Temporary Controls in Safety-Critical Work: 4 Traps That Make Short-Term Risk Look Acceptable

A temporary guard, bypass, barrier, procedure, or staffing arrangement can be the right decision when a permanent control cannot be restored before work must continue. The danger begins when the word temporary describes the paperwork rather than the condition.

For an EHS manager, the central question is not whether an interim measure exists. It is whether the organization can prove that the measure still limits the intended exposure, that one person owns the remaining risk, and that a credible path leads to a better control. My thesis is direct: temporary controls become dangerous when their expiry is treated as an administrative date instead of a decision point.

Why temporary controls deserve executive attention

ISO 31000:2018 treats risk management as an integrated decision process, which means an interim measure cannot be separated from objectives, context, communication, and review. IEC 31010:2019 adds a catalogue of assessment techniques, yet no technique can compensate for a control that nobody verifies after conditions change.

The hierarchy of controls, described by OSHA, places elimination and engineering solutions above administrative measures and personal protective equipment. That ordering matters during a temporary arrangement because a signed instruction may reduce exposure for a limited task, while leaving the underlying energy, interface, or failure mode unchanged.

Bird’s 1969 damage-control work is often represented as a 1-10-30-600 relationship between serious injury, minor injury, property damage, and near-loss events. The exact ratio is not a prediction for every site, but it reinforces a useful management question: what weak signals are being accepted while the organization waits for a permanent fix?

Across 25+ years leading EHS work in multinational operations, Andreza Araujo has repeatedly connected risk perception with the quality of the decision around the risk. In more than 250 companies served across 30+ countries, the practical test is not whether people can describe the hazard. It is whether the organization changes the condition that keeps the hazard present.

Trap 1: Calling a workaround a control

A workaround changes how people interact with a hazard, but it may not control the hazard itself. A second person watching a lift, a handwritten warning, a restricted access route, or a temporary operator instruction can be useful, although each depends on attention, timing, and the absence of competing pressure.

The distinction becomes visible when the task is repeated across shifts. A measure that works during a planned day shift may fail during overtime, contractor turnover, poor weather, or a rushed restart, because the control depends on assumptions that were never written down. The risk owner should state exactly what the interim measure changes and what it leaves untouched.

In Sorte ou Capacidade, Andreza frames safety as the management of risk rather than the bravado of taking it on. That position is useful here because a workaround often feels decisive. The team has done something, the permit is signed, and the task can proceed, yet the residual exposure may still sit in the same layer of the system.

Ask three questions before accepting the workaround. Which hazardous energy or exposure has been reduced? Which failure remains possible? What evidence would show that the measure stopped working? If the answers are vague, the organization has created an instruction, not a reliable control.

Trap 2: Letting the expiry date become a renewal habit

An expiry date is valuable only when it forces a decision. If a supervisor can extend the date with one click, or if a new form is issued without reviewing the field condition, the date becomes a reset mechanism that hides control drift.

Temporary controls should carry at least four dates or milestones: the date the condition was identified, the date the interim measure was verified, the date the permanent solution is expected, and the date the risk owner must decide whether work can continue. Those dates belong to different decisions, which is why one generic review date is often too weak.

Leaders should track the age of active temporary controls in three bands, such as less than 7 days, 7 to 30 days, and more than 30 days. The bands are management prompts rather than universal limits. A 24-hour bypass on a critical interlock may deserve more scrutiny than a 30-day construction barrier inspected daily, because the failure consequence and control reliability are different.

A control that passes its expiry without a replacement decision is not neutral. It has become an accepted operating condition, whether or not anyone used the language of risk acceptance. The responsible leader must remove it, replace it, stop the work, or document a fresh decision with evidence and authority.

Trap 3: Giving the form ownership instead of a person

Forms record decisions, but they cannot make decisions after the environment changes. The owner of a temporary control must have enough authority to stop work, obtain resources, challenge production priorities, and confirm that the measure still works where the task is performed.

Role confusion is common when EHS writes the condition, maintenance designs the repair, operations schedules the work, and procurement controls the delivery. Each function may act responsibly while the risk remains unowned between handoffs. The control register should name one accountable risk owner, one technical owner for the final solution, and one field verifier who can confirm the present condition.

James Reason’s work on latent conditions explains why this gap matters. A frontline deviation may be the visible event, while decisions about resources, design, maintenance, and supervision shape the conditions in which the deviation becomes possible. The temporary-control process should expose those conditions instead of locating all responsibility in the person who happens to meet the hazard.

Andreza’s Safety Culture: From Theory to Practice places culture in observable choices, which gives leaders a practical test. When the owner cannot state what will happen if the final repair misses its date, the organization is displaying a culture of deferral. Ownership means deciding before the deadline, not explaining after it.

Trap 4: Verifying paperwork instead of field reliability

A temporary control can look complete in a register while failing at the point of use. The barrier may be loose, the isolation may not match the drawing, the alternate route may be blocked, or the second checker may be assigned to another task. The record is accurate about what was intended, but silent about what workers actually face.

Verification should test the control under the conditions that matter. If the measure depends on a visual cue, inspect visibility from the operator position. If it depends on a supervisor, observe the handoff during the shift in which the risk is highest. If it depends on a maintenance repair, confirm the restored function rather than the work-order status.

The evidence should include the control boundary, the exposure it addresses, the verification method, the last result, and the condition that would trigger escalation. A photograph can help, although a photograph without location, date, and a question being tested is only decoration.

Use the control reliability evidence tests when the interim measure protects a serious hazard. Compare the stated barrier with the actual field state, because the difference is where temporary arrangements usually become unsafe.

What a defensible temporary-control record contains

A defensible record is short enough to use during work and specific enough to support a challenge. It should identify the hazard, exposed people, failure consequence, current control, remaining exposure, owner, verifier, expiry, final solution, funding or work order, and stop-work trigger.

This record is not a substitute for a risk assessment. It is the decision interface that keeps the assessment connected to work after the original meeting has ended.

How leaders should review temporary controls

Start with the oldest active items, the controls protecting high-consequence hazards, and the items that have already passed one review. A monthly review can work for stable portfolios, while a daily or shift-based check may be required when the control protects an energized system, a confined space, a major hazard, or a changing construction interface.

Ask the owner to explain the control without reading the form. Then inspect the field condition, compare the interim measure with the hierarchy of controls, and check whether the final solution still has a realistic path. When evidence conflicts with the record, treat the conflict as a decision failure rather than as a documentation defect.

Use the risk-matrix distortions review to challenge whether the rating reflects the actual exposure. Use the temporary-equipment decision points when the arrangement changes equipment, process, staffing, or start-up conditions. The goal is not to produce more forms. It is to prevent a temporary decision from becoming invisible infrastructure.

What to change on Monday morning

Choose one operating area with active temporary controls and build a visible list before the next shift change. Separate the controls by hazard consequence and age, then sample the three oldest items in the field. If the list is incomplete, that is already evidence that the control process does not know its own exposure.

For each sampled item, require one sentence that states the remaining risk, one person who owns the decision, one date that cannot pass silently, and one observation that would trigger a stop or escalation. This is more useful than asking whether the document is complete, because it tests whether the decision can survive pressure.

Andreza’s record includes a 50% reduction in accident ratio over six months at PepsiCo South America Foods under a 180-day plan. That result does not prove that every organization can reproduce the same outcome, but it illustrates the value of a time-bound operating plan whose measures are connected to decisions rather than displayed as isolated activities.

For a deeper treatment of how safety culture becomes observable in daily choices, see Safety Culture: From Theory to Practice and the practical resources from Andreza Araujo’s Safety School. A temporary control is worth keeping only while it remains understood, owned, verified, and on its way to replacement.

The decision leaders should not postpone

Temporary controls are not automatically weak, and permanent controls are not automatically effective. The decisive issue is whether the organization knows what the interim measure protects, what it cannot protect, who owns the remaining exposure, and when a new decision must be made.

When an expiry date passes without a deliberate review, the organization has not maintained a temporary control. It has normalized an unresolved condition. Risk owners who make the expiry visible, test field reliability, and fund the replacement path keep short-term work from becoming long-term exposure.