed interlock, an unverified isolation, or a contractor improvising a method can be visible for hours, yet nobody knows whether to pause, escalate, or accept the residual risk. That is cultural drift in operational clothing.

Across more than 250 cultural transformation projects, Andreza Araújo has observed that mature safety cultures give people clear authority before the difficult moment arrives. In *Sorte ou Capacidade* (Luck or Capability), Andreza argues that prevention cannot depend on luck, heroic individuals, or the intuition of whoever happens to be present. A field escalation matrix turns that position into a working routine for EHS managers and supervisors.

What you need before starting

Before building the matrix, gather four inputs: the current risk register, the list of critical controls, the stop-work procedure, and the authority table for residual-risk acceptance. If those documents disagree, the escalation matrix will expose the disagreement quickly. That is useful, because hidden disagreement is one of the reasons field teams delay escalation.

You also need a small design group with one operations leader, one EHS manager, one maintenance or engineering representative, one frontline supervisor, and one contractor interface owner if outsourced work is common. The group should review existing decisions on risk trigger thresholds for safety decisions, because a field matrix should translate thresholds into action rather than repeat policy language.

Step 1: Choose the scope of the matrix

Start with one high-risk work family instead of trying to cover the whole operation. Good first scopes include confined space, energized work, lifting and rigging, line breaking, machine intervention, work at height, hot work, contractor mobilization, or temporary change. The first version should prove the method where the cost of delay is visible and where supervisors already face hard decisions.

The verification test is whether the scope has recurring field variation. If every task is routine and stable, the matrix may add little. If conditions change because of weather, equipment condition, simultaneous operations, contractor handoff, missing parts, production recovery, or permit changes, escalation rules are needed because the original risk assessment cannot predict every field deviation.

Step 2: Define observable escalation triggers

Write triggers in field language. Do not write vague labels such as high risk, unsafe condition, poor behavior, or concern from the workforce. Write what people can see: critical control absent, isolation point not proven, lifting plan changed, exclusion zone breached, competent person unavailable, permit condition not met, rescue resource not ready, equipment defect not classified, or contractor method different from the approved plan.

ISO 45001:2018 expects organizations to identify hazards, assess risks, and determine controls, but the standard does not decide for a shift supervisor which field signal crosses the line. That is management work. Andreza Araújo's position on safety culture is relevant here because symbols and slogans do not control risk. What controls risk is the visible routine that makes escalation normal when facts change.

Step 3: Split triggers into three escalation levels

Use three levels because field teams can remember them under pressure. Level 1 means the supervisor can correct the condition locally and record the action. Level 2 means work pauses until EHS, operations, or engineering validates a temporary control. Level 3 means the activity stops and only the named risk owner or senior operations authority can restart it after residual risk is reviewed.

This three-level design prevents two common failures. The first is escalation inflation, where every deviation becomes an emergency and the system loses credibility. The second is escalation avoidance, where supervisors keep serious exposure local because the process feels too heavy. A practical matrix gives each level a decision, a time expectation, and a restart rule.

Step 4: Assign decision rights by role

For each trigger level, assign who can pause work, who can approve a field correction, who can define a temporary control, who can accept residual risk, and who must be informed after the decision. Avoid naming departments only. Departments do not answer radios, walk to the job, or sign restart decisions. Name roles such as shift supervisor, area manager, EHS manager, maintenance engineer, risk owner, site director, or contractor manager.

The matrix should connect with safety risk acceptance authority because acceptance without authority becomes informal permission. If a supervisor accepts residual risk that belongs to a plant manager or asset owner, the organization has not empowered the field. It has abandoned the field.

Before a matrix allows work to restart, define whether the situation requires rejection, escalation, conditional approval, or formal risk acceptance. That vocabulary prevents supervisors from turning a high-consequence residual risk into an informal local compromise.

Step 5: Define the evidence required before restart

Escalation without evidence becomes debate. For each trigger, define the evidence needed before work restarts: photo of restored guard, gas-test record, isolation verification, revised lift plan, competent-person sign-off, engineering note, updated permit, toolbox re-brief, or physical verification by the risk owner. The evidence should prove that the control exists and works, not merely that someone agreed to continue.

This is where many organizations confuse paperwork with control. A signed field form does not prove that a barrier is functioning. In risk management, the useful question is whether the evidence would help an independent reviewer understand why the restart decision was reasonable at that exact moment.

Step 6: Connect the matrix to dynamic risk assessment

The escalation matrix should not replace pre-task review. It should tell the supervisor what to do when the pre-task review discovers a condition outside the approved plan. A dynamic risk assessment identifies the change. The escalation matrix decides whether that change can be corrected locally or must move to higher authority.

The relationship matters because field routines often stop at awareness. The article on the 15-minute dynamic risk assessment routine explains how supervisors can identify changed conditions quickly. This guide adds the next layer: once the change is visible, the team needs a decision path that survives production pressure.

Step 7: Build the one-page matrix

Keep the matrix to one page for the pilot. Use columns for work family, trigger, escalation level, immediate action, decision owner, required evidence, restart authority, and record location. Put the most serious triggers first so supervisors do not have to search during a live decision. If the table needs six pages, the design group is writing a manual rather than a field tool.

A usable matrix reads like an operating instruction. For example, if a machine guard is removed and the task is not covered by an approved maintenance method, the immediate action is stop work, the decision owner is maintenance plus EHS, the evidence is the approved method and restored guarding or equivalent engineered control, and restart belongs to the area manager or named risk owner.

Step 8: Test it through a pre-mortem

Before launch, run a pre-mortem with supervisors and operators. Ask them to imagine that a serious incident happened despite the matrix, then ask where the matrix failed. Did the trigger appear too late? Was the decision owner unavailable? Did the restart evidence depend on trust rather than proof? Did contractors understand the same words? Did production pressure create a shortcut around Level 2 or Level 3?

This test should connect with pre-mortem workshop steps for critical work because the value sits in finding failure before the event. James Reason's work on latent failures also supports this approach: serious events often travel through organizational conditions that existed before the last person touched the job.

Step 9: Link repeated escalations back to the risk register

After the pilot starts, track repeated triggers. If the same escalation appears three times in a month, do not treat it as a local nuisance. Review the risk register, critical-control register, training method, procurement rule, or maintenance plan. Repetition means the field is reporting a system weakness that has not yet been resolved.

The link to risk register cleanup in 30 days is important because a register that never changes after field escalation is only an archive. ISO 31000:2018 treats monitoring and review as part of risk management. Field escalation is one of the richest review inputs because it shows where planned controls are being challenged by real work.

Step 10: Launch with supervisors before expanding

Train supervisors first, then operators, then contractors. Supervisors need practice with three scenarios for each work family: one Level 1 correction, one Level 2 pause, and one Level 3 stop with senior restart. The exercise should include radio communication, evidence capture, and the handoff to the decision owner. If the first use of the matrix occurs during a live high-risk job, the launch was late.

Measure the first 30 days with a small dashboard: number of escalations by level, time from trigger to decision, repeated triggers by work family, restart decisions without evidence, and cases where the decision owner was unclear. Andreza Araújo often frames safety leadership as presence plus consequence. In this context, consequence means leaders review the escalations, remove blockers, and make the next field decision easier.

Final checklist before approval

• The matrix covers one high-risk work family before scaling.
• Triggers are observable and can be described without personality labels.
• Each level has immediate action, decision owner, evidence, and restart authority.
• Residual-risk acceptance matches the site's authority table.
• Repeated escalations feed the risk register and critical-control review.
• Supervisors have practiced Level 1, Level 2, and Level 3 scenarios.

A field risk escalation matrix is not bureaucracy. It is a way to prevent weak signals from dying in the gap between field knowledge and management authority. In *Muito Além do Zero* (Far Beyond Zero), Andreza Araújo challenges organizations that confuse the absence of accidents with the presence of control. The escalation matrix makes that challenge practical because it asks leaders to prove that the organization can act before the event, not only explain itself afterward.