JSA vs Risk Matrix vs Field Verification: Which Evidence Should a Supervisor Trust Before Non-Routine Work?

A supervisor is standing at the edge of a shutdown job when the crew presents three reassuring documents. The JSA is signed, the risk matrix shows a tolerable residual score, and the permit is ready for release. Yet the isolation boundary on the drawing does not match the equipment in front of the crew.

That moment exposes a common mistake in risk management. Organizations often ask which tool is best, although the real question is which decision each tool can support. A job safety analysis, risk matrix, and field verification are not interchangeable forms. They produce different kinds of evidence, and each one can create false confidence when used outside its proper role.

A JSA describes the task sequence and its hazards, a risk matrix ranks the exposure against defined criteria, and field verification checks whether the planned controls exist and work in the actual operating context. Before non-routine work, the supervisor should use them as complementary decision tools rather than as competing approval documents.

What question does each method answer?

A JSA answers, “How will this work unfold, and where can the sequence create exposure?” It forces the team to break the job into meaningful steps, identify interactions, and connect each hazard with a control. Its value depends on whether the team describes the real job rather than copying a familiar template.

A risk matrix answers, “How should this exposure be prioritized under our criteria?” It creates a common language for severity, likelihood, existing controls, and escalation. ISO 31000:2018 treats risk as the effect of uncertainty on objectives, so the matrix should help leaders decide what requires additional treatment, not disguise uncertainty behind a colored square.

Field verification answers, “Is the control arrangement credible here and now?” The check may include the isolation point, equipment condition, access, exclusion zone, competence, communication, rescue path, and changes since the planning discussion. It is the only one of the three that directly tests the worksite against the plan at the point of decision.

How should supervisors compare the three methods?

The distinction matters because a supervisor may complete all three activities and still lack a sound release decision. A detailed JSA does not prove that the isolation was applied. A low matrix score does not prove that the person can reach the work area safely. A field walk does not explain the full task sequence if the team has not thought through simultaneous operations.

Use the comparison as a division of labor. The JSA develops the work logic, the matrix determines the level of scrutiny, and verification tests whether the decision can be released. This sequence also prevents the common habit of asking one document to carry the entire burden of risk management.

When is a JSA the strongest tool?

A JSA is strongest when the work contains several steps whose order affects exposure. Examples include non-routine maintenance, line breaking, temporary equipment installation, lifting near live operations, and tasks that move between teams or work areas.

The team should describe the actual method, including preparation, access, isolation, execution, testing, restoration, and handover. If the document begins with a generic hazard list and never explains how the task will change from one step to another, it is not yet a decision tool. It is only a record of familiar words.

The supervisor should ask the crew what could make the planned sequence impossible. A missing tool, a different equipment layout, a contractor substitution, an unexpected process condition, or a simultaneous job may require a new conversation. James Reason's work on latent failures is useful here because the visible error often follows hidden weaknesses in planning, interfaces, and control ownership.

Andreza Araujo's book Make The Difference: Be a Leader in Health & Safety treats operational leadership as a daily practice of making decisions visible. Applied to a JSA, that means the supervisor should be able to explain which step carries the greatest exposure and what will happen if the planned control is unavailable.

When is a risk matrix the strongest tool?

A risk matrix is strongest when leaders must compare different exposures, set escalation thresholds, or decide where limited engineering and operational attention should go first. It can support portfolio decisions across maintenance jobs, projects, contractor activities, and process changes.

Its weakness appears when the organization debates the color instead of the assumptions. Severity may be understated because the event seems unlikely, likelihood may be inflated to justify a preferred decision, or existing controls may be counted without evidence that they work. In that situation, the matrix creates agreement without improving the work.

Supervisors should inspect the criteria behind the score. Ask what event is being assessed, who could be exposed, what control must prevent serious harm, which evidence supports the likelihood rating, and what would trigger escalation. The article Risk Matrices: 9 Distortions That Make Critical Hazards Look Acceptable is useful when a team needs to challenge a score that looks objective but rests on untested assumptions.

ISO 45001:2018 also places emphasis on identifying hazards, assessing risks, and controlling operational processes. The standard does not turn a matrix into a permission slip. The local system still has to define who can accept residual risk, what evidence is required, and when the decision must return to a higher authority.

When is field verification the strongest tool?

Field verification is strongest immediately before release, during a change in conditions, and whenever the job contains critical controls whose failure could create serious harm. It should not be limited to asking whether a document is signed. The supervisor needs to inspect the condition that the document claims to control.

For an energy-isolation task, verification may include the correct asset, the correct isolation points, physical locks, zero-energy testing, and clear communication with affected people. For a lift, it may include the load, rigging, ground condition, exclusion zone, communication method, and the authority to stop when the plan changes. The evidence depends on the exposure.

Field verification becomes weak when the person checking it has no authority to change the plan. Give the verifier a clear stop or escalation route, and record the decision in operational language. “Control checked” is less useful than “the isolation was retested after the valve identification differed from the drawing, and the work stayed paused until engineering confirmed the boundary.”

The article Control Reliability Explained: 4 Evidence Tests Before Leaders Trust a Safety Barrier provides a related way to distinguish the existence of a control from evidence that the control can perform its intended function.

Which method should come first before non-routine work?

Start with the JSA when the task is unfamiliar or the sequence has changed. The crew needs to explain how work will happen before leaders can judge whether the controls are adequate. Do not begin with a matrix if the team has not agreed on the work method, because the score will be attached to an unstable description.

Use the risk matrix next when the exposure requires escalation, additional resources, or a decision outside the supervisor's authority. The score should prompt a question about treatment and ownership. It should not end the discussion simply because the result falls below a threshold.

Finish with field verification before the job is released. The supervisor should compare the plan with the actual boundary, people, equipment, controls, and surrounding work. If the evidence conflicts, the release decision stops until the plan is revised or the risk is escalated.

This order can change when there is an immediate field concern. A supervisor who sees an unguarded energy source or a changed process condition should stop the work first, then reopen the planning and assessment sequence. Good process does not require people to continue an unsafe activity while they complete the correct form.

What does each method miss when used alone?

A JSA used alone can become a polished description of work that never occurs as planned. The team may identify hazards correctly but fail to test access, isolation, equipment condition, or simultaneous operations. Its blind spot is execution.

A risk matrix used alone can convert uncertainty into a number that appears comparable across very different tasks. The matrix may support governance while missing a control failure that is visible to a person standing at the job. Its blind spot is evidence quality.

Field verification used alone can catch a visible problem but miss a hidden interaction that appears only when the whole task is considered. A supervisor may see the equipment ready while overlooking the restoration sequence, contractor interface, or emergency response assumption. Its blind spot is planning depth.

These are not arguments for more paperwork. They are arguments for assigning each tool a precise job. The critical-control walkdown process is valuable because it turns observation into a structured conversation about control purpose, owner, evidence, and action.

How should a plant turn the comparison into a release rule?

Define the minimum evidence for each category of non-routine work. A maintenance job may require a JSA, an isolation confirmation, and a field release. A process change may require a risk assessment, engineering review, management-of-change approval, and a commissioning verification. A contractor job may require interface ownership and a host representative who can stop work.

Then define the triggers that reopen the decision. Include changes in equipment, scope, crew, weather, shift, isolation, simultaneous operations, access, process state, or emergency arrangements. The trigger should be clear enough that a supervisor can recognize it without waiting for an EHS specialist to interpret the rule.

Finally, make one person accountable for the release decision and one person accountable for each critical control. Shared participation improves the quality of discussion, but shared ownership without a named decision-maker allows an exposure to remain active while everyone assumes that someone else has checked it.

Andreza Araujo's work across 25+ years of multinational EHS leadership and more than 250 cultural-transformation projects reinforces this practical point. Safety improves when the organization connects engineering, creativity, and care to a decision that people can see. Her 180-day plan at PepsiCo South America Foods was associated with a 50% reduction in accident ratio in six months, a result that is not a promise for another operation but a reminder that measurable change needs a defined plan, ownership, and verification.

Which evidence should a supervisor trust?

The supervisor should trust the evidence that answers the decision in front of them, while recognizing that no single method is sufficient. Use the JSA to understand the work, the risk matrix to determine scrutiny and escalation, and field verification to test whether the control arrangement is real at the point of release.

If the three methods disagree, trust the contradiction enough to stop and investigate it. A changed field condition deserves more attention than a reassuring score, and a weak task description deserves revision before the team debates tolerability. Risk management becomes credible when documents follow the work rather than replacing it.

For more guidance on turning safety decisions into operating practice, explore Andreza Araujo's books and Safety School resources, including Safety Culture: From Theory to Practice. Safety is about coming home, and the decision before non-routine work should make that outcome more likely through evidence that can withstand contact with reality.