Leading indicators and serious injury precursors

Margaret Doyle's request had been clear: she wanted to know whether the things that could kill someone at Harrowgate Foods Inc. were under control, before anything happened. That meant measuring something other than injuries. This lesson describes the leading indicators the working group considered, and the approach they chose to focus on serious injury and fatality precursors.

What makes an indicator leading

A leading indicator measures something that comes before harm and is expected to influence it. Research by the Campbell Institute, the National Safety Council's center for safety excellence, described good leading indicators as proactive, preventive and predictive: they measure actions that are taken before harm, they relate to preventing it, and they give some signal of future performance. The same research grouped leading indicators into several kinds, and Elena used a similar grouping:

• Activity indicators count whether planned safety work happened: inspections completed, training delivered, safety meetings held, observations done.
• Quality indicators measure how well that work was done: the share of inspections that found high-risk hazards, the quality score of investigations, the share of corrective actions verified as effective.
• Condition and control indicators measure the state of the controls themselves: lockout verifications passed, guards in place, forklift-pedestrian separation intact, ammonia detectors tested and working.
• Response indicators measure how quickly and well the company acts: hazards fixed on time, overdue corrective actions, stop-work events followed up.
• Perception and culture indicators measure what workers think and experience: survey results on reporting and speaking up, from HSE-401.

Activity indicators are the easiest to collect and the easiest to game. A target of 40 inspections a month can be met with 40 quick walks that find nothing. Elena's rule was that every activity indicator in the framework had to be paired with a quality or condition indicator that would show whether the activity was worth doing.

Serious injuries and fatalities

Before measuring precursors to serious harm, the working group needed a definition of serious harm. They adopted a definition used by several large companies and safety research groups. A serious injury or fatality, or SIF, is a work-related injury or illness that results in death, is life-threatening, or causes a permanent or long-term change in a person's life. At Harrowgate Foods Inc., that includes amputations, including fingertips involving bone, fractures of major bones, injuries needing hospital admission beyond observation, serious burns, crush injuries to the trunk, head injuries with loss of consciousness, eye injuries causing loss of sight, and serious chemical exposures such as to ammonia.

Under that definition, the company had two SIF cases last year: the spiral conveyor injury at Gainesville and the forklift strike at McDonough. Two is too few to measure trends. The working group needed something more frequent that still pointed at serious harm.

SIF potential and precursors

The answer was to classify every event, whatever its outcome, by its potential. An event has SIF potential if, under slightly different circumstances that could reasonably have occurred, it could have caused a serious injury or death. A forklift that brushes a racking upright and a forklift that misses a pedestrian by about 18 inches may both cause no injury, but the second has SIF potential and the first may not. A cut finger from a knife has low potential. A finger caught at a nip point on a conveyor that was supposed to be locked out has high potential, even if the finger is only bruised.

A SIF precursor is the condition behind such events: a high-risk situation in which a control that should manage a serious hazard is missing, ineffective or not followed, and which will eventually lead to serious harm if it continues. The lockout shortcut on the night sanitation shift was a precursor for a year before it injured anyone. So was the temporary staging lane at McDonough that put pickers in a reversing forklift's path.

The figure shows the idea that replaced the old triangle in Harrowgate Foods Inc.'s thinking. Events with serious potential appear in every layer: among near misses, first aid cases and recordable injuries as well as actual serious injuries. If the company finds and acts on that wedge, it addresses the causes of serious harm directly. If it focuses on the whole triangle, most of its effort goes to events with little serious potential.

A simple classification

The working group designed a short classification that a supervisor could apply when an event was first reported, and that the site safety lead would confirm within a week. It asks two questions. First, was there a release, or a realistic possibility of a release, of high energy, such as moving machinery, a moving vehicle, a fall from height, stored pressure, hazardous chemicals, electricity or extreme temperature? Second, was a control designed to manage that energy missing, failed or not used? If both answers are yes, the event is classified as SIF potential, whatever its actual outcome.

# Classify a sample of last year's reported events by SIF potential
events = [
    # (description, high energy?, control missing or failed?, actual outcome)
    ("cut from bread knife",                   False, False, "first aid"),
    ("forklift reversed past picker, no injury",True, True,  "near miss"),
    ("finger bruised at conveyor nip, no lock", True, True,  "first aid"),
    ("slip on wet floor, sprained wrist",      False, True,  "recordable"),
    ("ammonia smell at valve, no detector alarm",True, True, "near miss"),
    ("strain lifting flour sack",              False, False, "recordable"),
    ("spiral conveyor arm injury, no lockout", True, True,  "serious"),
    ("ladder used instead of platform at rack",True, True,  "near miss"),
    ("burn from tray, gloves worn",            False, False, "first aid"),
    ("mixer guard interlock bypassed",         True, True,  "near miss"),
    ("forklift struck picker in staging lane", True, True,  "serious"),
    ("pallet fell from rack, area clear",      True, False, "near miss"),
]
counts = {}
for desc, energy, control_fail, outcome in events:
    sifp = energy and control_fail
    key = (outcome, "SIF potential" if sifp else "low potential")
    counts[key] = counts.get(key, 0) + 1
for outcome in ("near miss", "first aid", "recordable", "serious"):
    hi = counts.get((outcome, "SIF potential"), 0)
    lo = counts.get((outcome, "low potential"), 0)
    print(f"{outcome:<11} SIF potential: {hi}   low potential: {lo}")
total_sifp = sum(v for (o, p), v in counts.items() if p == "SIF potential")
print(f"events with SIF potential: {total_sifp} of {len(events)}")

near miss   SIF potential: 4   low potential: 1
first aid   SIF potential: 1   low potential: 2
recordable  SIF potential: 0   low potential: 2
serious     SIF potential: 2   low potential: 0
events with SIF potential: 7 of 12

In this sample, seven of the twelve events had SIF potential, though only two caused serious injury. The pallet that fell from the rack involved high energy, but the rack's exclusion zone had worked as designed and kept people clear, so the control did not fail. The slip on the wet floor caused a recordable injury but involved low energy. When Nina applied the classification to all 412 events reported last year, 61 were classified as SIF potential. That was a large enough number to track, to analyze by hazard and to set targets for investigation and action.

Critical controls

The second family of indicators focused on the controls themselves. In HSE-401, Harrowgate Foods Inc. adopted the idea of critical control management from the mining industry: for each hazard that could cause a serious injury or death, identify the few controls that are essential to preventing it, define what 'working' means for each, and check them regularly in the field. The working group listed nine serious hazards and their critical controls. For lockout, the critical controls were a written machine-specific procedure, a lock applied by each worker at every energy isolation point, and a verification that the machine could not start. For forklift traffic, they were physical separation of pedestrian and vehicle routes, speed limits enforced by the trucks' controllers, and blue lights and alarms on reversing trucks.

Each critical control has a field verification: a short check, done by a supervisor or a trained worker, that the control is in place and working at that moment. The resulting indicator is the share of verifications passed. Unlike an injury rate, it moves every week, it points directly at serious hazards, and a manager can act on it immediately.

Process safety indicators

The ammonia refrigeration systems at Gainesville and McDonough needed their own indicators. Process safety practice, developed in the chemical and oil industries, uses a tiered scheme. The top tiers count losses of containment, ranked by the amount released and the consequences. The lower tiers count challenges to safety systems, such as relief valves lifting or alarms activating, and lapses in operating discipline, such as overdue inspections, out-of-date procedures and bypassed alarms. Luis Ortega, the maintenance lead, took on the ammonia indicators, which included any release above the threshold the company set, overdue inspections of pressure relief valves, out-of-service ammonia detectors and overdue management of change reviews for the refrigeration system.

Perception and culture indicators

Some precursors cannot be seen in records. Workers may know that a shortcut is routine long before any supervisor finds it, and whether they say so depends on whether they feel safe to speak. The company's annual culture survey from HSE-401 already asked about reporting and speaking up. The working group added a short quarterly pulse survey, five questions long, and took two of its questions as indicators: the share of workers who agreed that they could stop a job they believed was unsafe without negative consequences, and the share who agreed that problems they reported were fixed. Sam Pellerin pointed out that the second question was in effect a measure of the whole corrective action system from the worker's point of view.

Leading indicators are hypotheses

Elena reminded the group that a leading indicator is a hypothesis: it is chosen because the company believes that improving it will reduce harm. That belief may be wrong. Inspections may be completed without finding the hazards that matter. Training may be delivered without changing what people do. The company therefore needed to test its leading indicators over time, by checking whether improvements in them were followed by improvements in outcomes, and by asking whether serious events had been preceded by warning signs that the indicators should have caught. Lesson 5 explains how to design indicators so they can be tested, and Lesson 10 explains the statistics.