Safety Case vs PSM Audit vs Board Assurance Review: Which Evidence Should a Board Require?

A board can receive a polished safety case, a clean process-safety audit, and a confident assurance presentation, yet still lack the evidence needed to accept major-hazard exposure. The problem is not that one document is automatically weak. The problem is that each evidence stream answers a different question.

A safety case explains how a defined operation is supposed to prevent and limit major accidents. A PSM audit tests whether selected management-system requirements are in place and maintained. A board assurance review asks whether the organization can still defend its risk position, given what has changed, what has failed, and what remains uncertain. Treating these as interchangeable creates false comfort.

Why the three approaches should not be ranked as substitutes

The first decision is not which document looks most rigorous. It is which decision the board is making. A new process may require a demonstration that the hazards have been understood before operation. A mature site may need to know whether its process-safety program is being executed. A company facing production pressure may need an independent view of whether leaders are accepting exposure that the operating system can no longer control.

HSE safety-case guidance is built around major-hazard control arrangements for a defined installation or operation. OSHA’s Process Safety Management standard, 29 CFR 1910.119, requires employers to manage hazards associated with highly hazardous chemicals through specified information, analysis, procedures, training, mechanical integrity, management of change, incident investigation, and audits. ISO 45001:2018 provides a broader occupational health and safety management-system framework, while ISO 45004:2024 gives guidance for monitoring, measurement, analysis, and evaluation of OH&S performance.

Those references matter because they show why the evidence cannot be collapsed into one score. The safety case is mainly a risk demonstration. The PSM audit is mainly an implementation test. The board assurance review is mainly a decision and governance test. The same weakness can appear in all three, but it will be described differently.

Evaluation criteria: what should the board compare?

A useful comparison uses seven dimensions. First, identify the primary question. Second, define the boundary, because evidence from one unit cannot automatically represent another. Third, separate design intent from operating performance. Fourth, test independence, since the author of a control description may not be the right person to validate it. Fifth, examine time sensitivity, especially after changes, maintenance deferrals, or staffing disruption. Sixth, make uncertainty visible instead of hiding it inside an overall rating. Seventh, connect the evidence to an explicit decision owner.

Andreza Araujo’s approach to safety combines engineering, creativity, and care. Applied here, engineering means understanding the hazard and the barrier. Creativity means choosing evidence that exposes the real decision rather than repeating a familiar report. Care means refusing to convert uncertainty into a production target that people must absorb in the field.

A board should therefore ask a plain question before reviewing any pack: “What decision could we make differently after seeing this evidence?” If the answer is unclear, the pack is probably measuring activity rather than improving risk control.

Safety case: strongest for demonstrating the control basis

A safety case is strongest when the organization needs to demonstrate how a defined operation will prevent and limit major accidents. Its value is architectural. It brings together the hazard identification, credible scenarios, prevention and mitigation measures, emergency arrangements, operating assumptions, and management arrangements that support the claim that the operation can be run within an acceptable control basis.

That structure helps a board see the relationship between a major event and the barriers intended to prevent it. It can expose assumptions about staffing, inspection intervals, alarm response, relief capacity, isolation, competency, or emergency access that would otherwise be scattered across engineering files and procedures. It is particularly useful before starting a new operation, after a material design change, or when the risk profile has moved beyond the organization’s previous experience.

Its limitation is equally important. A safety case can describe a strong design while the field operates with degraded equipment, temporary bypasses, weak handovers, or overdue actions. The document may remain technically coherent while the control environment has drifted. That is why the board should never treat the existence of a safety case as proof that the controls are currently effective.

The right board question is not “Do we have a safety case?” It is “Which claims in the safety case have been tested recently in the work, and where do current conditions differ from the assumptions?”

PSM audit: strongest for testing implementation discipline

A PSM audit is strongest when leaders need to test whether the required elements of process-safety management are implemented and maintained. Its evidence may include process-safety information, process-hazard analyses, operating procedures, training records, mechanical-integrity records, management-of-change files, incident investigations, and action tracking.

That breadth makes the audit useful for identifying gaps that are not visible in a single incident or inspection. It can show that a site has allowed procedures to fall behind the process, that action closure is being reported without effectiveness checks, or that management of change is treating temporary conditions as administrative details. When the audit sample is well designed, it can also reveal whether local practice matches the written system.

The audit still has boundaries. Sampling can miss a weak barrier. Records can show completion without proving quality. A procedure can be present while the task is performed differently during a night shift, a contractor interface, or an abnormal operating condition. OSHA’s requirement for periodic compliance audits does not turn an audit into a guarantee that every major-hazard barrier will perform when demanded.

The right board question is “Which high-consequence controls did the audit test directly, which were inferred from records, and what was outside the sample?” That question forces the report to distinguish evidence from assumption.

Board assurance review: strongest for testing ownership and residual risk

A board assurance review is strongest when the decision is whether the organization should accept a known exposure, fund a control, pause an activity, approve a major change, or continue operating with a temporary deviation. It is not simply a shorter audit. It is a structured challenge to the quality of the executive risk position.

The review should connect the major hazard to its critical controls, control owners, current condition, verification evidence, overdue actions, and decision thresholds. It should also show what leaders know and what they do not know. A board cannot govern residual risk if the report contains only green status symbols without explaining the evidence behind them.

Its weakness appears when assurance becomes a presentation ritual. If executives select only favorable indicators, if the independent reviewer receives a filtered data set, or if the board is asked to “note” a risk without accepting a clear decision, the review creates visibility without control. It can also become detached from the operating system when no one returns to verify whether the decision changed work.

The right board question is “What exposure are we accepting today, who owns it, what evidence supports the acceptance, and what event would force us to reconsider?”

Why design evidence, audit evidence, and field evidence can disagree

Disagreement between the three evidence streams is not automatically a reporting failure. It may reveal that the organization is looking at different layers of the same risk. The safety case may assume an inspection interval that the maintenance system cannot meet. The PSM audit may confirm that the inspection process exists while field verification shows that technicians are closing work orders without testing the protective function. The board pack may then report the asset as compliant while the operational exposure is increasing.

James Reason’s work on latent conditions is useful for interpreting this pattern. A visible deviation may be the result of earlier design, planning, workload, supervision, or management decisions. The board should not stop at the last person who signed a form. It should ask which conditions made the weak signal ordinary and which control should have detected the drift sooner.

A practical test is to compare three statements. What should happen according to the risk basis? What does the management system require? What can the worksite demonstrate now? The distance between those statements is more decision-relevant than the average of their scores.

Decision matrix: which evidence fits which board decision?

The matrix is not a scoring model. It is a way to stop the board from asking one document to perform three jobs. A safety case should not be forced to prove current execution. An audit should not be forced to define the whole risk basis. An assurance review should not invent technical evidence that the operating system has never collected.

Recommendation by context: combine the streams without duplicating them

For a new high-hazard operation, start with the safety case or equivalent risk demonstration, then test readiness in the field before the board accepts the operating decision. For a mature operation with recurring process-safety findings, use the PSM audit to test system discipline, but select samples around the controls that prevent the most serious credible events. For a temporary deviation, a board assurance review should make the expiry, owner, compensating control, and stop condition explicit.

For recurring executive governance, maintain a short control-assurance view that links each major hazard to the latest design basis, the latest implementation test, and the latest field verification. The board does not need every record. It does need enough evidence to challenge whether the reported condition still represents the work.

Leaders who want to strengthen that discipline can use the risk register, Bow-Tie, and critical-control verification comparison to separate risk description from barrier evidence. The risk register, decision log, and control-verification comparison is useful when the question is residual-risk acceptance. For board-level governance, eight questions for owned safety decisions can turn a general review into an accountable decision.

Andreza Araujo’s book Safety Culture: From Theory to Practice makes the same broader point from a culture perspective: leadership is visible in the conditions it repeatedly accepts. A board that asks for evidence, challenges weak assumptions, and funds control improvement is shaping the operating culture more powerfully than a slogan can.

What the board should require in the next pack

The next board pack should identify the three evidence layers separately. For each major hazard, show the current risk basis, the critical controls, the last direct verification, open deviations, and the accountable executive. Mark evidence that is overdue, inferred, sampled, or unavailable. Do not hide those distinctions in a single red, amber, or green status.

Then state the decision in one sentence. The board is approving operation, accepting temporary exposure, funding a control, requiring a pause, or requesting better evidence. If the sentence cannot be written clearly, the organization is not ready to make the decision.

A safety case, a PSM audit, and a board assurance review become powerful when they reinforce one another without pretending to be the same instrument. The board should require the evidence that matches the decision, verify that the evidence reaches the field, and make residual risk an owned choice rather than an accidental by-product of production.