What-If Analysis: Run a 60-Minute Field Review

What-If Analysis gives supervisors and EHS managers a fast way to test a job plan before risk reaches the field. In a 60-minute review, the team asks disciplined what-if questions, records credible scenarios, assigns controls, and verifies whether the work can start without depending on luck. The same review can test safety margin as 4 operational buffers before a changed condition reaches the field.

The method is useful when a full HAZOP would be too heavy, a JSA would be too narrow, and a risk matrix would only score a problem already seen. ISO states that ISO 45001:2018 specifies an OH&S management system intended to prevent work-related injury and ill health, which makes a structured pre-job challenge more than paperwork. The practical promise is simple enough to test in one shift: if the team cannot name the worst credible deviations in 60 minutes, the job is not ready.

The same 60-minute discipline can support Prevention through Design reviews when a small change could quietly move work down the hierarchy of controls.

Step 1: What decision needs the review?

A What-If Analysis should begin with one clear decision, because a vague review turns into a conversation about everything and controls nothing. In 10 minutes, the facilitator should define whether the team is approving a one-time job, a changed method, a temporary bypass, a contractor activity, or a restart after maintenance.

This first step prevents the most common failure: using What-If Analysis as a loose brainstorming ritual. If the decision is "approve hot work beside an operating line," the review must test ignition sources, isolation, gas monitoring, fire watch coverage, and emergency response. If the decision is "restart a packaging line after guarding maintenance," the review must test stored energy, interlocks, access points, and first-hour supervision.

Across 25+ years leading EHS at multinationals, Andreza Araujo has observed that risk tools fail when the decision owner is absent. The person who can stop, postpone, redesign, or resource the job must be in the room, because otherwise the review produces notes rather than authority.

Step 2: Build the 5-person review cell

The review cell should include 5 roles: the work owner, the field supervisor, one experienced operator or technician, the EHS professional, and one person who understands maintenance or engineering constraints. A smaller group misses field reality, while a larger group usually dilutes accountability.

HSE explains that consultation is a two-way process in which employees can raise concerns and influence decisions about health and safety. That is why the experienced technician is not a courtesy invitation. The technician often knows the hidden valve, the shortcut used on night shift, or the access problem that the procedure never mentions.

The facilitator should assign one person to record scenarios and one person to challenge weak controls. This keeps the conversation moving without letting the fastest voice dominate. In teams where hierarchy is strong, ask the field worker to speak before the manager, since the first answer often frames what everyone else feels allowed to say.

Step 3: Map the job in 6 boundaries

A 6-boundary map keeps the What-If Analysis concrete. Before asking scenarios, define the task boundary, energy boundary, people boundary, equipment boundary, environmental boundary, and time boundary, because each boundary creates a different failure path.

The task boundary states where the job starts and ends. The energy boundary lists electrical, mechanical, hydraulic, pneumatic, chemical, gravitational, and thermal energy. The people boundary names employees, contractors, visitors, pedestrians, drivers, and nearby crews. The equipment boundary identifies tools, mobile equipment, temporary hoses, scaffolds, or bypassed devices. The environmental boundary captures weather, lighting, noise, ventilation, and floor conditions. The time boundary asks what changes during night shift, handover, or the last 30 minutes before production pressure rises.

For related methods, compare this boundary step with the difference between JSA, JHA, and Take 5. A JSA decomposes a task into steps, while What-If Analysis challenges deviations that may sit between steps or outside the written sequence.

Step 4: Ask what can change, fail, combine, or be misunderstood?

The best What-If questions test 4 families of deviation: what can change, what can fail, what can combine with another condition, and what can be misunderstood. This structure forces the team beyond obvious hazards and into the weak signals that precede serious events.

Use plain questions. What if the isolation point is mislabeled? What if the contractor arrives with a different tool? What if the crane path crosses a pedestrian route? What if the permit is valid but the weather changes? What if the operator assumes the line is depressurized because the previous shift said so? These questions work because they connect procedure, context, and human interpretation.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is visible in repeated decisions, not in slogans. A team that asks only polite questions is displaying cosmetic compliance. A team that asks uncomfortable operational questions is testing whether the system can absorb reality before the work starts.

Step 5: Score credibility before severity

Credibility should be judged before severity because dramatic scenarios can distract the team from likely precursors. In 8 to 12 minutes, mark each scenario as credible, possible but remote, or not credible under current conditions, then carry forward only credible and possible scenarios.

This avoids a common distortion in risk matrix discussions that hide fatal exposure. Teams sometimes jump straight to a red score, then spend the rest of the meeting debating colors. What-If Analysis should instead ask whether the scenario could happen today, with this crew, under this production pressure, using these controls.

A practical rule helps: if the team can name a pathway in 3 moves, treat the scenario as credible. For example, a temporary hose crosses a walkway, a pallet truck catches it during a shift change, and the hose releases chemical product near an unprotected drain. That pathway deserves controls even before someone calculates a formal risk score.

Step 6: Choose controls that change the work, not the paperwork

Controls should change the physical, organizational, or supervisory conditions of the work. A What-If Analysis fails when every answer becomes "brief the team," "pay attention," or "follow the procedure," because those responses leave the same exposure in place.

Use the hierarchy of controls as the filter. Can the energy be eliminated? Can the line be physically isolated? Can the route be separated? Can a temporary guard, barricade, lock, blind, ventilation change, or mechanical aid remove the exposure? Administrative controls still matter, although they should support a real barrier rather than replace it.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, weak controls often share the same signature: they depend on perfect memory at the worst moment. That is why a What-If register should distinguish physical controls, engineered interlocks, supervisor verification, permit conditions, and worker briefings instead of treating all actions as equal.

Step 7: How do you verify the controls before release?

Control verification is the point at which What-If Analysis becomes operational. Before the job is released, assign one owner, one evidence type, and one deadline for each critical control, because an unverified control is only an intention.

EU-OSHA notes that worker participation in OSH management supports effectiveness because workers know details of the work as performed. Verification should therefore happen where the work will occur, not only in the meeting room. Ask the field supervisor to show the isolation point, demonstrate the barricade, test the gas monitor, confirm rescue equipment, or walk the traffic route.

This step links directly to critical control verification for SIF exposure. For a 60-minute What-If Analysis, the verification record can be simple: scenario, control, owner, proof, due time, release decision. The discipline matters more than the form.

Step 8: Decide what moves to the risk register

Only scenarios that reveal recurring exposure, missing standards, design weakness, or control degradation should move to the risk register. A one-time housekeeping correction belongs in the action tracker, while a repeated exposure belongs in the risk management system.

The threshold is important. If every minor observation enters the register, leaders stop reading it. If serious recurring exposure stays outside the register, the organization loses memory. Use the What-If Analysis to identify which findings need ownership beyond the shift, especially when the scenario involves contractors, temporary work, energy isolation, high-risk maintenance, or SIF potential.

For register discipline, use a 30-day risk register cleanup as the next step. The What-If session creates evidence, but the register preserves accountability after the job is over.

Step 9: Close the loop in 24 hours

A What-If Analysis should close within 24 hours for short-cycle field work, because delayed feedback teaches crews that participation does not matter. The closeout should state what changed, what was rejected, what still needs engineering review, and who owns the remaining action.

This is where many organizations lose trust. Workers raise a valid concern, the meeting produces an action list, and the crew never hears what happened. HSE advises employers to provide feedback and respond to issues raised by employees or representatives within a certain time, which turns consultation from a legal formality into a visible management habit.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that speed of feedback changes behavior faster than campaign language. Safety is about coming home, and that promise becomes credible when workers see a concern become a changed control before the next shift repeats the same exposure.

Each week without a disciplined pre-job challenge allows weak controls to be normalized, especially in maintenance, contractor work, and production restart windows where a 15-minute shortcut can create a 24-hour consequence.

Step 10: When should you escalate beyond What-If Analysis?

Escalate beyond What-If Analysis when the scenario involves major accident potential, complex process deviations, multiple interacting safeguards, regulatory exposure, or uncertainty that the 5-person review cell cannot resolve. The method is fast, but speed must not become an excuse for shallow analysis.

Move to HAZOP, Bow-Tie, FMEA, LOPA, or a formal management-of-change review when the team identifies unknown energy paths, process chemistry, simultaneous operations, public exposure, or a control whose failure could produce a fatality. The point is not to defend the tool. The point is to choose the level of analysis that fits the consequence.

The comparison with HAZOP, Bow-Tie, and FMEA helps leaders avoid two errors: sending every field question into a heavy workshop, or using a 60-minute review for a decision that deserves engineering depth. What-If Analysis is strong when it protects the work from obvious drift, credible surprises, and weak controls before release.

Andreza Araujo's practical position is that risk tools should make work safer, not merely make files heavier. Use this 10-step method when the job is close enough to the field for worker knowledge to matter and serious enough that an informal conversation would leave too much to memory.