Stop-Work Authority vs Control Hold Point vs Exception Register: Which Gate Fits Off-Script Work?

When work drifts off the plan, leaders usually face one of three questions. Do we stop the job now because the danger is live, do we pause at a planned hold point because the next step needs proof, or do we record a temporary exception because the deviation is controlled but not yet closed? Each gate solves a different problem, and using the wrong one creates either overreaction or drift.

Across 25+ years of executive EHS, Andreza Araujo has seen teams lose control in two opposite ways. Some sites stop everything for every deviation, which teaches people to hide problems. Other sites keep calling everything a routine exception, which teaches people to accept drift as normal. In her book A Ilusao da Conformidade, the point is simple: paper compliance does not prove field control.

The practical question is not which gate sounds stronger. It is which gate matches the decision speed, authority, and evidence the work actually needs. That is why this comparison belongs in risk management, not in slogans about accountability.

Key Takeaways

• Use stop-work authority when the crew is facing immediate danger or a barrier has already failed in the field.
• Use a control hold point when the next step should not begin until someone verifies a condition, document, or barrier state.
• Use an exception register when the deviation is temporary, visible, owned, and tracked through a real decision path.
• The wrong gate either slows safe work without reason or normalizes a risk that should have stayed visible.
• Leaders should compare the gate to the decision, the urgency, the evidence needed, and the person who can close the loop.

What problem do these three gates solve?

All three gates exist because work does not stay perfect. Tasks change, materials arrive late, a permit slips, a contractor improvises, or a barrier is found weaker than expected. The real issue is how the organization responds when the planned path no longer matches the field.

James Reason is useful here because latent failure rarely begins at the final step. The immediate event usually sits on top of earlier decisions, weak controls, and missing feedback. A gate is only useful if it interrupts that chain before the field absorbs the cost.

For a related control-path view, read How to Screen a Temporary Field Change Before Work Continues, which shows why a change should be tested before it becomes routine.

How do the evaluation criteria differ?

Leaders should not choose the gate by habit. They should compare the decision against five criteria, because each criterion points to a different owner and a different level of urgency.

The comparison matters because a site that uses stop-work authority for every missing form will train people to avoid the signal. A site that pushes every deviation into an exception register will train people to normalize the problem. The right gate is the one that preserves honesty about what the field can and cannot safely do next.

Stop-Work Authority: when the work is already unsafe

Stop-work authority fits the moment a worker, supervisor, or contractor sees live danger that cannot be managed by continuing as planned. The hazard may be a failed barrier, unprotected line of fire exposure, unstable equipment, or a task that has crossed from controlled to unsafe in the moment.

The strength of this gate is speed. It gives the field a clean interruption when time matters more than argument. That is why it should be simple, widely known, and socially protected by leadership, because the person who stops the job is often the person closest to the real risk.

The trap is cultural. If the organization punishes inconvenience, people learn that stop-work authority is a theory, not a right. Andreza Araujo describes that pattern in A Ilusao da Conformidade, where systems look disciplined until pressure exposes what the papers could not carry.

For a deeper leadership view of the same gate, see Stop-Work Authority Explained: 4 Decision Gates That Keep It Real. It connects the right to stop with the response leaders must show afterward.

Control Hold Point: when the next step needs proof

A control hold point is different because it is planned in advance. The job is not necessarily unsafe yet, but the next step should not start until a defined condition is proved. That condition might be isolation status, permit approval, equipment readiness, supervision, or a field check that confirms the barrier still exists.

This gate works best when the team already knows the next step could create severe exposure if someone rushes. A hold point keeps the pause inside the job plan, which makes the pause part of the work rather than a surprise interruption. That design reduces drama and improves discipline.

The risk is bureaucracy. If the hold point is vague, the crew will treat it as an administrative delay and will try to work around it. If the owner is unnamed, the hold point becomes a waiting room. A hold point only earns its place when release requires a real decision, not a checkbox.

Use the hold point to protect the boundary between one controlled condition and the next. For example, the work may be fine after isolation verification, but not before it. The gate should keep that difference visible until the evidence is in hand.

For a practical companion, read Control Hold Point Explained: When Work Must Stop, because that article shows how the boundary should be documented and released.

Exception Register: when the deviation must stay controlled

An exception register is the right tool when the organization accepts that a deviation will exist for a defined period, but refuses to let it disappear into informal practice. The register should name the deviation, the reason, the owner, the compensating controls, the review date, and the end state.

This gate is useful when the work cannot be frozen immediately and the risk is temporary rather than live. It is also useful when several teams need visibility of the same deviation, because a shared register prevents the problem from being remembered by only one supervisor or one shift.

The danger is drift. An exception register can become a permission slip if no one checks expiry, challenge, or closure. That is why the register should never replace field verification. It should sit on top of it, not above it.

As Andreza Araujo argues in Sorte ou Capacidade, luck is a poor control strategy. If the exception lives only because nothing bad happened yet, then the organization has moved from management into hope.

For a live example of how deviations should be governed, see Permit Exception Case: How 250+ Projects Turned Deviations Into Risk Controls. It shows why the exception needs real ownership, not just documentation.

Decision matrix for supervisors and managers

This matrix is the quickest way to choose the gate without turning the choice into a committee problem. Start with the field condition, then match the gate to the decision that must be made.

A strong manager does not ask which gate sounds toughest. A strong manager asks which gate protects the next decision. That is a different question, and it usually produces a better answer because it keeps authority attached to reality.

Which gate fits which company context?

A supervisor on the floor usually needs stop-work authority first, because the supervisor is closest to the live condition and must be able to interrupt the task immediately. If the site culture makes that act costly, the whole system becomes slower and more dishonest.

An EHS manager often needs control hold points, because many recurring risks live at the boundary between steps. A hold point can protect isolation, permit release, contract handover, or startup verification without turning every one of those moments into an exception.

A plant manager or risk owner often needs an exception register, because exceptions cross functions and outlive a single shift. The register gives the organization memory, but only if leadership treats it as a live control and not as a filing cabinet.

Across 250+ cultural transformation projects, Andreza Araujo has seen the same pattern: sites improve faster when they choose one gate for the right moment rather than forcing one gate to do all the work. That is also why temporary field change screening matters. It keeps the deviation from entering the system as if it were ordinary.

FAQ

What is the main difference between stop-work authority and a control hold point?

Stop-work authority interrupts a task because the field condition is already unsafe. A control hold point pauses the job at a planned boundary until a defined condition is verified.

When should an exception register be used?

Use an exception register when the deviation is temporary, visible, owned, and reviewed on a defined date. It is useful when the work cannot wait, but the risk still needs disciplined tracking.

Can one job use all three gates?

Yes. A job can stop for live danger, then restart only after a hold point is released, and still carry an exception if a temporary deviation remains open. The important part is that each gate has a clear purpose.

What is the biggest mistake leaders make with these gates?

The biggest mistake is forcing every problem into the same gate. That creates either false urgency or tolerated drift, both of which weaken trust in the control system.

How should supervisors explain the choice to crews?

Supervisors should say why the job stopped, what proof is needed next, and whether the issue belongs to a hold point or an exception register. Clarity matters because confused crews usually improvise.

Conclusion

Stop-work authority, control hold points, and exception registers are not competing slogans. They are three different answers to three different control problems. Use stop-work authority for live danger, a control hold point for a planned proof step, and an exception register for a temporary deviation that must stay visible until it is closed.

The practical test is simple. If the field condition is already unsafe, stop the work. If the next step needs proof, hold the step. If the deviation must remain open for a period, record and review the exception. When leaders keep those purposes separate, they protect both speed and control.

For the next move, read How to Build a Critical Control Verification Calendar in 30 Days and use it to make the gate decisions visible on a regular cadence. Then keep following Headline Podcast for more field decisions that turn risk into control.