Pre-Mortem Workshop: 8 Steps for Critical Work

OSHA states that one root cause of workplace injuries, illnesses, and incidents is the failure to identify hazards that are present or could have been anticipated. This guide shows how to run a 45-minute pre-mortem workshop before critical work starts, so the team finds weak controls while there is still time to change the job.

Why does critical work need a pre-mortem before the permit is signed?

A pre-mortem workshop asks a team to imagine that a critical job has already failed, then work backward to identify the causes that would make that failure credible. In high-risk work, this 45-minute routine gives the EHS manager a disciplined way to test assumptions before people enter confined spaces, break containment, lift loads, work at height, or energize equipment.

HSE explains that employers must make a suitable and sufficient assessment of risks to employees and others. The trap is that many risk assessments become a signature ritual after the work plan is already emotionally locked, which means the team is defending the plan rather than interrogating it.

Across 25+ years leading EHS at multinationals, Andreza Araujo identifies that weak signals often appear before the permit is approved: a missing rescue resource, a contractor who cannot explain isolation boundaries, a supervisor who accepts a copied JSA, or a planner who assumes the same job will behave like last month. The workshop below turns those signals into named decisions.

Step 1: Define the exact critical work scenario

The first step is to write one failure scenario in operational language, with the job, location, energy source, exposed group, and time window named in a single sentence. A useful scenario takes 2 minutes to state and avoids vague phrasing such as unsafe work or poor planning.

For a line break, the sentence might read: At 02:00 on Unit 4, a contractor opens the wrong flange after isolation is accepted, releasing hot product toward 3 workers. That sentence is sharper than a broad risk register entry because it forces the workshop to test the work package, not the category.

ISO 31000:2018 specifies a process that includes identifying, analyzing, evaluating, treating, monitoring, and communicating risk. A pre-mortem does not replace that process; it adds pressure to the moments where normal planning can miss field reality.

The EHS manager should stop the session if the team cannot define the scenario within 5 minutes. When the room cannot name the credible failure, the planned work is not ready for a permit review.

Step 2: What failure are we willing to imagine?

The second step is to ask the group to assume the work failed 4 hours after start, with a serious injury, uncontrolled release, dropped object, or major equipment damage. The imagined failure must be severe enough to break polite optimism, yet specific enough to keep the discussion grounded in the job.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is revealed less by slogans than by repeated decisions under pressure. The pre-mortem exposes one of those decisions: whether the team is allowed to say that the plan can fail before management has already endorsed it.

Give each participant 3 minutes of silent writing before discussion. Silent writing matters because junior technicians, contractors, and night-shift supervisors often see failure paths that a confident project lead will explain away too quickly.

At this point, connect the workshop to the existing dynamic risk assessment routine. The pre-mortem happens before work starts, while dynamic assessment keeps testing the same assumptions as the job changes.

Step 3: Collect causes without debating them

The third step is to collect at least 12 possible causes in 8 minutes, without allowing the group to rank, defend, or solve them during capture. Quantity matters at this stage because the first 3 answers are usually familiar hazards, while the later answers reveal coordination gaps and weak controls.

The facilitator should group causes into 4 columns: energy, people, equipment, and timing. That structure prevents the discussion from collapsing into operator behavior, which is the easy explanation when the real issue may sit in isolation design, shift handover, access control, or production pressure.

OSHA describes hazard identification and assessment as a proactive, ongoing process to find hazards that are present or likely to be present. The pre-mortem makes that principle practical by asking what would have to be true for the incident to happen today.

Reject generic causes such as lack of attention unless the team can convert them into observable conditions. Fatigue after 10 hours on shift, unclear flange labeling, and no second verifier are usable; carelessness is not.

Step 4: How do we separate weak controls from paperwork?

The fourth step is to test each cause against existing controls and mark the control as verified, assumed, missing, or weak. This 4-status language is useful because a signed permit often says a control exists, while field evidence shows it has not been tested.

In more than 250 cultural transformation projects, Andreza Araujo observes that organizations overestimate controls when they read procedures and underestimate risk when they skip field proof. That is why the pre-mortem must ask for evidence: who saw the isolation, who tested the atmosphere, who checked the anchor point, who confirmed the exclusion zone.

The strongest workshop output is not a longer hazard list. It is a short list of controls that cannot be treated as real until someone verifies them in the field, which connects directly to control assurance through field evidence.

4 statuses keep the discussion honest: verified, assumed, missing, and weak. If more than one critical control is assumed or weak, the job needs a pause, not a motivational safety talk.

Step 5: Assign owners for the top controls

The fifth step is to assign one named owner, one proof method, and one deadline to each critical control that remains weak or assumed. A control without an owner is only an intention, and a control without proof creates the illusion that the risk has moved when it has only been documented.

Use a 3-column action line: control, owner, proof. For example, isolation boundary, maintenance supervisor, field photo plus second-person verification before 01:30. This keeps the output short enough to fit into the permit briefing and specific enough to be checked by the shift leader.

During the PepsiCo South America tenure, where the accident ratio fell 50% in 6 months, Andreza Araujo learned that prevention depends on management routines that force decisions before the event, not on heroic reaction after loss. The pre-mortem is one of those routines when it is tied to ownership.

Step 6: What should trigger escalation before work starts?

The sixth step is to define 3 escalation triggers that stop the job from starting until a competent person decides. Triggers must be visible before work begins, such as missing rescue capacity, unverified isolation, incomplete contractor competence evidence, conflicting SIMOPS, or an unavailable supervisor.

The market often treats escalation as a leadership virtue, but field teams need thresholds more than slogans. If the shift supervisor has to negotiate whether an assumed control is serious enough to pause, the system has already transferred executive ambiguity to the front line.

Use the same logic described in risk trigger thresholds for safety decisions: green for proceed, amber for senior review, red for stop and redesign. The pre-mortem should make those thresholds operational for this specific job.

3 triggers are enough for a 45-minute session, because a long trigger list becomes another document to ignore. Pick the few conditions that would change the decision to start work.

Step 7: Re-brief the crew in plain language

The seventh step is to turn the workshop output into a 5-minute crew briefing that names the failure scenario, the 3 most credible causes, the verified controls, and the escalation triggers. The briefing must be short enough for the field and concrete enough for a worker to challenge it.

James Reason's latent-failure view helps explain why the briefing matters: the incident path is often built before the operator acts, through design, planning, supervision, and conflicting goals. The pre-mortem briefing gives the crew permission to inspect that path before exposure starts.

Ask one contractor, one operator, and one supervisor to repeat the stop condition in their own words. If they cannot repeat it, the workshop has stayed at management level and has not reached the people who will be closest to the energy source.

Each week without a pre-mortem routine leaves the same silent assumptions inside permits, while critical work keeps moving through night shifts, contractor handoffs, and schedule pressure.

Step 8: Close the loop after the job

The eighth step is to review the job within 24 hours and compare the pre-mortem assumptions with what actually happened in the field. This closes the learning loop before memory fades, which is especially important when contractors leave site or the next shift inherits unfinished work.

The review should answer 4 questions: which imagined causes appeared, which controls worked, which controls were weaker than expected, and which trigger should be added to the next job. The goal is not to congratulate the team for a safe outcome, but to improve the next decision.

Link the output to the broader risk escalation process for weak signals. A pre-mortem that finds a recurring weak control should not die in a meeting note; it should change a trigger, a standard, a training point, or a management review agenda.

If the review produces no changes after several critical jobs, audit the quality of the workshop. A routine that never finds weak assumptions is either being used on low-risk work or being facilitated in a way that protects the plan from dissent.

Pre-mortem workshop vs JSA vs permit review

A pre-mortem workshop is different from a JSA or a permit review because it starts with imagined failure, not with task sequence or compliance confirmation. The three tools can work together, but they answer different questions and should not be collapsed into one meeting.

The practical sequence is simple: use the pre-mortem to find credible failure paths, use the JSA to connect hazards with task steps, use the permit review to authorize only verified controls, and use dynamic assessment to catch change during execution.

Conclusion

A pre-mortem workshop works when it converts imagined failure into verified controls, named owners, and escalation triggers before critical work begins. It does not add bureaucracy when the output changes the start decision, the permit briefing, or the field verification plan.

If your organization needs to turn critical-risk routines into visible management discipline, Andreza Araujo can support the diagnosis, workshop design, and safety culture governance needed to make this practice stick. Start at Andreza Araujo and align the next critical job before the permit becomes the only defense.