Operational control and management of change

The temporary staging lane that contributed to the aisle 14 collision in HSE-403 began as a sensible idea. During a peak week, the distribution center ran out of space at the dock, and a supervisor suggested staging outbound pallets in the end of a freezer aisle. Grace approved it by email. Nobody asked how forklifts would leave the lane, where pickers would walk, or whether the convex mirror at the aisle end would still show anything useful. The lane stayed for four months. It was a change, made with good intentions, that bypassed every control the company had.

This lesson covers the 'do' part of a management system: the operational controls that keep hazards in check during everyday work, and the management of change process that keeps new hazards from slipping in. Together they are where planning meets the floor.

Operational control

Operational control means planning, implementing, controlling and maintaining the processes needed to meet the system's requirements and to carry out the controls chosen in risk assessment. In practice, operational controls are everything that keeps work safe day to day: machine guards and interlocks, lockout procedures, permits to work, traffic management plans, safe work procedures, maintenance and inspection schedules, chemical management, PPE programs, supervision and the competence requirements from lesson 7.

Management system standards set some general expectations. Organizations should establish criteria for their processes, implement control of the processes in line with those criteria, keep documented information to the extent needed to be confident the processes were carried out as planned, and adapt work to workers. They should also coordinate the relevant parts of the system with other organizations at multi-employer workplaces, which lesson 9 covers.

'Adapt work to workers' deserves attention. It means designing tasks, workstations and schedules around the capabilities and limits of the people who do them, instead of expecting people to adapt to badly designed work. At the sauces plant, operators had been lifting 44 lb (20 kg) sacks of starch to shoulder height to tip them into mixers dozens of times a shift. The controls chosen through risk assessment were a sack tipping station with a vacuum lifter and a change to bulk bags for the highest-volume ingredient. That is adapting work to workers.

Applying the hierarchy in operations

Lesson 5 introduced the hierarchy of controls as a way of choosing controls. In operations, the hierarchy also tells you how much effort to put into keeping each control working. Engineering controls, once installed and maintained, work with little day-to-day effort. Administrative controls and PPE need constant effort: training, supervision, checks, enforcement and replacement. A system that relies mainly on procedures and PPE needs a heavy layer of checking to stay reliable. That is one more reason to move up the hierarchy wherever possible.

Critical controls

Not all controls are equal. For hazards that could cause death or permanent injury, the severity-5 hazards flagged in lesson 5, a small number of controls do most of the work of preventing the worst outcomes. These are often called critical controls. HSE-401 introduced the idea as part of serious injury and fatality prevention. In a management system, critical controls get special treatment.

• Identify them. For each severity-5 hazard, the team identifies the few controls that, if they failed, would make a fatal or life-altering outcome likely.
• Define performance. Each critical control has a clear standard: what it must do and how to tell whether it is working.
• Assign ownership. Each has a named owner responsible for its performance.
• Verify often. Each is checked in the field on a set frequency by someone who understands it, not just signed off on a checklist.
• Act on failures. A failed critical control is treated as a high-potential incident: work stops or is changed, and the failure is investigated.

The verification column changed how supervisors spent their time on night shift. Instead of signing a checklist at the end of the shift, Dev Sandhu now watched one complete lockout every night, chosen at random, and talked with the crew about anything that made it difficult. In the first month he found two isolation points where the lock could be fitted but the energy was not actually isolated because of a wiring change nobody had recorded. That finding led straight to the management of change process.

Permits to work

Permits to work are formal written systems for controlling high-risk, usually non-routine, work: confined space entry, hot work, work on energized equipment, work at height, breaking into lines carrying ammonia or chemicals. A permit specifies the work, the hazards, the controls required before work starts, the people authorized, the time period and the steps to hand the equipment back. It requires signatures from the person issuing it and the person doing the work, and it is closed out when the work is finished.

A permit system is only as good as the discipline around it. Common failures include permits issued without anyone visiting the work site, controls ticked without being checked, permits left open past their time, and permits used as paperwork rather than as a planning conversation. Harrowgate Foods Inc.'s audits of closed permits checked not only that they were filled in but that the controls listed matched the work done and that the issuer had visited the site.

Management of change

Changes are one of the most common sources of new hazards. New equipment, a new layout, a new chemical, a new shift pattern, a new supplier, a staffing change, a temporary workaround during a breakdown or a peak week: each can introduce hazards or weaken existing controls. Management system standards require a process for implementing and controlling planned temporary and permanent changes that affect safety performance, reviewing the consequences of unintended changes, and taking action to reduce any adverse effects.

The heart of a management of change process is simple: before a change is made, someone asks what could go wrong, the people affected are consulted, risks are assessed, controls are put in place, people are trained, documents are updated, and the change is approved by someone with authority. After the change, someone checks that it worked as intended.

Making change management work

Many organizations have a management of change procedure that nobody uses, because it is too heavy for small changes and too easy to bypass for urgent ones. Harrowgate Foods Inc.'s design addressed both problems.

• A quick screen for every change. A one-page form with eight yes-or-no questions: does the change affect equipment, layout, traffic routes, chemicals, energy sources, staffing, procedures or emergency response? If every answer is no, the change proceeds with a record. If any answer is yes, it goes to a fuller review.
• Scaled review. Small changes are reviewed by the supervisor and a worker from the area; larger ones by a team including maintenance, safety and the safety committee.
• Temporary changes have an expiry. Every temporary change, such as the staging lane, gets an end date. When it expires, it must be removed or reviewed again as a permanent change.
• Urgent changes still get a check. In a breakdown, the shift supervisor and maintenance lead do a short risk check before proceeding and complete the full review within a week.
• People changes count. Reorganizations, reductions in staffing, new supervisors and changes in shift patterns go through the same screen, because they can weaken supervision and competence.

The screen caught the wiring change Dev had found. An electrician had rerouted a circuit during a repair, and the old isolation point no longer cut power to one motor. Under the new process, any electrical change affecting isolation points triggered an update to the lockout procedure and a verification test before the equipment returned to service.

# Management of change screen: decide the level of review for proposed changes.
questions = ["equipment", "layout", "traffic", "chemicals", "energy",
             "staffing", "procedures", "emergency"]
def review_level(answers, temporary):
    yes = [q for q, a in zip(questions, answers) if a]
    if not yes:
        return "record only"
    level = "team review" if len(yes) >= 3 or "energy" in yes or "traffic" in yes else "supervisor review"
    return level + (" (with expiry date)" if temporary else "")
changes = {
    "new label printer on packing line": ([0, 0, 0, 0, 0, 0, 0, 0], False),
    "temporary staging lane in freezer aisle": ([0, 1, 1, 0, 0, 0, 1, 0], True),
    "new sanitizer from a different supplier": ([0, 0, 0, 1, 0, 0, 1, 0], False),
    "rewired motor circuit after repair": ([1, 0, 0, 0, 1, 0, 1, 0], False),
}
for name, (ans, temp) in changes.items():
    print(f"{name:<41} {review_level(ans, temp)}")

new label printer on packing line         record only
temporary staging lane in freezer aisle   team review (with expiry date)
new sanitizer from a different supplier   supervisor review
rewired motor circuit after repair        team review

Had the screen existed a year earlier, the staging lane would have gone to a team review with an expiry date, and someone would have asked how trucks would leave it. That is the whole value of the process: it puts a predictable question in front of a well-meaning decision.

Unintended change and drift

Not every change is planned. Equipment wears, people leave, workarounds become habits, and practices drift away from procedures, as HSE-401 described. A management system catches unintended change through field verification of controls, inspections, audits, worker reports and the review triggers in lesson 5. When drift is found, the response is the same as for a planned change: assess the risk, decide whether the procedure or the practice needs to change, and act. Sometimes the workers' version is safer and better, and the procedure should be updated to match it.

Maintenance as an operational control

Engineering controls only work if they are maintained. Guards crack, interlocks are bypassed, ventilation fans lose capacity, barriers are hit by forklifts and not repaired, alarms drift out of calibration. Harrowgate Foods Inc. linked its maintenance system to the risk register: every engineering control for a high or very high risk was entered as an asset in the maintenance system, with an inspection and test schedule. A failed inspection of a safety-related asset generated a priority work order, and the backlog of overdue safety-related work orders became one of the leading indicators reviewed monthly. When the distribution center's new walkway barriers were installed, they went straight into the maintenance system with a monthly inspection, so that damage from forklift contact would be found and fixed within days rather than when someone noticed.

Procurement and design

Operational control begins before equipment arrives. Buying a machine with good guarding and accessible isolation points is far cheaper than fixing it afterwards. Lesson 9 covers procurement more fully; here the point is that operational control includes setting safety criteria for anything the organization buys or designs, and checking that what arrives meets them before it is used.