Control Assurance: 6 Tests That Show a Critical Control Works Outside the Audit

A critical control can pass three desk checks and still fail at the point of exposure. This article gives operations leaders six field tests that show whether the control works when timing, staffing, equipment, and production pressure stop cooperating.

The distinction matters because control assurance is often confused with document assurance. A risk register may name the barrier, an audit may find a completed form, and a training record may show that someone attended a session, while the person facing the exposure still has no reliable protection at the moment the decision must be made.

ISO 45001 specifies a management-system approach that connects risk, operational control, and improvement. The standard does not turn a document into a working barrier. That conversion happens in the field, where the control either changes the exposure or leaves the decision to improvisation.

1. Test whether one person can name the control owner

A critical control is not operationally assured until one accountable role can explain what must be available, when it must be checked, what failure looks like, and who has authority to stop the task. A department, committee, or shared inbox is not an owner. The test is simple because the ambiguity is expensive. Ask the operator, supervisor, planner, and manager the same question, then compare the answers.

Ownership includes more than signing a checklist. The owner must have enough authority to correct the condition, enough proximity to see the exposure, and enough escalation access to stop work when the control cannot be restored. When the owner can only report a problem to someone else, the control has a named contact but not a functioning decision path.

Andreza Araujo’s work across more than 250 cultural transformation projects supports this practical distinction. Accountability becomes credible when leaders connect responsibility to a decision they can actually make, rather than assigning safety to a role that can only observe and recommend.

Use a one-page control card that states the exposure, the required control, the owner, the verification point, and the escalation threshold. If a worker cannot use that card during a pre-job conversation, the governance design is still too abstract.

2. Test whether verification happens before the exposure

A control that is checked after the hazardous step is complete may produce evidence, but it does not provide timely protection. The second test asks whether the verification occurs before the first moment when the exposure becomes possible, which makes timing a control property rather than an administrative detail.

Consider isolation, lifting, confined-space entry, or mobile-equipment separation. The relevant question is not whether someone inspected the control during the shift. It is whether the inspection occurred before energy was released, the load moved, the entrant crossed the boundary, or the pedestrian entered the interaction zone.

OSHA describes hazardous-energy control through steps that must occur before servicing begins. That sequence illustrates a broader principle. A verification that arrives after exposure has started cannot be treated as equivalent to a verification that authorizes the work safely.

Map the control against the task timeline. Mark the first exposure, the latest safe verification point, and the response if the check is missed. If the process allows work to continue while the evidence is pending, the organization has created a paperwork delay, not a control.

3. Test whether the control survives degraded conditions

A control is stronger when it remains usable under the conditions that make the task difficult. The third test introduces pressures that the normal procedure tends to hide, such as a late delivery, reduced staffing, poor visibility, equipment damage, competing alarms, or a short shutdown window, and then asks whether the required protection still operates.

This is not permission to run an unsafe experiment. The test belongs in a controlled review, tabletop exercise, or supervised field verification where the exposure remains protected. Its purpose is to expose the point at which the control becomes too slow, too complex, or too dependent on one experienced person.

NIOSH explains the hierarchy of controls by placing more effective protections closer to the hazard. That logic helps leaders diagnose weak assurance. When a critical control depends on perfect attention during a degraded condition, it may be carrying more risk than its design can reliably absorb.

Record the degraded condition, the control response, and the decision boundary. A mature review does not ask whether the crew tried hard enough. It asks which design feature, resource, or authorization rule made the safe action difficult to sustain.

4. Test whether handover preserves the exposure and the control

A control can be effective at the start of a shift and absent by the handover because the next team receives the task status without receiving the exposure logic. The fourth test checks whether the incoming team can identify what remains hazardous, which control is active, what has changed, and what must happen before work resumes.

Handover quality is revealed by the questions people ask, not by the length of the form. A useful handover names the condition that could make the task unsafe, the control that prevents that condition, the evidence that proves the control is ready, and the person who must respond if the evidence is missing.

In a Headline Podcast conversation about trust, Clive Lloyd emphasized that care, integrity, and competence shape whether people trust safety decisions. Handover is where that trust becomes visible. If the outgoing team conceals a delay to make the work look complete, the incoming team inherits a clean story instead of a safe condition.

Run a two-person handover drill for one high-risk task. Ask the incoming supervisor to restate the exposure and control without reading the form. If the answer changes the decision, the handover is transferring information but not control ownership.

5. Test the response when the control fails

A control is not fully assured until the organization has a rehearsed response for its failure. The fifth test asks what happens in the first five minutes after the control is unavailable, who protects the people exposed, who has authority to stop or isolate the work, and how the condition reaches the next decision-maker.

This test separates a barrier from a wish. A guard that is removed, a gas monitor that alarms, a rescue device that is unavailable, or a separation route that is blocked should trigger a defined response rather than a debate about whether the task is almost finished.

James Reason’s analysis of latent failures is useful here because the missed action is rarely the whole story. The response may fail because the escalation route is unclear, production incentives reward continuation, replacement equipment is not staged, or the supervisor has no agreed threshold for stopping work.

Write the response in observable terms. State the first protective action, the decision authority, the notification path, the restoration requirement, and the evidence needed before restart. If the response says “notify EHS” without protecting the exposure, it is an administrative referral rather than a safety control.

6. Test whether evidence proves control performance, not activity

Evidence is useful when it shows that the control operated at the point and time of risk. The sixth test distinguishes proof of activity, such as a completed inspection or attendance record, from proof of performance, such as a verified isolation, a functional interlock, a tested exclusion zone, or a documented stop decision before exposure.

ISO 45001 frames performance through operational control and improvement, which means leaders should ask what the record demonstrates about the hazard rather than how many forms were completed. A signed sheet can be accurate and still be weak evidence if it does not show the condition that mattered.

Create an evidence ladder with three levels. The first confirms that the control was planned. The second confirms that someone checked it. The third confirms that the control changed the exposure or stopped the work when it was not ready. Governance reviews should show which level supports each critical decision.

Andreza Araujo’s book Safety Culture: From Theory to Practice makes a related point about the distance between declared values and lived practice. Assurance closes that distance when the organization measures what people could rely on, not merely what the system expected them to complete.

7. Compare the six tests before calling the control reliable

A control is reliable only when ownership, timing, degraded-condition performance, handover, response, and evidence reinforce one another. The comparison below helps a risk owner identify which failure mode remains open before the control is presented as mature to an executive committee or audit team.

The table also shows why a single audit score can mislead. A control may be strong on ownership and weak on response, or strong in normal conditions and weak during handover. The correct decision is not to average the weaknesses away. It is to close the failure that leaves people exposed.

8. Make the next verification change a decision, not another form

The purpose of control assurance is not to create a larger audit trail. It is to make the next safety decision more accurate. After the five tests, the risk owner should be able to state which control is ready, which control is degraded, what exposure remains, who can accept the condition, and what must happen before work continues.

Start with one critical exposure rather than a site-wide campaign. Select the control that matters most, run the tests with the people who perform and supervise the work, and publish the decision in the same operating rhythm that governs production. The result should change a plan, a hold point, a resource allocation, or an escalation rule.

HSE describes leadership as a visible responsibility that shapes how health and safety is managed. Visible leadership is not a walk around the site followed by a photograph. It is the willingness to make an operational decision when the control is not ready, even when the schedule makes continuation attractive.

A control that cannot trigger a timely stop decision is not ready to carry a critical exposure through the next shift.

The useful question for leaders is narrower than “Are we compliant?” Ask whether the person facing the hazard can rely on the control before the exposure begins, when conditions deteriorate, during handover, and after the first sign of failure. That is the point at which a safety system becomes credible.

For more practical conversations about risk management, safety culture, and leadership decisions, visit the Headline Podcast and explore Andreza Araujo’s work on turning declared safety values into operating choices.