How to Build a Temporary Control Plan Before High-Risk Work

A machine guard is removed during maintenance, a fixed barrier is waiting for delivery, or a ventilation system is unavailable while production still has an obligation to continue. The immediate question is not whether the temporary arrangement looks tidy. The question is whether the replacement control can reduce the exposure for the full period in which the permanent barrier is missing.

A temporary control plan makes that decision visible. It identifies the hazard, defines the substitute barrier, assigns ownership, sets an expiry condition, and requires field verification before work starts. Without those elements, a temporary measure quietly becomes the new normal, which is exactly how residual risk survives management attention.

What you need before starting

Bring the current risk assessment, the work method, the equipment or process drawing, the name of the control owner, and the date or event that should end the temporary arrangement. Include the people who perform the task because a plan that ignores access, visibility, reach, pace, or maintenance constraints will misread the real exposure.

Use the hierarchy of controls as a decision test rather than as a poster. Ask whether the hazard can be eliminated, isolated, or reduced through engineering before accepting an administrative instruction or PPE as the main replacement. ISO 31000 and IEC 31010 provide the risk-management and assessment structure, while ANSI/ASSP Z590.3 is a useful reference when the missing barrier can be addressed through design.

Step 1: Define the missing permanent control

Write the absent or degraded control in operational language. “Guard unavailable” is more useful than “machine unsafe,” because it identifies the barrier that should prevent contact with moving parts. State why it is missing, when the condition began, which task is affected, and what evidence will show that the permanent control has been restored.

Separate the initiating condition from the exposure. A delayed replacement part is the condition. Hands entering the line of fire during clearing, adjustment, or inspection are the exposure. This distinction prevents the plan from becoming a maintenance note that never explains how a person could be harmed.

Step 2: Describe the credible exposure

Describe what a person could contact, inhale, fall into, be struck by, or release while the permanent control is unavailable. Include the task, location, energy source, affected people, and credible deviation from the written method. The plan should be specific enough that another supervisor can walk to the area and recognize the exposure without interpreting a vague risk statement.

James Reason’s work on active and latent failures supports this discipline. The visible deviation may be a hand inside a guarded area, but the conditions that make that movement likely can include poor access, production pressure, weak isolation, or a work method that does not match the equipment. A temporary plan is incomplete when it records only the final action and not the conditions that shape it.

Step 3: Select the strongest workable substitute

List the possible substitutes and reject any option that depends on perfect attention when a stronger barrier is reasonably available. A physical exclusion zone, an interlocked temporary arrangement, a verified isolation, or a redesigned sequence will usually provide more dependable protection than a sign that tells people to remain careful.

Do not label a control effective because it exists on paper. Test whether it prevents access, withstands the expected work conditions, remains visible, and can be maintained for the entire duration. Andreza Araujo’s The Illusion of Compliance is directly relevant here because documented completion does not prove that the control changes the exposure.

Step 4: Set non-negotiable operating limits

Define where the temporary arrangement applies and where it does not. State the permitted task, equipment state, personnel competence, environmental conditions, maximum duration, and any simultaneous activity that would invalidate the plan. If the arrangement is safe only when one activity is stopped, write that dependency into the control.

Use plain operational language. “Work may continue under controlled conditions” gives the supervisor no boundary to enforce. “Only inspection from outside the exclusion line is permitted until the replacement guard is installed and verified” creates a decision that can be checked in the field.

Step 5: Assign one accountable control owner

Name the person who can stop the work, approve the temporary arrangement, and confirm that the substitute barrier remains available. The owner may receive support from engineering, maintenance, operations, or EHS, but shared participation must not become shared ambiguity.

Include the person responsible for restoring the permanent control and the person who will verify the restoration. These roles are different. The maintenance lead may install the guard, while the operations supervisor verifies that it works during the task for which it is required. A plan that has no named restoration owner is a permission slip for indefinite extension.

Step 6: Verify the plan at the worksite

Walk the route, inspect the substitute barrier, and ask the people doing the work to show how the task will be completed without entering the exposure. Check sight lines, access points, stored energy, dropped-object paths, emergency response, and the effect of nearby work. Record the evidence, not only the approval signature.

Ask one uncomfortable question before authorizing the job. “What would make this temporary control fail during the shift?” The answer often reveals a missing tool, a blocked access route, a contractor interface, or a production condition that was invisible in the office review.

Step 7: Install an expiry trigger and escalation path

Give the temporary control an expiry condition tied to a date, production state, equipment status, or restoration milestone. A calendar date alone is weak if the work can be postponed without a fresh decision. Require reapproval when the trigger is reached, when the task changes, when a person is injured or exposed, or when the substitute barrier is altered.

Define escalation before the plan is needed. The supervisor should know who receives the issue when the permanent fix is delayed, the substitute control cannot be maintained, or the work cannot stay within its limits. Escalation is a safety control because it prevents local pressure from turning an exception into a routine.

Step 8: Close the loop through field evidence

Return after the task begins and verify that the plan is being used as written. Look for the barrier, the correct work sequence, the expected equipment state, and evidence that the exposure has not shifted to another person or task. If the field conditions differ, stop and revise the plan instead of recording a compliance failure against the workforce.

Close the temporary arrangement only when the permanent control is installed, tested, communicated, and accepted by the people who rely on it. Archive the reason for the temporary measure and the verification evidence so that repeated failures can be recognized as a design or maintenance problem rather than treated as isolated exceptions.

Final checklist for a temporary control plan

• The missing permanent control and the resulting exposure are described separately.
• The substitute barrier is stronger than a reminder whenever a stronger option is reasonably available.
• The operating limits, affected tasks, and invalidating conditions are explicit.
• One person owns the temporary control, while another can verify restoration when needed.
• The plan has a field verification record and an expiry or escalation trigger.
• The permanent control is tested before the temporary arrangement is closed.

Temporary controls are not a lower standard of safety. They are a time-bound risk decision that must remain visible until the permanent barrier is reliable again. The quality of the plan is shown by what it prevents people from having to improvise.

For a broader diagnostic of compliance gaps and cultural conditions, explore Andreza Araujo’s safety culture resources and The Illusion of Compliance through Andreza Araujo.

Frequently asked questions