---
name: ehs-and-workplace-safety
description: Runs environment, health and safety on an operating site — hazard controls in order of effectiveness, incident recording and reporting obligations, and safety measurement that does not reward silence. Use this to build or audit a safety program, decide what controls a hazard actually needs, work out whether an injury is recordable or reportable, investigate an incident, or fix safety metrics that have stopped producing reports.
---

# Environment, health and safety

Safety on an operating site is a legal obligation with clocks attached, not a value statement. The
difference matters at the moment something happens, because the obligations start running whether or
not anyone has decided what to do.

## Controls in order of effectiveness

The hierarchy is not advice about preference. It is a ranking by how much the control depends on a
person behaving correctly under pressure, and everything below the third rung does.

1. **Elimination** — the hazard is not there. The task is designed out, or done elsewhere.
2. **Substitution** — a less hazardous material, process or energy source.
3. **Engineering** — guards, interlocks, ventilation, barriers. The hazard remains; reaching it does
   not depend on judgment.
4. **Administrative** — procedure, training, signage, permits, rotation.
5. **Personal protective equipment** — the last line, worn by the person the hazard is nearest to.

Most programs that look thorough are stacked at rungs 4 and 5, because those are cheap to add and
produce documents. A new procedure and a toolbox talk in response to an injury is the default
answer, and it leaves the hazard exactly where it was.

The test for a proposed control: if the most rushed person on the worst shift skips a step, does the
hazard reach them? If yes, the control is at rung 4 or below whatever it is called.

## Energy control is the one to get right first

Most severe injuries on production equipment happen during maintenance, cleaning or clearing a jam —
work done with guards removed, by someone who has done it a hundred times, on a machine that was
believed to be off.

Isolation of hazardous energy has to be procedural per machine rather than generic per plant, and
must account for stored energy — pressure, springs, gravity, capacitance — which is what "off" fails
to address. Verification is the step that gets dropped: attempting the start after isolating is what
turns a belief into a fact.

Where an outside contractor works on the site, the isolation procedure is theirs to follow and yours
to specify. Coordination is the usual gap.

## Recordable, reportable and the clocks

These are three different thresholds and they are routinely conflated:

- **First aid** — treated and logged, not recorded.
- **Recordable** — medical treatment beyond first aid, restricted duty, days away, loss of
  consciousness, or a significant diagnosed condition. It goes on the log.
- **Reportable** — the serious subset that must be told to the regulator within a fixed window,
  measured in hours for a fatality and in a small number of days for an in-patient hospitalization,
  amputation or eye loss.

The failure is almost never refusal. It is that nobody knew the clock had started, because the event
was being managed as a medical matter while the reporting window ran. Name in advance who decides
recordability, who notifies, and what happens when that person is unreachable at 2am — which is when
it will happen. `legal-risk:regulatory-compliance` holds the wider obligation-tracking method.

Environmental releases carry their own thresholds and their own clocks, usually shorter. A site with
permits should know its reportable quantities before it needs them.

## Measure what precedes the injury

A recordable injury rate is a lagging measure on a small denominator. A site can go a year without a
recordable and still be one guard away from a serious event, and a site can record two minor injuries
in a strong year and look worse.

Worse, attaching the rate to bonuses or site rankings reliably suppresses reporting rather than
injuries. The first thing lost is the near-miss, which is the only free information the system
produces.

Measure ahead of the event instead: near-misses reported per period, with a rising count read as the
program working; hazards identified and closed, with age; time to close a corrective action; and
audit findings on the controls that matter, weighted toward rungs 1 to 3. Pair any lagging rate with
a severity-potential measure, because frequency and severity move independently and a program tuned
on frequency alone optimizes for paper cuts.

## Tooling

EHS management systems — Intelex, Cority, VelocityEHS, Enablon, Benchmark Gensuite and similar —
carry the incident log, corrective actions, training records and regulator-facing reports in one
auditable place, which is what an inspection asks for. The determining factor is whether reporting
is easy enough on the floor that near-misses actually arrive; a system only supervisors can reach
records incidents and nothing that precedes them.

Regulatory recordkeeping has a required form and a required posting period. Whatever the system,
confirm it produces the log in the form the regulator expects rather than an export someone
reformats each year.

Below that scale, a shared log with a fixed set of fields and a named owner per open item covers
most of the value. What cannot be substituted is the review — an incident system nobody reads is a
liability record rather than a safety program.

## Never

- Answer an incident with a procedure and a briefing while the hazard stays reachable.
- Let the recordability decision wait on the medical outcome while a reporting clock runs.
- Tie a site bonus to an injury rate, which buys silence rather than safety.
- Isolate a machine without verifying the isolation by attempting a start.
- Treat a near-miss report as a problem with the reporter.