It’s fair to say that many organisations have moments when the work safety management system looks substantial on the surface but the workplace is no safer for it. A toolbox talk is delivered as intended, ticked off, and filed. A hazard register or SWMS is updated for the fourth time this quarter, each entry rewritten rather than resolved. A safety auditor arrives, finds a folder of current permits and a wall of laminated posters, and leaves satisfied that the system appears working as intended. Unfortunately, it seems, the people in the room often fail to ask whether any of it changed what really happens once the auditor is gone. The performance that mattered is so often the one staged for the seat the auditor occupied. What continues after that seat is empty is sometimes never scripted at all.
Safety theatre occurs when the visible performance of safety becomes more important than the activity’s contribution to controlling risk. The work safety activity may of course have some value but the problem often arises when its display, completion or defensibility is treated as evidence that the underlying hazards are actually controlled. The term ‘safety theatre’ borrows its logic from security theatre, the phrase Bruce Schneier coined for airport screening and similar measures that make people feel more secure without making them more secure (Schneier, 2003). Safety theatre often develops without cynicism or fraud and people may believe the activity matters, and that good faith is part of what makes the performance durable.
The performers in this theatre are not abstract characters….they are the workers whose safe work method statement (SWMS) gets signed, whose toolbox talk gets ticked off, and whose personal safety is the nominal point of the entire production. Every other role considered in this article, including the audience, technician, critic, fire inspector, vendor and legal adviser, exists because of them, not the other way around.
It is worth remembering that the workforce (the cast member) is frequently the most directly exposed to the consequences of failure. Workers cannot simply opt out of the hazards while they perform the work as required, but they can contribute importantly to managing these hazards.
You might like our article on Paper to Practice in Work Safety
The work of safety versus the safety of work
Sidney Dekker’s distinction is a useful diagnostic: much of what safety professionals do is the ‘work of safety’ rather than the ‘safety of work’ (Dekker, 2019). Registers get maintained, procedures get written, toolbox talks get delivered, and inspection reports get filed somewhere.
None of that is inherently useless, but none of it likely guarantees that anyone is safer for having done it. Rae and Provan’s (2019) model of safety work names ‘demonstrated safety’ as one of four categories an organisation’s activity can fall into: work performed for an audience, a regulator, a client, a head office, rather than to change conditions on the ground. Provan, Rae and Dekker’s (2019) ethnography of practising safety professionals, built on that model found that substantial parts of the work they observed served this demonstrative purpose. The professionals interviewed were often aware of the distinction. This is not evidence of a workforce cutting corners, it simply describes stage technicians working in organisations that can recognise visible completion more readily than prevented harm, because averted harm leaves no simple traces to measure by an organisation.
Rae, Provan, Weber and Dekker (2018) gave the resulting build-up a name: safety clutter, the accumulation of procedures, documents, roles, and activities performed in the name of safety that do not contribute to the safety of operations. They identify three mechanisms that generate it – duplication, where the same requirement is re-imposed by different parts of the organisation, generalisation where a control designed for one hazard is applied indiscriminately to unrelated ones and over-specification where procedures are written in more detail than the work requires, until compliance becomes the goal rather than the outcome. Clutter is not neutral as it consumes time and attention that could go into genuine risk reduction, and it potentially breeds a cynicism of safety efforts across organisations. A worker who signs a SWMS that does not describe the job may be responding predictably to a process that has lost fundamental operational value. The signature still creates false assurance for the employer and the worker. The system should therefore ask why accurate participation has become less rational than superficial compliance.
A useful screening question that is echoed throughout the safety clutter research is this: would removing the activity tomorrow increase the risk of harm? A ‘no’ or ‘we do not know’ answer should trigger review, but it does not prove that the activity is clutter. Some activities preserve assurance, consultation, accountability, learning or emergency capability rather than directly changing a hazard. The more prudent test is to ask what safety function the activity performs, which hazard or control it influences, what evidence supports its contribution, who receives the value, who carries the burden, and whether the same function could be achieved more directly or reliably. These questions recur through the rest of this article because their answers should not change with the audience.
Why organisations keep performing
Safety theatre persists in organisations because it is measurable, visible, and comfortable in a way that genuine risk reduction often is not. Patterns across organisations are not new and are often repeatable.
The first pattern is reliance on indicators that look reassuring while measuring the wrong hazards. Hopkins (2009) explains that injury and fatality statistics tend to reflect personal safety rather than the management of process hazards. The two can move in different directions. As Dekker (2019) recounts, BP’s Texas City refinery had improving personal injury statistics before the 2005 explosion that killed 15 workers, and Esso’s Longford gas plant had a low injury rate before the 1998 explosion that killed two workers and cut gas supply to an entire state. Heinrich’s triangle likely does not justify assuming that reducing minor personal injuries will produce a corresponding reduction in major process events. Minor injuries and catastrophic events may arise from different hazards and causal pathways. Decision-makers are also often separated from the work by several reporting layers. Senior management or boards often see a dashboard built from these numbers rather than the conditions that workers encounter on a day to day basis.
The second pattern is the substitution of culture change campaigns for needed structural change. Hopkins has argued that posters, slogans, and hearts-and-minds programmes are largely ineffective because they target attitudes rather than the practices and structures that produce behaviour (Hopkins, 2006). On this view, culture emerges from how an organisation is structured and what it rewards. It is not a set of beliefs installed through a workshop that endeavours to change safety behaviours. We recognise that a safety culture survey may support diagnosis, but its score is ultimately not hard evidence that hazards are controlled. Gonçalves Filho and Waterson’s (2018) review of 41 publications found that most studies were descriptive and made limited attempts to assess the reliability or validity of the outcomes produced. Theatre begins when the score is treated as the result rather than one input to further investigation and action.
The third pattern is over-reliance on the lowest levels of the hierarchy of controls. Administrative controls and personal protective equipment typically provide less protection and reliability than elimination, substitution, isolation or engineering controls. They also tend to depend more heavily on correct and repeated human action (Safe Work Australia, n.d.). While they may still be necessary, particularly as part of a combined control system, they should not become a convenient substitute for a feasible higher-order control. A SWMS or work method whose control column reads ‘worker to be aware of’ and ‘supervisor to ensure’ for every identified hazard potentially does not demonstrate that higher-order controls were considered or adopted by the workplace. The method likely defaulted to the controls that are easiest to document, regardless of whether they address the hazard at its source.
The fourth pattern is drift that has already been normalised by the time anyone audits it. Diane Vaughan’s analysis of the Challenger disaster describes a mechanism worth naming precisely. She claims a small deviation from the documented system occurs, nothing bad happens, the deviation becomes the new normal, and that normal becomes the platform for the next deviation (Vaughan, 1996). Nobody in the organisation experiences this as wilful non-compliance. People come to believe, often reasonably on the evidence available to them, that the adjusted practice works because it has worked every time in the past. By the time an audit takes place, the theatre and the drift can be extremely difficult to distinguish. The documented system says one thing, the workforce does another, and everyone involved can point to a plausible reason why the gap is not a problem. Interim measures that quietly became permanent, trigger points that have been progressively widened over time, and the phrase ‘that’s just how we do things here’ are the visible edges of this process. None of them is likely ever revealed by a folder of current permits alone.
Hero and villain
Work safety unfortunately rarely gets to be a neutral fact in the theatre of work. It is cast, depending on who is telling the story and to whom, as either the hero of the piece or its villain, and the same underlying conditions can support either script. Dekker, Long and Wybo (2016) describe zero-harm commitments as a late-modern salvation narrative: a promise that a world without suffering is achievable, and that pursuing it is morally virtuous, so that the organisation chasing it is virtuous by association. An award for a million hours without a lost time injury, or a Chief executive’s foreword invoking ‘safety first’ or Towards Zero as a value rather than a target, is a typical hero narrative. It performs a function similar to a maturity score and likely tells an audience the show succeeded, whether or not anyone checked what was happening under the stage.
The villain casting runs the other way and is at least as old. Hopkins’ account of victim-blaming after disasters describes how organisations protect their own structures from scrutiny by locating the fault in an individual: a worker who cut a corner, a supervisor who signed off too quickly or a manager who unbecomingly let it happen. The same move works when the target is ‘safety’ itself rather than a person. A procedure blamed for slowing a job, a permit system blamed for a missed production deadline, a work health and safety (WHS) department cast as the reason a project ran over budget and over time. These narratives put safety in the way of the actual point of the exercise, and they licence exactly the workarounds and normalised deviations described above. Hero and villain are opposite scripts, but they do the same underlying work. Both settle the question of who or what caused an outcome before anyone has looked at the system that produced it.
Sleight of hand – ensuring the numbers add up
The first pattern listed above showed that even an honestly reported LTIFR may measure personal safety while revealing little about process safety. The number itself can also be shaped before it is reported. Safety statistics presented at the front of a board pack therefore deserve the same scrutiny as any other part of the organisation performance. Hopkins (1995) documented several practices that can move the published figure without moving the underlying risk. Injured workers may be placed on modified duties so an injury is not recorded as lost time. Ambulances are chased to get workers back to work before an LTI evolved. Claims may be managed in ways that affect what is counted. Reporting cultures may also discourage disclosure because a clean noticeboard reflects well on everyone standing near or in front of it. These effects do not always require crude deceit and they can often emerge through a series of individually defensible decisions.
Other reporting practices also warrant similar scrutiny things like a rate calculated across a large workforce can conceal a cluster of harm in one crew or site. A headline figure that counts employees but excludes contractors may leave heavily exposed workers outside the number. A rolling average can smooth a bad quarter into an unremarkable trend before anyone asks what happened inside it. Even the ‘days since last incident’ sign is stagecraft in the most literal sense in that it can reward silence as visibly as it rewards safety and make an unreported injury the quiet price of avoiding a reset.
None of this means the number is meaningless, or that measurement should be abandoned. It simply means a figure presented without its denominator, exclusions and history is incomplete evidence. If those omissions materially improve the story being told, the figure may also function as misdirection. The useful questions are what decision the figure supports, which hazards it represents, who is excluded, and what would be lost if it stopped being reported. Sometimes the honest answer is that only the noticeboard would change.
The vendors – considering the real value of work safety fads
Commercial safety products should be judged by the same standard as internal programmes. A proprietary safety system, trademarked methodology, licensed app or calculated return on investment does not establish effectiveness. The relevant questions are what evidence supports the method, whether the result was independently evaluated, which operating conditions it depends on, and what effect remained after implementation support ended.
This is not a claim that commercial safety products are worthless in themselves and some do improve controls, information flow or decision-making. The commercial relationship does, however, create an incentive to emphasise favourable results, which makes independent verification more important. Gonçalves Filho and Waterson’s (2018) review illustrates the underlying evidence problem. Most of the studies they reviewed provided descriptive accounts of safety culture maturity and made limited attempts to assess the reliability or validity of the outcomes. A licence fee does not resolve that limitation. A method should not be presented as proven unless the evidence supports that claim.
An effective intervention should leave a trace that outlasts the consultant’s engagement. That trace may be an altered control, capability, decision, operating practice or measurable performance result. The organisation should also know what must be maintained after the vendor leaves it. If neither the mechanism nor the continuing effect can be identified, the product is a candidate for review rather than renewal by default.
The critics
A theatre needs someone to review the performance, and in workplace safety that role is filled by auditors, certifying bodies, and consultancies, Safetysure included. The test already proposed is only as good as the method used to answer it. An audit that checks the permit folder, cross-references the SWMS register, and confirms the training matrix is current has reviewed the programme notes. It has not necessarily watched the performance. Where the audit objective includes implementation or control effectiveness, scrutiny requires observing work-as-done against work-as-imagined. Confirming that the imagined version has been documented is not enough.
This matters because a consultancy that treats documentation as evidence of operational safety, without testing it against what happens on the floor, is not outside the theatre described in this article. It is a critic reviewing the poster. The discipline this places on an auditor is the same one the rest of this piece asks of a safety management system: identify the function being assessed, test the evidence appropriate to that function, and be honest when implementation or effectiveness has not been checked.
Safetysure is not exempt from this, and does not claim to be as a commercial provider of WHS consulting, audit, and reporting services, its recommendations, frameworks and reported metrics are subject to the same questions. What function does the deliverable perform? What decision or control does it improve? What evidence supports that contribution? Stating that standard does not certify Safetysure’s work as substance rather than performance. It states the discipline the firm is accountable to, which is a more modest claim than an assurance of immunity from everything described above.
The role of the theatre fire inspector in the safety theatre
We note that the regulator is considered ‘the audience’, and deserves separating out for several reasons. Rae and Provan’s ‘demonstrated safety’ already casts the regulator as one destination for performed activity, alongside a client or a head office. But a regulator is not simply another member of the audience. Depending on the governing legislation and circumstances, a regulator may require remedial action, prohibit an unsafe activity or commence enforcement proceedings. That statutory authority puts the regulator closer to a fire inspector than to a critic. A theatre critic publishes a view the production may be free to ignore. A fire inspector examines the building itself and may be able to stop the show regardless of how the performance was received.
The distinction matters because documentation alone cannot show the physical condition of a workplace. A fire inspector who only reviews the printed evacuation plan, rather than walking the building and checking exits, is doing a critic’s work while holding an inspector’s authority. An inspection limited to documents and training records may fail to identify whether controls are present and effective in practice. Of course, the consequence of getting this wrong runs in both directions. A regulator who concentrates on paperwork may overlook ineffective controls. A regulator who looks only at physical conditions may miss the drift and governance failures that records, in depth interviews and reporting patterns can expose.
Behind the curtain
Legal professional privilege creates a genuine tension between candour for legal advice and the circulation of information needed for prevention. In Australia, privilege may protect confidential communications created for the dominant purpose of obtaining legal advice or providing legal services in relation to actual or anticipated proceedings. It does not automatically attach to an entire investigation merely because a lawyer commissioned it. A claim may be contested, and privilege may be lost through waiver or may not arise where the relevant requirements are not satisfied (Office of the Australian Information Commissioner, 2024).
The safety problem is not privilege in itself in that it arises if legal control of information prevents operational learning or delays necessary risk controls. An organisation can preserve valid privilege while establishing a separate process for communicating non-privileged facts, corrective actions and lessons to the people who need them. The underlying conditions, existing records and required controls do not become privileged merely because legal advice is sought about them.
Legal review can also influence how procedures are written across organisations and often change the intent of documentation as a tool to help manage risk. A procedure drafted for legal defensibility may serve an evidentiary function as well as an operational one. Those functions are not inherently incompatible, but they should be clearly distinguished. A document written to demonstrate that what is ‘reasonably practicable’ was considered may read differently from one written to describe how the job is performed. Rae, Provan, Weber and Dekker’s (2018) concept of over-specification is relevant where legal or assurance concerns add detail beyond what safe performance requires. The answer is not to exclude legal review, it is to ensure that the operational document remains usable and that any separate evidentiary purpose is addressed deliberately.
What contributes to the theatre of safety
Pulled together, the theatre of safety tends to share a small set of ingredients that contribute to the production in an organisation. Procedures get written without sufficient observation of the actual work, so they describe work-as-imagined rather than work-as-done. Metrics get chosen because they are easy to collect, or presented without the denominator and exclusions needed to interpret them. Culture initiatives and hero narratives ask people to feel differently without changing what the organisation rewards. Villain narratives displace scrutiny onto an individual or onto safety requirements themselves. Commercial programmes may be adopted without adequate evidence. Audits may verify documentation without observing the work it describes, while legal processes may restrict how some information circulates unless a separate learning pathway is established. What remains can be a documentation burden that has grown through duplication and generalisation until nobody can say which parts still perform a useful function. None of these ingredients requires bad faith. A regulator or client may legitimately need compliance demonstrated. A board may find a single number easier to interpret than a complex account of changing conditions.
The theatre survives because every individual scene can make sense on its own terms.
The foundation for effective safety – what lies under the stage
The clearest version of this problem is likely physical and certainly not administrative by nature. Vaughan’s drift and Hopkins’ discussion of process-safety indicators point to the same concern in different vocabularies: interim repairs that were never followed up, safety-critical equipment operating outside approved limits because it has done so without incident for years, and maintenance backlogs that never make it into the report the board sees. None of this shows up in a folder of current permits or a clean LTIFR chart. The stage set can be repainted every season while the floorboards underneath it keep decaying, and a wall of laminated posters says nothing about the effectiveness either.
The same discipline, aimed at the floorboards rather than the paperwork, is what turns a documentation review into an inspection of the building itself. It does not ask an organisation to abandon structure at all but asks the organisation to identify the function of each element, test the evidence of its contribution and redirect resources away from activities whose burden outweighs their value.
The alternative to safety theatre is likely not the absence of structure in that it must include engineered controls, measures of the performance of safety-critical controls, attention to maintenance backlogs and management-of-change integrity, and information flows that let bad news travel upward before it becomes a disaster. These measures do not replace every injury statistic, procedure or assurance activity but they fundamentally connect the system more directly to the hazards and controls that matter.
The honest question for work safety practitioners
Every element described in this article, the register, the maturity score, the toolbox talk and the privileged investigation, can make a useful contribution or become part of the performance. The difference is rarely visible from the programme notes. Organisations prepare safety information for boards, regulators, clients, workers and other audiences, each with different needs. Those accounts are necessarily selective and they should not be mistaken for direct evidence that the hazards facing the workforce have changed at all. The honest questions remains for organisations and safety practitioners themselves What function does this activity perform, what evidence supports its contribution, and would another approach achieve the same function more directly or reliably?
Few organisations are purely one thing or the other, and that is the uncomfortable element of this article. What matters in any work safety programme is not its scale, documentation, awards or the story it lets an organisation tell. It is whether the organisation can show a defensible contribution to controlling the specific hazards facing a specific workforce on any day and under any conditions.
A performance only exists while someone is in the audience. A control must make its contribution under the conditions in which it operates, whether or not it is being observed and that contribution, not the quality of the show around it, separates the theatre from the substance.
References
Dekker, S. (2019). Foundations of safety science: A century of understanding accidents and disasters. CRC Press.
Dekker, S. W. A., Long, R., & Wybo, J. L. (2016). Zero vision and a Western salvation narrative. Safety Science, 88, 219–223. https://doi.org/10.1016/j.ssci.2015.11.016
Gonçalves Filho, A. P., & Waterson, P. (2018). Maturity models and safety culture: A critical review. Safety Science, 105, 192–211. https://doi.org/10.1016/j.ssci.2018.02.017
Hopkins, A. (1995). Making safety work: Getting management commitment to occupational health and safety. Allen & Unwin.
Hopkins, A. (2006). Studying organisational cultures and their effects on safety. Safety Science, 44(10), 875–889.
Hopkins, A. (2009). Thinking about process safety indicators. Safety Science, 47(4), 460–465. https://doi.org/10.1016/j.ssci.2007.12.006
Office of the Australian Information Commissioner. (2024). Making claims of legal professional privilege. https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/making-claims-of-legal-professional-privilege
Provan, D. J., Rae, A., & Dekker, S. W. A. (2019). An ethnography of the safety professional’s dilemma: Safety work or the safety of work? Safety Science, 117, 276–289. https://doi.org/10.1016/j.ssci.2019.04.024
Rae, A., & Provan, D. (2019). Safety work versus the safety of work. Safety Science, 111, 119–127. https://doi.org/10.1016/j.ssci.2018.07.001
Rae, A. J., Provan, D. J., Weber, D. E., & Dekker, S. W. A. (2018). Safety clutter: The accumulation and persistence of ‘safety’ work that does not contribute to operational safety. Policy and Practice in Health and Safety, 16(2), 194–211. https://doi.org/10.1080/14773996.2018.1491147
Safe Work Australia. (n.d.). Managing risks. https://www.safeworkaustralia.gov.au/safety-topic/managing-health-and-safety/identify-assess-and-control-hazards/managing-risks
Schneier, B. (2003). Beyond fear: Thinking sensibly about security in an uncertain world. Copernicus Books.
Vaughan, D. (1996). The Challenger launch decision: Risky technology, culture, and deviance at NASA. University of Chicago Press.
You might like to read our article on Regulating Psychosocial Safety at Work