Worker clipping a fall-arrest lanyard to a safety line

NEWERA / IN PRACTICEFIRST EDITION / 2026

A NewEra publication

Critical Risk
Management
in Practice.

What it takes to make critical controls work where serious harm can occur.

Read Share on LinkedIn

Jamie MallinderNewEra Health Safety Human Performance

01 / Activity is not protection0%

NewEra / In Practice

Serious harm can be absent while the conditions for serious harm remain.

That is the problem Critical Risk Management is trying to solve.

A note from NewEra

Most organisations managing serious risks are not short of safety activity.

They have risk assessments, procedures, permits, training, inspections, audits, verification activities and layers of assurance.

The harder question is whether those activities tell us enough about the protection people actually rely on when serious harm is possible.

A control can exist in a standard and still be unavailable in the work.

A verification can be completed and still tell us very little about whether the control is effective.

A dashboard can be green while important protection is degrading.

And an organisation can go a long time without a serious event while weaknesses remain hidden.

Critical Risk Management exists to make those weaknesses easier to see and act on before consequence becomes the evidence.

That requires more than identifying critical risks and assigning controls to them.

It requires a clear understanding of how serious harm can occur, why particular controls matter, what those controls need to achieve, what evidence would demonstrate that they are effective, and what happens when protection is weak.

It also requires us to understand the work itself.

Controls operate in changing conditions. People encounter competing demands, interruptions, equipment constraints, contractor interfaces and situations that were not fully anticipated when the system was designed.

Good Critical Risk Management connects organisational intent with that operational reality.

This publication brings those ideas together.

It is not another safety system to sit beside the systems you already have.

It is a practical way to understand where serious harm can occur, what you are relying on to prevent it, and whether that protection is working where it matters.

Jamie Mallinder Founder, NewEra

How to use this publication

Read it

As one connected approach to Critical Risk Management.

The sections build from understanding serious-harm exposure and pathways through control selection, performance, verification, response, learning and assurance.

Use it

Use the models, questions and examples to challenge how Critical Risk Management works in your organisation.

Not simply how it is documented.

Share it

Each section and figure has been designed to stand on its own.

Share the part that helps the conversation you need to have.

The publication

Contents16 sections / 4 parts

NewEra / In Practice01

Part 01

Focus on serious harm

Critical Risk Management starts by narrowing attention.

Not everything that can cause harm is a critical risk.

Not everything that supports safe work is a critical control.

The discipline begins by understanding the events and exposures capable of causing serious harm and identifying the protection that matters most when those pathways exist.

Sections 01–04

Part 01 / Focus on serious harm01

ACTIVITY IS NOT PROTECTION.

Completion tells us what happened. It does not necessarily tell us what protection existed.

Serious harm rarely begins with an organisation doing nothing about safety.

More often, there is considerable activity.

Procedures are current.
Training is complete.
Risk assessments have been undertaken.
Inspections are happening.
Observations are recorded.
Actions are being closed.
Audits have been completed.
Verification activities are on schedule.

None of these things is inherently unimportant.

The problem is that they answer a different question.

They tell us something about what the organisation has done.

They do not necessarily tell us whether the controls people rely on to prevent serious harm are effective.

That distinction becomes especially important when serious events are rare.

An organisation can operate for a long time without a fatality or life-changing injury while important weaknesses remain present.

The absence of consequence cannot therefore be treated as evidence that protection is strong.

Critical Risk Management creates another line of sight.

Instead of asking only:

What safety activity have we completed?

It asks:

Where are people exposed to serious harm?
What controls are we relying on?
When are those controls demanded?
What state are they in?
What happens when protection weakens?

The objective is not to replace existing safety activity.

It is to understand what that activity tells us about protection.

FIGURE 1.1TWO VIEWS OF THE SAME DAY

WHAT THE ORGANISATION SEES
Injury rate ↓Training 100%Inspections 96%Actions closed 92%Serious injuries 0
WHAT THE WORK CONTAINED
Serious-harm exposuresCritical-control demandsDegraded controlsLocal adaptationsSerious injuries 0
SAME DAY. DIFFERENT INFORMATION.
The first view tells us about outcomes and activity.The second begins to tell us about the conditions in which serious harm could occur and the protection people were relying on.We need both.But they are not interchangeable.

The absence of harm is not evidence of protection.

A serious event is an outcome.

Protection exists before the outcome.

That creates an important challenge.

If we wait for harm to tell us whether our controls were effective, we learn too late.

A critical control may be degraded repeatedly without producing an injury.

A person may encounter an uncontrolled exposure without consequence.

A weak barrier may survive multiple demands.

A local workaround may keep work moving while reducing the reliability of protection.

Nothing happens.

The dashboard remains green.

Until the conditions align differently.

Critical Risk Management is therefore interested in something that traditional outcome measures cannot show on their own:

the condition of protection before consequence.

FIGURE 1.2WHAT GREEN CAN HIDE

96%
EFFECTIVE
Look closer at the remaining 4%.
Frequent exposureCatastrophic pathwayWeak independenceRepeated degradationControl demanded often
THE PERCENTAGE IS NOT ENOUGH.

Context changes what the result means.

Four per cent of weak controls distributed randomly across low-exposure work is one thing.

Four per cent concentrated around a frequently demanded control on a catastrophic pathway is something very different.

Aggregate performance can hide where attention is needed most.

Look closer

A high percentage of effective verifications does not automatically mean strong protection.

Ask where the weakness sits.

Ask how often people are exposed.

Ask what happens if the control fails.

Ask what other independent protection remains.

FIGURE 1.3SAME HOURS. DIFFERENT EXPOSURE.

SITE A
1,000,000 HOURSRelatively few high-energy interactions.
SITE B
1,000,000 HOURSFrequent mobile-equipment interactionsHigh-voltage isolationsCritical liftsWork at heightPressure containment work

Same hours. different exposure.

Hours describe time at work.

They do not describe what the work demanded.

This is why serious-harm prevention needs information about exposure as well as time.

In practice

Mobile equipment

A site reports:

98% critical-control verification completion.

Performance appears strong.

But closer examination shows that the remaining weakness is concentrated around one loading area.

Vehicle and pedestrian interaction is frequent.

The same separation weakness has been identified several times.

Temporary controls are repeatedly being used.

The underlying traffic interface has not materially changed.

The management question could be:

Why are we not achieving 100% verification completion?

But that is not the most important question.

A better question is:

WHY DOES THE SAME SERIOUS-HARM EXPOSURE CONTINUE TO DEPEND ON DEGRADED PROTECTION?

That changes the conversation.

From activity to exposure.

From completion to control condition.

From percentage to protection.

Critical Risk Management in Practice / 01

Part 01 / Focus on serious harm02

START WITH THE SERIOUS-HARM PATHWAY.

Categories organise risk. Pathways explain how serious harm can occur.

Organisations often begin Critical Risk Management with categories.

Working at height.
Mobile equipment.
Electrical energy.
Lifting.
Confined space.
Pressure.
Fire and explosion.

These categories are useful.

They organise information.

They help identify areas of material risk.

But a category does not tell us exactly how serious harm can occur.

Consider working at height.

A person could reach an unprotected edge and fall.

A fragile surface could fail beneath them.

Access equipment could lose stability.

A person could fall and depend on a fall-arrest system.

An object could be released from height and strike somebody below.

One category.

Several pathways.

Different protection.

If we stay at the category level, control selection becomes generic.

Harnesses.
Training.
Procedures.
Permits.
Barricades.
Supervision.
Inspections.

Some may be relevant.

Some may not.

The better question is:

How can serious harm actually occur?

That is the pathway we need to control.

FIGURE 2.1ONE RISK LABEL. DIFFERENT PATHWAYS.

WORKING AT HEIGHT

Person reaches unprotected edge→ fall
Fragile surface fails→ fall through
Access equipment loses stability→ fall
Person falls→ fall-arrest system is demanded
Object is released from height→ person below is struck

SAME CATEGORY.DIFFERENT PATHWAYS.DIFFERENT PROTECTION.

From hazard to consequence

A useful pathway starts with the source of harmful energy or hazardous condition.

It then considers the event or exposure that creates the potential for serious harm.

From there, we can understand how the pathway develops and where controls need to interrupt it.

The purpose is not to create a complicated bowtie for every activity.

It is to make the logic of protection visible.

FIGURE 2.2FROM ENERGY TO CONSEQUENCE

ENERGY / HAZARD
INITIATING EVENT / EXPOSURE
SERIOUS-HARM PATHWAY
CONSEQUENCE
Controls act on the pathway.
They prevent it developing.Detect changing conditions.Warn people.Limit escalation.Support recovery.Reduce consequence.

A control becomes easier to understand when we can say exactly where it acts and what it does.

Where does the barrier act?

Different controls perform different functions.

Understanding that function helps us see whether the pathway is genuinely protected.

FIGURE 2.3BARRIER FUNCTIONS

PREVENT
Stop the pathway developing.
SEPARATION
Keep people, energy or hazards apart.
CONTAINMENT
Keep hazardous material or energy within a defined boundary.
INTEGRITY
Maintain the physical or structural condition required to prevent loss of control.
CONTROL & ISOLATION
Control, remove or isolate hazardous energy or conditions.
DETECT & WARN
Identify a dangerous condition or change early enough for action.
RESPOND
Limit escalation or support recovery after the pathway has developed.
ESCALATION CONTROL
Prevent conditions becoming more severe.
RECOVERY & SURVIVAL
Reduce consequence and support survival or recovery.

In practice

High-voltage electrical work

The broad category is:

Electrical risk.

But that is not enough to decide what protection matters.

One pathway might involve:

energised equipment
person enters the electrical hazard zone
contact or arc event
fatal or life-changing injury.

Another may involve:

incorrect isolation
stored or introduced energy remains
work begins under an assumption of de-energisation
exposure to electrical energy.

The pathways are different.

The controls may therefore be different.

A generic list headed Electrical Controls can hide that distinction.

A pathway makes it visible.

Decision

Before asking whether the controls are effective, ask whether the serious-harm pathway is defined clearly enough to know what needs controlling.

Critical Risk Management in Practice / 02

Part 01 / Focus on serious harm03

NOT EVERY CONTROL IS CRITICAL.

Criticality is not a synonym for importance.

Critical Risk Management loses focus when every useful safety measure becomes a critical control.

Training may matter.

Planning may matter.

Supervision may matter.

Procedures may matter.

Inspections may matter.

Competency may matter.

But importance alone does not make something a critical control.

The first question is more fundamental:

Is it actually a control?

A control acts directly on the serious-harm pathway.

It changes what can happen.

Only after that has been established should we ask whether the control is critical.

FIGURE 3.1STAGE A — IS IT A CONTROL?

A1
DOES IT ACT DIRECTLY ON THE PATHWAY?Does it prevent, detect, warn, respond to or mitigate the defined serious-harm pathway?
A2
CAN ITS INTENDED FUNCTION BE CLEARLY DESCRIBED?Can we explain what the control actually does?
A3
DOES IT CHANGE THE PATHWAY?If it works as intended, does it materially change the development or consequence of the event or exposure?
A4
CAN ITS PERFORMANCE BE DETERMINED?Can we establish whether the control is capable of performing its intended function?
STAGE B — IS IT CRITICAL?
B1
DOES FAILURE MATTER?Would failure materially increase serious-harm potential?
B2
IS IT IMPORTANT TO INTERRUPT THE PATHWAY?Does the pathway depend significantly on this control performing?
B3
WHAT OTHER INDEPENDENT PROTECTION REMAINS?If this control fails, what genuinely independent protection is still available?
B4
DOES IT WARRANT CRITICAL-CONTROL MANAGEMENT?Does its importance justify defined performance requirements, verification, response and assurance?
PROVE THE CONTROL.
THEN PROVE THE CRITICALITY.

Control. enabler. activity.

These ideas are often confused.

Control

Directly changes the serious-harm pathway.

Enabler

Creates or maintains conditions that support control performance.

Activity

Something the organisation does to manage work or risk.

All three can matter.

They simply play different roles.

The purpose of classification is not to downgrade anything.

It is to understand what we are relying on.

Common trap

A long critical-control list can create the appearance of stronger protection.

In practice, it can make the genuinely critical controls harder to see.

In practice

A team reviewing a lifting risk identifies twelve “critical controls.”

They include:

Lift plan
Competent operator
Pre-start meeting
Exclusion zone
Rated lifting equipment
Equipment inspection
Supervision
Communication protocol
Ground assessment
Load control
Weather monitoring
Permit

All may contribute to safer lifting.

But the critical-control decision is not:

Which of these things are important?

Almost all of them may be.

The question is:

Which directly interrupt the defined serious-harm pathways, and which failures materially change the potential for serious harm?

The result may be a smaller number of critical controls supported by several important enablers and activities.

Nothing has been discarded.

The architecture has become clearer.

Critical Risk Management in Practice / 03

Part 01 / Focus on serious harm04

KNOW WHAT YOU ARE RELYING ON.

A control needs a function, not just a name.

Labels such as:

supervision
isolation
guarding
traffic management
procedure

can conceal considerable variation.

If we cannot clearly describe what a control does, it becomes difficult to define performance.

If performance is unclear, meaningful verification becomes difficult.

Two classifications help make the control more precise.

FIGURE 4.1CONTROL TYPE

HUMAN ACT
A person performs a defined protective action.The action itself provides the protection.
OBJECT
A physical or engineered object performs the protective function.
SYSTEM
An organisational or technical system delivers a defined protective function.

Control type tells us where the protective function resides.

Barrier function tells us what it does on the pathway.

Together they create a much clearer description of what the organisation is relying on.

In practice

Vehicle / pedestrian interaction

Compare these two descriptions.

Control

Traffic management

What exactly does that mean?

Now describe the control more precisely.

Control

Physical separation barrier between the pedestrian route and vehicle operating area

Type

Object

Barrier function

Separation

Pathway

Person enters vehicle operating area

↓

Vehicle/person interaction

↓

Person struck or crushed.

The second description is easier to:

design
understand
maintain
verify
assure
and improve.

Look closer

If the name of the control could describe an entire management program, it may not yet be defined precisely enough.

Critical Risk Management in Practice / 04

NewEra / In Practice02

Part 02

Prove the control

Identifying the control is only the beginning.

The organisation must be able to describe what effective performance looks like and obtain evidence that supports a meaningful decision about whether that performance exists.

Sections 05–08

Part 02 / Prove the control05

WHAT DOES EFFECTIVE MEAN?

Effective means capable of working and working where it matters.

A critical control can be well designed and still fail in the work.

It can also be present in the work but fundamentally incapable of providing the protection expected from it.

That creates two different questions.

Both matter.

FIGURE 5.1CAN IT WORK?

DESIGN EFFECTIVENESS

Is the control:

technically capable?

appropriately specified?

suitable for the pathway?

designed for foreseeable conditions?

supported by understood operating limits?

designed with relevant failure modes considered?

Design effectiveness asks whether the control is capable of performing the function expected from it.

DOES IT WORK HERE, NOW?

OPERATING EFFECTIVENESS

Is the control:

present when required?

available?

functional?

correctly implemented?

operating within required conditions?

reliable enough in the circumstances?

Operating effectiveness asks whether the intended protection actually exists where the work is occurring.

EFFECTIVE

A critical control is effective when it is:

CAPABLE of its intended function

AVAILABLE when required

CORRECTLY IMPLEMENTED in the work

RELIABLE enough to prevent or mitigate the defined serious-harm pathway.

CAN IT WORK?andDOES IT WORK HERE, NOW?

In practice

Electrical isolation

Imagine an isolation system that is technically excellent.

The equipment is designed correctly.

Isolation points are suitable.

Locking arrangements are robust.

The system has been engineered for the energy involved.

Its design effectiveness is strong.

But during the work:

the wrong isolation point is selected,
stored energy is not identified,
or the isolation is not correctly implemented.

The protection is ineffective.

Now reverse it.

The isolation is applied exactly as designed.

Everyone follows the process.

But the design itself does not isolate every energy source.

Perfect implementation cannot compensate for inadequate design.

Both dimensions matter.

Critical Risk Management in Practice / 05

Part 02 / Prove the control06

DEFINE PERFORMANCE BEFORE VERIFICATION.

If good is not defined, verification becomes opinion.

A control name does not tell us enough about successful performance.

Before designing verification, define what the control needs to achieve.

Then define what specifically needs to be true.

Only then should we decide what evidence is needed.

FIGURE 6.1FROM RISK TO DECISION

CRITICAL RISK
What serious-harm event or exposure are we managing?
CRITICAL CONTROL
What are we relying on?
PERFORMANCE STANDARD
What must the control achieve?
PERFORMANCE REQUIREMENT
What specifically must be true?
EVIDENCE
What would demonstrate that?
VERIFICATION
How will we obtain and assess the evidence?
DECISION
What does the evidence tell us about control effectiveness?

Performance standard

The performance standard describes what the control must achieve.

It defines the required protective function.

Performance requirement

The performance requirement makes that expectation specific enough to determine whether it is being achieved.

Evidence

Evidence is what would demonstrate whether the requirement is satisfied.

Verification

Verification is the method used to obtain and assess that evidence.

These concepts are connected.

They are not the same thing.

When they are collapsed together, verification becomes broad and subjective.

When they are separated, the logic becomes much clearer.

In practice

Pressure relief

Critical risk

Uncontrolled release of pressure with potential for fatal or life-changing injury.

Critical control

Pressure relief device.

Performance standard

Prevent pressure exceeding the defined safe operating limit.

Performance requirement

The device is correctly specified for the protected system and set to activate at the defined pressure.

Evidence

Approved specification.

Set-pressure record.

Inspection or test evidence.

Configuration matches the protected system.

Verification

Review specification and configuration, confirm test status and inspect the installed device.

Decision

Is the pressure relief function capable, available and correctly configured to provide the protection being relied upon?

That is much stronger than asking:

Is the pressure relief device compliant?

Critical Risk Management in Practice / 06

Part 02 / Prove the control07

DESIGN THE EVIDENCE FIRST.

Write the question second.

Verification is often designed backwards.

A team begins with:

What question should we ask?

The result is often a checklist filled with questions such as:

Is the control effective?
Is the procedure being followed?
Is the exclusion zone adequate?
Is the equipment compliant?

These questions are easy to put into a form.

They are harder to defend.

What does adequate mean?

What evidence supports yes?

Would two verifiers reach the same conclusion?

Does the answer tell us enough to make a decision about protection?

A stronger approach begins somewhere else.

What decision do we need to make?

Then:

What must be true?

Then:

What evidence would demonstrate it?

Then:

Where can that evidence be found?

Then:

How should we obtain it?

Only then:

What question or prompt will help the verifier obtain the evidence?

FIGURE 7.1QUESTION-FIRST

Question
Answer
Result
UNCERTAIN DECISION

EVIDENCE-FIRST

Decision
Requirement
Evidence
Source
Method
Question
MEANINGFUL DECISION

Evidence and verification are not the same thing.

Evidence is what tells us something about the control.

Verification is how we obtain and assess it.

That distinction changes the quality of verification design.

It moves attention away from writing better-sounding questions and towards defining what somebody would actually need to see, test, inspect, measure, review or discuss before reaching a conclusion.

Evidence can take different forms

Observe

See the control operating in the work.

Inspect

Examine physical condition, configuration or presence.

Test

Demonstrate that the control performs a required function.

Measure

Obtain quantitative evidence against a defined requirement.

Demonstrate

Have the required action or response shown in practice.

Review

Examine records, specifications, design information or other documented evidence.

Discuss

Use informed conversation where understanding, decision-making or work conditions are relevant to the requirement.

Triangulate

Use more than one source when no single source provides enough confidence.

No evidence type is automatically superior.

The right evidence depends on what needs to be known.

In practice

Exclusion zone

Question-first

Is the exclusion zone adequate?

Yes / no

What does a “yes” tell us?

Perhaps very little.

Evidence-first

Start with the decision:

Is effective separation being maintained between people and the defined line-of-fire exposure?
Then define what must be true.
The boundary is positioned at the required distance.
The boundary is physically identifiable.
Access is controlled.
People remain outside the defined area while the exposure exists.
The arrangement reflects actual movement of equipment and load.

Now determine the evidence.

Observe the work.
Measure or confirm separation distance where required.
Inspect the boundary.
Observe access behaviour.
Check whether the zone remains effective as work conditions change.

Only then write the prompts needed to obtain that evidence.

A VERIFICATION QUESTION IS ONLY USEFUL IF THE ANSWER SUPPORTS A DECISION ABOUT THE CONTROL.

Critical Risk Management in Practice / 07

Part 02 / Prove the control08

VERIFY WHERE THE CONTROL LIVES.

One control can require evidence from the system, the work and the control itself.

Critical controls exist within an organisational system.

They operate within real work.

And ultimately they need to provide protection at the point where serious harm can occur.

Evidence may therefore need to be gathered from different perspectives.

FIGURE 8.1ONE CONTROL. THREE PERSPECTIVES.

At the centre:CRITICAL CONTROLAround it:

SYSTEM

Is it properly designed and supported?

Standards
Technical specifications
Governance
Maintenance strategy
Competency systems
Change management
Design assumptions

WORK

Are conditions supporting its performance?

Planning
Coordination
Resources
Equipment condition
Interfaces
Environment
Competing activities
Changes from expected conditions

CONTROL

Is the required protection present now?

Available
Functional
Correctly implemented
Within required conditions
Providing the intended protective function

These are not three separate bureaucratic layers.

They are different perspectives on evidence.

In practice

Machine guarding

System

Has the guarding system been designed for the hazard and equipment?

Are specifications and modification controls appropriate?

Work

Are production demands, maintenance access, cleaning requirements or frequent interventions creating pressure to defeat or remove the guard?

Control

Is the guard present, secure and providing the required separation now?

One control.

Different evidence.

Different decisions.

Common trap

Creating three verification checklists that repeat the same question at three organisational levels.

The purpose is not repetition.

It is to see different aspects of control effectiveness.

Critical Risk Management in Practice / 08

NewEra / In Practice03

Part 03

Manage protection in real work

Protection changes.

Controls degrade.

Work changes.

Exposure changes.

The demands placed on controls change.

Good Critical Risk Management needs to make those changes visible and create an appropriate response.

Sections 09–12

Part 03 / Manage protection in real work09

CONTROL STATE IS NOT BINARY.

The purpose of control state is not classification. It is decision-making.

Real work contains uncertainty, degradation and partial performance.

A binary pass/fail result can hide that information.

Not every weakness means the same thing.

Not every control that is less than perfect has completely failed.

And not every “yes” represents strong protection.

A more useful control-state model distinguishes the condition of protection.

FIGURE 9.1CONTROL STATE

EFFECTIVE
The control is providing the required protection.
DEGRADED
The control remains functional, but performance has reduced.
WEAK
Some protection exists, but reliability is insufficient or uncertain.
FAILED
The control is not providing its required function.
ABSENT
A required control is not present.
Separate from the progression:
NOT REQUIRED
The control is legitimately unnecessary in the current circumstances.
NOT APPLICABLE
The control does not apply to the activity or situation being assessed.

State should change the decision.

An effective control may support work continuing as planned.

A degraded control may require restoration, monitoring or additional protection.

A weak control may require stronger interim measures or restrictions on exposure.

A failed or absent critical control may mean the work cannot safely continue.

The important question is not:

Did it pass?

It is:

What protection exists now, and what needs to happen next?

Critical Risk Management in Practice / 09

Part 03 / Manage protection in real work10

WEAK PROTECTION MUST TRIGGER A RESPONSE.

Finding the problem is not the response.

Verification is not complete when a result is entered into a system.

If critical protection is degraded, weak, failed or absent, something needs to happen.

And the first priority is not the action register.

It is the exposure.

FIGURE 10.1FAILED CONTROL RESPONSE

PROTECT
Manage the immediate exposure.
RESTORE
Re-establish the required protection.
RE-VERIFY
Confirm effective protection has actually been restored.
UNDERSTAND WHY
Understand the conditions that allowed the weakness to develop or remain.
PREVENT RECURRENCE
Strengthen the control, work or system.
LEARN
Use the information beyond the individual event.

Closing an action is not the same as restoring protection.

An action can be entered.

Assigned.

Tracked.

Closed.

None of those things independently tells us that the critical control is effective again.

That requires evidence.

Decision

When a critical control is weak, ask first:

Can exposure continue safely in the current condition?

Then:

What protection needs to be restored?

Only after that:

What needs to change so the weakness is less likely to return?

In practice

Interlock failure

A machine interlock fails.

A maintenance action is immediately raised.

That is necessary.

But the action itself does not protect anybody.

The immediate questions are:

Can the equipment continue operating?
Can access to the hazardous area occur?
What alternative protection exists?
Is that protection sufficient?
How will the interlock be restored?
How will restoration be confirmed?

Only then do we move into the deeper learning:

Why did it fail?
Was the failure detectable?
Had degradation been visible earlier?
Do similar interlocks share the same failure mode?
Could the same weakness exist elsewhere?

That is the difference between managing an action and managing protection.

Critical Risk Management in Practice / 10

Part 03 / Manage protection in real work11

EXPOSURE CHANGES WHAT MATTERS.

Calendar frequency is not the same as risk-based verification.

A critical control can exist for long periods without being meaningfully demanded.

Another may be demanded repeatedly during every shift.

That difference matters.

Three concepts help us understand it.

Exposure

A person encounters conditions associated with the serious-harm pathway.

Exposure tells us where and when serious-harm potential becomes relevant to people.

Control demand

Conditions occur in which the control needs to perform its protective function.

Verification opportunity

A point in the work where meaningful evidence of control performance can be obtained.

They are related.

They are not interchangeable.

FIGURE 11.1EXPOSURE / DEMAND / OPPORTUNITY

Imagine work occurring across a month.

DAY 1✓ Verification completed

DAY 4

DAY 9

DAY 12

DAY 19

DAY 26

And the highest-exposure activity occurs:DAY 19

Scheduled verification:But meaningful control demands occur on:

A monthly verification program can therefore be perfectly compliant with its schedule while missing the moments when the control is most meaningfully tested.

Frequency of verification ≠ frequency of risk.

In practice

Loading and unloading

A transport operation verifies a vehicle restraint control monthly.

But the control is demanded many times every day.

Demand also varies.

Some loading conditions are routine.

Others involve unusual loads, constrained access, unfamiliar drivers or changing interfaces.

A better verification strategy may combine:

periodic system assurance
routine operational checks
targeted verification during higher-demand conditions
and additional verification after change or degradation.

The question changes from:

How often do we verify this control?

to:

When and where would verification give us the most meaningful evidence about its performance?

Critical Risk Management in Practice / 11

Part 03 / Manage protection in real work12

CONTROLS DO NOT OPERATE IN PROCEDURES.
THEY OPERATE IN WORK.

A procedure can describe how work is expected to happen.

A standard can define requirements.

A risk assessment can anticipate conditions.

But the control still has to function in the work itself.

Real work contains variation.

Time pressure.
Equipment availability.
Different levels of experience.
Contractor interfaces.
Interruptions.
Environmental conditions.
Production demand.
Conflicting priorities.
Workarounds.
Changes.
Unexpected situations.

The existence of variation does not mean the system has failed.

It means the system and the work need to remain connected.

FIGURE 12.1WORK AS INTENDED / WORK AS DONE

ORGANISATIONAL INTENT
StandardsProceduresPlansDesignRequirements
THE WORK
Critical controls operate here.
OPERATIONAL REALITY
TimeEquipmentPeopleInterfacesEnvironmentDemandChangeResourcesCompeting priorities

The question is not whether Work as Intended or Work as Done is correct.

The question is whether we understand the relationship well enough to maintain protection.

Your existing system manages the work.

Crm makes sure the controls that prevent serious harm work within it.

Critical Risk Management should not become another process sitting beside planning, maintenance, operations, permits, supervision and execution.

It should help those systems focus on the protection that matters most.

In practice

Patient handling

A healthcare organisation has a well-defined patient-handling procedure.

The equipment is available.

Training is current.

The system looks strong.

But in practice:

patient condition changes
staffing varies
space is constrained
equipment may be elsewhere
urgent care competes for attention
and the task does not always resemble the scenario anticipated by the procedure.

The useful question is not simply:

Did staff follow the procedure?

It is:

What conditions shaped how the work was performed, and did the required protection remain effective within those conditions?

That is a richer learning question.

Keep the person in the system

For every important control, ask:

What does the person need to know?
What do they need to see?
What decision do they need to make?
What makes the control easier or harder to use?
What changes when conditions move away from what was expected?

Write for the person making the decision, in the moment they need to make it.

Critical Risk Management in Practice / 12

NewEra / In Practice04

Part 04

Turn evidence into better protection

Information only matters if it changes something.

The value of control information is not the information itself.

It is what the organisation can understand and change because that information exists.

Sections 13–16

Part 04 / Turn evidence into better protection13

LEARN BEFORE CONSEQUENCE.

You do not need an incident before there is something worth learning.

If organisational learning begins only after somebody is injured, many opportunities have already been missed.

Every meaningful exposure contains information.

So does every change in control state.

A useful unit for learning is:

Exposure + control state

That combination allows organisations to learn from far more than failure.

FIGURE 13.1LEARN BEFORE CONSEQUENCE

SUCCESS
Exposure occurred.The control performed effectively.What helped it work?
DEGRADATION
Performance reduced, but protection remained.What changed?
WEAK CONTROL
Protection existed but was unreliable.Why had weakness developed?
UNCONTROLLED EXPOSURE
People encountered the pathway without adequate protection.How did this become possible?
SIF / FPI
Serious consequence occurred or was narrowly avoided.What can we learn about the pathway, controls, work and system?
EXPOSURE + CONTROL STATE = LEARNING OPPORTUNITY

Learn from success too.

Successful work is not simply work where nothing went wrong.

There may be useful information in:

how people anticipated changing conditions
how a control remained reliable under demand
how teams coordinated around a difficult interface
how early degradation was recognised
how work was adapted while maintaining protection.

If we only study failure, we miss the conditions that help controls succeed.

Look closer

Ask not only:

Why did this control fail?

Also ask:

What normally helps this control succeed?

Critical Risk Management in Practice / 13

Part 04 / Turn evidence into better protection14

MEASURE PROTECTION.

Different measures answer different questions.

No single metric describes the state of serious-harm prevention.

Injury frequency tells us something about recorded harm.

Verification completion tells us something about activity.

Neither independently tells us where people are exposed or whether the controls protecting them are effective.

A stronger measurement architecture creates a line of sight across several domains.

FIGURE 14.1OUTCOMES

OUTCOMES
What happened?
EXPOSURE → CONTROL → RESPONSE → LEARNING
Where can serious harm occur?What state is the protection in?What happens when protection weakens?What are we learning?
ACTIVITY
What did we do?

Exposure

Possible measures include:

frequency of exposure
duration
number of people exposed
changes in exposure profile
control demand.

Control

Possible measures include:

effective controls
degraded controls
weak controls
failed or absent controls
recurring failure modes
variation by site, task or condition.

Response

Possible measures include:

immediate exposure managed
protection restored
time to restoration
re-verification completed
recurring weakness addressed.

Learning

Possible measures include:

common degradation mechanisms
conditions associated with success
repeated control weaknesses
cross-site patterns
systemic dependencies
recurring uncontrolled exposure.

Activity still matters.

Outcomes still matter.

The aim is not to replace one dashboard with another.

Activity tells us what the organisation did.

Control information tells us something about the protection that existed.

Outcome information tells us what happened.

They answer different questions.

The problem begins when one measure is expected to answer all of them.

Challenge the green.

Green results should not end curiosity.

Ask:

What evidence supports the result?
Was the control being meaningfully demanded?
Was verification performed where the control actually operates?
Could common failure modes have been missed?
Are different verifiers reaching similar conclusions?
Does operational experience support what the dashboard shows?

Green should mean there is evidence of effective protection.

Not simply that an activity was completed.

Critical Risk Management in Practice / 14

Part 04 / Turn evidence into better protection15

ASSURANCE SHOULD FOLLOW RISK.

More assurance is not always better assurance.

Uniform assurance can feel systematic.

Every control receives the same frequency.

Every site completes the same checks.

Every business unit follows the same calendar.

The approach looks consistent.

But the uncertainty is not consistent.

Neither is the exposure.

Neither is reliance on the control.

Assurance should respond to what the organisation needs confidence about.

FIGURE 15.1ASSURANCE FOLLOWS

RISK
How severe is the pathway being managed?
● RELIANCE
How much does serious-harm prevention depend on this control?
● UNCERTAINTY
How confident are we in its design and operating effectiveness?
DEPTH
How deeply should performance be tested?
FREQUENCY
How often is meaningful evidence needed?
COVERAGE
Where should assurance look?

Depth

One question may require a document review.

Another may require:

field observation
technical testing
measurement
interviews
data analysis
specialist review.

Frequency

Frequency should reflect:

risk
demand
variability
degradation
change
and what is already known about performance.

Coverage

Consider:

sites
assets
workgroups
activities
operating conditions
contractor interfaces
control types.

Independence may also matter.

Some assurance can be performed close to the work.

Other questions warrant greater separation from the activity being assessed.

In practice

Consider two controls.

Control a

Stable engineered control.

Low variability.

Strong historical evidence.

Low uncertainty.

Control b

Frequently demanded control.

Variable operating conditions.

Recent changes.

Repeated degradation.

High reliance.

Applying exactly the same assurance approach to both may be consistent.

It is not necessarily intelligent.

Assurance should follow risk, reliance and uncertainty.

Critical Risk Management in Practice / 15

Part 04 / Turn evidence into better protection16

MAKE CRM PART OF HOW WORK IS MANAGED.

CRM should strengthen the work, not become another system beside it.

Critical Risk Management becomes mature when it stops behaving like a separate safety program.

The organisation does not need another parallel universe of:

meetings
databases
forms
inspections
dashboards
actions
and assurance.

It needs the information about serious-harm protection to influence the way work is planned, performed, led and improved.

Several things need to come together.

Separate definition from evidence.

Some information should remain relatively stable.

Other information changes continuously.

Confusing the two creates poor data architecture and weak decisions.

FIGURE 16.1DEFINITION OF PROTECTION

Critical Risk
Serious-Harm PathwayCritical ControlBarrier FunctionPerformance StandardPerformance Requirement
EVIDENCE OF PROTECTION
ExposureControl DemandVerification EvidenceControl StateResponseLearningAssurance Findings

Separate definition of protection from evidence of protection.

One describes what should exist.

The other tells us what is happening.

Both are necessary.

Do not count controls.

Understand independence.

A long list of controls can create false confidence.

Five controls do not necessarily represent five independent layers of protection.

They may depend on the same:

power supply
sensor
maintenance process
person
communication system
procedure
data source
operating condition.

A single common dependency can therefore degrade several controls at once.

FIGURE 16.2APPARENT PROTECTION

CONTROL 1
CONTROL 2
CONTROL 3
CONTROL 4
CONTROL 5

All appear separate.But beneath them:

COMMON DEPENDENCYOne failure can weaken several controls.

Do not count controls.

Understand independence.

Build maturity through practice.

Maturity is not determined by the number of documents, bowties, dashboards or verification activities an organisation has.

It is visible in how Critical Risk Management works.

FIGURE 16.3CRM MATURITY

LIMITED
Fragmented and inconsistent.Critical risks and controls may be poorly defined.Practice varies substantially.
EMERGING
Core structures are developing.Risks, controls, responsibilities and verification are becoming clearer.
ESTABLISHED
The approach is systematically implemented.Performance expectations are clear.Meaningful evidence is gathered.Weakness creates a response.
INTEGRATED
CRM is embedded in how work is planned, performed, led and improved.Control information influences operational decisions.Learning moves across organisational boundaries.Assurance follows changing risk and uncertainty.

The purpose is not to achieve a maturity label.

It is to make protection more dependable.

The CRM operating discipline

Effective Critical Risk Management is not a one-off design exercise.

It is an operating discipline.

FIGURE 16.4UNDERSTAND

Around the entire discipline:

GOVERNSet expectations, accountability and decision rights.

ASSUREBuild confidence that the system and controls are doing what the organisation depends on them to do.

UNDERSTANDUnderstand the serious-harm event or exposure, the pathway and the conditions surrounding the work.
CONTROLIdentify the controls that genuinely interrupt or mitigate the pathway.
ENABLECreate the conditions that allow those controls to perform.
VERIFYObtain meaningful evidence of whether required protection exists.
RESPONDAct when protection is degraded, weak, failed or absent.
LEARNUnderstand what exposure and control performance are telling you.
IMPROVEStrengthen the controls, system and conditions around the work.

Then repeat.

Because the work changes.

Exposure changes.

Controls degrade.

People adapt.

Conditions move.

New information becomes available.

Critical Risk Management has to remain connected to that reality.

Critical Risk Management in Practice / 16

A practical starting point

Start where serious harm matters most.

Organisations do not need to redesign their entire Critical Risk Management framework before improving it.

Start with one material critical risk.

01 — DEFINEDefine the serious-harm event or exposure clearly.
02 — MAPUnderstand the pathway from ordinary work to serious harm.
03 — CHALLENGEReview the proposed controls.Are they genuinely controls?Which are genuinely critical?
04 — DEFINE PERFORMANCEDescribe what each critical control must achieve and what specifically must be true.
05 — DESIGN EVIDENCEDetermine what evidence would demonstrate effective performance.
06 — VERIFYGather that evidence where the control and work can meaningfully be understood.
07 — RESPONDProtect people and restore required protection when weakness is found.
08 — LEARNLook across exposure, control state and response for patterns.
09 — IMPROVEStrengthen the control and the conditions that support it.

Then apply what you have learned to the next risk.

Ten questions worth asking

01Are our critical risks clearly defined as serious-harm events or exposures?
02Do we understand how each serious-harm pathway can develop?
03Can we explain why each critical control is genuinely critical?
04Do we know what each critical control must achieve?
05Have we defined specific performance requirements?
06Does verification obtain evidence that supports a meaningful decision?
07Can we distinguish design effectiveness from operating effectiveness?
08Can we see where protection is degraded, weak, failed or absent?
09Does weakness trigger protection, restoration, re-verification and learning?
10Can leaders see where serious-harm protection is strongest, weakest and most uncertain?

If several of these questions are difficult to answer, the problem is unlikely to be solved by simply doing more verification.

Look at the architecture underneath it.

Where CRM commonly goes wrong

Too many critical controls

When everything is critical, attention becomes diluted.

Enablers labelled as controls

Important activities are mistaken for barriers that directly interrupt the pathway.

Weak understanding of the pathway

Controls are selected from generic lists rather than from how serious harm can actually occur.

Broad performance standards

Expectations are too vague to determine whether the control is effective.

Generic verification questions

Questions generate answers without producing useful evidence.

Completion becomes the KPI

The organisation measures whether verification occurred rather than what it learned about protection.

Everything is green

Positive results become normalised without sufficient challenge of the evidence underneath them.

Weakness creates an action, not protection

An action enters the system while the immediate exposure remains.

Verification is calendar-driven

Checks occur because the date arrived rather than because exposure, demand or uncertainty makes them meaningful.

Control quantity is mistaken for independence

Multiple controls share dependencies and can fail together.

Crm sits beside the work system

Critical controls become another safety process instead of part of planning, execution and operational decision-making.

Data becomes the objective

Dashboards become increasingly sophisticated while the connection between information and protection becomes weaker.

The test is simple:

DOES THE APPROACH HELP PEOPLE UNDERSTAND AND STRENGTHEN THE PROTECTION THAT MATTERS?

If not, more CRM may simply create more activity.

Keep the person in the system

Even highly engineered protection exists within a human system.

People:

plan the work
configure equipment
interpret information
maintain controls
recognise changing conditions
respond to alarms
make trade-offs
stop work
recover from unexpected situations
verify performance
learn from what happens.

This does not mean every control should depend on human action.

Where hazards can be eliminated or engineered out, stronger design should be preferred.

It means the effectiveness of the wider control system still depends on how people interact with it.

So keep asking:

What does the person need to know?
What do they need to see?
What decision do they need to make?
What makes the required action easier or harder?
What happens when conditions change?
How will they know when protection is no longer adequate?

The language matters too.

Performance requirements and verification prompts should be understandable by the person who needs to use them.

Avoid unnecessary technical language.

Avoid abstract statements that require interpretation.

Avoid writing for the procedure when the decision is being made in the field.

Write for the person making the decision, in the moment they need to make it.

Key definitions

Critical risk

An event or exposure with the potential to result in fatal or life-changing harm.

Serious-harm pathway

The sequence of conditions and events through which an exposure can develop into serious harm.

Control

Something that acts directly on a defined pathway to prevent, detect, warn, respond to or mitigate the event or exposure.

Critical control

A control whose failure would materially increase the potential for serious harm and which warrants specific management because of its importance in interrupting or mitigating the pathway.

Barrier function

The protective function performed by a control within the serious-harm pathway.

Performance standard

A statement describing what a critical control must achieve.

Performance requirement

A specific condition that must be satisfied for the required control performance to exist.

Design effectiveness

Whether a control is capable of performing its intended protective function.

Operating effectiveness

Whether the control is providing the required protection in the work, under the conditions that exist.

Evidence

Information that supports a conclusion about whether a defined requirement is satisfied.

Verification

The process of obtaining and assessing evidence to determine control effectiveness.

Exposure

A situation in which a person encounters conditions associated with a defined serious-harm pathway.

Control demand

A situation in which a control is required to perform its protective function.

Verification opportunity

A point in the work where meaningful evidence of control performance can be obtained.

Control state

The current condition of a control expressed in terms useful for operational decision-making.

Assurance

Activity that builds confidence that the CRM framework and critical controls are designed, implemented and operating as intended.

Final thought

Critical risk management is not the work.

It should help the work happen with stronger protection.

The value of CRM is not found in the number of critical risks identified, bowties completed, controls listed or verifications recorded.

It is found in whether the organisation understands where serious harm can occur, knows what protection it is relying on, can see when that protection is weakening, and acts before consequence becomes the evidence.

That requires good design.

But design is only the beginning.

Critical controls have to survive contact with real work.

They have to remain available when conditions change.

They have to perform when demanded.

They have to be understood by the people who depend on them.

Verification has to produce evidence worth making a decision from.

Weakness has to create a response.

And what the organisation learns has to make future protection stronger.

That is when Critical Risk Management stops being another safety process.

It becomes part of how serious harm is prevented.

Understand work.

Prevent harm.

About NewEra

NewEra Health Safety Human Performance works with organisations to understand work and prevent harm.

Our work brings together critical risk, human performance, psychosocial risk, work design, systems, learning and assurance.

We help organisations understand where serious harm can occur, strengthen the controls people rely on, learn from how work actually happens and build healthier, safer and better conditions for work.

Critical risk

Critical Control Management Critical Control Verification Bowtie & Barrier Analysis Critical Risk Assurance

Human performance

Work as Done Learning From Normal Work Learning Teams Safety Leadership & Field Coaching

Psychosocial risk

Psychosocial Risk Management Psychosocial Risk Assessment Healthy Work Design ISO 45003

Systems & assurance

Management Systems ISO 45001 / ISO 14001 / ISO 9001 WHS Auditing & Assurance Incident Investigation & Learning

thisisnewera.com

Newera

Health / Safety / Human Performance

Understand work. Prevent harm.

Critical RiskManagementin Practice.

A note from NewEra

How to use this publication

Read it

Use it

Share it

Contents16 sections / 4 parts

Part 01Focus on serious harm

Part 02Prove the control

Part 03Manage protection in real work

Part 04Turn evidence into better protection

Focus on serious harm

ACTIVITY IS NOT PROTECTION.

Look closer

In practice

Mobile equipment

START WITH THE SERIOUS-HARM PATHWAY.

From hazard to consequence

In practice

High-voltage electrical work

One pathway might involve:

Another may involve:

Decision

NOT EVERY CONTROL IS CRITICAL.

Control

Enabler

Activity

Common trap

In practice

KNOW WHAT YOU ARE RELYING ON.

In practice

Vehicle / pedestrian interaction

Control

Control

Type

Barrier function

Pathway

Look closer

Prove the control

WHAT DOES EFFECTIVE MEAN?

DESIGN EFFECTIVENESS

DOES IT WORK HERE, NOW?

In practice

Electrical isolation

DEFINE PERFORMANCE BEFORE VERIFICATION.

Performance standard

Performance requirement

Evidence

Verification

In practice

Pressure relief

Critical risk

Critical control

Performance standard

Performance requirement

Evidence

Verification

Decision

DESIGN THE EVIDENCE FIRST.

EVIDENCE-FIRST

Evidence can take different forms

Observe

Inspect

Test

Measure

Demonstrate

Review

Discuss

Triangulate

In practice

Exclusion zone

Question-first

Yes / no

Evidence-first

VERIFY WHERE THE CONTROL LIVES.

SYSTEM

WORK

CONTROL

In practice

Machine guarding

Critical Risk
Management
in Practice.

CONTROLS DO NOT OPERATE IN PROCEDURES.
THEY OPERATE IN WORK.