Safety Leadership: 6 Frictions That Separate Safety Intentions From Operating Capacity

When a critical control weakens, the organization often says that people should speak up sooner. That advice is incomplete. A concern can be raised clearly and still wait because the escalation path has no decision owner, no response time, no budget authority, or no evidence standard.

This article examines six frictions that make critical-risk escalation stall. The central question is not whether leaders encourage reporting. It is whether the operating system converts inconvenient information into a timely decision that changes exposure.

What makes critical-risk escalation different?

Critical-risk escalation concerns an exposure whose consequence can be severe even when the event is infrequent. The decision may involve hazardous energy, lifting, confined space, process safety, vehicle interaction, work at height, or another pathway in which a weak barrier can produce irreversible harm.

The escalation threshold cannot depend only on injury history. A quiet record may mean that the control is working, but it may also mean that exposure is not being detected, reported, or challenged. Leadership must define what evidence shows that the control is available, understood, used, and still suitable for the current conditions.

ISO 45001:2018 places leadership, worker participation, operational planning, and improvement inside one management system. That structure matters because a concern that reaches only the EHS function has not yet become a management decision. Someone with authority over design, staffing, sequencing, maintenance, or production must be able to change the conditions that created the concern.

1. The concern has no owner with decision rights

The first friction appears when an escalation has a name but not an owner. A tracker may assign the item to EHS, while the required action belongs to engineering, operations, maintenance, procurement, or a project sponsor. The record looks complete even though the person listed cannot alter the exposure.

Ownership should answer three questions. Who can accept the risk within a defined boundary? Who can allocate the resources that make the control dependable? Who must be informed when the exposure exceeds the authority of the first decision-maker?

Leaders should test ownership against a real scenario rather than an organization chart. If a guard is unavailable, a permit condition cannot be met, or a rescue arrangement is not credible, ask who can stop the work, who can fund the correction, and who can authorize a temporary decision. If the answers point to different people, the escalation path needs a named decision sequence.

That sequence protects workers from carrying a management decision that they do not have the authority to make. It also protects supervisors from being held accountable for controls that sit outside their span of control.

2. The evidence standard is unclear

Some organizations demand a completed investigation before they will act, while others accept a verbal concern without recording enough detail to decide. Both extremes slow response. The first treats proof as a precondition for protection, and the second creates a dispute about what was actually observed.

A workable escalation standard separates immediate protection from later diagnosis. The initial record should identify the task, the exposure, the weakened or missing control, the people affected, the change in conditions, and the action taken to prevent further exposure. It does not need to explain every causal layer before work is paused or redesigned.

James Reason's analysis of organizational accidents is valuable because visible events can be preceded by latent conditions in planning, maintenance, supervision, design, or resource allocation. Leadership should preserve the initial signal while the deeper review continues, because a request for perfect evidence can become a reason to defer protection.

Use a two-stage rule. First, decide what must happen to keep people away from unacceptable exposure. Second, determine what evidence is needed to restore, replace, or formally accept the control. The distinction gives leaders speed without sacrificing accountability.

3. Escalation enters a meeting instead of a decision path

A concern can be discussed repeatedly without being decided. It appears on a weekly agenda, receives a request for more information, and returns at the next meeting with the same unresolved condition. The organization has created visibility without movement.

Meetings are useful when they prepare a decision, but they are weak as a substitute for one. Each critical-risk escalation should identify the decision required, the person who owns it, the deadline, the evidence that will close it, and the consequence of missing the deadline. Without those fields, discussion becomes an administrative destination.

Senior leaders should review the oldest unresolved critical-risk items and ask what prevented a decision. The answer usually falls into a small set of categories, such as unclear authority, unavailable resources, conflicting priorities, incomplete technical design, or fear of interrupting production. Naming the category is more useful than labeling the item overdue.

A decision path also needs an exception route. If the assigned owner cannot decide within the available time, the item should move to the next level automatically. Escalation should not depend on the persistence of the person who first raised the issue.

4. The control has an owner, but no resource commitment

Leadership language becomes fragile when it asks people to maintain a control without securing the conditions that make maintenance possible. A procedure may require inspection, testing, competent staffing, spare parts, isolation time, or specialist support, while the operating plan funds none of them.

Resource commitment does not mean approving every request. It means making the trade-off visible and assigning the decision to the level that can carry its consequences. If a temporary control is accepted, the leader should define its limits, duration, compensating measures, and review date rather than allowing the temporary arrangement to become the new normal.

Andreza Araújo's safety leadership work connects credibility with what leaders make possible in the field. Across her 25+ years in multinational EHS leadership, the practical test has not been the elegance of the policy. It has been whether the conditions around the work support the decision leaders say they expect people to follow.

Review the escalation record alongside the operating plan. If the corrective action has no budget, no labor allocation, no engineering capacity, or no maintenance window, the action is not yet a control. It is an intention waiting for a decision.

5. The response time does not match the exposure

Many escalation systems use one response target for every concern. That approach is easy to administer, but it confuses administrative urgency with exposure urgency. A paperwork discrepancy and an unavailable fall-protection anchor should not enter the same queue.

Response timing should reflect how quickly the exposure can become harmful and how much control remains available while the decision is pending. A leader can define immediate stop or isolation criteria, same-shift review criteria, and planned correction criteria, provided the thresholds are understandable to the people who use them.

The timing rule should also describe what happens while the issue is open. If the work continues under a temporary arrangement, the arrangement needs a responsible owner, a verification method, and a clear end condition. Otherwise, the absence of a new incident will be mistaken for evidence that the temporary control worked.

Supervisors need the authority to move an item into the faster path without proving that harm is certain. The purpose of escalation is to manage uncertainty before the consequence arrives, not to wait until the evidence becomes irreversible.

6. Closure records activity instead of changed exposure

The final friction appears when closure means that a task was assigned, a document was revised, or a training session was delivered. Those actions may be necessary, but none proves that the exposure is lower or that the critical control will perform under the conditions that created the concern.

Closure should state what changed in the work, who verified the change, what evidence was checked, and which assumption would reopen the decision. A revised procedure can be sampled in the field. A new guard can be inspected under operating conditions. A staffing change can be tested during the shift where the previous weakness appeared.

Leaders should be cautious when closure depends on a communication campaign. Communication can clarify a decision, but it cannot replace a design change, a reliable isolation point, a competent resource, or a workable sequence. If the hazard remains and only the message changed, the record should remain open.

A strong closure record lets a future leader understand why the decision was made and what would make it invalid. That is how organizational memory becomes a control rather than a folder of completed actions.

How should leaders repair a stalled escalation system?

Start with a sample of recent critical-risk escalations, including items that were closed quickly and items that remained open. Map each one from the first signal to the final decision. Record where ownership changed, where evidence was requested, where resources were approved, and how the response was verified.

The review should produce a small operating standard rather than another large procedure. Define the minimum initial evidence, the decision owner, the response bands, the automatic escalation route, the temporary-control rule, and the closure test. Then give supervisors a short script that helps them state the exposure without turning the conversation into a personal accusation.

Use the next leadership review to examine one unresolved case in detail. Ask what the organization made difficult, invisible, or slow. That question does not remove personal accountability. It locates accountability where the authority to change the conditions actually exists.

Andreza Araújo's Safety Culture: From Theory to Practice reinforces the same practical distinction. Culture becomes credible when stated priorities survive competing demands, inconvenient information receives a response, and leaders invest in the conditions that make safe work possible.

Frequently asked questions

Critical-risk escalation becomes reliable when leaders remove the frictions that separate information from authority, resources, timing, and proof. The goal is not to make every concern dramatic. It is to make the right decision easier to reach before a weak control becomes a serious event.

For more practical guidance, visit Andreza Araújo's safety leadership resources and compare this escalation model with the four boundaries of stop-work authority.