New Hazard Controls: Design, Verification or PPE, Which Move Should Lead?

A new hazard enters the operation through a design change, a material substitution, a production shortcut or a work method that seemed temporary. The first leadership question is not whether the team has issued new PPE. It is whether the hazard can be removed before the new routine becomes normal.

Prevention through design, critical-control verification and personal protective equipment all have a place, but they answer different questions. Design asks whether exposure can be eliminated or reduced at its source. Verification asks whether an essential barrier can be trusted today. PPE asks how the individual will be protected while exposure remains. The quality of the decision depends on choosing the right lead move, not on collecting all three documents.

Across more than 25 years of international EHS leadership, Andreza Araujo has treated this distinction as a test of operating discipline. A control is not strong because it appears in a procedure. It is strong when the hazard is understood, the barrier has an owner and the field can show that the protection works.

Key Takeaways

• Prevention through design should lead when the hazard is being created, changed or engineered into the work.
• Critical-control verification should lead when a serious exposure already exists and leaders need proof that essential barriers work in the field.
• PPE should lead only as a personal layer while stronger controls are being designed, installed or maintained.
• A control decision should state the hazard, the consequence, the owner, the proof standard and the point at which work stops.
• The strongest control plan uses the three moves in sequence instead of treating PPE as evidence that the hazard has been solved.

Start with the decision, not the control label

Teams often begin a new-hazard review by asking which form to complete. That reverses the order. The decision comes first because the same hazard can require a different lead response at different stages of the work. A new automated cell may call for design changes before commissioning, critical-control verification during production and PPE during maintenance access.

The leader should name the exposure and its credible consequence in plain language. Then the team can ask whether the exposure can be removed, whether an engineered barrier can contain it and whether the remaining protection needs field proof. This sequence is consistent with the hierarchy of controls described in occupational safety practice and reflected in ISO 45001, which was published in 2018.

The practical trap is that PPE is visible. A box of respirators or face shields looks like action, while a layout change or interlock redesign may take longer to approve. That visibility can hide a weak decision. In Safety Culture: From Theory to Practice, Andreza Araujo frames standards as boundaries of care rather than boxes to tick. The same test applies here. Ask which move changes the exposure, not which move produces the fastest evidence of activity.

Prevention through design changes the hazard itself

Prevention through design should lead when the organization still has influence over the source of exposure. That includes equipment selection, facility layout, access routes, energy isolation points, material choice, process sequence and the way work is organized. The earlier the decision sits in the project, the more options remain available and the less the operation has to compensate later.

Design is especially valuable when the new hazard comes from a change that the team already considers acceptable. A faster line, a smaller maintenance access point or a new chemical transfer route may look like an efficiency decision, yet each choice can create a new exposure path. When the team reviews the hazard before procurement or installation, it can change the source rather than asking workers to manage the consequence.

The strength of design is prevention. Its weakness is distance from daily reality. Engineers may specify a safe configuration that later becomes difficult to maintain, clean or inspect. The control plan therefore needs an operating check before the design is declared complete. Ask the people who will use, clean, isolate and repair the equipment whether the intended control survives the actual work sequence.

Design should lead when the hazard is still being shaped. It should not become a reason to ignore an existing serious exposure while the project team waits for the next capital cycle.

Critical-control verification proves whether protection exists

Critical-control verification should lead when the operation already faces a serious consequence and the organization needs proof that the essential barrier is capable at the point of work. The question is narrower than a general audit. It asks whether a specific control prevents or limits a defined event, who owns it and how the organization will know that it remains effective.

This method fits situations such as stored energy, vehicle interaction, work at height, confined-space entry or process containment, where a failure can produce severe harm even when overall incident numbers look stable. A low injury count does not prove that the barrier is healthy. The verification must examine the control itself, the conditions that make it reliable and the evidence that the field team can use it as intended.

Verification becomes weak when it only checks whether a document exists. A permit may be signed while an isolation point is inaccessible. A guard may be installed while a bypass remains easy. A rescue plan may be approved while the team has never rehearsed the recovery route. The field evidence matters because it tests the difference between declared protection and operated protection.

Andreza Araujo’s work across more than 250 cultural transformation projects supports a simple leadership habit. Ask for proof close to the work, give the control a named owner and define the escalation rule before the verification starts. A failed verification is useful when it changes the decision. It becomes dangerous when it is softened to preserve the schedule.

PPE protects the person after exposure remains

PPE belongs in the plan when exposure remains after stronger controls have been applied, or when the organization needs a temporary layer while design and engineering changes are being completed. It is important, but its reliability depends on more conditions than many plans acknowledge. Selection, fit, compatibility, storage, inspection, replacement and correct use all matter at the same time.

The central mistake is to confuse issue with protection. Handing a worker a respirator does not prove that the exposure is controlled if the cartridge is wrong, the seal is poor or the task lasts longer than the change schedule allows. The same problem appears with gloves, hearing protection and fall-arrest equipment. The item is present, but the protection may not be real.

PPE also changes the burden on the individual. When the organization relies on a personal layer, it must explain the exposure, train the user, check the conditions and intervene when the equipment is not suitable. That is why PPE should not lead when a feasible design or engineered change can remove the hazard more reliably.

Use PPE as a deliberate layer with a review date. State what stronger control is planned, who owns it and what evidence will show that the temporary arrangement can end.

Decision matrix for a new workplace hazard

The matrix does not rank one method as universally superior. It shows where each method earns the lead. A design review cannot prove that a barrier is being used today. A verification checklist cannot redesign an access route. PPE cannot remove a process hazard. The methods reinforce one another when their boundaries are explicit.

How leaders sequence the three moves

When a new hazard appears, the leadership team should first ask whether the source can be redesigned. If the hazard remains, the team should identify the serious consequence and name the critical control that must prevent or limit it. PPE then covers the residual exposure and the period in which stronger controls are incomplete.

The sequence becomes operational when each move has a decision owner and a proof standard. Design owns the change to the source. Verification owns the evidence that the critical barrier works. PPE owns the personal protection that remains necessary. The handoff between them should be visible in the management-of-change record, the work package or the control register.

That structure also gives leaders a better escalation conversation. Instead of asking whether the team has completed the review, ask what changed, what remains exposed, which control is critical and what evidence permits the work to continue. A leader who asks those questions can see when a temporary layer is becoming permanent.

Recommendation for a new-hazard approval

Use prevention through design as the lead move whenever the hazard can still be removed or reduced through equipment, layout, process or work-organization choices. Use critical-control verification as the lead move when serious exposure already exists and the decision depends on proof that a specific barrier works in the field. Use PPE as the personal layer that covers residual exposure and the transition period.

Before approval, require one concise record that names the hazard, consequence, design choice, critical control, PPE requirement, owner, verification evidence and stop-work trigger. If any of those items is missing, the review is not complete enough to support a confident decision.

Headline Podcast keeps returning to the same leadership test. Safety improves when the conversation reaches the decision that changes work. For more practical discussions on workplace safety, leadership and risk, follow Headline Podcast and read the Headline Podcast safety archive.

FAQ

When should prevention through design lead a new hazard review? Prevention through design should lead when the hazard is being introduced through equipment, layout, process, materials or work organization. It gives leaders the best chance to remove or reduce exposure before the operating routine becomes fixed.

When is critical-control verification the right first move? Critical-control verification should lead when the hazard is already present, the potential consequence is serious and the organization needs evidence that the essential barriers are available, capable and used in the field.

Can PPE be the main control for a new hazard? PPE can be necessary, but it should rarely be the main response to a new hazard. It depends on correct selection, fit, use, maintenance and human behavior, so it should sit behind design and engineered controls whenever those options are feasible.

How does ISO 45001 relate to this comparison? ISO 45001, published in 2018, expects organizations to identify hazards, assess risks and apply an appropriate hierarchy of controls. The standard does not make one worksheet sufficient. Leaders still need to match the control method to the decision.

What should a leader ask before approving the control plan? Ask what can be removed by design, which serious consequence remains credible, how each critical control will be verified, who owns the control and what will happen if the proof is missing.