A renaissance in safety and health thinking is taking place as rates for fatal and serious injuries and illnesses continue unabated. This movement is re-examining of some of the concepts that underpin the safety and health profession. How senior leaders set the tone and expectations for their organizations is seen as critical. And the valuable input of front-line operators who best understand the work processes is also critical.

Most importantly, there is an increased understanding that risk is heavily influenced by human and organizational factors. These factors determine how employees address hazards and influence an organization’s capacity to address hazards. 

Key issues to be resolved

Important issues need to be addressed to develop new approaches to prevent fatalities and serious injuries:

• How can we better identify situations that have a greater likelihood to result in a fatality and/or serious injury or illness?
• How can we better set priorities for addressing those situations?
• How can we develop improved hazard mitigation strategies that help determine the appropriate levels of control, the appropriate number of layers of control, and most importantly, when protection is sufficient?
• How can we identify and address company/site/process human and organizational performance (HOP) characteristics that can contribute to fatalities and serious injuries?

Let’s define at this point fatalities and serious incidents, or FSIs. A serious injury or illness is any life-threatening injury or illness that, if not immediately addressed, is likely to lead to the death. It will usually require internal and/or external emergency response personnel to provide life-sustaining support.

Serious injuries or illnesses also may be life-altering. Iimpairment or loss of use of an internal organ, body function, or body part is the result.  Examples include, but are not limited to, significant head injuries, paralysis, amputations, and broken or fractured bones.

FSIs continue to occur for a number of reasons. One significant cause is a lack of respect for the hazard. This is manifested in several ways. Workplace hazards frequently are not recognized, or the risks they pose are not fully appreciated due to flawed risk assessment techniques. Sometimes employees exposed to a hazard become complacent in living with it, resulting in “normalization of deviation.”

Another reason is employers’ reliance on workers to be the last line of defense in dealing with serious hazards. Low-level controls are used in critical steps and workers are never expected to make a mistake.

Perhaps the greatest reason that FSIs continue is the failure to recognize and address related human and organizational performance (HOP) factors. These factors provoke errors and/or undermine defenses.

Myths must go

Solutions to these challenges exist. First, we must reassess several pillars of the S&H profession that may be myths when it comes to preventing serious incidents. These long-standing assumptions include:

• The mistaken interpretation of the Heinrich Pyramid (otherwise known as the “Safety Pyramid”) holding that managing less serious hazards at the bottom will effectively address higher-consequence hazards at the top; 
• Collective misuse of OSHA data as the primary metric for driving and assessing safety performance;
• Over-emphasis on history-based probability estimates when determining “likelihood” in conducting risk assessments;
• The mistaken belief that higher level controls do not provide the best business value; and
• The incorrect assumption that most injuries are caused by unsafe acts, which has been fueled and reinforced by flawed incident investigations.

Causes of FSIs

It is important to realize that the causes of FSIs often differ from those causing less serious injuries. As author Dan Petersen observed in 1989, “Different sets of circumstances surround their severity.”

Dan found that, unlike less serious incidents, FSIs tend to occur:

• In unusual and non-routine work;
• Where upsets occur;
• In non-production activities;
• Where sources of high energy are present; and
• During at-plant construction operations.

Also, reducing injury frequency does not necessarily produce equivalent severity reduction. As Fred Manuele notes in “On the Practice of Safety”, “The data require that we adopt a different mindset, and a particularly different focus on preventing events that have serious injury potential.”

This theory is bolstered by a 2007 Rand study that found no apparent relationship between OSHA reported injury rates and workplace fatalities. The absence of minor injuries is not predictive of the absence of future fatalities, and the presence of minor injuries is not predictive of the occurrence of fatalities in the future.

Current measurement systems create a “blind spot” for serious injury prevention. The traditional safety triangle is not predictive of FSIs, as author Tom Krause states. A study group led by Tom found that workplace situations with high proportions of FSI precursors are those with process instability, significant process upsets, unexpected maintenance, unexpected changes, high potential energy jobs, and emergency shutdown procedures.

Similarly, work activities that may have a high proportion of FSI precursors include operation of mobile equipment (and interaction with pedestrians); confined space entry; jobs that require lockout/tagout; lifting operations; working at height; and manual handling.

In working with member companies ORCHSE has found that these factors vary among different operations.  For example, one of our members in the electric power business found that during emergency situations its workers maintained a high state of vigilance and were less prone to serious incidents. They experienced serious incidents in routine maintenance and service operations where workers let their guard down and failed to wear necessary protective equipment.

At ORCHSE we define an FSI precursor differently than others: it is a situation involving a combination of hazard(s) and underlying human and organizational factors that, left unaddressed, could result in a fatal or serious injury.

This is an important difference because context is critically important to identify causation. The relationship between human and organizational factors and risk is presented below.

Human error causes & consequences

Research conducted on human error, its causes, and consequences helps to elucidate this risk relationship. Human error is a symptom of trouble deeper inside a system, according to author Sydney Dekker. To explain failure, we must understand how workers’ assessments and actions made sense at the time given the circumstances that surrounded them.

Workers themselves do not usually cause serious incidents. They can trigger latent conditions existing in systems, processes, procedures, and expectations on the job site, as Todd Conklin explains in “Pre-Accident Investigations”. Serious injuries often have multiple causal factors such as inadequate tools, equipment, and processes, James Reason notes in “Managing the Risks of Human Error”. These elements may be present for many years before combining with local circumstances and active failures to penetrate the system’s layers of defenses. As Conklin says, an accident can be defined as an unexpected combination of normal variability.

Human error is not a cause, but rather a symptom of a system that needs to be redesigned, offers Nancy Leveson in “Engineering a Safer World”. All behavior is affected by context, or the system in which it occurs. Tackling operator error requires examining the system in which people work, particularly the design of equipment, usefulness of procedures, and existence of goal conflicts and production pressures.

Don’t punish the operator who made a mistake, explore why the system allowed – or failed to accommodate – a mistake and work to improve the system, contends Chris Hart, chairman of the National Transportation Safety Board.

The truth: People are fallible

The principles of Human and Organizational Performance (HOP) focus on the truth that even the best people make mistakes. Still, situations in which errors are likely to be made are predictable, manageable, and preventable. Why? Individual behavior is influenced by organizational processes and values. Management’s response to failure matters.

Both HOP principles and characteristics of High Reliability Organizations (HRO) have a profound impact on overall risk and serve as two sides of the same coin to prevent fatalities and serious injuries. HOP issues focus on the context in which employees must address the hazards associated with their operation; HRO issues focus on organizational capacity to effectively deal with those hazards. Each approach is critical to prevention.

The five characteristics of HROs, as discussed by Weick and Sutcliffe in “Managing the Unexpected”, include:

• Preoccupation with failure: Error reporting is encouraged and lapses are treated as a symptom that something may be wrong with the system.
• Reluctance to simplify: Organizations know that the world they face is complex, unstable, and unpredictable.
• Sensitivity to operations: Organizations are attentive to the front line where the real work gets done.
• Commitment to resilience: Organizations detect and contain problems, and bounce back.
• Deference to expertise: People with the most expertise are valued regardless of rank. 

To achieve high reliability performance:

• identify and assess risks;
• identify and understand points of human interaction with hazards in the process;
• provide high levels (or multiple layers) of control at critical steps;
• do not expect people never to make a mistake or rely on them to single-handedly control the risk;
• continuously improve by learning from data such as precursor events, near misses, etc.;
• understand human performance issues and organizational characteristics that can provoke errors and/or undermine controls.

ORCHSE‘s new risk-based approach

ORCHSE proposes a six-step solution to achieve a fatality and serious incident-free workplace. It is a new risk model that creates a separate track for addressing serious hazards.

As the table below indicates, the solution relies on the same risk management steps, but employs a different approach to potential FSI exposures -- a dual-path strategy for prevention. Processes are evaluated to identify precursors to FSIs. Once precursors are identified, different approaches are used for risk assessment and risk management

This model emphasizes the need for a heightened sense of awareness and vulnerability in precursor situations:

1. Safety professionals assess the current situation and set the stage for the technical and cultural shift required to address FSI risk potential. Pros engage leaders to proactively shift focus from “outcomes” (often limited to tracking OSHA data) to the risks that drive them. Have leaders define an acceptable level of risk for the organization. This creates an important benchmark to identify and address serious hazards incompatible with acceptable risk. It also sends an important message to the workforce – leadership genuinely cares about their health and well-being.
   New levels of competence frequently must be established throughout the organization. Potential barriers to implementation, such as management system gaps, ineffective metrics, and certain aspects of the organizational culture relating to risk tolerance also must be identified and addressed.
2. Conduct an initial threat assessment to identify the most serious situations that are precursors to FSIs. These hazards must then be inventoried, assessed, and managed. Related human and organizational factors that could activate or intensify the hazard or undermine controls also must be identified and managed. The inventory should be constructed on a task basis, populated by “critical tasks” – those that “keep you up at night.” Assessing tasks is critical. A certain number of FSIs are “one-offs,” not reflected in existing data.
3. Conduct a risk assessment and refine priorities for intervention. Take the “guesswork” out of risk assessment when the consequences of a bad guess may result in tragedy. Identified precursors should be evaluated based on the potential severity of the hazard (severity), the degree of control (likelihood), and the number of workers exposed (magnitude). Related human and organizational factors that potentially activate or intensify the hazard or undermine controls should also be integrated into the risk assessment. The resulting Final Risk Assessment can be used to set priorities for FSI intervention and drive continuous improvement on two levels – hazard mitigation and underlying human and organizational factors.
4. Ensure adequate hazard control. Critical steps in the process – tasks where an incident could result in an employee being killed or seriously impacted – must be identified via task-based inventory. Be proactive to ensure operational consistency in these steps. Promote the use of checklists for key aspects, and anticipate mistakes. No matter how hard we try, mistakes happen – it is part of the human condition. It’s risky to expose workers to serious hazards, provide lower level controls, and expect workers never to make a mistake. Critical steps should be “mistake-proofed” whenever possible. 
5. Integrate human and organizational performance issues into the risk identification and abatement process. Cultural and organizational norms, management policies and practices, process conditions, and human factors impact S&H performance – and the FSI rate. Flawed incident investigations and a culture that assigns blame and concentrates on the last factor in a chain of events leading up to the incident ignore these issues. It’s critical to incorporate human and organizational performance (HOP) issues into precursor recognition and assessment strategies.
6. Drive continuous improvement with Infrastructure, including management systems and metrics. Cultural and organizational improvements are key to sustaining FSI prevention efforts over the long term. To sustain and drive continuous improvement, changes must be made in ongoing management system requirements, particularly regarding learning. Changes also must be made in the metrics used to measure prevention efforts and evaluate performance. Leading indicators can be developed to drive and assess key organizational and system improvements. And a relatively new trailing metric (largely developed by ORCHSE and adopted as a new Global Standard by ASTM) can be used to track outcomes for the more serious incidents.

Severity/Control Risk Matrix

ORCHSE integrates the degree of control and human and organizational performance factors into its risk assessment approach by developing a Severity/Control Risk Matrix. The following case study example illustrates its application.

Two workers on a scissors lift perform a “non-live” installation of wiring for fans that will later be connected, energized, and inspected by a licensed electrician. As they run conduit across the ceiling, they approach a partially exposed 480-volt electrical bus bar in a bus enclosure missing an end cap. One worker attempts to use a voltmeter to test the current; the voltmeter crosses two phases of the bus bar and explodes, setting fire to his clothing and causing burns to over 35 percent of his body. His co-worker manages to lower the lift, but his clothes catch fire too; both men pass out. The worker holding the voltmeter dies 14 days later.

The plant where the incident occurred was purchased by the company 18 months prior to the incident.  It employs 170 permanent employees and 200-300 temporary employees, most from the Dominican Republic, who work during a four-month busy season. Little formal training is provided and no safety training other than what employees learn on the job. The victim was a 19-year-old Hispanic male, originally hired as a laborer-helper, who was being trained to work as a mechanic’s assistant. The employee had no training on electrical safety, and was not trained to test circuits.

As Step One to perform an initial risk assessment based on severity of hazards and controls in place, ORCHSE applies its matrix to the case study with the following results:

As Step Two, ORCHSE considers HOP issues – characteristics of underlying systems and processes – that could provoke errors or undermine controls. This includes cultural and organizational attitudes and values, management systems, process conditions, and human factors.

• Value for safety not demonstrated by senior management;
• Employees do not receive support for safety decisions;
• High risk tolerance;
• Inadequate financial resources for safety;
• Low employee engagement;
• Production has higher priority than safety;
• Supervisors do not receive support for safety decisions; and
• Personnel resources are not adequate for safety.

Management systems issues include:

• Checklists not in use;
• Cross-monitoring not in use;
• Goals and objectives for safety performance had not been established;
• Infrequent inspections;
• Low management accountability;
• Poor communication;
• Poor risk recognition training;
• Potential for miscommunication;
• Pre-task briefing not in use;
• Pre-task planning/risk assessment not in use; and
• Procedures/work instructions not adequate.

Process condition issues can include:

• No emergency shutdown procedure;
• Inadequate design;
• Inadequate maintenance;
• Inadequate warning mechanisms; and
• Inadequate work/task resources.

Finally, examples of human factors issues involving fitness for the job and task can include:

• Lack of skills or education for the task;
• Distraction; and possibly
• Time pressure.

Consider the case study --it’s clear how differing approaches to risk identification and assessment can lead to radically different results. An experience-based approach will not pick up on the risk involved in the case study because there is no prior history of a similar experience. A hazard-based approach, on the other hand, will give this situation significant risk priority because the workers were operating at a high elevation while exposed to high energy with low-level controls. But only the hazard-based approach combined with a focus on human factors and organizational deficiencies yields higher priority attention to the task because the workers exposed to the hazards were impacted by organizational factors that made matters worse… much worse.

Applying this HOP approach to the earlier case study would have resulted in a different risk assessment as follows:

Building a more reliable risk assessment process

To prevent fatalities and serious injuries, remember these key points:

• Simply managing routine safety and OSHA recordables can leave a company vulnerable to fatalities and serious injuries.
• Effectively managing the most serious hazards requires rethinking fundamental S&H concepts that may be barriers to serious injury prevention. This can include how we do risk assessments.
• Take steps to identify FSI precursor situations – potentially serious hazards imbedded in tasks and processes and associated human and/or organizational factors that could undermine controls.
• Mistake-proof the critical steps in a process; don’t rely on the worker never to make a mistake.
• Recognize that people, programs, processes, the work environment, organization, and equipment are all part of a system. Flaws in the system impact the performance of  individuals and flaws in individuals impact the system.
• Integrate HOP factors into the risk assessment process.

Best practices

Forward-looking companies ORCHSE has worked with have implemented some of these practices. International Paper’s “It’s About LIFE,” or Life-changing Injury and Fatality Elimination, program has helped the company identify and focus on critical tasks. A LIFE incident analysis conducted over three years identified five focus areas responsible for the majority of FSIs: machine safeguarding (30 percent), falls (27 percent), motorized equipment (17 percent), harmful substances or environments (6 percent), and driver safety (2 percent).

The remaining incidents, classified as “other,” consisted primarily of acute trauma linked to materials handling (18 percent). Relying on project teams, International Paper has a data-driven LIFE strategy that focuses on: communicating effectively, engaging stakeholders, making safety a core value, learning from past mistakes, benchmarking best practices, improving training and education, changing the way it measures safety performance, and taking a global approach.

ALCOA has implemented a pre-job brief and work assessment so work teams can identify the high-risk task of the day. A high-risk task is defined as one in which an identifiable function of a job or activity has one or more critical steps, which if omitted or performed incorrectly, create the potential for single-point vulnerability that can lead to fatal or life-altering consequences. A pre-task discussion focuses on ensuring each person involved in the task, regardless of his or her experience, is aware of the critical steps and what could go wrong, the potential hazards and error-likely situations along with the procedures that apply and the layers of protection available to them. Most importantly, the discussion provides a means to agree on clear “Stop Work” criteria.

3M identifies high-hazard activities at a facility, conducts observations and interviews, identifies critical high-hazard tasks, and evaluates the risk of the task as performed. If the task is determined not to be high-risk, the company simply monitors critical controls. If it is determined to be high-risk (with potential consequences that are life-threatening or life-altering), 3M explores gaps in the layers of protection (LOP), chooses the best LOP intervention option, takes action to reduce risk, and then monitors critical controls.

3M has a core list of higher hazard activities that includes: working around mechanical hazards where guarding is critical; handling toxic, reactive, corrosive, or flammable materials; mobile equipment or vehicle operations; loading and unloading bulk materials (high volume liquids or solids); working on energized systems or under lockout or tag-out procedures; confined space entry or trench/pit excavation; pipe or line opening operations; working at heights; mechanical lifting operations; and use of open flame. It also identifies “red flag” situations that occur in unusual and non-routine work, in non-production activities, where upsets occur, during on-site construction activities, and where sources of high energy are present. A risk assessment and prioritization tool measures the degree of control, frequency of exposure, and consequence severity to determine a risk level score for an activity.

Conclusion

Preventing FSIs requires adopting a new set of assumptions about risk, incident causation, complexity, and the role of human and organizational factors in creating FSI circumstances. Current preventive approaches are not sufficiently protective. ORCHSE’s six-step process for prevention provides guidance to prepare an organization to transition to a risk-based perspective; identify, assess, and control risk; integrate human and organizational performance principles into risk assessment and abatement; and drive continuous improvement. Safety and health professionals will make significant progress toward FSI prevention and save lives by adopting these practices.