How to Run a Pre-Startup Safety Review in 8 Steps

A pre-startup safety review is the last structured pause before a new plant, modified line, or restarted system is allowed to move from planned change into live operation. It matters because the equipment may look complete while the process, the controls, the people, and the handover still carry unresolved risk.

The thesis is narrow and practical. A PSSR is not a sign-off ceremony. It is the decision gate that should prove the system is ready for energy, people, and production pressure to return at the same time. If the review only confirms that forms were closed, it has already missed the point.

Under OSHA's Process Safety Management standard, a pre-startup safety review is required before introducing hazardous chemicals into new or modified facilities, and that requirement is useful far beyond chemical plants because the logic is the same anywhere a change can create a new exposure path. ISO 45001:2018 points in the same direction when it asks for operational control and management of change, which means the restart gate should live in the field, not in a filing cabinet.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen a recurring pattern. Leaders close the project, thank the team, and assume the hardest part is over, although the real test begins when the site must prove that temporary changes are gone, critical controls are live, and the next shift understands what changed. In Safety Culture: From Theory to Practice, Andreza Araujo argues that culture appears in repeated decisions, not in the ceremony around them.

This guide is written for operations managers, maintenance leaders, and EHS managers who need a field routine they can run before startup, not a generic checklist they can file after the fact. It also pairs naturally with shutdown safety leadership, LOTO verification, and machine guarding audits before restart, because the same restart pressure shows up in all three.

What you need before starting

Bring the current change log, the equipment or line walkdown, the list of open punch items, the temporary deviation register, the critical-control list, and the names of the people who can stop startup. Without those items, the review becomes a discussion about memory instead of a review of the actual risk state.

The supervisor should also bring the last shift handover, the operator briefing notes, and any vendor or contractor closeout reports. Those records matter because the line may be physically ready while the people who will run it have not yet been shown the boundaries, the warnings, or the stop conditions.

James Reason is useful here because latent conditions often survive exactly where a project looks successful. A review that ignores weak handovers, temporary bypasses, or a rushed closeout may still produce a tidy file, although the plant is carrying the same failure path into operation.

Step 1: Define the startup boundary

Start by writing the exact boundary of the review. The boundary should answer what is starting, what has changed, which area is covered, and which part of the process is still not ready. A boundary written as "the new line" is weak because it does not tell the team where the control starts and ends.

The useful version names the system, the unit, the date, and the condition that will trigger the review. If the startup follows maintenance, say so. If the change came from a layout change, a recipe change, a software update, or a contractor handback, write that into the boundary because each one creates a different failure path.

Andreza Araujo's experience across 250+ cultural transformation projects shows that people act faster when the decision edge is clear. The review is stronger when everyone can repeat the boundary in one sentence without reading the form.

Step 2: List every change that touched the job

The second step is to list every change that touched the equipment, the process, the people, or the controls. A startup can be affected by new piping, a new sensor, a modified guard, a different cleaning method, a temporary bypass, or a revised sequence that looks minor on paper but changes the exposure in the field.

Do not accept a generic answer such as "only maintenance was done." Ask what was opened, removed, replaced, calibrated, tested, bypassed, painted, moved, or reprogrammed. That question matters because a change log that is too broad hides the exact point where the system can still fail.

As Andreza Araujo argues in A Ilusão da Conformidade, glossed in English as The Illusion of Compliance, a clean record can hide a weak field reality. A PSSR should be designed to expose that gap before the startup begins, not after the first abnormal sound or leak appears.

Step 3: Walk the field with operations, maintenance, and EHS

The third step is a field walk that includes operations, maintenance, and EHS together. The point is not to admire the asset. The point is to compare the written condition with the actual condition where people will work, monitor, clean, inspect, and respond if the system behaves unexpectedly.

Walk the line from the start point to the first usable output point. Look at access, escape routes, labels, barriers, drainage, emergency stops, guards, interlocks, warning signs, lighting, and housekeeping. If one group walks the line alone, each person sees only part of the story. The combined walk is more likely to expose the gap that a desk review would miss.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that improvement depended on visible routines that forced leaders to see what the field actually contained. A PSSR should work the same way because an apparently complete project can still hide the one condition that will matter first under production pressure.

Step 4: Verify critical controls, not only completion

The fourth step is to verify critical controls. Completion data tells you that the work was done. Control verification tells you whether the work now protects people. Those are not the same thing, and when leaders confuse them they often approve a startup that still has an open exposure path.

Check the controls that would actually stop a serious event. That usually means isolation points, guards, interlocks, relief devices, alarms, ventilation, emergency access, clear operator sightlines, and any barrier that protects the line-of-fire, stored-energy, or release pathway. The question is simple. Would this control still work if the first abnormal condition arrived today?

This is also where the review connects with critical-control verification. A PSSR is not the place to count signatures. It is the place to confirm that the barrier really exists, in the field, under the condition the startup will create.

Step 5: Clear temporary fixes and bypasses with owners

Temporary fixes are often the most dangerous part of a startup because they are easy to justify and hard to close. A bypass, a jumper, a temporary support, a removed guard, a short-term access change, or a reused workaround may be acceptable during the project, although it should never slip into normal operation by accident.

Each temporary item needs one owner, one expiry date, one removal criterion, and one decision about whether startup can proceed with or without it. If the team cannot say who owns the temporary condition, the condition is not temporary. It is simply ungoverned.

Andreza Araujo's book Make The Difference: Be a Leader in Health & Safety is useful here because leadership is not about accepting excuses politely. It is about making the next safe decision easier than the shortcut, which means a startup should not be approved while the field still depends on a workaround nobody wants to name.

Step 6: Check competence, handover, and contractor release

The sixth step is to verify that the people who will operate the system actually understand what changed. A startup can be technically ready while the shift team, the maintenance crew, or the contractor closeout team still carries a different mental model of the line.

Ask who trained the operators on the new sequence, who briefed the maintenance team on the remaining risk, who told the shift leader about open deviations, and who released the contractors. If a contractor still holds practical knowledge about a temporary condition, the handback is incomplete even if the commercial scope is finished.

In more than 250 cultural transformation projects, Andreza Araujo has seen that weak handovers create false confidence because everyone assumes the other side already explained the important part. That assumption is one of the fastest ways to move a startup from planned change into routine drift.

Step 7: Hold the approval meeting around stop rules

The seventh step is the approval meeting, and the meeting should revolve around stop rules rather than pride in progress. The group should decide what still blocks startup, who can accept residual risk, who can delay the start, and which condition forces a pause after startup begins.

This meeting should not become a speech about how much work the team has already done. It should answer whether the plant can run safely if the first abnormal event appears in the first hour. That is where James Reason's latent-failure thinking remains practical, because the hazard often sits in the decision structure long before it appears as an incident.

A good meeting ends with one clear sentence. If any critical control is not verified, startup waits. That sentence is simple because the moment is not simple. When the team can say it out loud without hedging, the organization has moved closer to real readiness.

Step 8: Close with a handback note and first-hour checks

The eighth step is to close with a handback note that the next supervisor can actually use. The note should name the boundary, the verified controls, the temporary items that were removed or approved, the open risks, the stop rules, and the first-hour checks that must happen after startup.

First-hour checks matter because readiness decays as soon as the system begins to run. A pump can leak, a sensor can drift, a guard can rattle loose, or a control sequence can behave differently once the line carries real load. The handback note should therefore tell the team what to watch, who owns the watch, and what to do if the first run does not match the expected condition.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture lives in repeated decisions under pressure. A good handback note proves that the organization is willing to repeat the right decision when the startup starts to feel normal again.

PSSR versus paperwork

One way to keep the review honest is to compare a paper-only PSSR with a field-ready PSSR. The table below is a quick leadership test for the startup meeting.

The comparison is useful because it keeps the review from drifting into ceremony. A startup gate that cannot survive this table is not ready to protect the first hour of operation.

Final checklist

• The startup boundary is clear and tied to the actual change, not to convenience.
• Every change that touched the job is listed, including temporary bypasses and minor modifications.
• The field walk has confirmed the condition of access, barriers, alarms, interlocks, and emergency paths.
• Critical controls are verified in the field, not only marked complete in the closeout file.
• Temporary fixes and open deviations have owners, dates, and a clear decision.
• The operator handover and contractor release show the same risk picture.
• Stop rules are explicit enough that the team can pause startup without guessing.
• The first-hour checks are written down and owned by the person who will run the system.

FAQ

What is a pre-startup safety review?

A pre-startup safety review is the final check that proves a new or modified system is ready to start safely. It should confirm that the right controls are in place, that temporary items are resolved or owned, and that the people who will run the system understand the new risk picture.

When should the review happen?

It should happen before hazardous operation begins, after the change is built, and before the first live run. If the review happens after startup, it is no longer a preventive gate. It has become a post-event audit.

Who should own the review?

Operations should own the startup decision, while maintenance and EHS support the evidence. The people who will run the line must be part of the decision because they are the ones who will see the first abnormal condition.

Is a checklist enough?

No. A checklist is useful only when it drives a field walk, control verification, and a real stop rule. If it only proves that someone filled a file, the review has already slipped into paperwork.

Which Andreza Araujo book fits this topic best?

Safety Culture: From Theory to Practice is the strongest fit because it connects repeated decisions with real culture. A Ilusão da Conformidade helps because a tidy file can hide a weak field condition, while Make The Difference: Be a Leader in Health & Safety keeps the startup decision tied to leadership behavior.

If your site is preparing a startup, restart, or major modification, use Safety Culture: From Theory to Practice and Andreza Araujo's advisory work to turn the change into a field decision. That is where compliance stops being a ritual and starts protecting the worker.