How to Run a Control-Owner Interview Before Risk Acceptance in 6 Steps

A risk acceptance decision is only as strong as the evidence behind the control being accepted. When the control owner cannot explain what the control prevents, how it is verified, and what happens when it is unavailable, the approval is not informed risk acceptance. It is a signature placed over an unanswered operational question.

This six-step interview gives an EHS manager, operations leader, or risk owner a short, repeatable way to test that question before work starts. It is not an audit of paperwork. It is a conversation that connects the written control to the conditions in which people must rely on it.

What you need before starting

Bring the current risk assessment, the control description, the person named as control owner, and the most recent verification record. If the work involves a temporary change, contractor interface, or degraded protection, include the exception or decision record as well. The temporary risk waiver approval test adds a practical check for keeping that exception bounded.

Use the same language that appears in the risk assessment, because changing the wording during the interview can hide a change in meaning. ISO 31000 treats risk management as a process that supports decisions, while ISO 45001:2018 expects operational controls to be planned, implemented, and maintained. The interview tests whether those intentions are visible at the point of work.

Set aside forty-five minutes. Invite the control owner and the person who depends on the control during execution. A second operational voice matters because the person who owns a control may describe its design, while the user experiences its gaps.

Step 1: Define the exposure in operational terms

Ask the control owner to describe the exposure without reading the risk assessment aloud. What can happen, to whom, during which task, and under what condition? A useful answer names the energy, movement, substance, pressure, or decision that can produce harm.

Then ask what would make the exposure more severe or more likely. Production pressure, unfamiliar contractors, a night shift, a temporary layout, or a failed communication channel can change the exposure even when the task name remains the same.

Record the answer in one sentence. If the interview produces a broad phrase such as “people could get hurt,” stop and narrow it. A control cannot be tested against an exposure that nobody can describe.

Step 2: State the control's intended effect

Ask, “What exactly is this control supposed to prevent, detect, or limit?” The owner should describe the mechanism, not merely the document or activity. “We complete a permit” is an activity. “We prevent unauthorized energy release by confirming isolation and ownership before work begins” describes an effect.

Separate preventive controls from mitigative controls. A barrier that stops an event before release is not interchangeable with a response that reduces harm after release. James Reason's work on active and latent failures remains useful here because a control can exist on paper while the surrounding system makes its reliable operation unlikely.

If the owner cannot explain the control's intended effect, do not move to approval. Rewrite the control statement with the owner and the person who uses it.

Step 3: Identify the person who must act

Every critical control depends on a human decision, even when equipment performs part of the function. Ask who initiates the control, who confirms it, who can stop the work, and who is informed when the control is unavailable.

Look for hidden handoffs. A supervisor may assume that maintenance confirmed isolation, while maintenance assumes that operations owns the boundary. A contractor may receive an instruction without receiving the decision right that allows the work to pause.

Write the names or roles beside each action. The control handoff review is useful when ownership crosses departments, shifts, or company boundaries. If two people believe the other owns the final confirmation, the control is not ready for acceptance.

Step 4: Test how the control is verified

Ask what evidence proves that the control is working today. A completed form may show that someone recorded an action, but it does not necessarily show that the barrier was present, available, and understood.

Ask the owner to name the verification method, its timing, its acceptance condition, and the person who reviews the result. For a physical barrier, the evidence may be a field check. For a permit boundary, it may be a joint confirmation before the task starts. For a competence-dependent control, it may be a demonstrated task rather than attendance at training.

Use the barrier ownership model to separate design ownership, execution ownership, verification ownership, and escalation ownership. A control that has four labels but no evidence is still unverified.

Step 5: Run the control failure scenario

Ask, “What happens if this control is missing, late, bypassed, or found ineffective?” The answer should identify the immediate action, the decision maker, the temporary protection, and the route for escalation.

Do not accept “we stop and fix it” as a complete response. Ask who stops the work, how the stop is communicated, what condition permits restart, and who confirms that the original exposure has been addressed. This is where a signed decision can become a safety blind spot if the acceptance process ignores degraded controls.

The risk-acceptance tests help challenge whether the decision has a defined boundary. If the failure scenario creates a new exposure that the original assessment did not cover, reopen the assessment rather than extending the approval.

Step 6: Set the acceptance boundary and follow-up

End the interview by stating what is accepted, for how long, under which conditions, and with whose authority. A risk acceptance decision should have a clear start point, an expiry or review trigger, and a named owner for the next verification.

Use trigger-based follow-up rather than a calendar date alone. A change in crew, scope, equipment, weather, production sequence, control performance, or incident history can require an earlier review. The trigger is more important than the meeting label.

Summarize the decision in the safety decision log, including unresolved questions and the evidence required before the next approval. On the Headline Podcast, Andreza Araujo and Dr. Megan Tranter often bring leadership back to this practical point: responsibility becomes real when a decision has an owner, a boundary, and a visible consequence for ignoring the evidence.

Final checklist before approval

Approve the risk only when the interview has produced clear answers to these questions.

• Can the team describe the exposure in operational terms?
• Can the control owner explain the control's intended effect?
• Are the people who act, verify, stop, and escalate identified?
• Is there evidence that the control works under current conditions?
• Does the failure scenario define stop, protect, escalate, and restart actions?
• Does the acceptance record state its boundary, trigger, expiry, and next owner?

If one answer is missing, the right response is not a longer approval form. The right response is to close the evidence gap or change the work until the control can be trusted. That distinction keeps risk acceptance connected to operational reality rather than administrative completion.

Explore more leadership and safety conversations on the Headline Podcast.