A risk assessment is a piece of paper. A guard is a piece of metal. Neither keeps anyone safe on its own a year later, on a wet Tuesday, with a new manager. What keeps a workplace safe over years is a loop that runs and runs. Plan. Do. Check. Act.
Plan→Do→Check→Act
Plan: decide what the risks are, what will be done, and who does it. Do: do it, with the training and the money it needs. Check: go and look. Are the guards on? Are the rules followed? Was anyone hurt? Act: fix what the checking found, and change the plan. Then go round again.
Walk round
↓→
Guard missing
↓→
Which part?
A manager finds a guard missing during the monthly walk round. Which part of the loop is that?
Plan.
Not yet. The plan said there would be a guard. The walk round is how the plan gets compared with the floor, which is checking.
Check.
Right. Going and looking is the check. What the manager does about it next is the act, and the loop is working only if that happens too.
Do.
Not yet. Fitting the guard in the first place was do. Finding that it has gone is a different move: looking at what do left behind.
Checked weeklywaits about three and a half days
vsvs
Checked yearlywaits about 6 months
Checking is the part that gets skipped, because nothing seems wrong until you look. A guard taken off for cleaning and never put back looks exactly like a guard that was never there. The longer between checks, the longer a missing guard stays missing. On average, it waits half the gap.
Move the control to set how often somebody checks. A guard comes off at a random moment, so on average it waits half the gap before the next check finds it.
Days it waits, on average3.5 days
A year, for size365 days
Every weekChecked every week. A guard that comes off at a random moment waits about three and a half days, half the gap, before the check finds it.
Days it waits, on average15 days
A year, for size365 days
Every monthChecked every month. A guard that comes off at a random moment waits about 15 days, half the gap, before the check finds it.
Days it waits, on average45.5 days
A year, for size365 days
Every three monthsChecked every three months. A guard that comes off at a random moment waits about 46 days, half the gap, before the check finds it.
Days it waits, on average182.5 days
A year, for size365 days
Once a yearChecked once a year. A guard that comes off at a random moment waits about 182 days, half the gap, before the check finds it.
Days it waits, on average365 days
A year, for size365 days
NeverNobody checks. The guard stays off until somebody is hurt, or until the machine is sold. The bar shows a year; the truth has no end.
A firm checks once a year. On average, how long does a missing guard stay missing?
A whole year.
Not yet. A year is the worst case, when the guard comes off the day after the check. On average it comes off halfway, so the average wait is half a year.
About six months.
Right. It comes off at some random point in the year, so on average halfway through. Six months of a machine running with its blades open, and nobody knows.
About a week.
Not yet. A week is roughly the wait when checks are twice a week. With one check a year, the gap is fifty times longer, and so is the wait.
Move the control.
A warehouse has had two near misses with the forklift at the loading door. Put the loop's four moves in order.
Tap them in order, first to last.
Plan the walkway→Paint and brief→Walk and count→Move it
Right. Decide, do, look, change: plan, do, check, act. The fourth move is the one most places skip, and it is the one that feeds a better plan into the next turn of the loop.
Guard back on, unaskedgood culture
vsvs
Perfect paperwork, guard offbad culture
There is a word for what the loop builds: safety culture. It means what people do when nobody is checking. In a good culture a worker puts the guard back because that is how things are done here, and says when it is broken. In a bad one, the paperwork is perfect and the guard is off.
Manualevery box ticked
vsvs
Guardoff for a year
vsvs
Where is the break?
A factory has a thick safety manual, every box ticked, and a guard that has been off for a year. Which part of the loop has broken?
Check. Nobody has gone to look, so the paper and the floor have come apart.
Right. The plan exists and the guard was fitted once. What stopped is the looking, and without it the act never happens either. A loop with no check is a straight line.
Plan. The manual must be wrong.
Not yet. The manual says there is a guard, and that was right when it was written. The paper is not wrong about the plan; it is wrong about the present, and only looking finds that.
Do. The guard was never fitted.
Not yet. It was fitted; it came off a year ago. The failure is not in doing the work but in nobody noticing that the work had been undone.
Fire planSeptember
↓→
New store roomMarch
↓→
Then?
A school writes a fire plan in September and files it. In March a new store room is built across the corridor that was the escape route. Nothing else happens. What did the loop need?
A thicker plan in September that covered every future change.
Not yet. No plan written in September knows what will be built in March. The loop exists because plans go stale, not because they were too thin.
Check and act: someone to walk the route, see it is blocked, and change the plan.
Right. No plan foresees a wall. The loop is built for this: a check in March finds the wall, and the act redraws the route before anyone needs it.
Nothing. The plan was done.
Not yet. The plan was done; the corridor is gone. A fire plan that leads into a wall is worse than no plan, and only checking tells the school it has one.
Lesson complete
Safety is a loop that runs for years: plan, do, check, act. The part that gets skipped is the checking.