Risk Treatment: 5 Blind Spots That Leave High-Consequence Exposure Unmanaged

A risk register can be green while a serious exposure remains active. The problem is not always poor analysis. More often, the treatment plan stops at description, scoring, or assignment, even though no barrier has become stronger and no operational decision has changed.

This article examines five blind spots that keep high-consequence exposure unmanaged. The aim is not to produce another risk-ranking exercise. It is to help an operations leader decide whether the treatment has changed the work enough to justify continuing it.

Why risk treatment is weaker than the assessment suggests

Risk treatment should connect an identified exposure to a decision, a control, an owner, and evidence that the response works. When one of those links is missing, the organization may have completed an administrative cycle without reducing the pathway to harm.

James Reason's work on organizational accidents helps explain why this distinction matters. An event usually requires more than one visible mistake, because latent weaknesses in design, supervision, maintenance, information, and management decisions can align with an active failure. A treatment plan that addresses only the final action at the point of work therefore leaves the wider pathway intact.

Across 25+ years of executive EHS work, Andreza Araujo has repeatedly positioned safety culture as an operating reality rather than a statement of intent. Her experience across more than 250 cultural transformation projects supports a direct test: what changed in the conditions, choices, and evidence that surround the risk?

1. The hazard is described, but the decision is missing

The first blind spot appears when a risk assessment names a hazard without naming the decision it must support. “Exposure to stored energy” may be accurate, yet it does not tell a plant manager whether equipment can start or maintenance can proceed. It also leaves unclear whether a safeguard is sufficient and who can authorize an exception.

A risk assessment becomes useful when its purpose is explicit. A modification review may ask whether a process can start. A critical-control review may ask whether a barrier is reliable enough for continued operation. A field escalation may ask whether the crew should pause until engineering support arrives. Each question requires different evidence.

Write the decision in one sentence before selecting treatment. Then record the boundary that would reopen it, such as a change in equipment, staffing, process conditions, contractor interface, or production demand. This discipline prevents an old assessment from becoming a permanent authorization.

A practical field risk escalation huddle can expose this gap quickly, because the team must say what decision is pending, what is uncertain, and who has authority to resolve it.

2. The control is listed, but reliability is assumed

The second blind spot is treating a control as effective because it appears in a procedure, risk register, permit, or training module. A listed barrier is only a claim until the organization can show how it functions when the task is urgent, the equipment is degraded, the supervisor is absent, or production pressure rises.

Control reliability has several dimensions. The barrier must be present, technically suitable, available when demanded, understood by the people who depend on it, and owned by someone who can maintain its condition. A warning sign may communicate an expectation, but it cannot compensate for a missing interlock or an access route that makes isolation impractical.

The market often minimizes this distinction because a documented control is easy to count. The harder question is whether the control prevents, detects, or limits the event under representative conditions. That is why a control reliability review should examine evidence, not only presence.

Choose one serious exposure and test its most important barrier. Ask what proves availability, what failure would look like, who receives the signal, and what happens next. If those answers are vague, the treatment has not earned closure.

3. Ownership is assigned, but authority is absent

An action owner is not automatically a risk owner. The person whose name appears in a system may be able to update a task, request a quote, or organize a meeting while lacking authority over design, maintenance, staffing, scheduling, or work authorization.

This creates a familiar pattern. EHS owns the action because EHS owns the register, while operations retains the conditions that create the exposure. The register remains active, reminders continue, and the original risk survives inside a chain of polite follow-up.

The treatment plan should identify the person who can change the condition and the person who can accept residual risk. Those roles may be different, but neither should be hidden behind a department label. If an action needs capital, engineering time, a shutdown window, or a production restriction, the decision must reach that level.

Use a management-of-change review when temporary workarounds alter the original assumptions. A temporary decision becomes dangerous when its operational owner is clear on paper but its expiry, evidence, and escalation route are not.

4. The risk score is precise, but the assumptions are weak

A numerical score can create false confidence when the inputs are uncertain, averaged, or disconnected from the actual work. The number may look disciplined even when the team has not agreed on exposure duration, credible consequences, barrier independence, or the conditions that make the event more likely.

Risk matrices are useful for prioritization, yet they do not determine whether a high-consequence pathway is acceptable. A low frequency estimate should not erase a weak critical control, and a low consequence estimate should not survive when the scenario includes multiple people, energy sources, or delayed rescue.

The counterpoint is important for leaders who want a single ranking system across sites. Consistency helps comparison, but forced precision can hide uncertainty. Record the assumptions beside the score and state what evidence would change the judgment. A score without its reasoning is difficult to challenge and even harder to govern.

When reviewing a risk matrix, ask whether the rating would remain credible if one barrier failed, one staffing assumption changed, or the task extended beyond the planned window. If the answer is unknown, the uncertainty belongs in the decision.

5. Treatment is closed before the field can prove it

The fifth blind spot appears when closure means that a document was revised, a course was assigned, or a meeting was held. Those activities may be necessary, but they do not prove that the exposure has changed or that the new arrangement can withstand normal operating pressure.

Define the closure evidence before the action begins. A design change may require a drawing revision and a functional test. A maintenance response may require proof that the defect no longer recurs. A supervision action may require observation during the task, not a photograph of a briefing board.

Andreza Araujo's book Safety Culture Diagnosis: Learn how to do your own provides a useful cultural lens for this problem, because the declared expectation must be compared with observable practice. Her work at PepsiCo South America, where the accident ratio fell 50% in six months under a 180-day plan, also illustrates why treatment needs a defined operating rhythm rather than a single announcement.

Close the action only when the evidence matches the claim. Attendance proves attendance. A signed procedure proves distribution. Neither proves that a critical safeguard works when the task is performed under the conditions that created the exposure.

What changes when the five blind spots are removed?

How should leaders use this diagnostic?

Select one high-consequence exposure that the organization currently considers controlled. Do not begin with the easiest action or the most polished register entry. Choose a risk whose treatment influences whether people start, continue, modify, or stop work.

Then ask five questions. What decision is pending? Which barrier matters most? Who has authority to change the condition? Which assumptions make the score credible? What evidence will permit closure? The answers will show whether the treatment is operational or merely recorded.

If the answers are incomplete, do not hide the gap by lowering the rating or extending the due date. Make the uncertainty visible, escalate to the person who controls the decision, and set a short review cycle. A clear unresolved risk is safer to govern than a green status that no one can defend.

Conclusion: risk treatment must reach the work

Risk treatment is credible when it changes a decision, strengthens a barrier, assigns authority, tests its assumptions, and leaves evidence that the field condition is different. A risk register is valuable when it helps leaders make those changes, not when it simply preserves the appearance of control.

For deeper work on safety culture, leadership, and risk ownership, explore Andreza Araujo's books and Safety School resources. The practical standard remains simple even when the analysis is difficult: safety is about coming home.