Alarm Review vs Proof Testing vs Field Inspection: Which Signal Deserves Priority?

F3 deep comparative for process safety leaders, asset owners, and EHS managers

When a process plant has limited time for assurance work, should the next review focus on alarms, proof testing, or field inspection? The answer depends on what the organization is trying to detect. Alarm review tests whether operators can receive and act on abnormal-condition information. Proof testing tests whether a protective function can respond when demanded. Field inspection tests whether the physical condition of the installation still matches the control design.

These activities are often placed in the same annual plan, which makes them look interchangeable. They are not. A plant can complete an alarm review while a safety instrumented function remains unavailable, or finish a proof test while corrosion, access, housekeeping, or an unauthorized modification weakens the physical barrier around it. The first move should follow the dominant uncertainty, not the easiest calendar slot.

Andreza Araujo's work on the gap between formal compliance and operated control is useful here. In A Ilusão da Conformidade, translated as The Illusion of Compliance, the central warning is that evidence of completion is not the same as evidence that protection works under pressure. This comparison applies that warning to process safety assurance without treating any single review as a complete safety case.

What this comparison is deciding

The decision is not which activity is most sophisticated. It is which activity can reduce the most important uncertainty before the next high-consequence demand. If the plant does not know whether alarms are prioritized and actionable, alarm review deserves attention. If a protective function has an overdue or weakly evidenced test, proof testing deserves priority. If documentation says a barrier exists but the installation may have degraded, field inspection should lead.

The strongest sequence usually combines all three, but sequence matters because assurance capacity is finite. Treating them as a checklist can produce a green plan that leaves the most consequential uncertainty untouched. The practical question is therefore, which signal should change the next operating, maintenance, or capital decision?

Evaluation criteria for choosing the first activity

Use six criteria before assigning the first review. The first is consequence relevance, meaning whether the activity addresses a credible high-consequence scenario. The second is detectability, which asks whether the activity can reveal a hidden weakness rather than confirm a known status. The third is decision proximity, or how directly the result changes a current operating or maintenance choice.

The remaining criteria are evidence quality, ownership, and time to action. Evidence quality matters because a completed form can still be weak evidence if acceptance criteria are vague. Ownership matters because a signal without a decision owner will become a finding in a tracker. Time to action matters because the most useful review is not the one with the longest report, but the one that moves a necessary control decision before exposure accumulates.

Score each criterion from 1 to 5, then record the reason for every score below 3. Include the operations manager, the asset or reliability owner, the process safety specialist, and a supervisor who understands the field conditions. That group is small enough to decide and broad enough to expose a mismatch between the written control and the work system.

Alarm review is the information-availability option

Alarm review should lead when operators receive too many alerts, cannot distinguish urgent signals from background noise, or routinely suppress alarms without a clear restoration rule. The review is strongest when it tests the alarm lifecycle, including prioritization, rationalization, shelving, response guidance, ownership, and performance after changes to the process or control system. ISA 18.2 and the Engineering Equipment and Materials Users' Association alarm-management guidance both treat alarm performance as a lifecycle issue rather than a one-time display adjustment.

The key output is not a lower alarm count. The key output is a defensible response expectation for the alarms that matter. A plant should be able to explain which operator action is required, how much time is available, what condition would make the response ineffective, and who owns the correction when the alarm does not perform as intended.

Alarm review is a weak first move when the main concern is a physical barrier that may be unavailable. Better graphics cannot compensate for a failed isolation valve, a bypassed trip, or a degraded containment boundary. In that situation, the review can wait until the plant has addressed the more direct barrier uncertainty.

Proof testing is the demand-response option

Proof testing should lead when the plant depends on a safety instrumented function, shutdown layer, trip, or other protective action whose availability cannot be inferred from normal operation. IEC 61511 treats proof testing as part of maintaining the required performance of safety instrumented systems, which means the test must challenge the relevant function against defined acceptance criteria rather than simply confirm that a maintenance record exists.

A useful proof test asks whether the complete protective path can respond. That includes the sensor, logic solver, final element, energy source, bypass state, test interval, restoration step, and documentation of failures. A partial test can be valuable, but it must be labeled as partial because a passing result for one component does not prove that the demand path is available end to end.

Proof testing is a weak first move when the plant has poor configuration control or uncertain physical condition around the device. A technically successful test can coexist with damaged cabling, inaccessible isolation points, incorrect identification, or a field change that was never incorporated into the design basis. When those conditions are credible, the proof test should be paired with field verification instead of being treated as the final answer.

Field inspection is the physical-condition option

Field inspection should lead when the central question is whether the barrier exists as designed and remains usable in the conditions where people operate and maintain the plant. The inspection should be targeted, not a general walk-through. It should trace a defined scenario from initiating event to consequence and check the physical barriers, access, labeling, isolation points, drainage, containment, fire protection, escape routes, and unauthorized changes that could defeat the intended protection.

Field evidence is especially important after maintenance, temporary repair, process change, repeated equipment failure, severe weather, or a long period without a direct verification. James Reason's model of latent and active failures explains why a document can remain correct while the operating system around it drifts. The inspection closes that gap by testing what is present, accessible, and usable now.

Field inspection becomes weak when inspectors only search for housekeeping defects or record photographs without connecting them to a credible loss scenario. The question is not whether the area looks orderly. The question is whether the physical condition preserves the function that the risk assessment assumes.

How the three options compare

The matrix shows why a plant should resist a universal annual sequence. Each option produces a different kind of evidence, and each can create false confidence when its scope is mistaken for proof that the entire control system is healthy.

Which signal deserves priority by context

Choose alarm review first when operators are receiving more alarms than they can process, when alarm priorities have multiplied without a clear basis, or when abnormal-condition response depends on tribal knowledge. The immediate decision should be which alarms require action, within what time, and under whose authority.

Choose proof testing first when a protective function is overdue, when test records do not show the acceptance criteria, or when a recent demand or failure has challenged confidence in the trip. The immediate decision should be whether the function can remain in service, needs compensating measures, or requires a controlled shutdown for restoration.

Choose field inspection first when the plant has changed, the barrier has been exposed to degradation, or the records and the installation no longer agree. The immediate decision should be which physical condition must be corrected before the scenario can be considered controlled.

When two signals are credible, use the consequence path to break the tie. A barrier that can prevent a severe release or ignition event should take precedence over an activity that only improves visibility, unless the information gap is so severe that operators cannot recognize the demand in time.

What leaders should do in the first 90 days

During the first 30 days, select one high-consequence scenario and map the three evidence types against it. Record what the alarm system says, what the protective function can demonstrate, and what the field actually shows. During days 31 to 60, close the most consequential evidence gap and assign one accountable owner for each remaining gap. During days 61 to 90, repeat the selected test after the corrective action and add the result to the operating review rather than leaving it in a specialist tracker.

This sequence prevents a common leadership error, which is asking for more assurance data without deciding what the data must change. As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture becomes visible in the decisions leaders reinforce. A review earns credibility when its result changes work, funding, maintenance priority, or operating limits.

Conclusion

Alarm review, proof testing, and field inspection answer different questions. Alarm review tests whether information can guide timely action. Proof testing tests whether a protective function can respond on demand. Field inspection tests whether the physical barrier still exists and can be used. The right first activity is the one that addresses the most consequential uncertainty before the next demand, then leads to an owned decision.

Process safety leaders who want to connect barrier evidence with leadership accountability can continue the conversation through the Headline Podcast, where operational signals are treated as inputs to better decisions rather than as proof of safety by themselves.