Safety Accountability: 6 Questions That Expose Unowned Risk in Leadership Decisions

A leadership team can assign an owner to every critical risk and still leave the exposure unowned. The gap appears when the named person cannot change the design, release funding, alter the schedule, stop work, or obtain reliable evidence from the field.

Safety accountability becomes real only when responsibility is matched with decision rights and verification. The six questions below are designed for executives, site leaders, and EHS managers who need to test whether an accountability model can withstand production pressure, not merely whether the organization has completed its responsibility matrix.

Why naming an owner is not enough

A risk owner is often treated as an administrative field in a register. Once a name is entered, the record looks mature, and the review can move to the next line. That logic confuses visibility with control.

James Reason's work on organizational accidents explains why serious exposure can persist through several apparently reasonable decisions. Latent conditions, weak defenses, and local workarounds can line up while each department believes that another function owns the consequence.

Andreza Araujo's Safety Culture: From Theory to Practice makes the same leadership issue practical. Culture is visible in repeated decisions, particularly when a control competes with output, maintenance time, staffing, or capital. A named owner without authority is a message that accountability exists on paper and nowhere else.

The first management test is simple. Ask whether the person listed in the risk record can change the condition that creates the exposure. If the answer is no, the organization has assigned observation, not ownership.

Question 1: Can the owner change the condition that creates the risk?

Responsibility should sit close enough to the exposure to preserve operational understanding, but it must also reach the decisions that can remove or reduce the hazard. A supervisor may understand the failure mode while lacking authority to change equipment, staffing, sequencing, or contractor scope.

Map the owner against the actual control. If the control depends on engineering, procurement, maintenance, scheduling, or a customer commitment, the owner needs a defined route into those decisions. Otherwise, the risk record becomes a request queue with no reliable way to alter the work.

ISO 45001:2018 supports this logic through leadership, consultation, operational planning, and the need to control changes that can affect occupational health and safety. It does not turn an organizational chart into proof that a control is effective.

Leaders should record the decision rights that sit beside each high-consequence risk. Those rights might include stopping a task, rejecting a temporary workaround, requesting engineering review, or escalating an overdue correction to the site leader.

Question 2: Does the owner control the resources needed to act?

A person can be accountable for a risk and still be unable to obtain the resources required to reduce it. The pattern is common when EHS is asked to own exposures that depend on capital approval, maintenance capacity, contractor availability, or additional staffing.

The question is not whether a budget exists somewhere in the company. The question is whether the owner can make the resource requirement visible, define its consequence, and obtain a decision before the exposure becomes routine.

When funding is delayed, the record should show the interim control, its owner, its expiry date, and the executive who accepted the remaining exposure. This prevents a temporary measure from becoming a silent transfer of risk to the frontline.

ISO 31000:2018 provides a useful governance lens because risk treatment is connected to decision-making, monitoring, and communication. A treatment plan without an explicit resource decision is unfinished management, even if the action status says open.

Question 3: Who can stop the work when the control is unavailable?

Stop-work authority is often stated broadly and practiced narrowly. A worker may be told to stop unsafe work, while the supervisor has no protection from schedule consequences and the manager has no response standard for the interruption.

Accountability is credible when the organization has defined the trigger, the person who may stop the task, the conditions for restart, and the leader who resolves disputes. Without those boundaries, stopping work becomes a personal act that depends on confidence and local relationships.

Consider a hypothetical maintenance task in which isolation is complete on paper but the field verification cannot confirm zero energy. The correct response is not to ask the mechanic to be more careful. It is to pause the job, escalate the evidence gap, and require a competent decision before exposure resumes.

The restart decision should identify what changed, who verified it, and which evidence supports continuation. That record creates a learning loop without turning the worker who raised the concern into the owner of the underlying control failure.

Question 4: Does the owner receive evidence from the point of work?

Accountability weakens when the owner sees only dashboards, audit status, or completed forms. Those sources can show activity, yet they rarely show whether the barrier is available, understood, and usable during the task that matters.

Field evidence should be specific enough to test the control. It may include a physical inspection, a functional test, a worker explanation, a maintenance record, a permit condition, or direct confirmation that the planned sequence matches the actual work.

HSE guidance on managing health and safety emphasizes arrangements that remain suitable as work changes. That principle matters because the control described in a procedure can drift from the control that people can actually use during a constrained shift.

Senior leaders should ask for one piece of field evidence during each review of a serious exposure. The request changes the conversation from whether an action is closed to whether the condition is safer than it was before the action began.

Question 5: What happens when production pressure conflicts with the control?

Every accountability model is tested when a safe method takes longer, requires a shutdown, or exposes a planning failure. If the response is to ask the frontline to compensate through attention, the organization has preserved the source of the risk.

Leaders should examine the decision path for the last exception. Who made the trade-off? What information did that person have? Which constraint made the approved method difficult? Who could change that constraint, and how quickly did the issue reach that level?

In Antifragile Leadership, Andreza Araujo connects leadership strength with the capacity to use pressure as information rather than hiding it. Applied to safety accountability, that means treating repeated exceptions as evidence that the operating design needs attention.

The practical output is not a promise that production pressure will disappear. It is a visible escalation rule that tells leaders when a deviation requires redesign, additional resources, a revised schedule, or a decision to stop.

Question 6: How is accountability verified after the action is closed?

Closure is an administrative event. Verification is an operational judgment. A corrective action can be closed because a document was revised while the equipment, behavior, or work sequence remains unchanged.

Set a verification date that reflects the risk and the operating cycle. The verifier should be independent enough to test the claim, competent enough to recognize a weak control, and close enough to the work to see conditions that a report can hide.

The review should compare the intended control with what people can perform. It should also check whether the control survived a shift change, a contractor handover, an abnormal condition, and the production pressure that previously exposed the weakness.

When verification fails, the organization should reopen the decision rather than blame the person who discovered the gap. That response protects the integrity of the system and keeps accountability attached to the condition that still needs to change.

Comparison: assigned responsibility versus real accountability

The difference between the two models is visible in the evidence they produce. Assigned responsibility creates a name and a status. Real accountability creates a decision path that can withstand disagreement, delay, and changing field conditions.

What leaders should change in the next review

Choose one serious exposure and ask all six questions without accepting general answers. Name the decision right, resource owner, stop-work trigger, field evidence, pressure response, and verification date. If any answer depends on informal goodwill, the accountability chain is not complete.

This review also gives EHS a stronger role. The function does not need to own every risk. It needs to make ownership testable, expose unowned dependencies, and ensure that leaders can see when a control has become unavailable.

Across Andreza Araujo's safety leadership work, the durable distinction is between what the organization says it values and what its decisions protect under pressure. Accountability becomes credible when those two things match in the field.

If your leadership team needs a practical way to connect responsibility, control verification, and escalation, explore Andreza Araujo's safety leadership resources.

Conclusion

Safety accountability is not complete when a risk has a name beside it. It is complete when the named owner can influence the condition, secure the needed resources, stop work, receive field evidence, escalate pressure, and verify that the action changed exposure.

The six questions turn an abstract governance promise into a decision test. Use them before the next serious-risk review, because unowned risk rarely announces itself as a missing name. It appears as a decision that everyone can describe and no one can make.