Plan, Do, Check, Act — The Check Is the Hard Part

IN SHORT

Health and safety management works like any other management discipline. Set objectives. Work out what the organisation needs to be capable of. Check whether it still is.

The checking is the hard part. Near misses and incidents are lagging indicators — they describe a state that already existed by the time you read about them. Most organisations measure in arrears, then plan as though they were measuring now.

The method is sound. The problem is where the information arrives.

What is the method, actually?

Strip away the vocabulary and health and safety management is ordinary management.

HSE's framework, HSG65, is Plan, Do, Check, Act — Deming's cycle, applied to risk. ISO 45001 says the same thing in clauses: set objectives (6.2), make sure people are competent and resourced (7.2), then monitor and evaluate (9.1).

Three steps:

  1. Objectives. What are we trying to achieve?
  2. Capability. What does this organisation need to be able to do — skills, equipment, process, time, authority — for that to be realistic?
  3. Check. Is the capability still there, and is it still the right one?

Most places do the first two well. The third is where it gets hard, and it's structural rather than cultural.

Why the picture does not hold still

Objectives and capability are set against a risk picture at a moment in time.

Then the world moves. A new line goes in. A contractor arrives who has never walked the site. A shift pattern changes and the handover that used to happen face to face now happens by note. Volumes rise and a route that was comfortable becomes tight. None of these are failures. Most are the business doing well.

Jens Rasmussen described what follows, in 1997. Under steady pressure to be efficient, practice drifts toward the edge of the safe operating envelope — not in one decision, but in many small, sensible ones.

The capability you specified is still there on paper. What it is being asked to cope with has changed underneath it.

The plan was right when it was written. The question is whether anyone has checked it against the work as it is now done.

Where the information actually arrives

A timeline. Objectives and capability are set, then the work changes, then the control degrades, then a near miss occurs, then an incident. Leading indicators can see the middle stage, where the work changes and the control degrades. Lagging indicators only report the last two stages, the near miss and the incident.
Near misses sit earlier in the sequence than incidents, which is why they are so valued. They are still on the right-hand side of it.

A near miss is a lagging indicator. It gets called a leading one constantly, and that is the most common category error in safety measurement.

A near miss has already happened. It tells you a control has already degraded far enough that the outcome came down to luck. Earlier than an injury, and far more useful — but still a report about the past.

So is everything else in the monthly pack. RIDDOR-reportable events, lost time, incident counts, days since the last incident. HSG65 calls this reactive monitoring, and HSE is explicit that it is not enough on its own.

The counterpart is active monitoring — checking the controls are working before anything fails. HSG254, HSE's guidance on process safety indicators, is the clearest public treatment of it. Its central recommendation is to pair measures: for every lagging indicator, a leading one watching the control it depends on.

So where does that leave most organisations?

Planning that assumes current information. Measurement that is almost entirely historical. And the gap between the two absorbed, quietly, by the people doing the work.

There is a knock-on effect worth naming. A quiet quarter gets read as proof that capability still matches risk. It isn't proof of that. It is equally consistent with a well-protected workforce, a lucky one, and one that has stopped reporting. The number cannot tell you which.

That is Erik Hollnagel's Safety-I point: measuring the absence of harm tells you very little about the presence of control.

None of which makes lagging measures wrong. They are legally required, they are comparable, and a properly investigated incident is one of the richest learning opportunities an organisation gets. The error is treating them as the whole answer to step three.

What this looks like in practice

Three things follow. None need new technology to start.

Pair every lagging measure with a leading one. Not a target — a check. If the control is segregation, the leading measure is whether the segregation is still physically there, and still being used on the shift that is actually running.

Re-ask the capability question when the work changes, not when the calendar says so. An annual review looks at a year-old picture. The better trigger is new plant, a new contractor, a change in volume, a new shift pattern, a new product. All of those are known in advance.

Treat "how is this job actually done?" as a measurement. Work-as-imagined versus work-as-done, and the human and organisational performance literature that followed it, point the same way. The gap between the procedure and the practice is the most informative thing about a site — and you can see it without waiting for an event.

The thinking is ahead of the measurement

Leading indicators, learning teams, human and organisational performance, Safety-II — the profession worked all this out some time ago. What has been missing is not the idea. It is the means.

Checking that controls hold, across a whole site, on every shift, over months, has always been too expensive to do except by sample. So it gets sampled, and the sample gets treated as the picture.

The more cheaply that checking can be done, the closer the method gets to running as HSG65 always described it. Planned, done, checked, acted on — with the checking arriving early enough to matter.

The method was never the problem. The lag was.

Common questions

Is a near miss a leading or a lagging indicator? A near miss is a lagging indicator. It is an event that has already occurred, and it tells you a control has already degraded to the point where the outcome depended on circumstance. It arrives earlier than an injury, which makes it more useful than most lagging measures, but it still describes the past rather than the present.

What is the difference between leading and lagging indicators in health and safety? Lagging indicators count outcomes that have already happened — injuries, RIDDOR-reportable events, lost time, near misses. Leading indicators check whether the controls intended to prevent those outcomes are currently in place and working. HSE guidance recommends pairing them, so each lagging measure has a leading counterpart watching the control it relies on.

What are active and reactive monitoring? Terms from HSE's HSG65 framework. Reactive monitoring investigates things that have gone wrong. Active monitoring checks that controls are working before anything fails — inspections, observations, verification that a procedure is being followed as written. HSE is explicit that reactive monitoring on its own is not sufficient.

Does a quarter with no injuries mean the controls are working? Not on its own. A period with no recorded injuries is consistent with a well-protected workforce, with good fortune, and with a workforce that has stopped reporting. Nothing in the outcome number distinguishes between them, which is why leading measures of control effectiveness matter.

How often should safety objectives and capability be reviewed? The more useful trigger is a change in the work rather than a date in the calendar — new plant, a new contractor, a change in volume, a new shift pattern, a new product. An annual review examines a picture that may be a year out of date, and the changes that matter are usually known in advance.

References