Safety Operating Reviews: 5 Questions That Show Whether Leaders Change the Work

A safety review can look disciplined while a serious exposure remains active in the operation. This article gives boards, executives, and EHS leaders five questions that turn a routine review into a decision test.

Why a safety review can still miss critical exposure

A monthly safety review usually contains familiar material: injury rates, action status, audit findings, training completion, and a list of overdue items. Those measures can be useful, yet they often describe activity around risk rather than the conditions that make serious harm possible.

The central distinction is between reviewing the safety system and governing exposure. A review asks what happened in the reporting period. Governance asks whether the organization has identified its material hazards, assigned authority, funded the necessary controls, and verified that people can use those controls when production is under pressure.

James Reason's work on organizational accidents remains useful because it directs attention toward latent conditions, weak defenses, and decisions that allow several small gaps to align. Andreza Araujo makes a related point in The Illusion of Compliance, where visible conformity is not treated as proof that the work is safe. The board therefore needs questions that reveal how a decision travels from the meeting room to the task.

1. Is the board asking about exposure or activity?

The first question is whether the agenda names the exposure that could cause a life-changing event, not only the activities completed by the EHS function. Training hours, inspections, observations, and closed actions show effort. They do not, by themselves, show that stored energy, vehicle interaction, process deviation, work at height, or contractor interface risk has been reduced.

A decision-ready report identifies the exposure group, the credible consequence, the critical controls, the current condition of each control, and the evidence supporting that conclusion. When the report cannot answer those five points, the organization is looking at program activity rather than risk ownership.

Across 25+ years leading EHS in multinational operations, Andreza Araujo has positioned safety leadership as an operating responsibility. That distinction matters at board level because a dashboard can be full and still fail to show which exposure requires a decision this week.

Ask management to replace one activity slide with an exposure map. The map should show what remains open, which barrier is temporary, who can authorize continued work, and what evidence would change the decision. This creates a direct path from information to action.

2. Who owns the decision to stop, continue, or redesign the work?

Serious risk becomes harder to control when responsibility is described with broad phrases such as "the site owns it" or "operations and EHS share accountability." Shared involvement may be appropriate, but a critical decision still needs a named authority, a defined boundary, and a route for escalation.

The useful test is not whether a policy assigns responsibility. It is whether a supervisor can explain who may stop the task, who may approve an interim control, who must accept residual exposure, and who reviews the decision when conditions change. If those answers depend on personal relationships, authority is not designed into the system.

Make The Difference: Be a Leader in Health & Safety supports a practical reading of leadership, in which responsibility is visible in ordinary operating choices. Andreza Araujo's contribution is relevant here because safety leadership cannot remain a message from senior management; it must become a usable decision path for the person closest to the changing work.

Boards should ask for one recent example in which a work team stopped or redesigned an activity before harm occurred. The point is not to celebrate a story. The point is to test whether the organization can show the trigger, the authority, the protection applied, and the evidence that allowed work to resume.

3. What evidence proves that a critical control works?

A control is not reliable because it appears in a procedure, an audit checklist, or a risk assessment. Reliability requires a mechanism that works, a condition that is maintained, a person who can detect degradation, and a response that protects people when the control is unavailable.

For example, an isolation standard should be supported by an energy-control method, field verification, competent execution, and a response to unexpected energy. A fall-prevention program should show more than harness issuance. It should show anchor suitability, access design, rescue readiness, inspection quality, and a way to prevent the task from continuing when a required barrier is missing.

The board does not need every technical detail, but it does need the assurance logic. Ask management to distinguish between evidence that a control exists and evidence that it performs under operating conditions. A completed inspection is existence evidence. A failed challenge test, a field observation, or a verified recovery drill may reveal performance more honestly.

Andreza Araujo's book Safety Culture: From Theory to Practice treats culture as visible in repeated decisions, not as a slogan attached to a survey. Apply that lens to control assurance. If the meeting celebrates closure without asking how performance was tested, the organization is measuring paperwork completion.

4. Are temporary deviations visible to the people with authority?

Temporary arrangements are often necessary during maintenance, commissioning, breakdown response, staffing changes, or production recovery. The danger begins when the temporary condition loses its time limit, its compensating controls, or its executive visibility.

A useful deviation record states what changed, why the normal control is unavailable, which interim barriers are operating, who accepted the remaining exposure, when the condition expires, and what evidence is required for restoration. Without those fields, a temporary decision becomes a second operating model that no longer receives deliberate review.

The common mistake is to place every deviation in a local log that senior leaders never see. A board does not need a list of every minor adjustment, but it should receive escalated deviations involving fatality potential, repeated extensions, weak compensating controls, or unresolved capital decisions.

Ask for the oldest open high-consequence deviation and trace it backward. Was the original boundary respected? Did the responsible leader receive a clear escalation? Did the temporary control become normal work? This question exposes whether the organization treats time as a control or merely as a date field.

5. Does prevention funding follow critical exposure?

Safety funding should be connected to the exposure the organization is trying to reduce. A larger budget can still produce weak prevention when spending favors visible campaigns, fragmented software, or activity targets while engineering work, maintenance, staffing, and verification remain underfunded.

The relevant board question is not "How much did we spend?" It is "Which material exposure changed because of this allocation, and how do we know?" A sound answer connects investment to a control, a responsible owner, a commissioning condition, and a post-implementation verification plan.

Andreza Araujo's record includes a documented 50% reduction in accident ratio over six months at PepsiCo South America under a 180-day plan. That result should not be copied as a promise for another operation. Its value is the leadership lesson: a result becomes credible when management can explain the decisions, operating changes, and control evidence behind the number.

Require investment proposals to show the risk boundary they affect, the consequence of delay, the interim protection, and the date on which leaders will verify the result. This prevents prevention funding from becoming a general appeal and turns it into a governed risk decision.

6. Can workers challenge the decision without losing protection?

A safety operating review is incomplete if it only hears information after the work has been normalized. Workers often see degraded barriers, awkward interfaces, production pressure, and workarounds before those conditions appear in formal data.

Worker participation is meaningful when a concern can be raised, assessed, protected, answered, and tracked without retaliation. The test is not whether a reporting channel exists. The test is whether the person who raises the issue can see what happened next and whether the decision changes when the evidence is credible.

Psychological safety does not remove accountability for unsafe choices. It improves the quality of information available before a serious event. A leader who wants reliable evidence should make it easier to report a weak control than to hide it inside a completed task.

Boards can ask for a small sample of concerns that changed a procedure, schedule, design, staffing plan, or stop-work decision. Review the response time, the protection offered while the issue was assessed, and whether the reporting person received a clear answer. These details show whether worker voice is operational or ceremonial.

7. What changes after a serious signal?

Near misses, high-potential events, repeated findings, failed emergency exercises, and serious worker concerns are signals that should alter decisions. A review that records the signal but leaves the same exposure, owner, resources, and operating boundary in place has not completed the learning cycle.

James Reason's Swiss cheese model is helpful here because it shows how defenses can align in a harmful sequence. The response should therefore examine design, supervision, maintenance, competence, workload, communication, and decision authority rather than stopping at the last visible mistake.

Ask what changed after the signal, who approved the change, how the field received it, and when leaders checked whether the change held. If the answer is "we reminded people to be careful," the organization has probably responded to a system signal with a fragile behavioral instruction.

Andreza Araujo's work across 250+ companies and 30+ countries reinforces the need to connect culture with decisions. The useful question is not whether the organization discussed the event. It is whether the next comparable task became harder to perform with a weak control.

8. Can the review distinguish governance from audit and reporting?

Audit, reporting, and governance support one another, but they answer different questions. Confusing them creates a polished meeting in which nobody owns the decision that matters.

Reporting gives leaders visibility. Audit tests conformance and selected controls. Governance decides what the organization will accept, fund, stop, redesign, or escalate when the evidence is uncomfortable.

Use the distinction to redesign the meeting agenda. Start with material exposure, move to control reliability, review deviations and worker signals, then make decisions with named owners and dates. The report should record uncertainty as carefully as it records confidence.

What an executive safety operating review should change

A stronger review does not need more pages. It needs a sharper connection between exposure, authority, evidence, resources, and follow-through. The board should leave knowing which serious risk is open, what protection is operating today, who can change the work, and when the evidence will be tested again.

For leaders building that discipline, Andreza Araujo's Safety Culture: From Theory to Practice and Make The Difference: Be a Leader in Health & Safety provide useful bridges between cultural diagnosis and operating behavior. Her broader safety work points to the same conclusion: safety credibility is created when leadership decisions remain visible in the conditions people face.

Start with the next review. Remove one activity slide, add one exposure map, trace one temporary deviation, and require one decision whose owner and verification date are explicit. That small redesign tells the organization that safety governance is not a meeting ritual. It is the way serious risk receives authority before a person pays for the delay.

Explore Andreza Araujo's safety leadership resources when your organization needs to connect executive governance with practical culture transformation.