How to Run a Mid-Shift Change Check That Keeps Risk Controls Owned

F2 how-to guide for supervisors, risk owners, and operations managers

A work plan can be correct at 7 a.m. and unreliable by noon. A delivery arrives late, a technician is reassigned, a permit is extended, or two jobs compete for the same isolation. When the team treats the original plan as permanent, the control remains attached to conditions that no longer exist.

This guide gives a supervisor an eight-step mid-shift change check. The purpose is not to reopen every risk assessment. It is to decide whether a changed condition affects a consequential control, who owns the decision, and what must happen before work continues.

What you need before starting

Bring the current work plan, relevant risk assessment, permit or isolation record, and the open-action or decision log. You also need access to the person who can change the work, not only the person who can describe it. Use a formal management-of-change route when the change affects design, process conditions, staffing competence, or a legal requirement.

Step 1: State what changed in observable terms

Write one sentence without assigning blame. “The second technician is unavailable and the job is now planned with one person” is useful. “The crew failed to follow the plan” hides the condition that changed. Ask the person closest to the task to confirm the sequence, timing, location, and resources that differ from the approved plan.

Verify the statement against the work area, permit, schedule, or equipment status. A common error is recording “conditions changed,” which makes later review impossible.

Step 2: Identify the control that may no longer hold

Link the change to one control that protects against a credible serious outcome. The control may be an isolation, guard, lifting plan, competent second person, line-of-fire exclusion, or rescue arrangement whose reliability depends on the changed condition.

Do not label awareness or good intentions as the control. James Reason’s work on latent failures supports a more useful question, which is what organizational condition could allow the visible failure path to develop. Verify the control where exposure occurs. The common error is reviewing the document while leaving the physical condition untested.

Step 3: Trace the changed condition to a failure path

Describe what could happen if the control is weakened. If the plan loses a spotter, explain which movement, blind area, or communication gap becomes credible. If a process runs outside its expected window, identify which alarm, interlock, inspection, or response time is affected.

Keep the analysis narrow enough to support a decision. ISO 31000 provides useful risk-management vocabulary, but this check should not become an abstract workshop. Verify that the failure path is tied to the current task. The common error is listing every hazard instead of testing the control that matters now.

Step 4: Confirm who owns the decision

Name the person who can stop, redesign, resource, or authorize the work. The person who notices the problem needs a route to raise it, but the control owner is the person with authority to change the condition or accept residual risk within the organization’s rules.

Ask the owner to state the decision plainly. “Continue,” “pause until the control is restored,” and “use a temporary measure until a defined time” are different decisions. Verify the owner against the role with operational authority. The common error is assigning an action to EHS when only operations can change the work.

Step 5: Choose the safest workable response

Compare the available responses in the work area. The strongest response usually restores the original control or changes the task so the exposure is removed. A temporary measure may be appropriate when it is specific, physically available, supervised, and time-limited.

Document why the response is workable under current conditions and what would make it unacceptable. Verify it with the affected worker before work resumes. The common error is calling a pause impractical without testing whether sequence, staffing, or equipment can change.

Step 6: Set an expiry point for temporary controls

A temporary control needs an owner, an end time, and a trigger for reassessment. The expiry point can be the end of a shift, arrival of equipment, completion of an isolation, or a formal review before the next phase.

Place the expiry point where the next supervisor can see it, and link it to the permit, shift log, or decision record. Verify that the incoming owner understands the condition. The common error is allowing a temporary barrier, extra watch, or manual check to continue without review.

Step 7: Escalate when the decision exceeds local authority

Escalate when the change affects a critical control, requires a design decision, creates conflicting priorities, or leaves the team without a credible recovery path. State the changed condition, control at risk, decision already taken, and support required.

Use the organization’s risk-acceptance route rather than an informal message. The risk-acceptance gate for frontline supervisors helps clarify which decisions belong locally. Verify that the receiving leader acknowledges the decision. The common error is escalating without stating what response is needed.

Step 8: Close the loop at the next handover

Record the changed condition, control tested, evidence observed, decision, owner, and next verification point. Keep the record short because its job is to preserve operational memory, not create a second risk register.

At handover, ask the next supervisor to repeat the condition and expiry point. The shift-handover questions for risk ownership provide a useful companion. Verify closure in the work area or approved record. The common error is marking the action complete before the original control is restored.

How to review the evidence after the shift

Review repeated change checks when the same control is weakened by staffing, scheduling, equipment availability, or unclear authority. Repetition may indicate a planning or design problem rather than a series of isolated decisions.

Use the comparison between a risk register, decision log, and control verification to decide which evidence should remain in the system. Across more than 25 years of multinational EHS leadership, Andreza Araújo has emphasized that safety leadership becomes credible when decisions are visible, owned, and connected to actual working conditions. That position is consistent with Safety Culture: From Theory to Practice.

Make changing conditions visible before they become accepted workarounds. Explore Andreza Araújo’s safety leadership resources for methods that connect risk ownership with daily operations.