How to Choose a Risk Method for Maintenance Shutdowns

A maintenance shutdown compresses weeks of decisions into a few intense days. Equipment is open, contractors are mobilized, production is waiting, and the risk team is often asked to choose one assessment method before anyone has defined the decision that method must support.

The better sequence is to start with the shutdown question, then select the risk method that can produce usable evidence. This guide gives maintenance managers, EHS professionals, and shutdown planners a nine-step workflow for matching method to exposure without turning risk assessment into paperwork.

What you need before starting

Collect the shutdown scope, equipment list, work packs, isolation boundaries, contractor interfaces, abnormal-work assumptions, and the decisions that could stop or redesign the job. You do not need every detail before the first review, but you do need enough context to distinguish routine work from a change in hazard, energy, sequence, or responsibility.

IEC 31010:2019 describes risk assessment techniques as a selection problem rather than a single mandatory tool. That principle matters during shutdowns because a task-level job safety analysis cannot answer the same question as a process hazard review, a barrier review, or a consequence analysis.

Step 1: Define the decision the assessment must support

Write the decision in one sentence. It may be whether the shutdown can start, whether a work pack needs redesign, whether a temporary control is acceptable, whether simultaneous operations can proceed, or whether a specialist review is required.

Ask who will act on the result and what evidence that person needs. A method is useful only when its output changes a decision, and a risk register that does not identify the next decision becomes a storage system rather than a control.

Verify: the work pack names an accountable decision owner and a decision date.

Common error: beginning with the preferred method because the organization already has a familiar template.

Step 2: Separate routine work from changed conditions

Compare the shutdown task with the normal operating state. Look for opened equipment, removed guards, temporary access, simultaneous work, bypassed alarms, unfamiliar contractors, changed pressure or temperature, degraded utilities, and reduced supervision.

These changes determine whether a task-level review is enough. A familiar job can require a higher-level method when the surrounding system changes, because the interaction between jobs may create the exposure that the individual work pack cannot see.

Verify: mark each changed condition on the shutdown map and assign an owner to confirm the assumption.

Common error: treating a recurring maintenance task as routine even though the shutdown sequence has changed.

Step 3: Map the exposure across work boundaries

Draw the boundary around the work rather than around one crew. Include operations, maintenance, inspection, contractors, logistics, temporary power, lifting, confined spaces, energy isolation, and emergency response.

Then identify where one work pack can alter another. A vessel entry can affect line breaking nearby. A crane lift can change the escape route. A delayed isolation can keep several crews exposed to stored energy. Boundary mapping reveals when the assessment needs a method that can examine interaction rather than isolated task steps.

Verify: every interface has a named owner and a communication point before work begins.

Common error: assigning risk ownership to the EHS function while the people controlling the interface remain unnamed.

Step 4: Choose a task method for defined work

Use a job safety analysis or job hazard analysis when the work sequence is clear, the hazards are tied to the task, and the crew can verify controls at the point of work. The method should describe the task steps, exposure, controls, responsible person, and stop conditions in language the crew can use.

Do not ask a task review to evaluate the whole plant. If the shutdown contains major process changes, simultaneous operations, or complex energy interactions, keep the task review and add a method that operates at the system level.

Verify: the crew can explain the critical controls without reading the form.

Common error: copying a previous job analysis even though the equipment state, crew, access, or isolation boundary has changed.

Step 5: Choose a structured method for process change

Use a structured process review when the shutdown changes design intent, operating sequence, safeguards, chemistry, pressure, flow, or the relationship between equipment. HAZOP, What-If analysis, and similar methods can help the team identify deviations and consequences that a task checklist will miss.

The choice depends on the question. HAZOP suits a defined process design with guide words and a multidisciplinary team. What-If analysis can be practical when the team needs a faster challenge of credible scenarios. The important safeguard is not the label of the tool. It is whether the method exposes the deviations that matter for the shutdown decision.

Verify: the review records assumptions, deviations, consequences, safeguards, recommendations, and action owners.

Common error: selecting a method because its workshop can be scheduled quickly, without checking whether its output fits the decision.

Step 6: Test preventive and mitigative barriers

Use a Bow-Tie review when the central question is whether threats, preventive controls, consequences, and mitigative controls remain connected. This is especially useful when the shutdown depends on critical barriers such as isolation, detection, relief, emergency shutdown, rescue, or recovery.

For each barrier, ask who owns it, what must be available, how it will be verified, what failure looks like, and what happens when the verification fails. A barrier that exists only in a drawing does not provide the same protection as one that is available, independent where required, and tested under the shutdown conditions.

Verify: each critical barrier has an owner, verification evidence, and a response if it is unavailable.

Common error: counting procedures and training records as proof that a physical or operational barrier will work.

Step 7: Escalate uncertainty instead of averaging it away

Some shutdown decisions cannot be resolved by adding detail to a low-quality assessment. Escalate when the consequence is severe, the initiating event is poorly understood, the control depends on an untested assumption, or the team cannot agree on the work boundary.

Escalation can lead to a specialist review, a design change, a different method, a staged start, or a decision to defer the work. The risk decision should show what remains unknown and who has authority to accept, reduce, or reject it. A green score does not close an evidence gap.

For a practical escalation structure, compare this workflow with a risk escalation path for unresolved high-hazard actions.

Verify: unresolved assumptions appear in the decision record with a deadline and accountable owner.

Common error: reducing an uncertain consequence or likelihood to make the matrix produce an acceptable color.

Step 8: Run a field verification before release

Take the assessment to the work area before the shutdown starts. Confirm that access, isolation points, equipment condition, communication, rescue capability, tooling, lighting, and temporary controls match the assumptions in the review.

Field verification is where the team discovers that a control is technically specified but practically unavailable. Andreza Araújo’s *Safety Culture Diagnosis* places value on evidence that connects formal expectations with what people can actually do. That principle is useful here because a signed assessment cannot verify a control that the worksite has not made executable.

Verify: the person who controls the work signs the release only after the critical assumptions are checked in the field.

Common error: treating a pre-shutdown walkdown as a ceremonial sign-off rather than a challenge to the written assessment.

Step 9: Convert findings into a live shutdown control plan

Close the loop by transferring the important findings into the shutdown control plan, permit system, daily coordination meeting, and field verification schedule. Assign a review trigger for changed sequence, failed isolation, new simultaneous operations, weather, fatigue, or a control that becomes unavailable.

Keep the record short enough to use. A risk decision should show the exposure, the critical control, the owner, the verification, the response to failure, and the point at which the work must stop or return for review.

During her PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araújo’s published professional record connected improvement with operating routines rather than isolated safety campaigns. The transferable lesson for shutdowns is simple, although its execution requires discipline: assessment quality matters only when it changes how work is planned, released, and checked.

Use the limits of risk-matrix scoring as a final challenge to comfortable numbers, especially when the evidence behind a rating is weak.

Final shutdown checklist

• State the decision, owner, and deadline before selecting a method.
• Mark changed conditions and interfaces across the shutdown boundary.
• Use JSA or JHA for defined task exposure, not whole-system uncertainty.
• Use a structured process review when design intent or process conditions change.
• Use Bow-Tie logic when barrier ownership and verification are central.
• Escalate severe consequences, unresolved assumptions, and disputed boundaries.
• Verify critical controls in the field before releasing work.
• Transfer findings into permits, coordination routines, and stop-work triggers.

Where to go next

For practitioners building a repeatable risk decision routine, Andreza Araújo’s books and Safety School resources provide a broader foundation for connecting technical assessment with leadership, culture, and field behavior. Explore the books and Safety School resources when the shutdown process needs to mature beyond forms and isolated workshops.