How to Build a Safety Decision Log in 30 Days

A safety decision log is a disciplined record of the choices leaders make when weak signals, control doubts, overdue actions, or production pressure change the risk picture. It matters because safety leadership becomes real only when the organization can see who decided, based on what evidence, by when, and with what follow-up.

Many leadership teams already have incident reports, dashboards, audit findings and action trackers. The missing layer is usually different. They cannot reconstruct why a supervisor accepted a temporary workaround, why a risk owner delayed a control repair, or why a plant manager kept work running after a warning signal appeared.

The thesis of this guide is direct: a decision log is not more paperwork if it captures the decisions that already shape exposure. It becomes waste only when EHS records trivia instead of the few choices that can prevent serious harm.

What you need before starting

Before building the log, define the scope, the accountable leader, the risk categories that deserve entry, and the weekly review rhythm. A useful first version can start with high-risk work, SIF exposure, contractor interfaces, critical-control failures, repeated weak signals and overdue corrective actions that have reached leadership level.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture appears in repeated choices, not in the words printed on a banner. The decision log makes that idea visible because it records whether leaders chose control, delay, escalation, substitution, stop work or acceptance under pressure.

Across 25+ years leading EHS in multinationals and supporting 250+ cultural transformation projects, Andreza Araujo has seen that leadership teams often discuss risk intensely and still leave the room without a named decision. That gap is where the log earns its place.

Step 1: Define which decisions deserve a log entry

Start by excluding routine administrative activity. The log should capture decisions that change risk exposure, such as accepting a temporary control, escalating a repeated deviation, delaying a corrective action, stopping a task, approving contractor mobilization, or changing the sequence of high-risk work.

The common error is logging every meeting note because the team wants to appear disciplined. That creates a document nobody reads. A better rule is that an entry is required when a reasonable leader could ask, thirty days later, why the organization chose that path.

For a plant leadership team, connect the entry rule with existing live-risk routines such as risk trigger thresholds. When a threshold moves from watch to verify, escalate or stop, the decision should appear in the log with evidence and owner.

Step 2: Choose the minimum fields

Use a short template with enough structure to reconstruct the choice. The minimum fields are date, site or area, risk topic, weak signal or evidence, decision made, decision owner, dissent or unresolved concern, required action, deadline, verification method and closure status.

Do not add fields that leaders cannot maintain during a real operating week. A 22-column spreadsheet may impress a committee, although it usually fails when production pressure rises. The first version should fit on one screen and still answer the question that matters: what changed because leadership saw the risk?

The decision owner should be the person with authority to change conditions, not the person who typed the note. That distinction protects EHS from becoming the custodian of decisions that operations actually owns.

Step 3: Set decision categories that match real risk

Create categories that reflect how the site loses control. Useful categories include critical-control failure, temporary workaround, overdue action, contractor interface, permit exception, repeat deviation, stop-work decision, resource constraint, management of change and psychosocial escalation where leadership action is required.

These categories prevent the log from becoming a diary. They also help leaders see patterns, because five temporary workarounds in the same production area may reveal a design weakness that one isolated entry would never expose.

If the site already uses a risk register, connect the category to the register without copying the whole record. The risk register describes the scenario, while the decision log records the live leadership choice. For cleanup work, the distinction is similar to the one used in risk register cleanup.

Step 4: Record the evidence before the opinion

Each entry should begin with the evidence that forced attention, not with the conclusion. Evidence may include a failed field verification, repeated near miss, missed isolation check, overdue action, conflicting permit condition, worker concern, contractor deviation, or a leading indicator that no longer matches what supervisors see.

This protects the team from hindsight bias. James Reason's work on organizational accidents remains useful here because it separates visible frontline acts from deeper conditions that shape decisions. If the log captures evidence before interpretation, later review is less likely to become a search for someone to blame.

Write the evidence in field language. A phrase such as "two isolation tags missing during line-break preparation" is stronger than "procedure noncompliance observed" because it tells the next reviewer what condition existed and why the decision mattered.

Step 5: Name dissent and unresolved concerns

The log should have a field for dissent, unresolved concern or technical objection. This does not mean every disagreement becomes a formal dispute. It means the organization records when a credible concern remained after the decision, especially when the final choice accepts temporary exposure.

Andreza Araujo's work on antifragile leadership is relevant because strong leadership does not hide uncomfortable information to protect the meeting. It uses pressure as a test of the system, asking which control is fragile, whose concern has not been resolved and what evidence would change the decision.

This step also connects with technical dissent protocols. If dissent appears repeatedly in the same cluster, the issue may require redesign, external review or senior escalation rather than another local compromise.

Step 6: Link every decision to verification

A decision without verification is only an intention. For each entry, name how the team will check whether the decision changed the field condition. Verification may be a supervisor observation, critical-control check, photo evidence, permit sample, worker interview, maintenance record, trend review or targeted audit.

The verification method should match the risk. A serious exposure cannot be closed only by email confirmation, and a temporary control should not remain open-ended because nobody scheduled the field check. HSE leadership guidance emphasizes assessment and review, and that principle is practical only when leaders can see whether the control worked.

For serious injury and fatality exposure, align verification with critical control registers and bow-tie reviews. The question is not whether the action was assigned. The question is whether the barrier is present, effective and owned.

Step 7: Review the log weekly with leaders

Set a weekly review that lasts no more than thirty minutes. Review new entries, overdue verification, repeated categories, decisions accepted under temporary controls and any dissent that remains unresolved. The meeting should end with named decisions, not with broad encouragement.

The trap is letting EHS present the log while line leaders listen politely. Safety leadership becomes visible when plant managers, department heads and risk owners explain their own decisions, remove constraints and accept the consequences of delay. During Andreza Araujo's PepsiCo South America tenure, where the accident ratio fell 50% in six months, the transferable lesson was the leadership cadence, not a decorative reporting format.

Use a simple rule for urgency. If a decision concerns missing isolation, uncontrolled contractor exposure, repeated high-risk permit failure or absent rescue readiness, it cannot wait for a monthly committee. The log should force the earlier conversation.

Step 8: Audit patterns after 30 days

After the first thirty days, audit the log for patterns instead of counting entries as success. Look for repeated temporary workarounds, the same owner delaying decisions, categories with weak verification, unresolved dissent, actions closed by email and decisions that were made only after an incident or near miss.

This review gives leaders a sharper picture than a clean dashboard. A plant may show stable TRIR while the decision log reveals repeated acceptance of weak barriers. That is why the log belongs beside lagging indicators, leading indicators and field verification, not beneath them as a clerical annex.

Close the first cycle by changing one leadership routine. If overdue critical actions dominate, change the escalation rule. If contractor interface entries repeat, redesign mobilization. If dissent is common but unresolved, strengthen the technical review path. The log has value only when the next thirty days look different.

Safety decision log template

Conclusion

A safety decision log works when it records the few leadership choices that can change exposure before harm occurs. It should be small enough to use every week and strong enough to show whether leaders chose control, delay, escalation or redesign when the risk picture changed.

If your organization wants safety leadership to become visible in operating decisions, Andreza Araujo and ACS Global Ventures can support the diagnostic, cadence design and leadership routines through Andreza Araujo.