Beyond Traditional Safety Paradigms

Safety models and indicators can be useful in decision making to improve workplace safety, but they are often relied upon to tell us more than they ultimately can. This paper examines the effective limits of five established paradigms or instruments and proposes a testable hypothesis: tracking the condition of critical controls and worker exposure for specific risks may better support decisions about rare catastrophic events and cumulative health harms as work happens. These proposed indicators are not validated measures of risk or safety performance in that their usefulness, reliability, practicality and acceptance by workers and any unintended effects must be tested in the field and validated. This paper has been created to be a thought provoker for safety practitioners.

The paper distinguishes between evidence drawn from cited sources, the author’s interpretations of that evidence, and proposals for a candidate measurement approach and pilot method for examining critical controls that ultimately impact on worker fatality rates. Examples provided seek to illustrate how the proposals might apply in practice but they do not prescribe universal controls or legal standards.

The proposed method ultimately rests on several assumptions that the author wishes to highlight this at the outset.

• That the current condition of critical controls can be observed or evidenced consistently enough to inform workplace decisions.
• This information can add something useful to existing inspections, worker consultation, event learning and outcome data.
• Assumes that workers and supervisors will find the measure workable if they can help define it, and;
• That work conditions can be measured without creating inappropriate surveillance of individuals.

These assumptions are hypotheses for a pilot to test, not findings established by the author’s work in this paper.

You might like to Read Work Health & Safety Performance Indicators by John Ninness

Practicability is therefore a condition of use for any model used in workplace safety. An indicator may look promising in theory, but it is unlikely to improve control if people cannot collect it reliably, understand it quickly, act on it within their responsibilities or sustain it during ordinary work. This, too, is the author’s implementation assumption and must be tested in future pilot research.

Here, practicability refers to whether the approach can work in everyday use. It does not apply or determine the legal test of what is reasonably practicable.

That test depends on the relevant jurisdiction and duty. For example, section 18 of the Work Health and Safety Act 2011 (Qld) requires a duty holder to weigh likelihood, the degree of harm, knowledge, and the availability and suitability of controls, with cost considered after assessing the risk and available controls. The proposed indicator may inform that judgement, but it cannot replace it.

Paradigms in work safety

The paper examines five commonly cited instruments: Heinrich’s domino model, the accident triangle, injury rates, Reason’s system approach and Robens’ regulatory model. Each was likely developed for a different purpose by their authors. They represent, respectively, a causal model, a loss-ratio proposition, an outcome metric, an accident model and a regulatory philosophy.

Their usefulness does not depend on each being universally true, it depends largely on whether they are used to answer questions they can credibly address.

The existing problem is not that safety practice draws on older models but it arises when a model or indicator is treated as proof of more than it measures.

A low injury rate, for example, may describe frequent, survivable harm while revealing little about the condition of controls intended to prevent a rare fatal event. A signed safe work method statement may establish that a document was issued but say little about whether the work followed the plan. A near-miss count may reflect reporting activity without showing whether the events reported were meaningful precursors to serious harm.

For each instrument, the questions are the same: what does it detect, and what decision can that information credibly support?

Heinrich: move beyond the person not beyond accountability

Heinrich’s work is commonly associated with treating accident prevention as a management concern and with interrupting causal pathways before people are hurt. This is a historical interpretation used to frame the discussion not a claim that his work alone produced that change.

Its enduring weakness is the way its familiar ratios and emphasis on unsafe acts can encourage investigations to end with the injured person. Manuele’s review argues that two propositions associated with Heinrich should be dislodged from practice. Firstly that unsafe acts are the principal cause of occupational accidents, and that reducing accident frequency will achieve an equivalent reduction in injury severity (Manuele, 2011).

Review recent investigations and ask where each explanation finally stops. If a finding ends with “the worker failed to” or “the supervisor failed to..”, the next question is what conditions made that failure likely, possible, normalised or difficult to recover from. Those conditions may include plant design, production pressure, supervision, competence, task planning, workload, maintenance, procurement or conflicting objectives.

This is not an argument that individuals should have no responsibilities within an effective work health and safety system. It is an argument that individual action should not be a complete causal explanation for the incident findings. Unfortunately, (in the author’s experience) many practitioners and organisations default to this model.

The accident triangle

The accident triangle is commonly used to justify attention to hazards, near misses and property-damage events before somebody is injured. In this paper, that is treated as a reporting and learning rationale, not proof that all reported events predict serious harm. A reporting system that ultimately detects credible precursors may reveal degraded controls before a serious event occurs.

The difficulty starts when organisations assume that the triangle becomes a law of prediction. In a 13-year analysis of Mine Safety and Health Administration data from more than 25,000 mines, Yorio and Moore found that the observed triangle form depended on how event severity was defined (Yorio & Moore, 2018). Their work does not make near-miss reporting unhelpful but it does mean that organisations should not assume that reducing all low-severity events will proportionately reduce fatal or serious events.

Near-miss systems should assess whether reports identify exposure to a credible fatal, permanently disabling or serious-health outcome, and whether the organisation ultimately acted on the control weakness identified in the investigation. The number of reports alone does not answer either question materially.

A useful reporting classification therefore distinguishes:

• credible precursors to fatal or permanently disabling outcomes;
• high-potential health exposures, including loss of containment and control failures;
• recurring work-design conditions that can produce psychosocial harm; and
• lower-consequence events that still warrant local learning.

The count is ultimately not the control but it ought to be a prompt to examine the condition of the control.

Injury rates | What is useful outcome data and does it give incomplete assurance?

Injury rates clearly remain useful for some purposes in that they can show trends in frequent occupational injury, assist comparison when the data are comparable, and prompt questions about recurrent slips, strains, cuts and similar harm.

Unfortunately, they do not demonstrate that process, plant, energy, traffic, confined-space, electrical or other high-consequence risks are controlled. The BP U.S. Refineries Independent Safety Review Panel found that BP had mistakenly treated improving personal-injury rates as evidence of acceptable process-safety performance, and that the rates were not predictive of process-safety performance (BP U.S. Refineries Independent Safety Review Panel, 2007). The United States Chemical Safety and Hazard Investigation Board similarly concluded that personal-safety metrics were not a reliable measure of major-accident risk or a good indicator of process-safety performance (U.S. Chemical Safety and Hazard Investigation Board, 2007).

The author proposes to apply this analytical caution beyond refineries. The cited process-safety cases do not establish that every high-consequence risk has the same causal pattern and they do illustrate why the absence of injury, by itself, may not show that controls are present, functional or capable of preventing the worst credible outcome.

Injury outcomes should therefore remain on the dashboard, but in their proper place. Practitioners must recognize that they are outcome data and they are not substitute evidence that critical controls are working in a business today.

Reason’s approach to persons and systems

For this paper, James Reason’s distinction between the person approach and the system approach is a useful analytical starting point. The person approach focuses on individual errors while the system approach focuses on the conditions in which people work and on the defences that prevent or mitigate error (Reason, 2000).

For the purposes of this paper, the Swiss cheese image (cited by many safety practitioners) is used as a dynamic model in that the gaps in defences can open, close and shift (Reason, 2000). It therefore prompts a present-tense question for partitioner’s work “Who has checked whether each critical defence is operating now and under the actual conditions of work?”

We also recognise that a bow-tie, control map or procedure is treated as a hypothesis about how risk should be controlled. It does not in itself verify that barriers are in place and the proposed assurance approach would require observation, testing, consultation and, where appropriate, instrument data while the exposure is occurring.

Robens: Where duty holder are snowed by paper accumulation

The Robens Report proposed that primary responsibility should sit with those who create and work with risks, within a system combining state regulation and supervision with industrial self-regulation and self-help (Robens, 1972). It also proposed broad statutory duties supported, where needed, by regulations and voluntary standards or codes.

For Australian practitioners, this paper draws a practical lesson rather than making a claim about legislative lineage. General duties, regulations, approved codes, licences, technical requirements and documented systems must be assessed by whether they contribute to effective control in the work being done.

Safe work method statements, permits, inductions and pre-start checks can be useful controls or parts of control systems. They become weak evidence when they are treated as proof that the work is safe without checking the task at the workface, environment, interfaces, equipment, exposures and people doing the work.

The applied test is likely simple to implement from a practitioner perspective. Select a high-risk task. Compare the documented method with work as performed then check the actual controls are working rather than the signatures alone. Don’t confuse a signature with a working control.

You might like to read Paper to Practice Gaps in Work Safety by John Ninness

Do not replace one paradigm with another

Safety thought is often described in historical ages, but those labels can become a misleading progression from old to new. Borys, Else and Leggett described the adaptive age as transcending rather than replacing earlier safety ages (Borys et al., 2009).

That qualification matters significantly to practitioners. In a survey of 41 aviation safety investigators, Karanikas, Chionis and Plioutsias (2020) found that the supposed old-versus-new distinction was not cleanly reflected in investigation practice. Participants applied aspects of new thinking without abolishing older practices, with their approach shaped by the information, resources, time, culture and training available.

Karanikas and Zerguine’s review of new safety paradigms makes a highly related point. New approaches can offer useful insight, but they should not be treated as universally applicable or deterministic. The authors identify weaknesses in generalisation, in the connection to technical safety fields and in treating safety largely as an organisational-psychology issue (Karanikas & Zerguine, 2024).

The author’s position is that the response should be integration with discipline. Depending on the risk scenario, this may require guarding, systemic investigation, worker judgement, process-safety methods, occupational-hygiene methods and clear duty-holder accountability. The task is to match the method and measure to the risk and decision.

Current control condition

Karanikas and Zerguine (2025) propose definitions of health, risk and safety intended to clarify the constructs that underpin occupational health and safety practice. Their Table 4 treats risk as the potential for harm arising from exposure to, or interaction with, material and immaterial agents. It defines safety as action to control risk and proposes simplified, summarised and comprehensive definitions for different organisational levels.

This paper treats the definitions as a useful conceptual starting point, not a settled measurement system to move forward with. The paper also notes the practical and ethical questions raised by wider monitoring of health, risk and safety.

Let’s assume occupational hygiene as an analogy for present-tense attention to exposure and control. It does not assume that material and psychosocial hazards are identical measurement problems. Material agents may have measurable concentrations, routes of exposure and exposure standards. Psychosocial hazards can involve workload, role clarity, support, interpersonal behaviour, justice, traumatic content, change and the design of work. Some are cumulative. Some arise through acute events. Any measurement approach must remain connected to the work system and must not become surveillance or diagnosis of workers.

The author proposes that present control condition and actual exposure be considered with outcome data, worker experience and other evidence when decisions concern current risk control. The author does not suggest that exposure-time arithmetic can represent all safety questions.

Proposed hypothesis: critical-control exposure indicators

The author proposes that organisations test a family of risk-specific measures rather than search for a universal safety score.

The candidate measure is critical control exposure time:

• The total worker-hours exposed to a specified risk scenario while a defined critical control is in an unauthorised absent, degraded or unassured condition, and no verified equivalent control is in place.
• This is not a direct measure of risk or relative safety level but it is a candidate indicator of a control condition that may increase risk. If the proposed measure proves reliable and useful in a pilot, it could support timely judgement and action.

Figure 1. Proposed critical-control exposure indicator. The indicator describes an exposure-control condition. It is not a direct measure of risk, safety performance or legal compliance.

For the measure to be meaningful, each indicator needs six defined elements.

1. Risk scenario

State the exposure being managed e.g people on foot interacting with mobile plant in a loading area; work on energised equipment; entry into a confined space; or sustained excessive workload during a project phase.

2. Critical control and performance standard

State what the control is and what “in place” means in observable terms. Examples include traffic separation maintained, an isolation verified dead, an interlock tested healthy, a spotter present with a defined field of view, or a roster operating within an agreed fatigue-control limit.

3. Control state

Keep these states separate i.e. present and functioning; degraded; absent; unverified; deliberately bypassed with approved alternative controls; and work stopped or exposure prevented. An unverified control is not automatically a failed control.

4. Exposure denominator

Record worker exposure hours for the defined scenario, not generic site operating hours. Four hours of an unavailable control while no-one is exposed is not equivalent to four hours of active exposure involving 40 workers.

5. Equivalent or compensating controls

Record whether an alternative, demonstrably effective control was authorised and in place. A control map must describe the risk-control arrangement that actually applied, not merely the preferred arrangement.

6. Decision rule and response

State what the information triggers: stop work, restore the control, use an alternative arrangement, escalate for engineering review, or review whether the original control standard was workable.

Practicability test

A measure should be trialled only where its collection and use are practicable in the work system. For this paper, that means the organisation can demonstrate all of the following:

• the risk scenario, control state and exposure boundary can be defined in observable terms;
• the required information can be collected with sufficient consistency and timeliness for the intended decision;
• the collection burden is proportionate to the risk and does not displace field supervision, maintenance, consultation or other critical work;
• the responsible person has authority, resources and a defined response when the measure identifies a degraded condition;
• workers and supervisors can understand, challenge and use the measure in ordinary work; and
• the method protects privacy and does not require individual health surveillance unless separately justified, lawful and appropriately governed.

These are the author design conditions, not empirically validated criteria. A pilot should test whether they are met. If they are not, the indicator should be simplified, redesigned or not used.

The purpose is not to create a compliance score. It is to test whether exposure to degraded control conditions can be made visible while work is still being done without creating an impracticable administrative burden.

What the safety measure must not become

The author anticipates four failure modes that the pilot must test.

First, it can confuse assurance with risk in that a completed verification does not prove a control will work. A missed verification does not prove that it failed, and the indicator must therefore sit beside functional tests, field observations, worker consultation, maintenance information, high-potential events and outcome data.

Second, it can create a false aggregate For example one total number across unrelated hazards would conceal the mechanism, exposure and consequence that make the result meaningful. At least initially, indicators should remain risk- and control-specific.

Thirdly, it can be gamed by people within a system e.g. If a measure is used to rank teams or individuals, people may record a control as present rather than raise a difficult problem. The unit of analysis must be the work condition and control arrangement, not the worker. Workers and supervisors need a role in defining the control standard, interpreting the data and deciding what action is workable.

Finally, it could become intrusive in psychosocial work. Indicators should focus on work-design conditions, such as sustained workload, recovery opportunity, staffing, role clarity or unresolved conflict pathways. They should not profile personal vulnerability, diagnose health conditions or substitute data collection for consultation.

What a pilot would need to show

The next step is not to install a dashboard across an organisation. It is to test whether the indicator adds decision value.

The author would regard a pilot as credible only if it:

• select one physical high-consequence scenario and one psychosocial work-design scenario;
• define the risk mechanism, critical control and observable control standard with workers, supervisors and technical specialists;
• test whether different assessors classify control states consistently;
• test data quality from permits, plant systems, rosters, inspections or direct observation;
• record exposure prevented by work stoppage or alternative controls;
• assess whether the measure prompts earlier and better control decisions;
• check for gaming, workarounds, privacy impacts and reporting deterrence; and
• compare the indicator with field evidence, worker experience, high-potential events and outcome data rather than assuming that it predicts harm.

The author adopts three pilot questions from Karanikas’ review of safety performance metrics: whether the measure is applicable, feasible and appropriate to the condition or performance it seeks to describe (Karanikas, 2016, p. 266). This does not establish the measure’s validity. It identifies matters the pilot must test.

Conclusion

The author’s position is that established safety models become problematic when they are used outside their evidentiary range.

Heinrich remains a prompt to investigate causation beyond fate, provided the explanation does not stop at the worker. The accident triangle remains a prompt to look for meaningful precursors, provided counts are not mistaken for prediction. Injury rates remain useful outcome data, provided they are not used as evidence that fatal-risk controls are healthy. Reason remains a foundation for systems thinking, provided systems are checked in the present tense. Robens remains a reminder that duty holders must exercise judgement provided paperwork is not accepted as a substitute for control effectiveness.

The next useful development may not be another named paradigm or a single replacement metric. It may be a better family of measures that tells people where exposure is occurring while critical controls are degraded, lack certainty or are totally absent.

That proposition likely now needs evidence. The author’s interest is not in declaring a new number but it is in testing whether risk-specific critical-control exposure indicators help supervisors, workers, duty holders and boards recognise degraded protection early enough to act before the harm actually occurs.

References

Borys, D., Else, D., & Leggett, S. (2009). The fifth age of safety: The adaptive age. Journal of Health and Safety Research and Practice, 1(1), 19–27. https://researchonline.federation.edu.au/vital/access/manager/Repository/vital:3557

BP U.S. Refineries Independent Safety Review Panel. (2007). The report of the BP U.S. Refineries Independent Safety Review Panel. https://www.csb.gov/assets/1/20/baker_panel_report1.pdf

Heinrich, H. W. (1931). Industrial accident prevention: A scientific approach. McGraw-Hill.

Karanikas, N. (2016). Critical review of safety performance metrics. International Journal of Business Performance Management, 17(3), 266–285. https://doi.org/10.1504/IJBPM.2016.077244

Karanikas, N., Chionis, D., & Plioutsias, A. (2020). “Old” and “new” safety thinking: Perspectives of aviation safety investigators. Safety Science, 125, Article 104632. https://doi.org/10.1016/j.ssci.2020.104632

Karanikas, N., & Zerguine, H. (2024). Are the new safety paradigms (only) about safety and sufficient to ensure it? An overview and critical commentary. Safety Science, 170, Article 106367. https://doi.org/10.1016/j.ssci.2023.106367

Karanikas, N., & Zerguine, H. (2025). Redefining health, risk, and safety for occupational settings: A mixed-methods study. Safety Science, 181, Article 106698. https://doi.org/10.1016/j.ssci.2024.106698

Manuele, F. A. (2011). Reviewing Heinrich: Dislodging two myths from the practice of safety. Professional Safety, 56(10), 52–61. https://aeasseincludes.assp.org/professionalsafety/pastissues/056/10/052_061_F2Manuele_1011Z.pdf

Reason, J. (2000). Human error: Models and management. BMJ, 320(7237), 768–770. https://doi.org/10.1136/bmj.320.7237.768

Queensland. (2011). Work Health and Safety Act 2011 (Qld), s 18. https://www.legislation.qld.gov.au/view/xml/inforce/current/act-2011-018

Robens, A. (1972). Safety and health at work: Report of the Committee 1970–72 (Cmnd. 5034). Her Majesty’s Stationery Office.

U.S. Chemical Safety and Hazard Investigation Board. (2007). Investigation report: Refinery explosion and fire, BP Texas City, Texas, March 23, 2005 (Report No. 2005-04-I-TX). https://www.csb.gov/bp-america-texas-city-refinery-explosion/

Yorio, P. L., & Moore, S. M. (2018). Examining factors that influence the existence of Heinrich’s safety triangle using site-specific H&S data from more than 25,000 establishments. Risk Analysis, 38(4), 839–852. https://doi.org/10.1111/risa.12869