How to Run a Critical-Control Handover in 20 Minutes

A critical-control handover is the transfer of live barrier responsibility from one shift, crew, or supervisor to the next. It is not a courtesy update. If the handover does not carry the field state, the stop condition, and the owner of each control, the next team inherits a story while the hazard keeps its own timetable.

Across 25+ years leading EHS in multinational operations, Andreza Araujo has seen one pattern repeat in maintenance, shutdowns, contractor interfaces, and night-shift work. The control looked stable until the shift changed, the language got shorter, and the person receiving the job trusted the summary more than the field. In Safety Culture: From Theory to Practice, culture is visible in repeated decisions, and the handover is one of the clearest decisions a site makes every day.

This article is for supervisors, EHS managers, maintenance leads, and operations leaders who need a practical transfer routine. ISO 45001:2018 expects operational control, communication, and change management to work together, while James Reason's work on latent failures explains why a weak transfer can survive several apparently normal shifts before it becomes visible in an incident.

What you need before starting

Bring the current task, the last shift note, the permit or work order, the list of live critical controls, and the name of the person who can stop the job. If the work touches line breaking, lockout, temporary deviation, confined space support, or simultaneous operations, bring those records too. The handover only works when it starts from the real job, not from the memory of the person who is already leaving.

The review below belongs in the same family as a temporary deviation risk review and a scope-change risk review, because all three routines are trying to stop a small change from becoming a hidden transfer of risk.

The goal is simple. In twenty minutes, the outgoing owner should be able to show what is still live, what changed, what can wait, and what forces an immediate stop. If that cannot be said plainly, the job is not ready to move.

Step 1: Name the control boundary before you name the next owner

What to do: define which controls must survive the shift. This usually includes isolation, access, guarding, atmospheric monitoring, traffic separation, permit conditions, temporary fixes, and any barrier that would fail the job if it vanished during the transfer.

How to do it: walk the area and point to the exact boundary. The outgoing supervisor should say where the work starts, where it stops, and which control is the last thing holding the risk in place. Avoid broad phrases like maintenance area or production line, because broad language hides the point where the hazard actually enters.

How to verify: ask the incoming supervisor to repeat the boundary without looking at notes. If the two people describe different edges, the handover has already drifted away from the field.

Common error: naming the next owner before the control boundary is clear, which turns the transfer into a status chat instead of a barrier check.

Step 2: List the live critical controls one by one

What to do: list the controls that are still carrying risk. A handover fails when it mentions the job in general but does not identify the controls that would actually prevent harm if something changes before the next shift starts.

How to do it: write each control in plain language and attach the field evidence that proves it is alive. If the control is an isolation, show the lock and the point. If it is monitoring, show the reading and the alarm threshold. If it is a temporary deviation, show the expiry and the restoration path. The related article on LOTO verification is useful here because a lock, by itself, is not the proof.

How to verify: ask whether each control can be pointed to, touched, or observed. If the answer is only written somewhere, the control is still one step too abstract.

Common error: collapsing several controls into one vague line such as all good or under control, which hides the weakest barrier in the set.

Step 3: Translate abbreviations into field meaning

What to do: replace shorthand with field meaning. If the outgoing team says PTW, LOTO, SIMOPS, or temp fix, the incoming team needs the real condition, not just the acronym.

How to do it: ask the outgoing owner to explain what each shorthand means for this exact job. Which permit is active, which energy is isolated, which other work is happening nearby, and which temporary arrangement still needs a decision. A clean abbreviation can still hide an ugly reality, and that is exactly where A Ilusao da Conformidade, translated as The Illusion of Compliance, becomes practical.

How to verify: have the incoming supervisor restate the meaning in one sentence per item. If the explanation sounds like office language instead of field language, the handover is not ready.

Common error: letting shorthand save time when the next shift really needs clarity, not speed.

Step 4: Check what changed since the last shift

What to do: compare the current field state with the last shift state. Weather, staffing, contractor mix, adjacent work, equipment condition, and production pressure can all change the meaning of the same task.

How to do it: ask one question at a time. What changed in the task, what changed in the area, what changed in the people, and what changed in the control picture. The point is not to collect a dramatic story. The point is to catch the first small change that makes the old handover stale.

How to verify: if the outgoing and incoming supervisors cannot name at least one real change, the handover may be copying yesterday into today.

Common error: assuming the same job means the same risk, even though the field never stays still for long.

Step 5: Test the stop condition and the restart condition

What to do: define the condition that stops the job and the condition that allows restart. A critical-control handover is weak if the team can describe the work but cannot say what would force a pause.

How to do it: write the stop condition in behavior, not in mood. The crew stops if isolation cannot be verified, if monitoring changes, if a temporary control expires, if an adjacent task appears, or if the next supervisor cannot accept the same boundary. Then write the restart condition in the same way.

How to verify: ask the incoming owner to say what would make them stop the job without waiting for permission. If they hesitate, the transfer has not yet reached the point of authority.

Common error: making the stop rule so vague that everyone can read it and nobody can use it.

Step 6: Resolve temporary fixes before the job moves again

What to do: decide what temporary fixes are acceptable and what needs formal action. Temporary controls can keep a job moving for one shift, but they cannot become the hidden plan for the week.

How to do it: check every workaround, bypass, override, or substituted method against an expiry, an owner, and a restoration path. If the workaround survives one handover, it deserves a new review. The same logic applies in temporary deviation review, because exception control is still control only when someone owns the end of the exception.

How to verify: ask what will be restored, by whom, and by when. If nobody can answer, the temporary fix has already become a quiet permanent state.

Common error: treating temporary as a comforting word instead of a time limit.

Step 7: Rebrief the next owner in person

What to do: do the transfer face to face, at the job, with the work in view. A critical-control handover is not complete when the note is typed. It is complete when the next owner accepts the same field picture that the previous owner described.

How to do it: the outgoing supervisor should walk the incoming supervisor through the boundary, the live controls, the stop condition, and the open issue list. Then the incoming supervisor should repeat it back in plain words. That repeat-back is not theater. It is the proof that the next owner sees the job, not just the document.

How to verify: compare the repeat-back with the field. If the verbal version and the physical version do not match, the handover continues until they do.

Common error: doing the transfer by phone, message, or memory when the job is still active and visible.

Step 8: Record the learning and tie it to the next review

What to do: capture the change, the controls, the stop condition, the temporary fixes, and the owner. Then set the next review time before the team disperses.

How to do it: keep the note short enough that the next shift will actually read it. The best record is not the longest one. It is the one that helps the next owner avoid repeating the same confusion. If the handover exposed a missing control or a weak boundary, connect it to incident evidence preservation and to the incident timeline, because the first job after a near miss or incident is to protect the facts before they dissolve into memory.

How to verify: the record should answer who owns the control, what changed, what stops the work, and when the next review happens.

Common error: closing the file without changing the next shift's decision point.

Critical-control handover versus ordinary shift handover

An ordinary shift handover tells the next team what happened. A critical-control handover tells the next team what is still live, what can fail, and what must stop the job.

Final checklist

• The control boundary is visible in the field.
• Each live critical control has an owner and proof.
• Abbreviations have been translated into plain language.
• The stop condition and restart condition are explicit.
• Temporary fixes have an expiry, an owner, and a restoration path.
• The incoming supervisor repeated the handover back in person.
• The record now helps the next shift make a better decision.

FAQ

What is a critical-control handover?

It is the transfer of live barrier responsibility from one shift, crew, or supervisor to the next. The handover must show what controls are still active, what changed, and what would force a stop before the job continues.

Why is a critical-control handover different from a normal shift handover?

A normal handover reports progress. A critical-control handover transfers risk ownership, field evidence, and the stop condition. If the next owner cannot explain the live controls in plain language, the transfer is incomplete.

Who should own the handover?

The outgoing supervisor or job owner should own the transfer, while the incoming supervisor must accept it by repeat-back and field verification. Operations owns the decision, and EHS should verify the quality of the routine.

What is the biggest handover mistake?

The biggest mistake is trusting shorthand and assuming the next crew can infer the meaning. A short message may save time, but it often drops the control boundary, the temporary fix, or the stop condition.

Which Andreza Araujo book fits this topic best?

Safety Culture: From Theory to Practice fits because the handover is a repeated decision under pressure. A Ilusao da Conformidade fits because a clean note can still hide a weak field reality.

If your operation wants to make handovers stronger than memory, start with Andreza Araujo's books at the official store and use Andreza Araujo to request a diagnostic that connects shift transfer, field verification, and critical controls.