What-If Analysis: 7 Questions Leaders Should Ask

OSHA process-safety guidance recognizes What-If as a process hazard analysis method, yet many organizations still treat it as a casual meeting question. This guide shows how to use What-If analysis to test non-routine work before assumptions become exposure. When the scenario leads toward startup, the same questions should feed the pre-startup safety review rather than stay inside the workshop notes.

Why What-If analysis fails when leaders make it informal

What-If analysis is a structured way to ask what could go wrong, how severe the consequence could be, and which control would stop the scenario. The American Chemical Society hazard assessment guidance describes the method as structured brainstorming that identifies credible failures before judging likelihood and consequence.

The weak version starts with a broad question and ends with silence. A supervisor asks, anything else?, the crew waits, and the plan moves forward because nobody wants to slow the job. What most risk reviews miss is that silence can mean alignment, but it can also mean hierarchy, fatigue, contractor hesitation, or fear of sounding negative.

On the Headline Podcast, Andreza Araujo and Dr. Megan Tranter often return to visible felt leadership because risk information moves through trust before it reaches a form. A useful What-If review therefore depends less on the elegance of the template and more on whether the leader can hear an inconvenient scenario without defending the plan too early.

1. What if the job changes after the permit is signed?

A What-If review should begin with scope drift because non-routine work rarely stays exactly as written. A permit-to-work may define the first task, although the field often adds a second valve, a blocked access point, a missing tool, or a contractor dependency that was not visible during planning.

For ground disturbance, that question belongs inside the excavation permit before the first cut, because drawings, weather, access, and contractor interfaces can all change the risk picture.

This is where risk matrix blind spots become dangerous. The original matrix may have ranked the task correctly, but it cannot protect a condition that was never named. The leadership question is not whether the matrix was completed. It is whether the team has permission to stop when the task no longer matches the assessment.

Ask the crew to identify the exact condition that would invalidate the permit. In a construction shutdown, that might be scaffold relocation, a change in lifting radius, a new energy source, simultaneous work above the crew, or weather that changes access. The answer should produce a restart trigger, not a vague reminder to stay aware.

For road work, service routes, and business driving, the same What-If logic applies to fleet safety leadership failures. A route plan should name the condition that stops or reroutes the trip before the driver is alone with the pressure.

1 restart trigger per non-routine job is a practical minimum for supervisors because it gives the crew a shared line between acceptable variation and a new risk decision.

2. What if the first control fails quietly?

What-If analysis should test quiet control failure, not only dramatic failure. Many serious exposures begin when a control appears present on paper but is not actually functioning in the field, which is why OSHA hazard-identification guidance emphasizes reviewing controls in the context of the workplace.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is visible in repeated operational decisions under pressure. The repeated decision that matters here is whether the leader verifies the control or accepts the label. A lock, barricade, spotter, gas test, rescue plan, or exclusion zone can exist administratively while still failing operationally.

Ask what would show that the first control is not working. If the answer is unclear, the team does not have a control yet. For work at height, the question may focus on anchor suitability. For line breaking, it may focus on residual pressure. For lifting, it may focus on ground bearing, communication, and exclusion integrity.

3. What if the most experienced person is wrong?

A What-If review should challenge expertise respectfully because experience can reduce risk perception when the job feels familiar. Daniel Kahneman's work on cognitive bias helps explain why confident judgment can narrow attention, especially when time pressure makes a familiar answer feel efficient.

The trap is treating the senior technician as the control. Experienced people are vital, but their memory cannot replace verification. If the strongest argument for the plan is that a respected person has done it before, the review has drifted from risk assessment into reputation assessment.

Ask the most experienced person to name the scenario that would surprise the crew. Then ask a newer worker or contractor to name what looks unclear. The difference between those two answers is often where the risk review becomes useful, because it combines memory with fresh perception.

4. What if the interface belongs to nobody?

What-If analysis should expose interface ownership because many field failures sit between teams. A contractor controls access, maintenance controls isolation, operations controls timing, and EHS controls the permit standard, yet nobody owns the moment where those controls must work together.

This is the same weakness described in contractor interface risk. The risk is not only inside one contractor's task. It sits in the gap between organizations, especially when the work involves lifting, electrical isolation, confined space entry, line breaking, or traffic management.

Ask who owns the interface and what that person must verify before work starts. The answer should name a role, a field check, and a communication rule. If the answer is a department name or a group email, the interface still belongs to nobody.

Each week without interface ownership increases the chance that crews normalize workaround coordination, while leaders continue to believe the formal contractor-management system is controlling the job.

5. What if the scenario needs a stronger method?

What-If analysis is useful for fast scenario discovery, but it should trigger deeper methods when the consequence is severe or the uncertainty is technical. IEC 31010 includes structured What-If among risk assessment techniques, while methods such as HAZOP, FMEA, Bow-Tie, and LOPA serve different decision needs.

The leadership error is forcing every risk question into the easiest method. A What-If session can reveal a credible loss-of-containment scenario, but the team may still need HAZOP, Bow-Tie, or LOPA selection tests to decide whether safeguards are adequate. Speed is useful only when it does not hide technical depth.

Use a simple escalation rule. If the What-If answer involves multiple barriers, high-energy release, fatal consequence, process deviation, or uncertainty about safeguard independence, stop treating the review as complete. Move the scenario into the method that can defend the decision.

6. What if the emergency response assumption is false?

A What-If review should test emergency response because a weak rescue assumption can turn a controllable event into a fatal one. Plans often assume rapid communication, clear access, trained responders, available equipment, and a medical route that works under real field conditions.

Across more than 250 cultural transformation projects, Andreza Araujo observes that organizations frequently overestimate response readiness because drills are cleaner than emergencies. The question is not whether the emergency plan exists. The question is whether the response would work when the injured person is elevated, trapped, contaminated, isolated, or unreachable by the planned route.

Ask the team to rehearse the first ten minutes verbally. Who calls, who stops adjacent work, who retrieves equipment, who reaches the worker, who communicates with external responders, and what blocks the route? 10 minutes of verbal rehearsal often reveals more than a signed rescue-plan attachment.

7. What if nobody owns the action after the meeting?

A What-If analysis only protects people when each credible scenario creates an action, an owner, and a verification point. Without that discipline, the method becomes a conversation artifact that gives leaders confidence without changing the field.

This is where Bow-Tie barrier questions help even when the team does not build a full Bow-Tie. For each scenario, ask which preventive barrier stops the event, which mitigative barrier reduces harm, who verifies each barrier, and what evidence proves the verification happened before exposure.

Close the session with a decision log. The log should include the scenario, required control, owner, due time, field verification, and stop-work trigger. If the team cannot name those six items, the scenario is still open, no matter how complete the worksheet looks.

Conclusion

What-If analysis works when leaders use it to challenge the plan before work starts, especially where scope drift, quiet control failure, expertise bias, contractor interfaces, technical uncertainty, emergency assumptions, and weak ownership can hide inside a clean permit.

The strongest What-If question is not the most creative one. It is the question that changes a control before exposure begins. Share this guide with the leader responsible for your next non-routine job, and bring the conversation to Headline Podcast at headlinepodcast.us.