FOR BOARDS AND EXECUTIVES
Six questions your board should be able to answer.
Work health and safety law places a personal duty on officers that cannot be delegated to a safety manager, a consultant or a committee. It is not enough for the organisation to be compliant. You have to be able to show how you know it is.
The six questions.
01 Are we current?
Do you and your fellow officers have up-to-date knowledge of work health and safety matters? Not a briefing from three years ago, but current understanding of your duties and what has changed.
02 Do we understand what could kill someone here?
Can you describe the nature of the operation and its hazards in your own words? Not the top of a risk register, but the handful of things that could seriously injure or kill someone, and the controls standing between the work and that outcome.
03 Is our safety structure and resourcing proportionate to our risk?
Does the safety function have the people, budget, authority and seniority the risk profile actually demands? A single adviser reporting three levels down in a high risk operation is an answer to that question, and it is the wrong one.
04 Does bad news reach us quickly, and unfiltered?
Are there processes for receiving and considering information about incidents, hazards and risks, and responding in a timely way? Put bluntly: would you hear about a serious near miss, and would you hear it before it had been softened on the way up?
05 Does the safety management system support how we actually operate?
Are there processes for complying with your duties, and do they fit the operating model? A system built for one fixed site does not hold across a contractor workforce on twelve. Systems fail at the seams between how the business runs and how the system assumes it runs.
06 How do we know any of this is true?
This is the question that catches boards. The duty is not to be told the controls are working. It is to verify it. Management reports and dashboards are assurance about assurance. Testing whether critical controls are actually in place and effective is verification.
ANSWERING QUESTION SIX
You cannot independently verify your own controls.
A critical control is one that has to function to prevent a fatality or a catastrophic outcome. Not one of two hundred line items on a risk register, but the handful of things standing between your people and the worst day in your company's history. Each one needs a performance standard, a named owner, and evidence that it still works in practice.
Most organisations verify their own. That is self-assessment, and neither a regulator nor a principal contractor treats it as evidence. The people who designed a control, implemented it and report on its performance are not well placed to tell you honestly whether it holds.
For Tier 1 contractors the problem compounds. You carry the duty, but most critical controls are executed by subcontractors several layers down the chain. Verification has to reach that far or it is not verification.
Independent verification tests each critical control where the work actually happens. Is it in place, does it perform to its standard, does the person relying on it know what it is, and would it hold under the conditions that genuinely occur on your sites. What you get is a defensible evidence base, which is precisely what the duty to verify requires.
WHERE THE GAP USUALLY IS
Most boards can answer two or three of these well.
That is the normal starting position, not a failure. The work is closing the gap between what you believe is happening and what you can actually demonstrate, and question six is almost always where that gap is widest.
The usual way in is a Safety Reality Assessment aimed at question six. Over four weeks we test whether the critical controls you rely on are in place and working where the work happens, and report the evidence to the board.