Stop Work Authority Protocol in 30 Days

Stop work authority fails when it is written as a right but operated as a career risk. This guide shows how an EHS manager can build a 30-day protocol that makes stopping unsafe work fast, documented, and defensible.

Why does stop work authority need a protocol?

Stop work authority needs a protocol because ISO 45001:2018 expects workers to remove themselves from serious and imminent danger, while many companies still leave the decision trapped inside fear, hierarchy, and unclear restart rules. ISO specifies the occupational health and safety management system requirements, but the standard does not run the shift, coach the supervisor, or protect the operator who speaks first.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture appears in repeated decisions, not in declared values. A stop-work card on a lanyard has little force if a technician believes the production manager will punish the interruption during tomorrow's meeting.

The practical aim is narrow: define exactly who can stop work, what evidence is enough, how the first 15 minutes are handled, who authorizes restart, and what must be reviewed within 48 hours. Without those details, the right exists on paper while the risk remains in the field.

Step 1: What counts as stop work authority?

Stop work authority is the explicit power of any worker, contractor, supervisor, or visitor to pause a task when a condition could cause serious injury, fatality, environmental release, or uncontrolled exposure. The definition must fit ISO 45001:2018, HSE guidance on worker consultation, and the company's own high-risk activity list.

The first trap is treating every discomfort as stop work or, at the other extreme, reserving the protocol only for visible emergencies. Across 25+ years leading EHS at multinationals, Andreza Araujo identifies that vague rights become political negotiations, especially when production loss is measurable and risk avoidance is not.

Write a one-page definition with 4 trigger families: imminent danger, missing critical control, changed work condition, and psychological pressure that prevents safe execution. Link this definition to existing routines such as safety concern triage, because the organization needs one intake language for urgent and non-urgent signals.

Step 2: Map the high-risk tasks first

The protocol should start with high-risk tasks because stop-work decisions are hardest when hazards are familiar and production pressure is normal. In the first 3 days, map activities such as confined space entry, energized work, lifting, hot work, chemical transfer, working at height, and mobile equipment interaction.

What most companies miss is that stop work authority becomes weaker in routine work than in special work. A scaffold missing a tag attracts attention, while a forklift route used for 5 years with poor pedestrian separation becomes background noise, even though the exposure is repeated every shift.

Use the existing risk register, permit-to-work records, and incident history to produce a task list with no more than 12 initial categories. Keep the scope tight during the first 30 days, because the supervisor must be able to recognize the triggers without reading a manual in the field.

Step 3: Define the first 15 minutes

The first 15 minutes decide whether stop work becomes a safety action or a social conflict. The protocol must state who freezes the task, who protects the area, who listens to the concern, and who prevents restart before the hazard is understood.

15 minutes is long enough for a supervisor to isolate the area, record the trigger, and call the competent person, but short enough to prevent the stoppage from becoming an improvised meeting. HSE explains worker involvement in health and safety decisions through consultation guidance, and that involvement only works when the worker is heard before the hierarchy defends the plan.

Use a 4-part field script: stop the activity, thank the person who raised it, ask what changed or failed, and decide whether the task moves to controlled pause or emergency response. This is where technical dissent becomes practical, because the worker's objection must be converted into evidence rather than treated as attitude.

Step 4: Set evidence rules for stopping and restarting

Evidence rules protect both safety and fairness because they separate a serious risk signal from rumor, preference, or interpersonal tension. A stop-work protocol needs minimum evidence for the pause and stricter evidence for restart, since restarting work creates a new managerial decision.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that field routines improve when leaders remove ambiguity from front-line decisions. The same principle applies here: the person who stops work should not need a legal argument, but the person who restarts work must show that the control is restored.

Define evidence as observations, measurements, missing documents, failed controls, changed conditions, or credible worker reports. For restart, require named owner, corrective action, supervisor approval, and worker confirmation that the original concern has been addressed.

Step 5: How should supervisors respond?

Supervisors should respond with a fixed script because tone determines whether the next worker will speak or stay silent. In the first response, the supervisor has 3 duties: protect the person who raised the stop, protect the work area, and protect the integrity of the decision record.

A supervisor who says, "Why did you stop the job now?" turns a safety decision into a loyalty test. James Reason's work on latent failures helps explain why the better question is different: what condition made the task unsafe despite the plan that said it was ready?

Train supervisors to use 5 sentences, always in the same order: thanks for stopping, show me the condition, we will not restart until we understand it, I will document the decision, and no one is penalized for raising a credible concern. This response connects directly to safety reporting, because both systems depend on trust after the first report.

Step 6: Build the restart decision record

The restart decision record is the evidence trail proving that work resumed because controls were restored, not because pressure increased. It should capture 8 fields: date, location, task, trigger, stopped-by role, immediate control, restart approver, and verification evidence.

In more than 250 cultural transformation projects, Andreza Araujo observes that the restart moment reveals the real safety culture more sharply than the stoppage itself. Many organizations tolerate stopping work when everyone agrees, but they rush restart when delay becomes expensive.

Keep the form short enough for field use and strong enough for audit. A 1-page paper card or mobile form is sufficient if it includes a photo, measurement, or document reference where needed, plus a mandatory note from the person who raised the concern when that person is available.

Step 7: What metrics prove the protocol is working?

The protocol is working when stop-work events become better in quality, not merely higher in count. Track 6 indicators in the first 30 days: credible stops, invalid stops, average response time, restart defects, repeated trigger type, and retaliation complaints.

Counting stops alone creates the same distortion seen in weak near-miss programs, where volume can look like learning even when control quality is flat. ILO describes occupational safety and health as a prevention system, and prevention requires attention to precursors, not just event volume.

Review the dashboard weekly with operations, EHS, and worker representatives. If credible stops rise during the first month, treat that as signal discovery, not failure, unless the same trigger repeats without control improvement.

Step 8: Close the 30-day review

The 30-day review should decide whether the protocol changed decisions in the field, not whether everyone attended training. The review must compare pre-launch assumptions with actual stoppages, supervisor responses, restart evidence, and worker comments from at least 3 shifts or crews.

Use the review to detect 3 traps: managers praising stop work in town halls while criticizing delay in private, supervisors restarting with verbal assurance only, and workers using the protocol for conflicts that belong in a different channel. None of those traps means the protocol failed, but each one shows where governance must tighten.

Close the month by updating the trigger list, refining the restart form, and feeding recurring issues into the risk register. Where the event is a concern rather than an imminent danger, route it through safety voice routines so the system keeps learning without turning every weak signal into a full work stoppage.

Stop work authority protocol: weak vs strong design

Each month without a clear stop-work protocol teaches workers that the decision is personal, while each documented restart teaches supervisors which controls must be restored before pressure returns.

Conclusion

A stop-work protocol works when it turns a difficult field interruption into a protected, repeatable, evidence-based decision.

If your operation needs to build this discipline across supervisors, contractors, and high-risk tasks, Andreza Araujo's safety culture advisory work can help convert the policy into daily control. Start at Andreza Araújo.