Safety Culture: 6 Blind Spots That Make Operational Change Unsafe

A new production line, contractor, software system, or maintenance arrangement can weaken safety before anyone reports an incident. The paperwork may be complete, the training may be scheduled, and the project may still leave the operating team with an exposure that nobody clearly owns.

This article takes a critical position. Operational change is not safe because the approval workflow is complete. It is safer when leaders can show that critical controls, decision rights, and field verification survived the change in the conditions where people actually work.

Why operational change exposes safety culture

ISO 45001, updated in 2018, requires organizations to consider change within their occupational health and safety management system. That requirement matters because risk is rarely changed by a single technical modification. A new machine changes maintenance access, staffing, isolation points, training needs, production rhythm, and the authority required when the arrangement fails.

The cultural question is whether leaders treat those effects as part of the work or as administrative detail. James Reason’s work on latent failures helps explain why a frontline deviation can be prepared long before the operator touches the task. A design choice, an unclear handover, or an unrealistic schedule can remove a layer of protection while the formal process still appears healthy.

Across more than 250 cultural transformation projects, Andreza Araujo has consistently connected culture with repeated decisions. People learn what leaders truly protect by watching which concerns receive resources, which shortcuts are challenged, and which deadlines are allowed to overrule a control.

1. The approval blind spot hides who owns the changed exposure

A change request usually names a sponsor, a technical reviewer, and an approver. Those roles do not always identify the person who owns the exposure after the project enters normal operations. When ownership stops at approval, the condition can move between engineering, maintenance, production, and EHS without a decision-maker who sees the whole risk.

The gap becomes visible when the new arrangement needs an exception. A supervisor may know that the control is difficult to use, maintenance may know that access is restricted, and EHS may know that the risk assessment is outdated. Each group holds a fragment, while nobody has the authority to decide whether the work should continue.

Assign one operational owner for each high-consequence exposure created or changed by the project. The owner should be able to explain the control, approve resources, stop the activity, and accept only a residual risk that has been explicitly reviewed.

2. The procedure blind spot confuses publication with usability

A revised procedure can be technically correct and operationally unusable. It may assume access, staffing, tools, language, or time that the worksite does not have. The document is then treated as evidence of control even though the operating team has already built a workaround.

That workaround is not automatically a sign of careless behavior. It can be evidence that the new design does not fit the real sequence of work. A safety culture that punishes the person who reveals this mismatch will preserve the document and lose the warning.

Test the procedure where the task occurs, with the shift, equipment, interfaces, and interruptions that define the real job. Ask the worker to demonstrate the control rather than confirm that the text was read. Record where the sequence breaks, then redesign the condition before calling the change complete.

3. The handover blind spot turns a project boundary into a risk boundary

Many changes move through a formal handover from project to operations. The handover often transfers drawings, manuals, open actions, and training records, but it may not transfer uncertainty. The receiving team inherits a new condition without knowing which assumptions have not yet been tested.

This matters during night shifts, contractor transitions, and early production runs, when the people who approved the change may no longer be present. A control that depends on one engineer’s memory is not yet a dependable operating control.

Include unresolved assumptions in the handover itself. Name the control that is still being proven, the evidence required, the person who will review it, and the trigger that sends the issue back to the project owner. A handover should make uncertainty visible instead of giving it a new filing location.

4. The temporary-control blind spot makes short-term risk look acceptable

Temporary barriers are often introduced to keep production moving while a permanent solution is designed. They can be legitimate, but their presence changes the risk conversation because a temporary measure may be weaker, harder to verify, or dependent on extra attention.

The cultural failure occurs when the temporary arrangement has no expiry condition. Once the work becomes familiar, the organization stops treating it as a deviation and starts treating it as the normal design. The control is then defended by habit rather than by evidence.

Every temporary control needs an owner, a review date, a defined failure condition, and a decision about what happens when the date passes. If the permanent fix is delayed, the leader should record a new decision rather than allow the old exception to continue silently.

5. The performance blind spot rewards output while control quality deteriorates

Operational change creates pressure to prove that the investment is delivering. Leaders track commissioning dates, throughput, downtime, cost, and training completion. Those indicators matter, but they do not show whether the critical control remains reliable during the new operating pattern.

A site can meet the project schedule while supervisors spend more time correcting unsafe interfaces, operators bypass alarms, or maintenance teams work around inaccessible isolation points. If the dashboard counts only output, the culture receives a clear message about which result deserves protection.

Add one or two control-effectiveness questions to the change review. Can the control be verified at the point of work? Does the responsible person have the time and authority to maintain it? Are repeated deviations changing the design, or are they being closed as individual behavior issues?

6. The escalation blind spot makes speaking up expensive

People often raise concerns during change, but the response determines whether the next concern arrives early or after harm. A worker who reports a blocked access route, a missing isolation point, or an unrealistic sequence is testing the organization’s practical tolerance for bad news.

A response that asks the worker to “be careful” leaves the hazard in place and transfers the burden to the person with the least power to redesign the system. Amy Edmondson’s research on psychological safety is useful here because the issue is not comfort. It is whether people can contribute information that a team needs in order to make a better decision.

Close the loop with a visible decision. State what will change, who owns it, when the team will receive an update, and what work is paused until the condition is addressed. When the answer is no change, explain the reasoning and the additional protection required. Silence is not closure.

How should leaders test the new condition?

The review should take place after the new condition has met real work, not only after the project team has completed its checklist. A short field review with operators, maintenance, supervision, and the risk owner can expose friction that a meeting room cannot see.

What does a stronger safety culture do differently?

A stronger culture does not promise that every change will be frictionless. It makes friction useful. Leaders expect the new arrangement to reveal questions, and they create a route through which those questions can alter the design, the schedule, or the control decision.

Andreza Araujo’s Safety Culture: From Theory to Practice is relevant because it treats culture as something people experience through decisions, not as a statement displayed beside the entrance. Her work at PepsiCo South America Foods, where the accident ratio fell 50% under a 180-day plan, also illustrates why visible ownership and time-bound execution matter more than activity volume.

For leaders, the practical test is simple to state even when it is demanding to perform. After the change, can the operating team explain what could cause serious harm, which control must hold, who can stop the work, and what evidence proves that the arrangement is working?

If those answers are unclear, the change is not finished. The organization has approved a plan, but it has not yet demonstrated a dependable operating condition.