Environment, health and safety

Safety on an operating site is a legal obligation with clocks attached, not a value statement. The difference matters at the moment something happens, because the obligations start running whether or not anyone has decided what to do.

Controls in order of effectiveness

The hierarchy is not advice about preference. It is a ranking by how much the control depends on a person behaving correctly under pressure, and everything below the third rung does.

1. Elimination — the hazard is not there. The task is designed out, or done elsewhere.
2. Substitution — a less hazardous material, process or energy source.
3. Engineering — guards, interlocks, ventilation, barriers. The hazard remains; reaching it does not depend on judgment.
4. Administrative — procedure, training, signage, permits, rotation.
5. Personal protective equipment — the last line, worn by the person the hazard is nearest to.

Most programs that look thorough are stacked at rungs 4 and 5, because those are cheap to add and produce documents. A new procedure and a toolbox talk in response to an injury is the default answer, and it leaves the hazard exactly where it was.

The test for a proposed control: if the most rushed person on the worst shift skips a step, does the hazard reach them? If yes, the control is at rung 4 or below whatever it is called.

Energy control is the one to get right first

Most severe injuries on production equipment happen during maintenance, cleaning or clearing a jam — work done with guards removed, by someone who has done it a hundred times, on a machine that was believed to be off.

Isolation of hazardous energy has to be procedural per machine rather than generic per plant, and must account for stored energy — pressure, springs, gravity, capacitance — which is what "off" fails to address. Verification is the step that gets dropped: attempting the start after isolating is what turns a belief into a fact.

Where an outside contractor works on the site, the isolation procedure is theirs to follow and yours to specify. Coordination is the usual gap.

Recordable, reportable and the clocks

These are three different thresholds and they are routinely conflated:

• First aid — treated and logged, not recorded.
• Recordable — medical treatment beyond first aid, restricted duty, days away, loss of consciousness, or a significant diagnosed condition. It goes on the log.
• Reportable — the serious subset that must be told to the regulator within a fixed window, measured in hours for a fatality and in a small number of days for an in-patient hospitalization, amputation or eye loss.

The failure is almost never refusal. It is that nobody knew the clock had started, because the event was being managed as a medical matter while the reporting window ran. Name in advance who decides recordability, who notifies, and what happens when that person is unreachable at 2am — which is when it will happen. legal-risk:regulatory-compliance holds the wider obligation-tracking method.

Environmental releases carry their own thresholds and their own clocks, usually shorter. A site with permits should know its reportable quantities before it needs them.

Measure what precedes the injury

A recordable injury rate is a lagging measure on a small denominator. A site can go a year without a recordable and still be one guard away from a serious event, and a site can record two minor injuries in a strong year and look worse.

Worse, attaching the rate to bonuses or site rankings reliably suppresses reporting rather than injuries. The first thing lost is the near-miss, which is the only free information the system produces.

Measure ahead of the event instead: near-misses reported per period, with a rising count read as the program working; hazards identified and closed, with age; time to close a corrective action; and audit findings on the controls that matter, weighted toward rungs 1 to 3. Pair any lagging rate with a severity-potential measure, because frequency and severity move independently and a program tuned on frequency alone optimizes for paper cuts.

Tooling

EHS management systems — Intelex, Cority, VelocityEHS, Enablon, Benchmark Gensuite and similar — carry the incident log, corrective actions, training records and regulator-facing reports in one auditable place, which is what an inspection asks for. The determining factor is whether reporting is easy enough on the floor that near-misses actually arrive; a system only supervisors can reach records incidents and nothing that precedes them.

Regulatory recordkeeping has a required form and a required posting period. Whatever the system, confirm it produces the log in the form the regulator expects rather than an export someone reformats each year.

Below that scale, a shared log with a fixed set of fields and a named owner per open item covers most of the value. What cannot be substituted is the review — an incident system nobody reads is a liability record rather than a safety program.

Never

• Answer an incident with a procedure and a briefing while the hazard stays reachable.
• Let the recordability decision wait on the medical outcome while a reporting clock runs.
• Tie a site bonus to an injury rate, which buys silence rather than safety.
• Isolate a machine without verifying the isolation by attempting a start.
• Treat a near-miss report as a problem with the reporter.