TECHNIQUE WORKS

HSEQ INSIGHTS · MONTHLY BRIEFING

PUBLICATION

HSEQ Insights

WRITTEN BY

Amador Brinkman

OPERATIONS

Western Europe · The Gulf

EDITION 14 · October 2026

The Hierarchy of Controls & Management of Change

The Padlock Nobody Fitted

Last month's edition ended with a padlock.

At Buncefield, behind the level gauge that stuck fourteen times, there was one more barrier: an independent high-level switch. Its only job was to stop the flow into Tank 912 if everything else failed. It was new, fitted on 1 July 2004.

The switch had a test lever. To test the switch, you moved the lever. After the test, the lever had to be held level, and a padlock did that. If the padlock was not in place, the lever could be left down or fall down, and the switch would be off in that position.

Nobody told the people who installed it and looked after it. The investigation found that the contractor's staff thought the padlock was "for security 'anti-tamper' purposes only". So it was never fitted, and after each test the lever was left where the switch could not work or where it could drop into that position.

In the early hours of 11 December 2005, the gauge stuck again, the switch did not trip, and more than 250,000 litres of petrol came out of the roof vents of Tank 912.

One incident from my own work comes to mind every time I tell this story.

A forklift operator was loading flatbed trucks with pallets of petrochemical pellets, around 22 pallets a truck, trip after trip between the warehouse and the yard. The warehouse floor sat slightly above the yard, and where the two met, someone had built a short ramp: about 25 centimetres high, steep, with nothing along its edge.

The ramp met the requirements in the drawing. Nobody put it through management of change, and nobody added it to the risk assessment. It was too small to be a change.

On one trip, a moment's loss of focus put one wheel over the side of the ramp. The truck tipped. In a tip-over the instinct is to get out, and he tried to. He was seriously injured, with fractures to his foot and his shoulder. His helmet and the cab frame protected his head.

Nobody on that site expected anything to happen on a 25-centimetre slope. A kerb or a barrier along that edge would have worked on every trip, whether or not the driver was concentrating. What the site had instead was the driver's attention.

Each time I return to Buncefield, I am struck by how ordinary it appears. The switch was a well-engineered control. Without anyone deciding it, it became a control that depended on a person remembering one step after a test. Nobody remembered, because nobody knew the step was there.

Section 1: The Case

September's edition was about the tracker: reports closed in the system while the condition behind them stayed the same. October moves from the tracker to the equipment, because the same thing happens there, only more quietly.

Start with the list every risk assessment course teaches. ISO 45001 sets it out in clause 8.1.2, in this order: eliminate the hazard; substitute it with something less hazardous; use engineering controls and reorganise the work; use administrative controls, including training; and use personal protective equipment. The standard's own guidance says each level is less effective than the one before it.

The reason is simple. The top three levels work while nobody is watching. A hazard that has been removed cannot hurt anyone at 02:00. A fixed guard is present during the night shift, on weekends, and on the day when the supervisor is sick. The bottom two levels need a person to remember the right thing every time, under whatever pressure the shift brings that day.

A lot of organisations treat an engineered control as finished once it has been installed and written into the risk assessment. As a matter of fact, engineered controls move down the hierarchy all the time, and nobody signs anything when they do. In my experience it happens in three ways.

The first is defeat. An interlock stops the machine when a gate opens, which is exactly what it is for and what makes fault-finding slow. So someone bridges it, tapes it, or leaves a spare key in the switch. From that moment the guard is no longer an engineered control. It is a rule: do not reach in while it is running. A rule is an administrative control, two levels down.

The second is decay. A guard is damaged by a forklift. A sensor is misaligned. An automatic shut-off is not tested or is tested and not put back in working order. A control that no longer works looks exactly like one that does, so nobody notices until the day it is needed.

The third is change. Equipment is replaced, a line is extended, software is updated, the speed goes up, and the night shift is reduced by one person. Each change can turn an engineered control into something that only works if someone remembers an extra step. Buncefield is the third route. A new switch was fitted in 2004, and it came with a hidden step that nobody wrote into any procedure.

All three routes share a common feature. The paperwork does not move. The risk register still states that it is an "interlocked guard". The audit checks that the risk assessment exists and is signed. Most sites have fewer working controls at the top of the hierarchy than their risk assessments claim, and the actual number is unknown to everyone in the building.

That is why this is a leadership subject and not only an engineering one. Every move down the hierarchy saves something today: time on a changeover, cost on a project, a few minutes on a jam. The cost of that saving falls on one person, usually at night and usually the most experienced one on the shift, because he is the one trusted to clear the fault. Nobody in the boardroom decided that. Nobody had to.

Section 2: The Evidence

Go back to Buncefield, because the official investigation says more about change than most people remember.

The regulators' own report, Buncefield: Why did it happen? (2011), explains that the switch could be fitted to warn of a high level or a low level. To stop an overfill, as it was here, moving the test lever down switched it off. The padlock was there to keep the lever level in normal operation, and the report calls it "a vital safety feature". The supplier did not pass that on to the contractor who installed and maintained it or to the site operator.

Then comes the part that matters for this edition. "Critically", the report says, the 2004 replacement of the switches should have gone through a formal management of change process: an engineering look at the benefits and disadvantages of the change and "a consideration of what changes in procedures (e.g., in testing) would be necessary as a result." The site's own safety report required that review for critical equipment. For the switch on Tank 912, "no such procedure was considered."

One question was asked at that point: what has to be done differently after a test on this new switch? , would very likely have found the padlock.

After the incident, the switch manufacturer changed the design. A pin now stops the lever from travelling below the level. The solution that worked was an engineering one. The step someone had to remember became a part that does the job on its own.

Buncefield is not the first time a change has done this. Management of change as a discipline is widely traced back to Flixborough in 1974. A crack was found in one of six reactors at a chemical plant. To keep production going, the damaged reactor was taken out, and a temporary bypass pipe was fitted between the two reactors on either side. The openings were 28 inches across; the largest suitable pipe they could find on site was 20 inches. The bypass was put together on site, supported on scaffolding, and only limited calculations were done on it. About two months later it failed. Twenty-eight people were killed, eighteen of them in the control room.

A temporary change, made in a hurry, to keep the plant running. Every site manager reading this report has approved one.

Defeat is the other route, and the numbers on it are uncomfortable. In a study published in 2006, the German accident insurers asked close to 1,000 safety specialists in metalworking companies how often protective devices on machines are defeated. Their estimate was close to 37 per cent of protective devices, permanently or temporarily. A follow-up online survey across all sectors, run from 2020 to 2022, measured it a different way and put it at 27.2 per cent of machines: still more than one in four. The most common reasons given were fault-finding, setting up and repair, and about half of the respondents said their company had had at least one accident or near miss caused by a defeated protective device. These are expert estimates, not measurements, and they should be read that way. They still point in one direction.

The fatal cases point the same way. A NIOSH study found that maintenance was mentioned in 24 of the 41 robot-related deaths at work in the United States between 1992 and 2017, which is 58.5 percent. Where the type of maintenance was described, the most common tasks were unjamming, cleaning a sensor and troubleshooting. Most of the people killed were not running the robot. They were fixing it.

The law already expects all of these actions. The UK's work equipment regulations (PUWER) require that guards and protection devices "not be easily bypassed or disabled." The EU Machinery Directive says the same: guards must "not be easy to by-pass or render non-operational". ISO 14119, the international standard for safety switches on machine guards, updated in 2024, has a whole section on designing them so people have less reason to bypass them. And for change, ISO 45001 clause 8.1.3 requires a process to control planned changes, both "temporary and permanent", including changes to equipment, work organisation and the workforce. The EU's Seveso III Directive, which covers every site holding large quantities of dangerous substances, makes management of change a required part of the safety management system.

The duty is written down in every document your auditors review. What most sites are missing is someone who checks whether the top control is still in place.

Case Study

Consider a composite, drawn from a pattern I have seen at more than one site in Western Europe: a manufacturer with automated end-of-line packing and palletising, three shifts, and a capital plan that has been adding automation for several years.

The business case for each automation project included a safety line, and it was true. Fewer people near moving parts. Fewer manual lifts. In normal running, the line was safer than the one it replaced.

The risk moved to the moments that were not normal. The palletiser cell had interlocked gates, and the risk assessment listed them, correctly at the time, as an engineering control. Then the line changed, one project at a time. A conveyor was extended, adding a new way in, protected by light beams that stop the machine when someone passes through. A software update changed what happened when a jam cleared: the machine could now restart on its own once a sensor saw the product move. The line speed went up, and with it the number of jams on the night shift.

Engineering approved each change. Each one worked. None of them went through a review that asked three plain questions: where do people now have to go to clear a fault, what stops the machine while they are there, and do the procedure, the isolation point and the training still match the line?

So the night shift found its answer. Isolating the cell properly meant walking to a panel at the far end of the line, locking off, clearing the jam, and waiting for the system to restart. Clearing the jam itself took a fraction of that. A spare gate key appeared in a drawer. Then it was in the switch. The interlocked gate was still on the drawing and still in the risk assessment. On nights, it had become a rule about not reaching in, followed by experienced people who were confident they knew when the machine would move.

The day the restart logic surprised one of them was the day the site found out what its risk assessment was worth. In this composite, he was lucky: a bruised arm and a near miss. A fish processor in Shetland was sentenced in August 2026 for a case where the outcome was much worse (see this month's Market Insights).

What changed afterwards was not expensive, and very little of it was about training.

The site walked the line at night, with the people who actually clear the jams, and listed every task that happens outside normal running: jam clearing, sensor cleaning, changeover, and fault-finding. For each task, one question: which control here works without anyone having to remember it?

Where the honest answer was "none", the solution was escalated up the hierarchy. A power switch that can be padlocked off was fitted right next to the machine, so making it safe took less time than walking past it. The loose gate key was replaced by a key system that physically ties the gate to the power: the gate cannot open while the machine is live, and the machine cannot start while the gate is open. The restart logic was changed so that clearing a jam required a deliberate reset from outside the cell. Engineering also investigated the cause of the jams, because a guard that people defeat every night indicates that the design does not fit the work. ISO 14119 says the same thing in the language of a standard.

Two rules were added for the future. Any bypass or override is entered in a register, with a name, a reason and an end time, and the production manager reads that register every week. And no change to the line goes live until someone from the shift that will clear its faults has walked it and signed that the isolation points, the procedure and the training match what is now on the floor.

No two operations produce the same numbers, so the benchmarks here come from published research rather than from one site. In the United States, OSHA estimates that compliance with its lockout/tagout standard, the rules for isolating machinery before people work on it, prevents around 120 deaths and 50,000 injuries a year, and that a worker injured by unexpected energy loses on average 24 working days. The German survey quoted earlier puts the share of machines with a defeated protective device at 27.2 per cent. Use them as a yardstick for your own night walk, not as a target.

THE CHANGES YOU ALREADY MADE

Everything above is about the next change. It leaves unchanged the changes already sitting in your operation that never went through a review, and that is where most managers stop reading.

Every site has them. The bypass fitted during a breakdown two years ago is still in place. The spare part that fits but is not the same design. The procedure that replaced a guard was in place "until the new one arrives". The night shift went from five people to four, but with the same tasks. None of them were reckless decisions. Each one solved a problem that week.

They are also why a management of change procedure on paper does not protect you. The procedure only sees changes that someone thinks of as changes.

Start with one rule that removes most of the argument: if it is not the same design, it is a change. US process safety law has a phrase for it, "replacement in kind": a replacement built to the same design specification. Anything else counts as a change and goes through review. At Buncefield, a new switch went in without that review, and nobody asked what had to be done differently after a test.

Then identify what is already there. You will not find it in the change log, because it never went in. Ask the people who maintain and run the equipment: what do you do that is not in the procedure, and what is "temporary" on this line? Look for extra wires fitted to get round safety switches and keys that override them. Search the maintenance system for the term "temporary." Most sites discover more than they expected in one afternoon.

For each item, one of three decisions, taken by someone with the authority to take it: put the engineered control back; make the change properly, with the risk assessment, the isolation points, the procedure and the training brought up to date; or stop the activity. A temporary change gets an end date and an owner, because ISO 45001 clause 8.1.3 covers temporary changes as well as permanent ones, and an auditor who finds a temporary bypass with no end date has found an uncontrolled change.

This November's weekly emails cover the full management of the change process, from the first request to the check months after go-live. This edition only asks for one thing: know which of your controls have already moved.

Section 3: The Principle

June's edition argued that the business continuity plan belongs to the business. July's edition argued that an investigation's finding is a leadership decision. August's said the same about the board dashboard, and September's about what happens after a report is filed.

October adds one more. The level of the hierarchy at which a risk is controlled is a leadership decision, and so is every move down it.

Each move down saves something visible today and moves the cost onto someone invisible tonight. A procedure is cheaper than a guard. A sign is cheaper than a procedure that someone checks. A gloved hand is cheaper than a redesign. None of these trades is wrong in itself. Occasionally the guard is not practicable, and the law allows for that. What makes them dangerous is that nobody with authority sees them being made, so nobody accepts them in writing, and nobody checks a year later whether the "temporary" answer is still in place.

The issue matters to a board for a reason beyond the next incident.

Picture the site visit during due diligence. A buyer's technical adviser, or your own, walks the line with the risk register in his hand. The register says interlocked guards. He finds a key in a switch and a sign on a gate. He asks for the change records for the last three changes to that line, and there are none. He will not read your risk register as evidence of control. He will read it as a document that describes a site you no longer operate.

That conversation usually does not affect the headline price. What it does is slower: the buyer asks for a remediation plan, a specialist survey of the machinery, an indemnity, or a capex line for guarding and controls in the first year. And from January 2027, new machinery placed on the EU market has to meet the new Machinery Regulation, so the equipment you are specifying today will be judged against it.

None of this needs a new system. It needs the people at the top to stop accepting "engineering control" in a risk register as proof and to ask, now and then, to see it working.

HSEQ MARKET INSIGHTS · MONTH YEAR

HSEQ MARKET INSIGHTS: OCTOBER 2026

Four reference points for anyone whose risk assessment is more confident than the floor.

1. A damaged interlocked gate, a removed panel, and a £451,500 penalty. In August 2026, Pelagia Shetland Ltd was fined £420,000, plus a £31,500 victim surcharge, after a supervisor clearing a blockage on a palletiser was struck repeatedly by the machine. A forklift had damaged the interlocked gate in early 2024. Two senior staff, including the injured supervisor, had been removing a loose fence panel to clear frequent blockages without isolating the power, and the machine restarted when he triggered a sensor. The HSE inspector: "Interlocking guards exist for one reason: to stop people reaching dangerous machinery while it's still live." Source: HSE press release, 28 August 2026; Lerwick Sheriff Court, sentenced 26 August 2026.

2. The EU Machinery Regulation applies in less than three months. Regulation (EU) 2023/1230 replaces the Machinery Directive from 20 January 2027. It keeps the duties that guards must not be easy to bypass and that manufacturers design for "reasonably foreseeable misuse" and adds requirements on control systems that must withstand malicious attempts to interfere with them. Machinery bought now for delivery next year should be specified against the regulation. Great Britain stays under its Supply of Machinery Regulations; Northern Ireland follows the EU. Source: Regulation (EU) 2023/1230, Annex III; eur-lex.europa.eu.

3. More than one machine in four still has its protection defeated. The IFA's 2020 to 2022 online survey estimates that 27.2 per cent of machines have permanently or temporarily defeated protective devices. Most respondents, 57.3 per cent, believe it happens less often than ten years ago. Fault-finding, setting up, and repair remain the most common reasons for defeating protective devices, and about half of respondents reported at least one accident or near miss caused by such a device. Source: IFA, online survey on the manipulation of protective devices, 2020 to 2022; reported in BGHM Magazin 02/2023.

4. In the Netherlands, many companies do not reach the first rung. The Dutch Labour Inspectorate's Arbo in Bedrijf 2024-2025, published in April 2026, found that only 68 per cent of companies have a risk inventory and evaluation (RI&E) and that 45 per cent of companies working with hazardous substances take no or insufficient measures to control the risks. A hierarchy of controls starts with knowing the hazard is there. Source: Nederlandse Arbeidsinspectie, Arbo in Bedrijf 2024-2025, 23 April 2026.

QUESTIONS FOR YOU TO CONSIDER

Six questions. They are diagnostic, not rhetorical.

1. For your three highest risks, at which level of the hierarchy is each one controlled today, on the floor, on the night shift? Is that the same level your risk assessment states?

2. How many bypasses, overrides and "temporary" changes are in place on your site right now? If nobody can give you a number, that is the finding.

3. Which of your safety-critical devices only works if someone remembers a step after testing or maintenance: a lever, a key, a reset, or a valve put back in position?

4. For the last three changes to your most automated line, who checked after go-live that the isolation points, the procedure, and the training still matched the equipment?

5. When a guard or interlock is defeated on your site, does anyone ask why the design was made that attractive, or only who did it?

6. Is the machinery you are buying this year specified against the EU Machinery Regulation that applies from January 2027?

PRACTICAL ACTION

Five steps, in sequence, with what each one actually costs.

Step 1. Walk one line at night. One shift. Take your most automated or most changed line and walk it on the night shift with the people who clear its faults. List every task outside normal running: jam clearing, cleaning, changeover, and fault-finding. For each task, write down the control that actually protects the person doing it, as it is, not as it is written. The gap between the two lists is the finding.

Step 2. Count what has moved. One afternoon. Count the bypasses, override keys, extra wires around safety switches and "temporary" changes in place on that line. Search the maintenance system for the term "temporary." Do not judge them yet. The number is the only slide you need to start the conversation.

Step 3. Decide each one. Half a day, the management team is in one room. For each item from Step 2, one of three decisions must be made: Restore the engineered control; make the change properly, with risk assessment, isolation, procedure and training updated; or stop the activity. Temporary changes have an owner and an end date. Write the decision down, with the name of the person who took it.

Step 4. Start a bypass register. Ten minutes a week. Every bypass or override goes in, with a name, a reason and an end time. The production manager, not HSEQ, reads it every week, and anything past its end time goes to his manager automatically.

Step 5. Include the night shift in every change. One hour per change. No change to equipment, software, speed or staffing goes live until someone from the shift that will clear its faults has walked it and signed that the isolation points, the procedure and the training match. Then verify again three months later. This November's weekly emails break this step down in detail.

If you cannot run all five, run Step 1 on its own. One night walk, written down honestly, is very difficult for anyone to set aside.

PERSONALISED RECOMMENDATIONS

For the CEO / General Manager

At your next site visit, ask to see one interlock work. Ask the person responsible for the cell to open a gate while it is running, and watch to see if it stops. Then ask how many bypasses are open on the site today and who decided each one.

Three things separate a real answer from a confident one. A real answer has a number. It names the person who accepted each bypass. And it comes with an end date. Please ensure you obtain all three, and your system will be functioning properly. Get none, and you have learned more than an audit report would tell you. You are not expected to know where every isolation point is. You are expected to make it normal for people to show you the control working, rather than the document that says it exists.

For the COO / Operations Director

Most of the changes that move controls down the hierarchy start in your budget and your schedule: a speed increase, a shift pattern, a cheaper spare part, a project finished on time by skipping a review. Most of the defeated guards are your people who are solving your production problem. Start there, because the solution is often a production fix. A line that jams less is a line whose interlocks get defeated less.

Your first concern may be the time involved, so here is the breakdown of the costs. One night walk per line, one afternoon to count, half a day to decide, ten minutes a week for the register, and one hour per change for the shift sign-off. The cost of not doing it arrives on a single night, and it is measured in something apart from hours.

For the HSEQ Director

Your risk register is only as true as the last time someone checked it on the floor. Propose the night walk, own the method, and hand the decisions to the line, where they belong. Sit in on every change review and ask the engineers what new information the person clearing a fault on this equipment must remember today compared to yesterday.

When you encounter a defeated interlock, resist the urge to treat it as a discipline case first. Ask why the design made it worth defeating. Occasionally the answer is a person who took a shortcut. More often than not, it is a guard who turns a two-minute task into a twenty-minute one. A function that only finds offenders will stop hearing about bypasses. A function that fixes the reasons will hear about all of them.

None of these findings is a verdict on your engineers or your operators. Almost every site with a few years of changes behind it has controls that have moved. Knowing which ones has been the missing part.

NEXT MONTH

November moves from the equipment to the person.

At Buncefield, someone tested the switch and left the lever where it could not work. At Flixborough, someone built a bypass from the available pipe. On the automated line, a gate that should have been locked was opened by someone. In every investigation report, that person appears at the end of the chain, and the word that usually follows is 'error'.

November's edition is about human error before the investigation: how people actually make decisions under time pressure, why the same mistake keeps happening to different people, and why most programmes spend their money on training and signs while ignoring what happens to people after they act. Alongside it, the weekly emails will take management of change step by step, from the first request to the check months later.

If this edition describes your organisation, or one you sit on the board of, you are not alone in it, and it is a conversation worth having before it becomes an investigation.

We are always open to talking it through, with no agenda beyond understanding your situation. Send me a direct message on LinkedIn, write to info@techniqueworks.com, or pick up the phone: +31 (0) 85 212 95 44.

Each edition of Technique Works HSEQ Insights is published monthly at insights.techniqueworks.com. Subscribe to receive it directly; the archive, including September's edition on closing near-miss reports, August's on board-level safety metrics and July's on incident investigation, is there now.

If it belongs in your GM's inbox, your COO's, or your HSEQ director's, forward it as is.

Subscribe → insights.techniqueworks.com

TALK IT THROUGH

Technique Works · HSEQ Insights Newsletter · Edition 14 · October 2026