Control Confidence Explained: 4 Evidence States Before High-Risk Work

A permit can be signed, a risk register can be current, and a control can still be unready. The missing question is not whether the control appears in the plan. It is what evidence shows that the control is available for this work, in this place, with these people, under these conditions.

Control confidence gives leaders a practical way to answer that question. It separates a planned barrier from one that is present, tested, and still working while the task moves through its most exposed steps.

Control confidence is the strength of evidence showing that a risk control has been specified, installed, tested, and kept effective under current operating conditions. It helps leaders decide whether work may start, continue, pause, or require escalation before a weak assumption becomes exposure.

Why control confidence matters before work starts

Risk treatment is often recorded as if selection were the same as execution. ISO 31000:2018 describes a process for identifying, analyzing, evaluating, and treating risk, yet the process only protects people when the selected treatment can be seen and relied on at the worksite.

Across more than 25 years in multinational EHS leadership, Andreza Araujo has emphasized the gap between declared controls and operated controls. A procedure may require isolation, exclusion, supervision, or rescue, while the field has only a verbal intention and a deadline. That gap is where confidence disappears.

The practical test is simple. Ask what evidence would convince a skeptical supervisor that the control is ready. If the answer is only a document number or a signature, the decision is still resting on assumption.

What does a planned control prove?

A planned control proves that someone has described a treatment for a known hazard. The description may appear in a risk assessment, permit, method statement, drawing, or pre-job review. This state matters because unplanned work usually has no agreed boundary, owner, or response route.

Planned does not mean installed

A plan can require a guard, a locked valve, a gas test, or a spotter without confirming that the item exists at the exact point of exposure. The control remains conceptual until the team can locate it and explain what failure it is meant to prevent.

Leaders should ask who owns the control, when it must be verified, what condition makes it invalid, and which action follows if it cannot be provided. Those questions turn a written intention into a decision boundary.

What does a present control prove?

A present control exists where the work is happening. It can be seen, accessed, and connected to the hazard it is meant to manage. A barrier stored in a vehicle, a rescue kit outside a locked area, or a monitor without a working sensor does not provide present control.

Presence must match the exposure

Presence is not a visual contest. The important issue is whether the control occupies the right position in the sequence. A barricade placed after a moving vehicle crosses the line of fire is present, but it is not positioned where it can prevent the exposure.

Field verification should therefore follow the task from the first irreversible action to the last recovery step. The reviewer needs to see the control, hear the operating limit, and confirm that the person responsible can act without searching for permission.

What does a tested control prove?

A tested control has performed its critical function under a defined check. The test might confirm zero energy, an alarm response, a communication route, a load limit, a gas reading, or a rescue access path. The exact test depends on the hazard, but the principle stays the same: evidence must connect the control to the consequence it is meant to prevent.

Test the failure that matters

Weak verification checks whether the control looks correct. Strong verification checks whether the control would interrupt the hazardous sequence. James Reason’s model of latent failures is useful here because a barrier can fail through design, maintenance, supervision, communication, or operating conditions before the final action becomes visible.

A supervisor should record what was tested, who witnessed it, what result was expected, and what would invalidate the result. That record is more valuable than a generic tick because it preserves the reasoning behind the release decision.

What does a sustained control prove?

A sustained control remains effective after the work begins. This is the state most often assumed and least often checked, because teams tend to verify at the start and then trust the original condition for the rest of the job.

Conditions can erode a working control

Weather, simultaneous operations, fatigue, equipment movement, changing access, production pressure, and temporary modifications can weaken a control without producing an obvious failure. The task may still look normal while the control has lost its connection to the exposure.

For sustained confidence, define a recheck trigger before the work starts. A trigger can be a shift handover, a change in crew, a process interruption, a new nearby activity, or any condition that changes the original assumption. The purpose is not to create paperwork. It is to make renewal of evidence easier than silent continuation.

How should leaders use the four states?

The four states work as a progression, not as four interchangeable labels. Planned asks whether the control was designed. Present asks whether it exists. Tested asks whether its critical function works. Sustained asks whether it remains reliable while the exposure continues.

Use the weakest relevant state as the decision limit. A low-consequence task may proceed with planned and present evidence, while high-risk work may require tested and sustained evidence before the next irreversible step. The threshold should follow the credible consequence, the recovery difficulty, and the amount of change in the job.

This approach complements a barrier health review because it makes the evidence state visible before leaders discuss performance. It also strengthens the risk register by distinguishing a treatment that is listed from one that is being managed in the field.

When should work pause?

Work should pause when the evidence state is weaker than the exposure requires, when a critical control cannot be demonstrated, or when changed conditions make earlier evidence unreliable. A pause is not an admission that the plan failed. It is a decision that prevents an unverified assumption from becoming the next step in the hazardous sequence.

The work owner should then choose one of three actions. Restore the missing control, redesign the task so the exposure changes, or escalate the decision to the authority that can accept the residual risk. Continuing while the evidence remains unclear is not a neutral choice because it transfers the uncertainty to the people closest to the consequence.

How to keep control confidence from becoming paperwork

Keep the record short and specific. Capture the control, the evidence state, the person who verified it, the condition that would invalidate it, and the next review trigger. Five useful fields are better than a long form that no one reads at the point of work.

Leaders should also review pauses and failed verifications, not only completed jobs. Those events show where the organization’s assumptions are weaker than its procedures, which is the kind of operational evidence that improves safety culture without pretending that a perfect form means a perfect control.

High-risk work should proceed only when the control evidence matches the consequence of failure. A plan creates intent, presence shows availability, testing shows function, and sustained verification shows that the control still protects people as conditions change.

FAQ

What is control confidence in safety management?

Control confidence is the strength of evidence supporting the belief that a safety control exists, works as intended, and remains available during the task.

What are the four control confidence states?

The states are planned, present, tested, and sustained. Each state answers a different question about whether the control is ready to support the decision.

Is a signed permit proof that controls are ready?

No. A signed permit shows that a control plan was authorized, but it does not prove that the physical control is installed, tested, or maintained.

Who owns control confidence?

The work owner owns the operating decision, while the people performing and verifying the work provide evidence and challenge when the control is unclear.

When should work stop because confidence is weak?

Work should pause when the evidence state does not match the consequence, a critical control cannot be demonstrated, or changed conditions invalidate the original verification.

If the team cannot show which evidence state supports the next irreversible step, the job is not ready for that step. Restore the control, change the exposure, or escalate the decision.

For more practical guidance on risk management and safety leadership, visit Headline Podcast and explore Andreza Araujo’s field-based analysis.