Safety Leadership: 5 Questions That Expose When the Plan No Longer Fits the Field

The permit is approved, the method statement is signed, and the crew is ready to begin. Then a delivery arrives late, the access route closes, a specialist is missing, or the equipment behaves differently from the pre-job review. The document remains valid in the filing system, yet the work has moved beyond the conditions it describes.

This is where safety leadership becomes a decision discipline rather than a communication exercise. A plan is useful only while it represents the hazards, controls, resources, and authority that exist in the field. When those elements change, the leader must decide whether to adapt the method, pause the task, or stop it. The five questions below are designed to expose that mismatch before an exception becomes normal work.

Key answer: when field conditions no longer match the approved plan, the leader should make the mismatch visible, test the affected control, assign decision authority, and verify the revised method under real operating pressure.

Why an approved plan can still lose control

Approval confirms that someone reviewed a proposed method at a particular time and with a particular set of assumptions. It does not prove that the crew has the same staffing, equipment, access, sequence, weather, production pressure, or interface conditions when the task begins.

ISO 45001:2018 requires organizations to control planned changes and manage risks associated with changes in operations, processes, and equipment. The practical difficulty is that many field changes do not arrive as formal projects. They arrive as a missing part, a delayed isolation, a shortcut around congestion, or a supervisor who believes the deviation is too small to report.

James Reason’s work on latent failures helps explain why these moments deserve leadership attention. A visible workaround can be the final expression of earlier design weaknesses, unclear responsibilities, or conflicting priorities. Treating the workaround as an individual attitude problem may remove the person from the task while leaving the conditions that produced it untouched.

Andreza Araujo’s Make The Difference: Be a Leader in Health & Safety places operational leadership in the quality of everyday decisions. That standard matters here because a leader who only checks whether the plan exists is checking paperwork. A leader who tests whether the plan still fits the work is checking control.

Question 1: What changed between approval and execution?

Start with facts that can be observed. Ask the crew to describe the difference between the planned task and the task now in front of them. The answer may concern sequence, people, equipment, location, access, timing, interfaces, or the condition of the hazard itself.

Do not begin with, “Why did you not follow the plan?” That question pushes the conversation toward blame before the organization understands the change. Ask instead, “Which part of the plan no longer describes what you must do?” The wording makes the mismatch visible while keeping accountability for the next decision.

A supervisor can record the change in one sentence, such as, “The lifting path in the plan is blocked by a live delivery route, so the load would pass closer to workers than the reviewed boundary.” That sentence is stronger than a note saying “conditions changed,” because it identifies the affected control.

The common leadership mistake is to accept vague language. When the change cannot be named, it cannot be assessed, assigned, or verified. In more than 250 cultural transformation projects supported by Andreza Araujo, her professional biography describes a recurring management requirement: field evidence must lead the conversation, rather than the assumption that the written process already explains the work.

Question 2: Which control is now uncertain?

Not every change has the same consequence. The leader should identify the barrier whose performance is now uncertain, because that barrier determines whether the task can continue under a revised method.

If the change affects a housekeeping detail, the response may be immediate correction. If it affects isolation, separation, load stability, atmospheric testing, fall protection, traffic segregation, or emergency access, the response requires a more deliberate decision. The point is not to make every variation bureaucratic. The point is to avoid treating a critical control as if it were a cosmetic detail.

Ask three connected questions. What was the control supposed to prevent? What evidence would show that it is still effective? Who can provide or authorize that evidence? A leader who cannot answer the third question has found a decision-rights gap, even if the technical control is well designed.

This approach also protects the worker who raises the concern. The worker is not required to prove the entire risk assessment before asking for help. The leadership response should be proportionate to the uncertain control, which means the organization investigates the barrier instead of demanding that the person carry the whole burden of technical justification.

Question 3: Who has authority to adapt, pause, or stop?

Many organizations communicate stop-work authority as a principle while leaving the response path undefined. A person can pause the task, but nobody knows whether the supervisor, maintenance manager, permit issuer, or plant manager must make the next decision. The result is a pause that feels unsafe to maintain.

Authority should be defined at the point where work changes. The person closest to the exposure needs permission to pause when a critical control is uncertain. The supervisor needs authority to obtain resources or change the sequence. The risk owner needs authority to reject an unacceptable residual exposure. Senior leadership needs a clear escalation route when local authority is pressured by production or schedule.

Andreza Araujo’s Safety Culture: From Theory to Practice connects culture with the habits that leaders reinforce. If the person who stops work is thanked but left waiting for hours without a decision, the formal message and the operating message disagree. Workers learn from the operating message.

A practical test is to ask a supervisor on each shift, “If this control is unavailable at 2 a.m., who can decide, what evidence is required, and how quickly will the answer return?” If the answers differ, stop-work authority exists in language but not in the operating system.

Question 4: What pressure is making the mismatch attractive?

Most field deviations have a reason that makes them locally attractive. The crew may be trying to avoid a long equipment wait, protect a delivery window, reduce exposure to weather, keep a contractor occupied, or prevent a supervisor from reporting a missed target. Understanding that pressure does not excuse an unsafe choice. It shows why the choice may recur.

James Reason’s distinction between active failures and latent conditions is useful here. The visible action may be a bypass, but the conditions that reward the bypass can sit in scheduling, staffing, layout, maintenance, or performance management. If the leader corrects only the action, the same pressure will produce another workaround during the next shift.

Ask, “What became easier when the crew used the workaround, and what became harder?” The answer often reveals a trade-off that leadership has allowed to remain informal. When the safe method requires a personal favor, an unplanned delay, or repeated negotiation, compliance depends on individual courage rather than on a stable work design.

This question is especially important for senior leaders. A plan-versus-field mismatch can expose a budget or capacity decision that has been hidden inside frontline behavior. During her tenure at PepsiCo South America Foods, where Andreza Araujo led a 50% reduction in accident ratio in six months, the documented result is a reminder that leadership cadence and operating conditions influence safety outcomes together. A target alone cannot repair a system that makes the wrong choice easier.

Question 5: What must be true before work resumes?

Stopping work is only the midpoint of the decision. The team needs a clear restart condition that states what has to be observed, who accepts the condition, and how affected workers will know that the method has changed.

A weak restart note says, “Review completed and work may continue.” A stronger condition states, “The alternate lifting path is barricaded, the delivery route is closed for the lift, the spotter has confirmed the exclusion zone, and the supervisor has observed the first cycle.” The second version gives the team evidence that can be checked.

For complex work, the revised plan should show the changed sequence, critical controls, communication boundary, emergency response, and owner for each decision. It should also identify which assumptions remain uncertain. A revised document that hides uncertainty creates the appearance of control without improving the control itself.

Require a post-resumption check when the task returns to normal pressure. The crew may follow the revised method while leadership is present and then revert when the supervisor leaves, the next shift arrives, or the schedule tightens. The control is restored only when it survives the condition that originally made the mismatch attractive.

How leaders decide without turning every change into delay

Good leadership does not require a full committee for every field variation. It requires a clear threshold for when a change affects a critical control, decision authority, or emergency readiness. Below that threshold, the supervisor can correct the condition and record the learning. Above it, the work pauses until the responsible risk owner makes a defensible decision.

Use a short decision sequence. Name the change, identify the uncertain control, select the person with authority, define the evidence required, and set the restart condition. The sequence is brief enough for a shift conversation, yet it prevents the two most common failures, silent adaptation and indefinite escalation.

The leader should also distinguish between a planned improvement and an unreviewed deviation. A crew may identify a safer method that reduces exposure, but the method still needs confirmation when it changes the sequence, equipment, isolation, or emergency response. Calling every improvement a deviation discourages initiative. Calling every deviation an improvement removes technical discipline.

What field evidence should be recorded?

Record only what helps the next decision. The minimum evidence should identify the original assumption, the observed change, the affected control, the authority who decided, the condition for restart, and the follow-up check. This creates a decision trail that can be reviewed without turning the record into a narrative of every conversation.

Use photographs, sketches, permit annotations, equipment readings, or direct observation when they clarify the control. Do not treat a completed form as proof that the control worked. The evidence should answer what changed in the work and whether the barrier performed after the change.

The record is also useful for trend review. Repeated changes in the same location may reveal poor layout. Repeated missing resources may reveal procurement or maintenance weakness. Repeated late escalations may reveal a supervisor who lacks authority. The pattern is more valuable than any single deviation because it shows where the operating system is asking people to improvise.

That is the distinction emphasized in Safety Culture Diagnosis: Learn how to do your own. A culture diagnosis gains value when perceptions can be compared with observable practice. Leaders should apply the same discipline to plan mismatches by comparing what the procedure says, what the worker reports, and what the field evidence shows.

How to make the five questions part of the leadership rhythm

The questions become useful when they appear before the incident review, not only after it. Add them to pre-job conversations for high-risk work, shift handovers, field verification, contractor coordination, and the first review after a process or equipment change.

Keep the conversation specific. Ask for one changed condition and one uncertain control rather than inviting a general discussion about safety. Then close the loop by naming the person who will decide and the time when the decision must return. A question that produces no owner becomes another ritual.

Review recurring mismatches at the leadership level each week. Look for changes that were detected early, changes that were absorbed silently, and changes that were escalated after the exposure became visible. The purpose is not to count deviations as a performance score. The purpose is to remove the conditions that make unsafe adaptation attractive.

Across 25+ years of EHS leadership in multinational operations, Andreza Araujo has built her work around the difference between declared culture and operated culture. The same difference appears in plan control. A site may declare that anyone can stop work, while its operating habits teach people to keep going. It may declare that changes are managed, while its field decisions depend on personal negotiation.

The leadership test is whether control survives the next pressure

A plan-versus-field mismatch is not a paperwork defect. It is a leadership test that reveals whether the organization can see change, protect a critical control, and return a decision to the people doing the work.

The five questions provide a practical discipline. Ask what changed, which control is uncertain, who has authority, what pressure is shaping the workaround, and what must be true before work resumes. Then verify the revised method after the task returns to normal operating pressure.

Leaders who use this rhythm make field intelligence part of governance. They also make stop-work authority credible because a pause leads to a decision rather than to silence. If your leadership team needs to improve how risk reaches the executive table, compare this approach with the technical dissent decisions that keep risk visible and the risk-escalation distortions that keep leaders blind.

For practical resources on safety leadership and culture, explore Andreza Araujo’s work. The aim is not to create more forms. It is to make the next safety decision clearer while the work is still in front of you.