4.4 Corrective actions that hold

1 Answer every root cause you named

The arithmetic is simple and it is the first thing to check on any finished report: each root cause should have at least one corrective action pointing at it, and each corrective action should trace back to a root cause. An action with no cause behind it is somebody's pet project; a cause with no action behind it is a finding you have written down and accepted.

OSHA's recommended practices ask you to eliminate or control all serious hazards — those causing or likely to cause death or serious physical harm — immediately, and to use interim controls while longer-term solutions are developed. The interim control is not a lesser option; it is what protects people during the months the real fix takes.

2 Reach as high up the hierarchy as you can

The hierarchy of controls decides how durable an action is. OSHA 3885 reproduces it from NIOSH and asks employers to select controls in order, emphasizing engineering solutions — including elimination and substitution — first, then safe work practices and administrative controls, and finally PPE.

The guidance adds two cautions worth carrying. Avoid controls that introduce new hazards — exhausting contaminated air into an occupied space, or hearing protection that makes a backup alarm inaudible. And use a combination where no single method fully protects people.

3 The hazard control plan

OSHA 3885 describes what a control plan has to contain, and it is four fields plus a habit: list the hazards needing control in order of priority; assign responsibility for installing or implementing each control to a specific person with the power or ability to do it; establish a target completion date; plan how you will track progress; and plan how you will verify the effectiveness of the controls after they are implemented.

The guidance is also explicit that the plan is reviewed periodically — at least annually, and whenever conditions, processes or equipment change — to confirm that the controls are still effective. A control installed in March is not a control in December unless somebody has looked.

4 Verification is a different act from completion

Marked done means somebody says they did it. Verified means somebody went and looked at the work being done with the control in place. The gap between those two is where most repeat incidents live.

1. 1
   Decide the verification when you write the action, not afterwards — observe three lifts, re-measure the noise, audit ten permits.
2. 2
   Set the date for it separately from the completion date, far enough out for reality to assert itself.
3. 3
   Have someone other than the action owner do the looking, wherever the organization is big enough.
4. 4
   Record what was actually observed, not that it was observed.
5. 5
   If the control has been bypassed or worked around, that is the finding — go back to the root cause, not to the person.

5 Close the loop with the people

OSHA's recommended practices ask employers to communicate the results of the investigation to managers, supervisors and workers to prevent recurrence, and — under worker participation — to report back routinely and frequently on the action taken in response to concerns and suggestions.

There is a self-interested reason as well as a decent one. A workforce that reports hazards and close calls into silence stops reporting. The five minutes spent at the next crew meeting saying what came out of last month's investigation is the cheapest thing you can do to keep the information flowing — and the information is the only early warning you have.

Ask, too, where else the same conditions exist. The same rig on two other crews, the same generic procedure on four other machines, the same PPE assessment covering six other tasks. An investigation that fixes one location and leaves the pattern in place has done a quarter of the work.

6 Reviewing the program itself

The guide lists, among the marks of an effective incident investigation program, a provision for an annual program review to identify and correct program deficiencies and to identify incident trends. That is a different exercise from reviewing individual investigations.

Four questions make it worth the hour: how long did investigations take from incident to closed action, and is that getting better or worse? What proportion of corrective actions were engineering or higher, rather than administrative or PPE? What proportion were verified rather than merely marked complete? And do the root causes cluster — the same procedure, the same supervisor's area, the same shift, the same machine family — in a way that points at something bigger than any single incident?