Assurance Case Explained: 4 Proofs That Safety Claims Survive Field Reality

F7 | Risk Management

A safety case can look convincing because it contains approvals, procedures, training records, and inspection results. That collection is not yet proof. A claim becomes dependable only when the organization can show why the control should work, what evidence supports it, and how the evidence is tested in the conditions where exposure is real.

An assurance case is a structured argument that connects a safety claim to evidence, assumptions, limitations, and verification activities. It does not replace a risk assessment or a procedure. It makes the reasoning behind those controls visible so leaders can challenge weak assumptions before an incident does.

Key Takeaways

• An assurance case connects a safety claim to an argument, evidence, assumptions, and verification.
• Four proofs make the case useful: the claim is specific, the control mechanism is credible, the evidence reflects field conditions, and the argument has an owner.
• ISO 45001:2018 and ISO 31000:2018 support a context-based view of risk, documented decisions, operational control, and performance evaluation.
• James Reason's model of latent and active failures explains why a signed control can still fail when its assumptions are not tested.
• The aim is not more paperwork. The aim is to make safety confidence proportional to the quality of the evidence.

What does an assurance case mean in safety management?

An assurance case answers a practical question that many risk registers leave implicit: why should a decision-maker believe that this control will reduce exposure in this situation?

The answer has four linked parts. First, the claim defines the condition that is supposed to be safe. Second, the argument explains why the selected controls can produce that condition. Third, evidence shows what has actually been checked. Fourth, assumptions and boundaries identify where the conclusion may stop being valid.

This structure is especially useful when work involves contractors, temporary changes, complex interfaces, or controls that depend on several teams. It gives the risk owner something more useful than a folder of completed forms, because the owner can see which conclusion rests on which proof.

Proof 1: The safety claim is specific enough to test

A vague claim cannot be assured. “The job is safe” hides the exposure, the time window, the people affected, and the conditions that must remain stable.

A testable claim names the hazard and the control outcome. For example, a confined-space entry plan may claim that no entrant will be exposed to an oxygen-deficient atmosphere during the authorized task, provided the atmosphere is tested at defined intervals, the ventilation arrangement remains available, and the rescue response can reach the entry point.

The wording matters because each condition creates a verification question. A claim that cannot be converted into an observation, record, demonstration, or decision rule is not ready for assurance. It is a statement of confidence.

Proof 2: The control mechanism is credible

Evidence that a form was completed does not prove that the control changes exposure. The argument must explain the mechanism between the control and the hazard.

Consider an isolation certificate. Its value does not come from the signature alone. The mechanism includes identifying the correct energy source, applying the isolation, verifying zero energy, communicating the boundary, and preventing unauthorized restoration. If one step depends on an outdated drawing, the argument has a visible weakness even when the certificate is complete.

ISO 45001:2018 expects operational controls to be planned and implemented within the organization's conditions, while ISO 31000:2018 frames risk management around context, decision-making, and continual improvement. Neither standard turns documentation into automatic proof. The assurance case has to show how the documented control is expected to work in the actual task.

Proof 3: The evidence represents field reality

Evidence becomes weak when it is collected far from the work, after the work has changed, or by someone who cannot see the relevant condition. A procedure review may confirm that the instruction is clear, yet it cannot by itself prove that the equipment is accessible, the alarm is heard, or the supervisor can stop the task under production pressure.

Field evidence should match the claim. A control that depends on worker recognition needs a realistic demonstration. A control that depends on equipment availability needs a physical check. A control that depends on escalation needs a rehearsal or a trace showing that the decision path works.

This is where James Reason's analysis of latent failures remains valuable. Organizational decisions, design choices, resource constraints, and weak supervision can sit behind an operator's visible action. An assurance case should therefore inspect the conditions around the task, not merely ask whether the final barrier was present.

Proof 4: The argument has an accountable owner

An assurance case without an owner becomes a document that everyone can reference and nobody must maintain. The owner is not simply the person who stores the file. The owner is accountable for keeping the claim, evidence, assumptions, and verification schedule aligned.

Ownership must include a trigger for review. A process change, contractor change, altered staffing, failed test, overdue inspection, or serious near miss can invalidate an assumption even when the written procedure remains unchanged.

Leaders should also separate control ownership from evidence collection. The person who performs a check may not have authority to accept residual risk, change the design, or suspend work. Those decision rights belong in the argument, because evidence without authority can identify a weakness without correcting it.

Where do assurance cases fail?

The first failure is scope inflation. Teams try to assure an entire management system in one document, so the claim becomes broad and the evidence becomes decorative. Start with a decision, a critical task, a major hazard, or a control whose failure could create severe consequences.

The second failure is evidence substitution. A training attendance sheet is used as proof of competence, or a procedure review is used as proof of field execution. Those records may support the argument, but they do not answer the same question.

The third failure is frozen confidence. A case is accepted once and never revisited, even though the work changes. The argument should state its assumptions and the conditions that trigger a new review.

Andreza Araujo's *Safety Culture: From Theory to Practice* makes a related point about the distance between declared systems and repeated operating choices. The assurance case closes part of that distance by forcing the organization to show which choices are actually sustaining the control.

How should a leader review an assurance case?

A useful review can fit into a focused decision meeting when the case is scoped correctly. The leader should ask four questions.

1. What exact safety claim are we accepting?
2. Which control mechanism is supposed to produce that outcome?
3. What evidence was gathered in the conditions where the exposure exists?
4. Which assumption, owner, or change trigger could invalidate the conclusion?

The review should end with a decision, not just comments. The leader may accept the claim, require stronger evidence, change the control, narrow the work scope, or stop the activity until an unresolved dependency is addressed.

What should the final assurance record contain?

A concise record should preserve the reasoning that another competent person would need to challenge or renew the decision. It should identify the safety claim, the argument, the evidence sources, the assumptions, the limitations, the accountable owner, and the review trigger.

When the record contains only a checklist of completed actions, it can show activity without showing control. When it links each conclusion to evidence that reflects the field, it becomes a decision tool. That distinction matters because confidence should rise only when the proof becomes stronger.

A control is not dependable because it appears in three documents. It is dependable when the organization can explain how it works, demonstrate that it works in the task, and respond when the conditions that support it change.

If your leaders need a stronger way to connect risk decisions with field evidence, Andreza Araujo helps organizations turn safety culture into decisions that can be tested and sustained.