New Critical Control Owner in 60 Days: What to Verify Before the First Leadership Review

A new critical control owner has sixty days to turn an important barrier from a name in a register into a control that leaders can trust. The role is not to collect signatures or report activity. It is to define the exposure, verify the control in real work, expose weak evidence, and make overdue action visible before a serious event tests the system.

Picture a supervisor who inherits ownership of vehicle-pedestrian separation, energy isolation, fall protection, or another high-consequence control. The register says the control exists, yet nobody can show how often it is checked, what failure looks like, or who acts when the check is weak. The first leadership review arrives quickly. A polished status report will not answer the question that matters: can the organization rely on this control under pressure?

What a critical control owner needs to understand before starting

A critical control is a barrier that must work to prevent a fatal or permanently disabling outcome. The owner is accountable for the control system, not personally responsible for performing every field check. That distinction matters because ownership becomes ineffective when one person is expected to compensate for unclear design, weak supervision, missing resources, or poor escalation.

ISO 45001:2018 expects organizations to identify hazards, assess risks, establish operational controls, and evaluate performance. A critical control owner connects those requirements to one specific exposure. The owner should be able to answer four questions in plain language: what unwanted event are we preventing, which control should stop it, what evidence shows that the control is present and effective, and what happens when the evidence is weak?

Andreza Araujo describes a related leadership principle in Safety Culture: From Theory to Practice. The frontline leader carries and translates the culture, which means safety leadership cannot be delegated to a document owner who never sees the work. The role therefore combines governance with field contact. It also requires enough authority to escalate a degraded control without waiting for an incident.

First week: establish the control boundary

Start with the unwanted event, not the control label. "Traffic management" is too broad to guide ownership. "A powered vehicle strikes a pedestrian at a loading interface" defines an event, a location, and a consequence pathway that can be tested. Write the event in one sentence, then identify the people, tasks, equipment, and conditions that place them in the exposure.

Next, map the control boundary. State where the control begins, where it ends, and what it does not cover. A physical barrier may protect a fixed crossing but not a temporary loading area. A permit may authorize an activity but not verify that isolation is complete. A training record may show that a person attended a course but not that the control was used correctly during a congested shift.

Collect the current procedure, risk assessment, inspection form, maintenance record, training requirement, incident history, and escalation route. Read them together rather than treating each as proof. If the procedure assigns responsibility to "the supervisor," identify which supervisor, during which shift, with which authority and which response time.

End the week with a short control statement that a worker can understand. Include the exposure, the required control, the owner, the evidence source, the response to failure, and the review cadence. The common error is accepting the existing wording because it is approved. Approval proves that a document passed a process. It does not prove that the control works at the point of exposure.

Days 8 to 30: test evidence where work happens

During the next three weeks, observe the control in normal work, changed work, and work under pressure. A barrier that works only during a planned demonstration is not yet reliable. Visit different shifts, include at least one handover, and ask the people exposed to describe the control without showing them the procedure first.

Use four evidence questions. Is the control present? Is it correctly designed for the exposure? Is it used when the task changes? Does someone respond when it fails? These questions separate existence from effectiveness. They also reveal why a dashboard can remain green while the field is carrying an unmanaged gap.

Record observations as evidence, not as accusations. Note the task, condition, control status, consequence pathway, and immediate action. If a gap is hypothetical, label it as hypothetical. If the gap comes from an internal record, preserve the date and source so that a later review can distinguish verified evidence from interpretation.

At the end of day thirty, classify the control as verified, partially verified, not verified, or not applicable to the observed condition. Do not use a percentage unless the organization has defined what the percentage means. A control can be present in ninety percent of observations and still fail at the one interface where the fatal exposure is concentrated.

Days 31 to 60: convert weak evidence into decisions

The second month is where ownership becomes leadership. Bring the evidence to the people who control design, staffing, maintenance, production planning, procurement, and supervision. The owner should not present a list of findings that others are expected to interpret. Each weak signal should lead to a decision about restoring, redesigning, resourcing, suspending, or accepting the exposure at the correct authority level.

Build a small control review with five fields: the exposure, the required control, the evidence observed, the decision needed, and the named decision owner. Add a due date that reflects the consequence and the time the organization can tolerate the gap. A date without a decision owner is a forecast, not an action.

Use escalation rules before the meeting begins. An unknown energy source, missing rescue capability, loss of a critical physical barrier, or a work change that invalidates the approved method should not wait for the next monthly review. The escalation rule should state who is contacted, what work status applies, and what evidence must be returned before work resumes.

Prepare the first leadership review around decisions rather than activity. Show which controls were verified, which were not, what changed in the field, which actions are overdue, and where the organization is relying on a temporary measure. This is the point at which a critical control program either becomes useful or turns into reporting theater.

What the owner should have ready on day 60

The first sixty days should produce a working control file, not a larger archive. Keep the event definition, control boundary, evidence tests, verified observations, escalation rules, open actions, and review cadence together. A leader who opens the file should understand the exposure and the next decision without asking the owner to translate six disconnected systems.

Show the difference between a control that is designed well and a control that is operating well. The first is a planning question. The second is a field question. Both matter, although the second is where assumptions meet conditions such as overtime, weather, congestion, contractor turnover, maintenance delay, and production pressure.

Agree on a recurring review rhythm. Weekly review is appropriate for a newly degraded control or a short-term recovery plan. Monthly review can test trends, overdue actions, and resource decisions. A quarterly leadership review can examine whether the control remains suitable as work, equipment, staffing, or organizational priorities change.

The owner should also state what they cannot verify. Candor protects the control system because it prevents leaders from mistaking missing evidence for positive evidence. When the owner can say, "we do not yet know whether this barrier holds during the night shift," the organization has a decision to make. When the report says "on track," the gap remains hidden.

Common mistakes that weaken the role

The first mistake is assigning ownership without decision rights. If the owner can observe a degraded control but cannot stop work, request engineering support, or escalate to an accountable leader, the role is administrative.

The second mistake is measuring completed checks instead of control performance. A full checklist can coexist with an unsuitable barrier, rushed verification, or a response that arrives after the exposure has already occurred. Review the quality and consequence of the evidence, not only the count of forms.

The third mistake is treating one good observation as proof of reliability. A control is tested by variation. Check different crews, shifts, locations, workloads, and operating conditions because the conditions that defeat a barrier rarely announce themselves in the standard scenario.

The fourth mistake is letting temporary controls lose their expiry date. A temporary arrangement becomes a hidden operating condition when nobody owns the restoration decision. Every temporary measure needs an end date, a responsible leader, and a trigger for escalation if restoration is delayed.

The fifth mistake is presenting bad news as a personal failure. James Reason's work on latent failures supports a wider reading of weak control evidence. The review should ask which design, resource, supervision, or planning conditions allowed the gap to remain, while still making the immediate exposure and required action explicit.

Resources to deepen the role

Begin with ISO 45001:2018, especially the links between operational planning, leadership, worker participation, and performance evaluation. Use the organization's own risk assessments and procedures as working material, but test them against actual conditions rather than treating them as final proof.

Within Andreza Araujo's catalogue, Safety Culture: From Theory to Practice helps connect leadership behavior with cultural consistency, while Luck or Capability supports the distinction between relying on favorable outcomes and managing the conditions that shape them. Gold Leadership adds a practical reminder that inspiration starts change, yet sustained leadership depends on repeated action under pressure.

For a related operational decision, the guide on building a risk acceptance gate for frontline supervisors shows how to make residual exposure, authority, evidence, and expiry conditions explicit.

A critical control owner earns trust by making uncertainty visible early enough to change the work. In sixty days, the goal is not to produce a perfect scorecard. It is to give leaders a defensible view of which barriers can be relied on, which cannot, and what decision must happen next.

Frequently asked questions

What does a critical control owner do?

A critical control owner defines the exposure, clarifies the barrier that should prevent the serious outcome, verifies the control in real work, and escalates weak or missing evidence to the person who can act.

Does the owner perform every field verification?

No. The owner designs the verification approach and checks its quality, while supervisors, workers, maintenance teams, and other competent people provide evidence from the work they perform.

What should happen when a critical control fails?

The response should follow a pre-agreed escalation rule that states the work status, immediate protection, accountable decision owner, and evidence required before the task resumes.

How is a critical control different from a general safety action?

A critical control is tied to a defined high-consequence event and has a clear performance expectation. A general action may improve the system, but it does not by itself prove that the barrier preventing the serious outcome is working.

What should leaders ask at the first review?

Leaders should ask which controls were verified, where evidence was weak, what exposure remains, which decision is overdue, and whether the current resources and operating conditions are sufficient for the control to hold.