Control Health Metrics: 5 Blind Spots Boards Miss

Control health metrics are leading indicators that test whether critical risk controls are present, working, verified, and acted on before serious injury or fatality exposure becomes an event, including occupational health signals such as exposure monitoring and medical surveillance. Unlike TRIR or DART, they do not wait for harm, and unlike activity counts, they must prove barrier quality.

The Bureau of Labor Statistics reported 5,070 fatal work injuries in the United States in 2024, with one worker death every 104 minutes. This article shows why many board dashboards still miss weak controls even after adding leading indicators.

On the Headline Podcast, Andreza Araujo and Dr. Megan Tranter often return to one question: what separates declared safety from real safety when leaders are under pressure? Control health metrics sit exactly in that gap, because they can either reveal fatal-risk weakness or create a polished dashboard that hides it.

Why do control health metrics fail at board level?

Control health metrics fail at board level when they describe safety work completed rather than risk control strength. OSHA explains that leading indicators are proactive measures that can show whether safety activities are preventing problems, yet a board report can still count inspections, training hours, and action closure without proving that high-consequence controls worked during real exposure.

The distinction matters because a board cannot govern fatal risk through activity volume. A 98 percent inspection-completion rate may look disciplined while permit quality, isolation verification, line-of-fire separation, and supervisor stop decisions remain weak. The metric is active, but the risk insight is passive.

Co-host Andreza Araujo's own work in Safety Culture: From Theory to Practice argues that culture becomes visible in repeated decisions, not in the existence of formal programs. A control health dashboard should therefore ask what decision changed after the measure appeared, which owner acted, and whether the next high-risk task became safer within 30 days.

This is also why a control health article must connect with board metrics that compare control health, TRIR, and SIF exposure. The present issue is narrower: even after leaders choose the right metric family, blind spots in design can still leave the board under-informed.

1. The metric counts verification but not control quality

A verification count is weak when it tells the board how many checks happened but not whether the critical control could actually stop the hazard. A facility may complete 120 field verifications in a month, yet the board still needs to know how many controls failed, how many were accepted with conditions, and how many required work to stop.

The common trap is treating presence as performance. A lock, guard, permit, gas test, exclusion zone, or rescue plan can exist on paper while failing the conditions that make it a barrier. NIOSH places elimination and substitution at the top of the hierarchy of controls because control strength differs by design, which means a dashboard cannot treat every verified item as equal protection.

Senior EHS leaders should split the metric into at least 3 lines: control present, control effective, and control restored after weakness. If all 3 lines are green every month, the board should ask whether the field is being inspected honestly or merely sampled politely.

2. The denominator hides real exposure

A control health percentage can mislead when the denominator is administrative rather than exposure-based. Reporting 95 percent completion of planned verifications says little if the highest-risk tasks, contractors, night shifts, shutdown work, or non-routine jobs were not represented in the sample.

This is the same logic behind safety metric denominators and exposure bases. A board metric should not ask only how many checks were finished. It should ask how many SIF-exposure hours, critical lifts, confined-space entries, energized interventions, mobile-equipment interactions, or hot-work jobs were covered by meaningful verification.

A practical board rule is to require the denominator to name the exposure. Instead of "critical control checks completed," use "critical-control checks per 100 high-risk work permits" or "failed controls per 1,000 SIF-exposure hours." That wording forces the metric to face the work that can kill someone.

3. Corrective action closure is mistaken for risk reduction

Corrective action closure is not proof of risk reduction unless the organization verifies that the control changed in the field. A closed action may mean the owner uploaded a photo, completed a training record, updated a procedure, or changed a due date, while the original exposure remains active.

OSHA's severe injury reporting rule, 29 CFR 1904.39, requires employers to report a fatality within 8 hours and an in-patient hospitalization, amputation, or loss of an eye within 24 hours. Those thresholds remind leaders that severe events move faster than many action-tracking systems, especially when closure discipline is more administrative than operational.

The stronger metric is not closure rate alone. It is verified-control restoration after closure, with a second check after 7 to 30 days for recurring defects. That shift turns action tracking from paperwork hygiene into fatal-risk governance.

4. Why does a green dashboard still hide SIF exposure?

A green dashboard hides SIF exposure when it aggregates weak and strong signals into one average. BLS recorded 5,070 fatal work injuries in 2024, and fatal risk does not distribute evenly across all tasks, shifts, or departments, which means a site average can look stable while a small number of high-energy tasks carry most severe potential.

Average-based reporting is comfortable because it reduces board tension. It also delays decisions. A 92 percent control health score may hide a failed crane exclusion zone, a missing line-of-fire control, a bypassed interlock, a weak tank overfill prevention layer, or an overdue confined-space rescue drill if those exposures sit inside a large denominator.

James Reason's Swiss cheese model helps here without blaming the operator. The board should see where multiple layers are thin at the same time, because a single weak control may be recoverable while 3 weak layers around the same fatal-risk scenario deserve immediate escalation.

The practical fix is scenario-based reporting. Instead of one control health score, show the top 5 fatal-risk scenarios, the critical controls for each, the last verification result, the owner, the open defect age, and the stop-work rule that applies when the control is absent.

5. The board sees the score but not the response rule

A control health metric is incomplete when the board can see the score but not the response rule attached to it. If 1 failed critical control only creates a discussion item, while 5 failed controls create the same discussion item, the metric has no governance force.

This is why leading indicator response rules matter. Every control health threshold should define who acts, by when, with what authority, and what work must stop if the control cannot be restored. Without that rule, the dashboard becomes a monthly description of drift.

In more than 250 cultural transformation projects, Andreza Araujo has observed that organizations often know more than they act on. For board reporting, that gap is unacceptable. A metric that does not change budget, staffing, engineering priority, contractor access, shutdown readiness, or executive escalation is not yet a safety governance tool.

How should executives audit control health metrics?

Executives should audit control health metrics by tracing one fatal-risk scenario from exposure to board decision. The audit should take less than 90 minutes for a focused review, and it should verify whether the metric shows exposure, control quality, defect age, accountable owner, response threshold, and field evidence.

The audit starts with a simple selection: pick one high-risk scenario that could produce a fatality this quarter. Then ask the EHS leader to show the control set, the most recent field verification, the failed-control history, the action status, and the decision that changed because of the metric.

If the answer is a spreadsheet of completed activities, the board has activity assurance rather than control assurance. If the answer shows exposure, failure mode, action authority, and verified restoration, the metric is closer to real safety.

Comparison: activity indicators vs control health evidence

Activity indicators and control health evidence are not interchangeable. One reports that safety work occurred, while the other tests whether a critical barrier still protects people during actual exposure.

OSHA publishes guidance on leading indicators because proactive measures can reveal whether safety activities prevent incidents. The board's task is to demand the second column only as context and govern from the third column, where the metric proves whether the barrier can still do its job.

What should change in the next 30 days?

The next 30 days should produce a smaller, stricter control health dashboard. Executives do not need 25 new indicators; they need 5 fatal-risk scenarios, named critical controls, exposure-based denominators, response rules, and evidence that weak controls were restored before work continued.

The fastest improvement is to remove comfort metrics from the board pack. Keep TRIR, DART, and severity rate as lagging context, but do not let them occupy the space needed for SIF exposure, critical-control failure, action aging, and stop-work use.

Each month without this change allows green dashboards to normalize weak barriers, while severe exposure keeps moving through permits, maintenance work, contractor tasks, and production recoveries.

As Andreza Araujo and Dr. Megan Tranter frame it on Headline Podcast, real safety depends on the conversations leaders are willing to have before the event. A board that asks for control health evidence is no longer reviewing safety history; it is deciding whether fatal-risk controls deserve action today.