Procedure Usability: 9 Gaps That Turn Rules Into Risk

Procedure usability is the degree to which a safety rule can be understood, found, followed, and verified during real work. A procedure may satisfy ISO 45001 document control and still fail in the field when its language, timing, sequence, or ownership does not match the task.

ILO estimates published in 2023 put work-related deaths near 2.93 million people each year, and many of those losses happen in organizations that already own written rules. This article shows 9 procedure usability gaps that make a documented control look strong on paper while leaving operators, supervisors, and EHS managers exposed during execution.

Why procedure usability is a safety control, not a formatting issue

Procedure usability is a control-quality problem because a rule that cannot be used at the point of work is not controlling the risk it describes. ISO 45001:2018 asks organizations to plan and control operational processes, while ISO explains that ISO 45001 provides a management-system basis for occupational health and safety. The missing question is whether the operator can execute the rule under noise, fatigue, production pressure, and time constraint.

As Andreza Araujo argues in The Illusion of Compliance, compliance can become a convincing simulation of safety when the organization confuses evidence of writing with evidence of control. A 42-page work instruction may satisfy an auditor, yet it may also hide the 4 decisions a field crew must make before breaking containment, entering a confined space, or restarting a guarded machine.

EHS managers should test procedures the way they test physical barriers, because the procedure is part of the barrier stack. If the rule does not tell the worker what to stop, who to call, and which condition makes the job unacceptable, the document is information, not a control.

1. The rule is written for the auditor, not the task

A procedure written for the auditor prioritizes definitions, policy language, and document hierarchy, while a usable procedure prioritizes the next field decision. In high-risk work, the worker often needs the correct instruction in less than 60 seconds, not a legal explanation of the safety management system.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen that the strongest written programs often fail at the handoff between the office and the field. The hidden failure is not literacy alone. It is the assumption that a worker under pressure will translate policy language into safe sequencing without support.

Test this gap by taking one critical procedure to the worksite and asking a supervisor to find the first stop condition. If the answer takes more than 2 minutes, rewrite the procedure around task flow and link the outcome to a procedure usability case rather than a style preference.

2. The procedure has no visible stop criteria

Stop criteria are the explicit conditions that require the task to pause before risk increases. A usable procedure names the 3 to 5 field conditions that make continuation unacceptable, such as missing isolation proof, unstable weather, incomplete gas testing, damaged guarding, or unclear line ownership.

What most safety programs miss is that stop-work authority fails when the procedure asks for courage but does not give the worker a technical trigger. The person on the job should not have to argue from instinct when the document could define the threshold.

For supervisors, the practical move is to add a short stop box at the top of every critical procedure. That box should answer 3 questions: what condition stops the job, who restarts it, and what evidence proves the condition changed.

3. The sequence hides the highest-risk decision

A procedure sequence hides risk when the most dangerous decision appears after administrative steps instead of before the exposure. In a permit-to-work flow, for example, isolation verification must appear before access, because the worker needs proof before the body enters the hazard zone.

In Safety Culture: From Theory to Practice, Andreza Araujo connects culture to observable decisions, not declared values. Procedure sequence is one of those observable decisions, since the order of instructions tells workers what the organization believes matters first.

Map the procedure against the actual task and mark the irreversible points. If the irreversible point appears before the verification step, the procedure is teaching the wrong behavior. This same logic applies to ISO 45001 operational controls, ANSI Z10, and ILO-OSH 2001, even though the documents use different structures.

4. Why do workers bypass procedures they agree with?

Workers bypass procedures they agree with when the written method does not fit the conditions of the job. A person can believe in the rule and still ignore it when the instruction requires a tool that is unavailable, a signature from someone off shift, or a step that no longer matches equipment changed in 2024.

This is where many leaders mistake noncompliance for attitude. James Reason's work on latent failures helps explain why the visible deviation may be the last symptom of a design problem that management created earlier through poor planning, weak supervision, or outdated documentation.

The field test is simple. Ask the crew to mark every step they skipped in the last 30 days and write the reason beside it. If the reason repeats across shifts, the bypass is not a character issue. It is a procedure-design signal that belongs in the corrective-action system.

5. The document ignores language, literacy, and shift reality

Procedure language becomes a risk factor when it assumes one reading level, one native language, and one daytime condition. In multilingual plants, distribution centers, and construction sites, a critical instruction that is clear to the engineer may be ambiguous to the night-shift contractor.

During her Unilever LATAM tenure across 19 countries, Andreza Araujo worked in environments where the same corporate standard had to survive different languages, labor structures, and local practices. That experience matters because procedure usability is not only an English-writing issue. It is a translation, context, and supervision issue.

Use pictures only when they clarify a decision, and do not let icons replace technical thresholds. A gas-test requirement still needs numbers, intervals, and acceptance criteria. A lifting plan still needs load, radius, equipment, competent person, and exclusion-zone rules.

6. The procedure is not connected to training evidence

A procedure that is not connected to training evidence cannot prove competence when the task fails. HSE states in its guidance that risk assessment should focus on sensible measures to control real risks, and HSE explains risk assessment as finding hazards, deciding who may be harmed, and controlling the risk.

The training gap appears when attendance records become the only evidence. A worker may have attended a 45-minute briefing and still be unable to perform the 6 critical checks the procedure requires. Attendance proves exposure to content, not the ability to execute the control.

Connect each critical procedure to a competence matrix with observed field verification. For high-risk work, the verifier should watch the worker perform the step, ask what would stop the task, and record whether the answer matched the procedure.

7. How can leaders see whether a procedure works?

Leaders can see whether a procedure works by observing the task, timing the decision points, and checking whether workers can name the stop criteria without prompting. A 30-minute field review often reveals more than a month of document-control reports.

In more than 250 cultural-transformation projects, Andreza Araujo observes that leaders often ask whether procedures exist before asking whether people trust and use them. That order matters because existence is a weak signal, while field use is a strong signal.

Build procedure checks into safety walks. The leader should ask for the current version, the last changed step, the most common workaround, and the evidence that the procedure prevented risk in the last 90 days. This makes the review close to a safety culture evidence review instead of a paperwork inspection.

8. The rule has no owner after approval

A procedure without an active owner becomes obsolete as soon as equipment, staffing, maintenance method, or contractor interface changes. Document-control approval may freeze a file, but the worksite keeps moving through modifications, temporary repairs, seasonal peaks, and new supervisors.

The ownership trap is that everyone assumes EHS owns the procedure because safety is in the title. For operational controls, the real owner must be the line function that controls the work, with EHS acting as technical challenger and verifier.

Assign one operational owner, one EHS reviewer, and one field reviewer for every critical procedure. Review triggers should include incident learning, equipment change, legal change, contractor change, and a fixed 12-month review for high-risk tasks.

Each month without procedure ownership allows small field adaptations to become the unofficial method, while the controlled document keeps describing work that no longer exists.

9. The procedure is not tested after an incident

A procedure not tested after an incident loses one of the clearest learning opportunities the organization has. The investigation should ask whether the rule was known, available, understandable, practical, sequenced correctly, and verified before it asks only whether the worker followed it.

ILO reports that non-fatal occupational injuries affect hundreds of millions of workers each year, and ILO describes occupational safety and health as a global public-health and labor issue. That scale should make leaders suspicious of explanations that stop at individual behavior.

After any SIF potential event, add a procedure usability review to the investigation. Compare the written rule with the real timeline, interview the people who used it, and update the procedure only after the control gap is clear.

Comparison: documented procedure vs usable control

Procedure usability protects the gap between rule and reality

Procedure usability matters because the worker does not execute the policy manual. The worker executes the next decision under time, pressure, tools, weather, language, fatigue, and supervision, which means the rule must be usable before it can be trusted as a control.

If your organization needs to convert written safety rules into field evidence, start with the 9 gaps above and test the highest-risk procedure this week. For leaders who want a deeper cultural diagnosis, Andreza Araujo's work in Safety Culture Diagnosis and ACS Global Ventures can help connect procedure quality, leadership behavior, and real safety at Andreza Araujo.