QEHS terminology, defined.

Rate of cases involving days away, restricted duty, or job transfer.

DART = ((column H + column I cases) × 200,000) / hours worked. It captures the OSHA form 300 columns H (days away from work) and I (job transfer or restriction), so it counts every case that changed what the worker did — sent them home, moved them to light duty, or transferred them to another job. DART is more severity-weighted than TRIR and less noisy than LTIR, which is why it is the rate many safety programs track as their primary severity measure. DART and TRIR move together in a well-run program, but they can diverge. A rise in DART while TRIR holds steady means the cases that are happening are more severe — more people losing days or being restricted — even if the count of recordable cases is flat. That divergence is the signal that separates a frequency problem from a severity problem, and it changes the intervention: frequency points at hazard exposure and pre-task control, severity points at high-energy events and the serious-injury-and-fatality prevention agenda. See TRIR and LTIR; for the upstream measures, see leading indicator.

Related: trir, ltir

A reactive metric measuring past performance.

A lagging indicator measures what already happened — TRIR, LTIR, DART, the lost-time injury count, the fatality count, the citation count, the environmental release count. It is the metric a customer or a regulator asks for first because it is comparable across employers and because OSHA defines the numerator and the denominator. A lagging indicator is the bottom line of safety performance: it tells you whether harm happened, not whether it is about to. The weakness of a lagging-only program is steering. A rate that counts recordable cases tells you the program failed after the failure, on a lag of weeks to months, and at a granularity where a single event swings the number at a small site. Programs that report only lagging indicators to leadership are flying blind between reviews, because the leading measures — near-miss rate, overdue corrective actions, inspection closure, training compliance — move before TRIR does. The honest use of a lagging indicator is as the outcome variable the leading indicators are trying to move, not as the day-to-day steering signal. See leading indicator, TRIR, and DART.

Related: leading-indicator, trir

A proactive metric predicting future performance.

A leading indicator is a proactive metric that predicts future safety performance — it changes before the lagging indicator it predicts. The standard examples are near-miss rate, inspection closure time, training-currency rate, observation-to-action conversion, and corrective-action overdue rate. A program that reports only lagging indicators is reacting to what already went wrong; a program that reports leading indicators is steering toward what is about to. The discipline is in the definition. A leading indicator has to have a defensible causal link to the lagging outcome — near-miss rate predicts incident rate because the same hazards produce both, and corrective-action closure time predicts recurrence because an open action is an unremoved hazard. A metric without that link is just a number. The other discipline is that a leading indicator has to be movable by the program: a rate the program cannot influence is a weather report, not a control. For the contrast, see lagging indicator; for the rate a leading program tries to push down, see TRIR.

Related: lagging-indicator, trir

Cases with days away from work, per 100 FTE per year.

LTIR = (lost-time cases × 200,000) / hours worked. It is a subset of TRIR that counts only the cases with days away from work — OSHA form 300 column H. Because it filters for the cases that kept someone off the job, LTIR is a sharper severity signal than TRIR, which counts every recordable case equally regardless of whether the worker lost a day or an hour. The trade-off is sample size. Lost-time cases are rarer than recordable cases, so LTIR is noisier at small sites and can swing on a single event. The jurisdictions that emphasise lost-time over broader recordability — and the customers that ask for it — tend to be in Europe and Australia, where the model WHS framework and the RIDDOR-style reporting rules weight days lost heavily. For most programs LTIR sits beside TRIR rather than replacing it: TRIR shows how often harm happens, LTIR shows how severe it is when it does. See TRIR and DART.

Related: trir, dart

Lost-time injuries per million hours worked.

The Lost Time Injury Frequency Rate is the metric the rest of the world uses where the US uses TRIR — lost-time injuries normalised to a fixed hours denominator so employers of different sizes can compare. The formula is the number of lost-time injuries multiplied by a million and divided by the hours worked, and it is the benchmarking currency in Australia, the UK, and global mining and construction, where a customer or a principal contractor asks for the LTIFR before they let a contractor on site. A lost-time injury is a work-related injury that keeps the worker off at least one full scheduled shift after the day of the incident, and the threshold is what makes the number comparable across employers. The difference between LTIFR and the US TRIR is the denominator and, in practice, the population. TRIR normalises to 200,000 hours — 100 workers at 2,000 hours — and LTIFR to a million, so the two numbers are not directly comparable and a program that reports both has to label them clearly. The weakness of LTIFR is the same as every lagging indicator: it counts the failures that already happened, on a lag, and a small site can swing the number with a single event. The honest use is as the outcome the leading indicators — near-miss rate, overdue corrective actions, inspection closure — are trying to move. See LTIR, TRIR, and DART.

Related: ltir, trir, dart

Days lost per recordable incident, measuring injury seriousness.

The severity rate is the metric that asks how bad the injuries are, not how many — the total days away from work divided by the number of recordable incidents. A TRIR of 3.0 tells you the frequency; the severity rate tells you whether those three incidents were cuts that needed a stitch or amputations that ended a career, and a program with a low frequency and a high severity is a different risk profile from one with a high frequency and a low severity. OSHA recordkeeping under 29 CFR 1904 counts the days away from work on the 300 log, and the severity rate is the number that surfaces the catastrophic-event risk a frequency metric can hide. The severity rate is the companion to TRIR, not a replacement, and a program that reports only the frequency is reporting only half the picture. The trend that should worry leadership is the severity rate that rises while the TRIR falls — fewer incidents, but the ones that happen are worse — because that is the signature of a program that suppressed the minor injuries without addressing the serious-injury potential underneath. The leading indicators that predict a severity spike are the near-misses with serious potential, the SIF precursors, and the management-of-change gaps — the measures that move before the catastrophic event does. See TRIR, LTIR, and DART.

Related: trir, ltir, dart

Recordable injuries per 100 full-time workers per year.

TRIR = (recordable cases × 200,000) / hours worked. OSHA uses 200,000 as the normalising constant (100 full-time-equivalent workers × 2,000 hours per year). It is the single most-cited safety metric in the industry and the one a customer or a regulator asks for first, but it is a lagging indicator — it measures what already happened, not what is about to. A TRIR of 0 is not a safe site; it is a site with no recordable cases in the window, which can mean excellent control or under-reporting. A recordable case under OSHA 29 CFR 1904.7 is a work-related injury or illness that results in death, days away from work, restricted duty or job transfer, medical treatment beyond first aid, or loss of consciousness. The first-aid list in 1904.7(b)(5)(ii) is what separates a treatable case from a recordable one. TRIR is comparable across employers because the numerator and the denominator are defined, but it flattens severity — a cut finger and a fatality each count as one recordable case, which is why DART and LTIR exist alongside it. For the related rates, see LTIR and DART; for the leading measures that move it, see leading indicator.

Related: ltir, dart, leading-indicator

An unplanned event causing or with potential to cause injury, illness, or damage.

Incident is the umbrella term covering near-misses, first-aid cases, recordable injuries, lost-time injuries, fatalities, and environmental releases. OSHA uses the phrase "injury or illness" for the work-related recordable subset, and the broader category — including property damage and process upsets — is what a QEHS platform has to track as one population so that the safety program and the environmental program read from the same record. The reason the umbrella matters is that the categories share an investigation path. A near-miss, a recordable injury, and a fatality on the same hazard are the same failure at different outcomes, and the corrective-action discipline that closes one should close all three. Classifying an incident correctly — recordable versus first-aid, lost-time versus restricted, environmental versus safety — is what feeds TRIR, DART, and LTIR accurately, and misclassification is one of the most common findings an OSHA inspector writes. See near-miss, CAPA, and root cause analysis.

Related: near-miss, capa, rca

The end-to-end process of reporting, investigating, classifying, and closing workplace incidents — from near-misses to recordable injuries.

Incident management covers the full lifecycle of a safety event: intake (first report from the field), classification (near-miss, first-aid, recordable, lost-time, SIF), investigation (root cause analysis), corrective actions (CAPA), and close-out verification. Modern incident management software captures incidents on mobile devices with geolocation and photo evidence, auto-classifies severity through a guard tree, and automatically updates the OSHA 300 log.

Related: incident, near-miss, rca, capa, osha-300, sif

A grid combining likelihood and consequence to classify incident severity.

Typically a 5×5 or 4×4 matrix. Consequence axes: people (first aid → fatality), environment (no impact → catastrophic), assets ($0 → major loss), reputation (no media → international). Likelihood axes: almost certain, likely, possible, unlikely, rare. The intersecting cell determines severity level (S1–S5), which drives investigation depth, escalation protocol, and reporting requirements.

Related: risk, incident, risk-register

An incident with potential for harm that did not result in injury or damage.

A near-miss is an unplanned event that could have caused injury, illness, or damage but did not — the dropped tool that missed the worker, the gas test that caught a leak before ignition, the slip that did not end in a fall. Capturing near-misses is a proxy for organisational safety culture, because low report counts usually signal under-reporting, not a safe site. The sites that report the most near-misses are typically the safest, because reporting is what lets a program act before the same hazard produces an injury. The operational value of a near-miss is that it is a free lesson — the hazard fired without the cost of a recordable case. A program that logs, triages, and closes near-misses gets the leading-indicator benefit (the rate moves before TRIR does) and the hazard-removal benefit (the same condition is corrected before the next crew walks into it). A program that does not capture near-misses pays for the lesson twice — once as the near-miss it ignored, once as the recordable case it became. See incident and leading indicator.

Related: incident, leading-indicator

A formal review of a near-miss event to identify causes and prevent recurrence.

Near-misses are leading indicators of future incidents — Heinrich's Triangle suggests hundreds occur before a serious injury. A near-miss investigation follows the same methodology as an incident investigation (5-Whys, fishbone, bowtie) but with lower urgency. Reporting culture is the key variable: organisations where near-misses are celebrated, not punished, collect the richest data.

Related: near-miss, rca, five-whys, leading-indicator

OSHA-mandated log of work-related injuries and illnesses.

US employers with 11+ employees must maintain the OSHA 300 Log throughout the year. Each entry records: case number, employee name, job title, date, injury/illness type, and outcome (days away, restricted duty, etc.). The companion Form 301 captures per-incident details. The 300A summary is posted 1 Feb – 30 Apr each year.

Related: trir, incident, dart

The UK regulatory standard for demonstrating risk has been reduced to an acceptable level.

ALARP requires that risks be reduced until the cost of further reduction is grossly disproportionate to the benefit. It sits between broadly acceptable risk (<10⁻⁶/yr fatality) and intolerable risk (>10⁻³/yr). The Health and Safety Executive (HSE) publishes risk tolerability criteria. ALARP is the dominant framework in UK, Australia, and Singapore; the US uses feasibility-based cost-benefit for OSHA standards.

Related: safety-case, lopa, risk

A risk-visualisation method connecting threats, a top event, and consequences.

A bowtie diagram is a risk-visualisation method that puts a central top event in the middle — the loss of containment, the release, the ignition — with preventive barriers on the left that keep threats from triggering it, and mitigative barriers on the right that keep the consequence from escalating once it has. The diagram is the picture an operations team and a regulator can read at the same level: the threats, the barriers, the degradation factors that weaken a barrier, and the consequences the barriers are there to stop. It is used heavily in process safety and major-hazard facilities, where a single top event can cascade into a catastrophe. The value of a bowtie is not the diagram; it is the barrier register it produces. Each barrier on the diagram has an owner, a performance standard, and a verification — the human action, the instrumented function, the physical relief — and the audit tests the barrier, not the drawing. A bowtie built from a HAZOP carries the top events and the safeguards forward in a form the operations team can manage, and the management-of-change process re-touches the bowtie when a barrier is modified. The weakness is the static diagram: a bowtie drawn once and never reviewed is a poster. See HAZOP, process safety management, and risk.

Related: hazop, psm, risk

An explosion triggered by airborne combustible dust particles in an enclosed space.

The "dust pentagon" requires: combustible dust, ignition source, oxygen, dispersion, and confinement. Common dusts: wood, grain, sugar, metal, coal, plastic. NFPA 652 (Fundamentals) and commodity-specific standards (NFPA 61, 484, 654, 655, 664) govern. OSHA NEP targets grain handling, food processing, and wood products. Primary explosions often trigger more devastating secondary explosions.

Related: lel, hazard, psm

A control whose failure or absence could lead directly to a fatal or catastrophic event.

The ICMM Critical Control Management (CCM) framework, widely adopted in mining, distinguishes critical controls from supporting controls. Critical controls are subject to more rigorous verification — field checks, dedicated inspections — than routine controls. A critical control failure triggers immediate work stoppage regardless of residual risk assessment. The CCM framework is aligned with ISO 45001 risk management.

Related: control-hierarchy, bowtie, inherent-risk

A structured analysis of how components can fail and the effect of each failure.

A Failure Mode and Effects Analysis is a structured method that lists the ways a design or a process can fail, the effect of each failure, and the controls that detect or prevent it. Each failure mode carries a Risk Priority Number — the product of Severity, Occurrence, and Detectability, scored on a 1-to-10 scale — and the high-RPN modes take corrective-action priority. The split is DFMEA for product design and PFMEA for the manufacturing process, and the analysis is updated whenever the design or the process changes, because a failure mode that was acceptable at one severity can become unacceptable after a change raises the occurrence. FMEA is required by IATF 16949 for automotive suppliers, common in aerospace under AS9100, and used in medical device contexts under ISO 13485, and it is the analytical backbone of a risk-based quality system — the failure modes feed the risk register, the corrective actions feed the CAPA, and the residual risk feeds the management review. The weakness is the RPN as a steering number: a high severity with a low occurrence can score the same as a low severity with a high occurrence, and the two are not the same risk. The discipline that makes FMEA work is the closure — an action assigned to every high-RPN mode and verified, not a worksheet filed for the audit. See root-cause analysis, NCR, and bowtie.

Related: rca, ncr, bowtie

A top-down, deductive failure analysis using Boolean logic to map causes.

A Fault Tree Analysis — FTA — is the deductive risk method that starts at the undesired event — the top event, the loss of containment, the reactor runaway, the safety-function failure — and works backward through the AND and OR logic gates to the basic events, the equipment failures and the human errors and the common-cause failures that combine to produce it. The tree is read top-down: the top event happens when the gate below it is true, and the gate is true when its inputs are true, and the cut sets are the minimal combinations of basic events that would trigger the top event. FTA is the method that finds the single-cause path and the multi-cause path, and the cut set with one event is the single point of failure the design has to eliminate. FTA is used in process safety, aerospace, and nuclear — the high-consequence domains where the top event is catastrophic and the analysis has to prove the probability is low enough — and it pairs with the bottom-up FMEA, which starts at the failure modes and asks what they cause, where FTA starts at the consequence and asks what causes it. The two cross-check each other: the FMEA finds the failure modes, the FTA finds whether the failure modes combine to the top event, and the LOPA takes the cut sets and assigns the independent protection layers. The discipline that makes FTA work is the basic event with a real probability — a gate populated with a guessed frequency is a tree that looks rigorous and is not — and the common-cause failure that breaks the assumed independence between two protection layers. See FMEA, bowtie, and LOPA.

Related: fmea, bowtie, lopa

A systematic evaluation of fire hazards, the likelihood of a fire occurring, and the consequences for people and property.

A fire risk assessment identifies fire hazards (ignition sources, fuel sources, oxygen sources), evaluates the risk to people (employees, visitors, contractors, vulnerable persons), and prescribes controls (detection, suppression, compartmentation, evacuation routes, emergency lighting). It is a legal requirement in the UK under the Regulatory Reform (Fire Safety) Order 2005 and is enforced through local fire authorities. FRAs must be reviewed regularly and after any significant change to the premises or work activities.

Related: risk-assessment, emergency-response-plan, hazard

Any source of potential damage, harm, or adverse health effects.

A hazard is the source of potential harm — moving machinery, a chemical, a height, a pressurised system, a workload. Risk is the combination of likelihood and consequence when someone is exposed to the hazard. The distinction is operational: a hazard exists whether or not anyone is near it, and risk appears when a worker enters the hazard zone without sufficient control. Programs reduce risk by removing or isolating the hazard, not by warning people about it, because a warning does not change the consequence of the exposure. The control hierarchy ranks the options from most to least effective: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. A hazard controlled only by PPE is a hazard the program has chosen to live with at the bottom of the hierarchy, and an incident at that hazard is a predictable outcome rather than an accident. Identifying hazards is the input to a Job Hazard Analysis, and tracking them in a risk register is what makes them auditable. See risk, JHA, and hierarchy of controls.

Related: risk, jha, control-hierarchy

A structured review of a process using guide-words to find deviations.

A Hazard and Operability Study is a team-based process-hazard-analysis technique that walks the process design node by node — a pipe, a vessel, a reaction step — and applies guide-words (No, More, Less, Reverse, As Well As, Other Than) to each parameter (flow, temperature, pressure, level, composition) to surface deviations, their causes, their consequences, and the safeguards that detect or prevent them. It is the PHA method of choice for processes covered by OSHA 29 CFR 1910.119 and the EU Seveso directive, where the hazard is high-energy or a toxic release and the design has to be challenged line by line. The output of a HAZOP is a worksheet of deviations ranked by risk, each with a safeguard and an action — and the value is in the team, not the worksheet. The study forces the design engineer, the operator, and the safety engineer to argue the same drawing at the same table, which is where the assumptions that would have failed in commissioning surface instead. The weakness is the follow-through: a HAZOP whose actions are never closed is a study, not a control. A QEHS platform holds the worksheet against the asset, links each action to a corrective action, and carries the residual risk onto the bow-tie and the risk register. See bowtie, PSM, FTA, and LOPA.

Related: bowtie, psm, fta, lopa

A structured workshop identifying hazards at the earliest design stage.

A Hazard Identification Study — HAZID — is the first risk review on a new project, run before the detailed engineering freezes the design, because the hazard eliminated on paper at the concept stage is the cheapest hazard to eliminate and the one that is hardest to remove after the steel is ordered. A multi-disciplinary team works through a structured prompt list — fire, explosion, toxic release, structural collapse, environmental release, dropped object, ship collision, the site-specific and the process-specific — and for each credible hazard identifies the cause, the consequence, and the safeguard, then carries the result into the project hazard register. The HAZID is the screen that decides what the HAZOP, the LOPA, and the QRA have to look at in detail. The HAZID is deliberately coarse and broad — it is the wide net cast early, where the HAZOP is the narrow study run later on the lines that matter. The discipline that makes a HAZID useful is the credible-hazard test: a hazard that is physically impossible at the site is noise, and a hazard that is credible but dismissed without a reason is the one that shows up in the incident report. The output is a hazard register with the risk ranked before the safeguards, the safeguards listed against the risk, and the residual risk carried forward to the detailed studies. The HAZID that produces no actions is the HAZID that was a box-tick, and the project that skips it is the project that discovers the hazard in commissioning. See HAZOP, hazard, and risk register.

Related: hazop, hazard, risk-register

The ranked order of effectiveness for controlling workplace hazards.

The hierarchy of controls is the ranked order of effectiveness for controlling a workplace hazard, recognised by NIOSH and ISO 45001. From most to least effective the five levels are elimination (remove the hazard entirely), substitution (replace it with a less hazardous alternative), engineering controls (isolate the worker from the hazard), administrative controls (change the way people work), and personal protective equipment (protect the individual worker). The order is the point: a control higher on the list is more reliable than one below it because it does not depend on the worker doing the right thing. PPE is the last resort, not a primary control, because it fails when the worker takes it off, wears it wrong, or the equipment degrades — and the consequence of that failure is the full, uncontrolled hazard. A program that controls a high-energy hazard with PPE and procedure alone has accepted the hazard at the bottom of the hierarchy, and an incident at that hazard is a predictable outcome. The defensible position is to walk up the list as far as the process allows: substitute before you guard, guard before you instruct, instruct before you issue PPE. See PPE, hazard, and risk.

Related: ppe, hazard, risk

The raw risk level before any controls are applied.

Inherent risk = likelihood × consequence, assessed as if no controls exist. It represents the true hazard potential of an activity. Organisations use it to prioritise resources — high inherent risk scenarios warrant robust control frameworks even if current residual risk is acceptable, because control failure could be catastrophic.

Related: residual-risk, risk, risk-register

A step-by-step breakdown of a task identifying hazards at each step.

A Job Safety Analysis is a step-by-step breakdown of a task that identifies the hazards at each step and the controls that neutralise them. It is functionally equivalent to a Job Hazard Analysis (JHA) — the term JSA is common in Australian and Canadian workplaces, JHA in US OSHA contexts — and the output is always the same written document: the task broken into steps, the hazard at each step, and the recommended control. It is the pre-task control for work that is not routine enough to have a permit but hazardous enough to need a plan, and completion before high-risk work is a standard procedural requirement. The value of a JSA is that it forces the crew to name the hazard before the work, not after. A task that names pinch points as a hazard and gloves and guard as a control is a task the crew has thought about; a task with no JSA is a task the crew is improvising. The discipline that makes it work is the same as the pre-task plan: the JSA is completed at the workface, by the crew doing the work, signed before the first step, and revisited when the conditions change. A QEHS platform holds the JSA against the task and the location, links each control to the hierarchy of controls, and feeds completion into the leading-indicator dashboard. See JHA, permit to work, and the hierarchy of controls.

Related: jha, ptw, control-hierarchy

A JHA that explicitly includes environmental hazards alongside safety hazards.

JSEA is common in mining, oil and gas, and utilities, where spills, soil contamination, and noise are material alongside personal safety risks. Each task step is evaluated for both safety AND environmental consequences, and controls are specified for both. Integrating safety and environment in a single document reduces form fatigue and improves field compliance.

Related: jha, jsa, iso-14001

A semi-quantitative method for evaluating whether risk reduction is adequate.

LOPA assigns a probability of failure on demand (PFD) to each independent protection layer (IPL) and calculates mitigated event frequency. If the mitigated frequency exceeds the tolerable risk target, additional layers — often a Safety Instrumented System (SIS) — are required. LOPA is the primary method for determining SIL requirements per IEC 61511.

Related: sil, fta, psm

The risk remaining after controls are applied.

Residual risk = inherent risk adjusted for the effectiveness of controls in place. ISO 45001 requires organisations to determine whether residual risk is acceptable (tolerable) or requires further action. A risk register typically records both inherent and residual scores for each entry. Residual risk is the basis for management decisions on further treatment.

Related: inherent-risk, risk, risk-register

The combination of likelihood and consequence of harm from a hazard.

ISO 31000 defines risk as the effect of uncertainty on objectives. In QEHS practice it is calculated as Likelihood × Consequence, often on a 5×5 matrix with named thresholds — Low, Medium, High, Critical — that map to a control expectation and a response time. The matrix is not the analysis; it is the summary of an analysis that already identified the hazard, the exposure, and the existing controls. The two failure modes of a risk matrix are over-grading and complacency. Over-grading — calling everything High — trains reviewers to ignore the threshold, and the matrix stops driving action. Complacency — accepting a High because it has been High for years — lets a residual risk sit because no one re-rates it after a control changes. A defensible risk register re-rates on a schedule, ties each rating to a named control, and treats a rating change as a trigger for management of change rather than a paperwork edit. See hazard, risk register, and bowtie.

Related: hazard, risk-register, bowtie

The process of identifying hazards, evaluating the likelihood and severity of harm, and determining appropriate controls.

A risk assessment is the foundation of any safety, quality, or environmental program. It involves identifying hazards (what could cause harm), evaluating the risk (how likely and how severe), and implementing controls following the hierarchy of controls (elimination, substitution, engineering controls, administrative controls, PPE). Risk assessments can be qualitative (matrix-based), semi-quantitative, or quantitative (QRA). They must be reviewed periodically and after any significant change (management of change).

Related: hazard, moc, control-hierarchy, bowtie, jha

A living list of identified risks with owners, controls, and review dates.

A risk register is the core artefact of a risk-based management system — the living list of identified risks that ties each hazard to its owner, its controls, and its review date. A row carries the risk description, the category, the likelihood and consequence (often on a 5×5 matrix), the inherent risk score, the controls in place, the residual score after controls, the owner, and the next review date. ISO 31000 and ISO 45001 both expect it, and an auditor treats a register that has not been reviewed in the last quarter as a finding rather than a backlog. The register is only as good as its review cycle. A list built once and never refreshed is a compliance artefact, not a risk tool, because the risks that matter change — a new process, a new chemical, a new contractor, or a near-miss that moved a hazard up the matrix. The discipline that keeps it live is the same corrective-action discipline that closes a finding: every risk has an owner, every control has a verification, and the review is scheduled not triggered by an audit. A QEHS platform holds the register, the bow-tie or HAZOP that produced the top risks, and the corrective actions that close them, on one record. See risk, hazard, and bowtie.

Related: hazard, risk, bowtie

A structured argument, supported by evidence, that a system is acceptably safe.

Required for major hazard facilities in the UK (COMAH), Australia (MHF regulations), and offshore installations (Safety Case Regulations 2015). A safety case demonstrates that all major accident hazards have been identified and risks reduced ALARP (As Low As Reasonably Practicable). It is a living document, updated after significant changes. Differs from a PHA in that it makes a formal safety argument to the regulator.

Related: hazop, lopa, sil, psm

A specific safety function implemented by a Safety Instrumented System.

A Safety Instrumented Function — SIF — is a single automatic safety loop that takes a process variable past its safe limit and shuts the process down to a safe state, without a human in the loop and without the basic process control system that runs the plant. A SIF is built from three elements — the sensor that detects the deviation, the logic solver that decides the action, and the final element that executes it, the shut-off valve or the breaker or the pump trip — and each SIF carries a Safety Integrity Level, the SIL, that says how much risk reduction the function has to deliver. The high-pressure shutdown, the emergency depressurisation, the burner-management trip, and the overfill shutdown are the archetypal SIFs on a process plant. A SIF is a function, not a box — the function is what the loop has to do, and the Safety Instrumented System, the SIS, is the collection of hardware that implements the functions the hazard analysis said the plant needs. The standard is IEC 61511 for the process sector and IEC 61508 for the equipment vendor, and it governs the full lifecycle — the hazard and risk assessment that defines the SIF and its SIL, the design that meets the SIL, and the validation, the operation, and the proof testing that keeps the SIL over the life of the plant. The failure that undermines a SIF is the proof test that lapsed or the systematic failure the hardware-in-fault analysis missed, and the SIF that is bypassed for operations is the SIF that is absent when the excursion happens. See SIL, LOPA, and PSM.

Related: sil, lopa, psm

A discrete level (SIL 1–4) defining the reliability required of a safety function.

Defined in IEC 61508 and IEC 61511. SIL 1 requires a PFD of 0.1–0.01; SIL 4 requires 0.0001–0.00001. SIL is determined through LOPA or risk graph methods. Safety Instrumented Systems (SIS) must be designed, verified, and validated to achieve the required SIL. SIL is not a product rating — it is a system-level achievement.

Related: lopa, sif, psm

A field-level risk assessment completed immediately before a task.

A TRA (also called a FLRA — Field Level Risk Assessment) is completed by the work crew on-site, immediately before starting work. It accounts for real conditions: weather, crew experience, equipment condition, nearby activities. A TRA supplements — but does not replace — a formal JSA or JHA prepared in advance.

Related: jsa, jha, ptw

A proactive safety approach focusing on observing and reinforcing safe behaviors.

Behavior-Based Safety — BBS — is the proactive safety method that observes what the worker does, not what hurt the worker, on the premise that the unsafe act is the leading indicator of the injury and the safe act is the leading indicator of the safe outcome. Trained observers run structured observations against a defined checklist, record the safe and the at-risk behaviours without naming or blaming the individual, and turn the aggregate data into the coaching conversation and the process fix. The frameworks are DuPont STOP and the ABC model — Antecedent, Behaviour, Consequence — which says the behaviour is shaped by what comes before it and what comes after it, so the way to change the behaviour is to change the antecedent and the consequence, not to exhort the worker. BBS is the programme that produces the leading indicator the lagging metrics cannot, because the observation count and the per-cent-safe rate move before the TRIR does, and a site that runs a hundred observations a week has a measure of exposure the injury count does not give. The failure mode of BBS is the observation that becomes paperwork — the checklist the supervisor fills in to hit the quota, with no coaching and no fix — and the programme that degenerates into the quota is the programme that loses the leading-indicator value and breeds cynicism on the floor. BBS is most effective paired with a just culture, where the at-risk behaviour is coached and the reckless one is sanctioned and the honest error is not punished, so the observation stays honest. See leading indicator and near-miss.

Related: leading-indicator, near-miss

The systematic process of defining required competencies for each role, assessing individuals against those requirements, and closing gaps through training.

Competency management goes beyond training completion tracking. It defines the knowledge, skills, and behaviours required for each role (competency framework), assesses each individual against the framework (self-assessment, supervisor assessment, practical demonstration), identifies gaps, and assigns training or development actions. ISO 45001 requires organisations to ensure workers are competent to perform tasks that may impact OH&S. Competency records should be linked to incident data — if a pattern of incidents correlates with specific competency gaps, the training program needs revision.

Related: management-review, leading-indicator, iso-45001

Entry into a space not designed for continuous occupancy with limited egress.

A confined space entry is the work that puts a worker into the space not designed for continuous occupancy, with the limited entry and the limited egress that turn a small problem into a fatality — the tank, the vessel, the manhole, the silo, the pit. OSHA 29 CFR 1910.146 defines the permit-required confined space as the one with a serious hazard: the atmospheric, the engulfment, the entrapment, or the configuration that could trap or asphyxiate the entrant. The entry requires the atmospheric test for the oxygen, the LEL, and the toxic gases before the entrant goes in, the isolation and the lockout of the energy and the fluids that could move into the space, the written entry permit that authorises the entry, the attendant outside who watches the entrant, and the rescue plan that gets the worker out without a second casualty. The confined-space fatality is the one that takes the rescuer with it, because the atmosphere that dropped the entrant drops the co-worker who climbs in to help, and the rescue without the plan and the equipment is the cascade the standard was written to stop. The non-entry rescue — the tripod, the winch, the retrieval line — is the method the standard prefers, because the entrant who can be pulled out does not need a rescuer in the space. The atmospheric test is not a one-time reading: the continuous monitor on the entrant, the periodic re-test, and the ventilation that holds the atmosphere are the controls that keep the entry safe over the time the work takes. NFPA 350 is the practice guide on top of the OSHA rule. See permit to work, LOTO, and LEL.

Related: ptw, loto, lel

Processes for pre-qualifying, onboarding, and monitoring third-party workers.

Contractor management is the discipline that governs third-party workers on a host site — the pre-qualification, the onboarding, the work authorisation, the performance monitoring, and the re-evaluation — because under OSHA Multi-Employer Citation Policy the host employer retains liability for the safety of a contractor the host does not directly employ. The programme covers pre-qualification (insurance certificates, the LTIFR, the training records, the competency evidence), site orientation before the contractor steps on the floor, permit-to-work integration so a contractor cannot start high-risk work without the host authorising it, performance monitoring through observations and incidents, and a periodic re-evaluation that catches the contractor whose stats drifted since the last renewal. The contractor is where most serious injuries happen on a process site, because the contractor does the non-routine work — the maintenance, the turnaround, the confined-space entry — and the non-routine work is where the isolation, the permit, and the management-of-change fail. OSHA treats contractor management as an explicit element of process safety management under 29 CFR 1910.119(h), with requirements for the selection, the training, the periodic evaluation, and the access to the safety information a contractor needs to do the work safely. A QEHS platform holds the contractor against the site, the permit, and the competency register, so the authorisation and the evaluation are on one record, not in three spreadsheets. See PSM, permit to work, and ISO 45001.

Related: psm, ptw, iso-45001

OSHA 1926 Subpart CC requirements for crane operation on construction sites, including operator certification, inspections, and lift planning.

OSHA's crane standard (29 CFR 1926 Subpart CC) mandates operator certification (by type and capacity), annual inspections, monthly and shift inspections, and a documented lift plan for critical lifts. Key requirements include ground condition assessment, power line clearance (20 ft minimum up to 350 kV), signal person qualifications, and load chart compliance. Crane-related incidents are frequently fatal; OSHA data shows that over 60% of crane fatalities involve struck-by or crushed-by incidents.

Related: risk-assessment, permit-to-work, working-at-heights

A virtual replica of a physical asset, process, or system — used for real-time monitoring, simulation, and predictive safety analytics.

A digital twin is a live digital representation of a physical asset (pump, compressor, reactor), process (production line), or system (plant, refinery). It ingests real-time sensor data (IoT), historical operational data, and engineering models to simulate behaviour, predict failures, and optimise performance. In QEHS contexts, digital twins are used for predictive safety — modelling gas dispersion, explosion overpressure, or evacuation scenarios — and for linking equipment condition to permit-to-work risk assessments.

Related: moc, risk-assessment, bowtie

Regulatory requirements from the US Department of Transportation covering the safe transport of hazardous materials by road, rail, air, and water.

DOT compliance under 49 CFR covers hazardous materials transportation (HMR — Parts 171-180), including classification, packaging, marking, labelling, placarding, shipping papers, and emergency response information. Shippers must classify hazardous materials into one of nine hazard classes, select proper packaging, provide 24/7 emergency response contact, and train all hazmat employees within 90 days. DOT drug and alcohol testing (Part 40) applies to safety-sensitive transportation employees and includes pre-employment, random, post-accident, and reasonable suspicion testing.

Related: sds, ghs, emergency-response-plan

A digital platform for managing environment, health, and safety programs — incidents, audits, permits, training, and compliance.

EHS software centralises environment, health, and safety management into a single audited platform. It replaces spreadsheets, paper forms, and siloed point solutions with configurable modules for incident reporting, inspections, audits, permit-to-work, training, risk assessments, and regulatory reporting. Modern EHS software supports responsive web capture from any device, offline-first mobile, real-time dashboards, and SIEM-grade audit trails.

Related: incident, permit-to-work, rca, leading-indicator

Requirements for protecting workers from electric shock, arc flash, and arc blast — governed by NFPA 70E and OSHA 1910 Subpart S.

Electrical safety programs address shock hazards (current passing through the body) and arc flash hazards (explosive release of energy during a fault). Key elements include: establishing an electrically safe work condition (lockout/tagout, test-before-touch), arc flash risk assessment (incident energy calculation, arc flash boundary, PPE selection using the PPE category method or incident energy analysis), qualified person training, and insulated tool requirements. NFPA 70E requires arc flash assessments be reviewed every 5 years or when the electrical system changes. OSHA 1910.333 requires live parts to be de-energised before work unless de-energising introduces additional hazards.

Related: loto, ppe, risk-assessment, control-hierarchy

A documented plan for responding to foreseeable emergency scenarios.

OSHA 29 CFR 1910.38 requires an Emergency Action Plan for all workplaces; OSHA 29 CFR 1910.119 imposes additional requirements for PSM sites. An ERP covers: evacuation routes, assembly points, emergency contacts, shutdown procedures, fire response, chemical release, medical emergencies, and communication protocols. Annual drills are standard; post-drill reviews drive continuous improvement.

Related: psm, moc, incident

OSHA requirements for protecting workers from cave-ins and other hazards when excavating trenches or excavations deeper than 5 feet.

OSHA 29 CFR 1926 Subpart P requires protective systems (sloping, benching, shoring, trench box) for all excavations 5 feet or deeper, unless the excavation is in stable rock. A competent person must classify soil type (Type A, B, or C), inspect the excavation daily and after rain, and ensure adequate access/egress within 25 feet of workers. Atmospheric testing is required for excavations deeper than 4 feet where hazardous atmospheres may exist. Cave-ins are one of OSHA's "Fatal Four" and are almost always preventable with proper protective systems.

Related: confined-space, permit-to-work, risk-assessment

The design, installation, and maintenance of equipment in atmospheres where flammable gases, vapours, mists, or dusts may be present.

Explosion protection addresses the risk of fire and explosion in hazardous areas classified under the ATEX (EU) or NEC/CEC (North America) frameworks. Key concepts include area classification (Zone 0/1/2 for gases, Zone 20/21/22 for dusts), equipment protection levels (EPL), ignition source control, and explosion venting/suppression. The DSEAR (UK) and OSHA 29 CFR 1910.307 (US) regulations mandate that employers classify hazardous areas and select appropriate equipment.

Related: dust-explosion, lel, hazop, psm, moc

The management of occupational road risk — policies, driver qualification, vehicle maintenance, and telemetry for commercial vehicle fleets.

Fleet safety addresses the single largest cause of occupational fatalities in many countries: driving for work. A fleet safety program includes driver qualification (licence verification, medical fitness), vehicle selection and maintenance (pre-trip inspections, preventive maintenance schedules), journey management (route planning, fatigue management, weather assessment), and monitoring (telemetry, dash cams, GPS tracking). Key metrics include crash rate per million miles, preventable vs non-preventable incidents, and near-miss reports from drivers. ISO 39001 provides a framework for road traffic safety management systems.

Related: risk-assessment, leading-indicator, near-miss

OSHA's right-to-know standard requiring chemical labelling and SDS availability.

The Hazard Communication Standard — OSHA 29 CFR 1910.1200, HazCom 2012 — is the right-to-know rule that requires an employer to tell a worker what hazardous chemicals are in the workplace, what they can do to the worker, and how to protect against them. The 2012 revision aligned the US with the Globally Harmonized System, which gave every chemical the same 16-section safety data sheet and the same label with the pictogram, the signal word, the hazard statement, and the precautionary statement. The four requirements are a written program, a chemical inventory, an SDS for every hazardous chemical, and training — and HazCom is, year after year, among the most frequently cited OSHA standards. HazCom is cited so often because the requirements look simple and are not. The written program has to name the person responsible and describe how the inventory, the sheets, and the training are kept current; the inventory has to list every hazardous chemical and match the labels on the containers; the SDS has to be the current revision and accessible on the shift the worker is exposed; the training has to cover the hazards of the specific chemicals the worker uses, not a generic briefing. The failure that produces the citation is the one a QEHS platform is built to close: the inventory that drifted from the containers, the sheet that was the old revision, the training that was never completed. See SDS, GHS, and PPE.

Related: sds, ghs, ppe

A permit authorising activities that produce sparks, flame, or heat near flammable materials.

A hot work permit is the authorisation a site issues for the work that produces the spark, the flame, or the heat that can ignite the combustible — the welding, the cutting, the grinding, the brazing, the soldering — and it is the permit-to-work control that sits between the torch and the fire. Before the permit is issued, the area is tested for the flammable atmosphere at the LEL, the combustibles are removed to the 35-foot radius or shielded with the fire blanket, the fire watch is assigned and staged with the extinguisher, and the permit specifies the location, the duration, and the precautions. The permit is the record that the controls were verified before the spark, not after. The hazard the hot-work permit governs is the smoulder. The spark that ignites the combustible does not always start the fire at the moment of the work — the slag that rolls under the floor, the heat that conducts into the wall cavity, and the ember that smoulders for hours are the fires that kill after the crew has gone home, and the post-work fire watch the permit requires is the control that catches the smoulder before it becomes the fire. The 30-to-60-minute watch is the minimum, and the serious permit extends it past the shift, because the fire that starts in the wall in the early morning is the one the morning crew finds. The relationship to LOTO is the isolation the hot work runs alongside, and the LEL is the atmospheric test the permit starts with. See permit to work, LEL, and LOTO.

Related: ptw, lel, loto

A step-by-step breakdown of a task with hazards and controls per step.

A Job Hazard Analysis — also called Job Safety Analysis (JSA) or, in Australia, a Safe Work Method Statement (SWMS) — breaks a task into steps, identifies the hazard in each step, and assigns a control to each hazard before the work starts. The structure is task steps, hazards per step, controls per step, residual risk. A JHA done at a desk by a safety lead is a draft; a JHA reviewed on-site by the crew performing the work, with the actual tools and the actual conditions in front of them, is the document that prevents the incident. The common JHA failure is that it becomes a template — the same generic steps and the same generic controls pasted for every task, signed and filed without engaging the specific hazards of the specific job. A JHA that does not change when the conditions change is evidence against the program, not for it. Tying the JHA to a permit-to-work, so the controls it lists are the controls the permit enforces, is what closes the loop between the analysis and the work. See hazard, permit to work, and hierarchy of controls.

Related: hazard, ptw, jsa

The three-step verification that energy isolation is complete before working on equipment.

After applying lockout/tagout devices, the worker must attempt to activate the equipment ("try") to confirm all energy sources are isolated and the equipment cannot be energised. This is the critical last step of LOTO that prevents accidents from incomplete isolation. OSHA cites LOTO violations as one of the top 10 most frequently cited standards annually.

Related: loto, ptw, ppe

Isolating hazardous energy during servicing and maintenance.

Lockout/tagout is the control of hazardous energy during servicing and maintenance — the discipline that prevents a machine from starting, a pipe from pressurising, or a capacitor from discharging while someone is inside it. OSHA 29 CFR 1910.147 governs it for general industry and requires four things in sequence: identification of every energy source (electrical, hydraulic, pneumatic, thermal, mechanical, chemical, gravitational, stored), isolation of those sources, application of locks and tags with a named authorised person, and verification of the zero-energy state — the try-out step that proves the lock worked before the worker enters. The failure that kills people is the shortcut around the sequence, and the citation OSHA writes most often is the one for skipping verification or for an energy source the procedure did not list. 1910.147 also requires a periodic inspection — typically annual — of each energy-control procedure against the actual equipment, because procedures drift from the hardware they describe. A LOTO program in a QEHS platform holds the machine-specific procedures, the authorised-employee list, the periodic-inspection schedule, and the return-to-service sign-off in one record, so the lock and the paperwork do not live in two places. See permit to work, lock-tag-try, and confined space.

Related: ptw, lock-tag-try, permit-to-work

Physical barriers, devices, and procedures that prevent worker contact with hazardous machine parts — points of operation, rotating parts, flying chips.

OSHA 29 CFR 1910 Subpart O requires that all machine hazards be guarded. Guards must be affixed to the machine where possible, secured such that they cannot be removed without tools, and designed to prevent any part of the worker's body from reaching the danger zone. Types include fixed guards, interlocked guards, adjustable guards, and self-adjusting guards. Devices include presence-sensing mats, two-hand controls, and light curtains. Machine guarding violations are consistently among OSHA's top 10 most-cited standards, and amputations from unguarded machinery are among the most preventable serious injuries.

Related: loto, risk-assessment, control-hierarchy

A structured process for evaluating changes before they are implemented.

Management of Change is the PSM element at 29 CFR 1910.119(l) and an ISO 45001 and ISO 9001 expectation under risk-based thinking. It captures the technical basis of a change, the procedures and documents it affects, the training the change requires, and the authorising approvals — all before the change is executed. The standard exists because a change made without analysis is one of the most common root causes in major-hazard incidents: a valve swapped for an incompatible one, a setpoint relaxed without re-rating the relief path, a new reagent introduced without updating the SDS. An MOC that is treated as a formality — a checkbox a project manager signs the day before the change — is the one that produces the incident the program is later investigated for. A defensible MOC classifies the change (replacement-in-kind versus change), triggers a pre-startup safety review for the non-replacement cases, and feeds the mechanical-integrity program when the change touches equipment. The audit trail is the point: the record has to show what was changed, why, who approved it, and what was verified before the change went live. See PSSR, PSM, and HAZOP.

Related: pssr, psm

The legacy 8-section chemical information sheet, replaced by the 16-section SDS.

The Material Safety Data Sheet — MSDS — is the legacy name for the chemical safety document the worker, the first responder, and the industrial hygienist read, the one the pre-GHS regimes used and the one the GHS transition replaced. The OSHA HazCom 2012 revision adopted the GHS, renamed the document the Safety Data Sheet — SDS — and standardised it to the 16-section format, so the worker reads the same sections in the same order across every chemical on the site. The legacy MSDS is the document a facility that has not updated its inventory still holds, and the regulation requires the update to the SDS format on the schedule the HazCom revision set. The legacy MSDS differed from the SDS in two ways that mattered: the format was not standardised, so every manufacturer laid out the sections differently and the worker could not find the same information in the same place, and the content was less consistent, because the hazard classification and the precautionary statements were the judgement of the manufacturer rather than the GHS framework. The facility that still holds the MSDS is the facility that has not finished the HazCom-2012 update, and the QEHS system that holds the chemical inventory has to flag the legacy sheet and pull the current SDS, because the first responder who needs the toxicology in an emergency needs the 16-section document, not the legacy one. See SDS, GHS, and HazCom.

Related: sds, ghs, hazcom

A formal authorisation to perform high-risk work with defined controls.

A permit to work is the formal authorisation that high-risk work cannot start without — hot work, confined-space entry, working at height, energy isolation, excavation, and critical lifts are the categories a permit-to-work system governs. The permit is a document and a workflow: it captures the scope, the isolations, the gas tests, the fire watch, the standby attendant, and the controls agreed between the requestor, the authorising person, and operations, and it requires a named signatory to accept the controls before the first step. The permit is also the record — it is retained as audit evidence that the work was planned and authorised, not improvised. The failure mode of a permit system is the permit-as-paperwork — a form filled in to satisfy the auditor after the work was decided. A permit-to-work system that works isolates the energy before it authorises the work, sequences the approvals so no one can skip a step, and closes the permit with a return-to-service sign-off so the isolation is released by the person who applied it. OSHA treats the permit-required confined-space standard (29 CFR 1910.146) and the lockout/tagout standard (29 CFR 1910.147) as the backbone, and the permit is where those controls are documented at the workface. See lockout/tagout, confined space, and job hazard analysis.

Related: hot-work, confined-space, loto, jha

A formal, documented system authorising hazardous work for a defined scope and duration.

A permit-to-work system is a formal, documented authorisation for hazardous work — a defined scope, a defined duration, a defined set of controls, and a named issuer and acceptor. The permit types cover the work that produces the serious injuries: hot work, confined-space entry, working at height, electrical isolation, excavation, and radiography. The permit is issued by an authorised person, accepted by the work-team lead, and formally closed on completion with the controls released and the area returned to service. The closure is where most PTW systems fail. A permit that is opened and never closed leaves the isolation in place after the work is done, which produces the next incident — the line re-energised while someone is still in it, the confined space re-entered without a fresh gas test. A defensible PTW system makes closure a hard step, ties the permit to the lockout-tagout record, and refuses to release the isolation until the closure is signed. PTW failures are implicated in most major industrial disasters for a reason: the work was authorised, the controls were listed, and no one verified they held. See LOTO, hot work, and confined space.

Related: ptw, hot-work, confined-space, loto

Equipment worn to minimise exposure to hazards.

Personal Protective Equipment is the gear a worker wears to reduce exposure to a hazard — the hard hat, the safety glasses, the respirator, the arc-rated suit, the hearing protection. OSHA 29 CFR 1910.132 requires a hazard assessment that certifies the PPE selected for the task, and 1910.133 through 1910.138 govern the specific standards for eye, head, foot, hand, respiratory, and hearing protection. PPE is the cheapest control to specify and the most expensive to rely on, because it protects the wearer only when the wearer wears it correctly, every time, without exception. PPE is the last rung of the hierarchy of controls — elimination, substitution, engineering controls, administrative controls, and PPE — and the reason it is last is that it does not remove the hazard, it only sits between the worker and the hazard that is still there. A program that jumps to PPE before it has asked whether the hazard can be eliminated or engineered out has chosen the control that depends on human compliance over the control that does not. The discipline that makes PPE work is fit, training, and enforcement: a respirator that does not fit leaks, a harness that is not anchored holds nothing, and a hard hat left in the cab protects no one. See the hierarchy of controls and safety data sheet.

Related: control-hierarchy, sds

The systematic issuance, tracking, inspection, and replacement of personal protective equipment across a workforce.

PPE management goes beyond handing out hard hats. It includes hazard-specific PPE assessments, a PPE matrix by job role, issuance records with size and expiry tracking, periodic inspections, replacement schedules, and training verification. OSHA requires employers to assess workplace hazards, select appropriate PPE, train employees on use and limitations, and maintain or replace PPE as needed. Digital PPE management links issuance records to training records and incident reports, providing a complete chain of accountability.

Related: ppe, hazard, control-hierarchy, jha

A structured review confirming a facility or system is safe to start up.

Required by OSHA PSM (29 CFR 1910.119(i)) for new or modified facilities where the change triggers MOC. A PSSR confirms: construction complies with design specs, safety/operating/maintenance/emergency procedures are in place, a PHA has been performed and recommendations addressed, and affected employees have been trained. Sign-off by operations, maintenance, and safety is typical.

Related: moc, psm, hazop

Periodic internal and external inspection of boilers, pressure vessels, and storage tanks — mandated by ASME code and jurisdictional regulations.

Pressure vessel inspection is the scheduled examination of boilers, pressure vessels, air receivers, heat exchangers, and storage tanks to confirm they remain safe to operate at their design pressure. In the United States, vessel design and construction are governed by the ASME Boiler and Pressure Vessel Code (BPVC) Section VIII, and in-service inspection follows the National Board Inspection Code (NBIC). Vessels covered by OSHA's Process Safety Management standard (29 CFR 1910.119) — those holding a hazardous substance above the threshold quantity — must also meet the PSM mechanical-integrity requirements for inspection, testing, and deficiency correction. There are five main inspection types. An external inspection is performed annually while the vessel is in service, checking for leaks, corrosion, insulation damage, and relief-valve condition. An internal inspection requires the vessel to be shut down, isolated, and entered (or boroscoped) on a 3-5 year interval to examine the shell, heads, welds, and internal components for cracking, pitting, and wall thinning. Thickness testing (ultrasonic measurement) maps remaining wall at corrosion-prone locations and feeds the remaining-life calculation. Pressure-relief devices are tested and recalibrated on their own schedule. Non-destructive examination (NDE) — ultrasonic, magnetic-particle, dye-penetrant, and radiography — is used for weld inspection and crack detection without removing material. Inspection intervals are set by the NBIC, the manufacturer's recommendation, and jurisdictional rules, which in many states and provinces require a commissioned inspector and a filed report. Every inspection must be documented: the record identifies the vessel (including its ASME U-stamp serial and National Board number), the inspector, the methods and tests used, thickness readings, any corrosion or crack findings, the remaining-life calculation, and the next due date. In a QEHS platform these records live against the asset, with automated renewal schedules that flag the next inspection before it falls due and trigger a permit-to-work for the shutdown. Pressure vessel certification is the authority to sign off an inspection or perform a repair. In-service inspection is typically performed by an Authorized Inspector commissioned by the National Board, often working for an Authorized Inspection Agency (AIA) or, in jurisdictions that operate it, the state boiler inspector. Repairs and alterations must be performed by an ASME-certified organization holding an R Stamp (the NBIC repair stamp), and the repair must be documented on an R-1 form filed with the National Board. A vessel that has been repaired outside this process is not certified and should not be returned to service. Insurance is closely tied to inspection. Boiler and machinery (B&M) insurance carriers require current inspection records as a condition of coverage, and many jurisdictions require a valid certificate of inspection before a vessel may legally operate; uninspected vessels are typically excluded from property and liability policies and can void business-interruption cover. CSB investigations have documented fatalities from uninspected or improperly repaired vessels, which is why insurers and auditors treat a missing or overdue pressure vessel inspection as a finding, not a paperwork issue.

Related: risk-assessment, moc, psm, permit-to-work, internal-audit

OSHA's 14-element framework for preventing catastrophic releases of highly hazardous chemicals.

Process Safety Management is the OSHA framework (29 CFR 1910.119) for preventing catastrophic releases of highly hazardous chemicals. It applies when an on-site quantity of a listed chemical exceeds its threshold, and it sets 14 interlocking elements: employee participation, process safety information, process hazard analysis, operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work permit, management of change, incident investigation, emergency planning and response, compliance audits, and trade secrets. The 14 elements are an interlocking system, not a checklist. MOC without PHA re-validation lets a change weaken a safeguard no one re-examined. Mechanical integrity without MOC lets a replacement-in-kind slip into a change no one documented. Compliance audits every three years are the only element on a fixed clock; the rest run continuously and depend on each other. Non-compliance is expensive — Willful citations carry per-instance penalties in the millions — but the real cost is the incident the system was built to prevent. See HAZOP, MOC, PSSR, and SIL.

Related: hazop, moc, pssr, sil

The shared values, beliefs, and behaviours that determine how safety is prioritised in an organisation.

Safety culture is often assessed using maturity models (Bradley Curve: reactive → dependent → independent → interdependent). Key dimensions: leadership commitment, worker involvement, just culture (reporting vs. blame), hazard reporting rates, and safety communication. A weak safety culture is the root cause behind most major disasters (Chernobyl, Challenger, Deepwater Horizon). Culture change requires sustained leadership behaviour, not slogans.

Related: bbs, near-miss, leading-indicator

The process of maintaining current SDS documents for all hazardous chemicals on-site.

OSHA HazCom requires SDSs to be readily accessible to workers during their shifts. An SDS management system tracks: chemical inventory, SDS revision date, storage location, access controls, and superseded versions. When a supplier updates an SDS (e.g., new health data, revised exposure limits), the system must propagate the update and notify affected workers.

Related: sds, hazcom, ghs

OSHA-mandated requirements for scaffold design, erection, use, and dismantling — covering supported, suspended, and mobile scaffolds.

OSHA 29 CFR 1926 Subpart L governs scaffold safety in construction. Key requirements include: scaffolds must be designed by a qualified person, erected and dismantled under a competent person's supervision, equipped with guardrails and toeboards at 10 feet (or fall arrest at higher elevations), inspected before each shift, and never loaded beyond their rated capacity. Common violations include missing guardrails, inadequate planking, and improper access. Scaffold-related incidents are among the OSHA "Fatal Four" construction hazards.

Related: working-at-heights, ppe, risk-assessment

A steel or aluminium protective system placed in a trench to protect workers from cave-ins during excavation work.

A trench box (also called a trench shield) is not designed to prevent cave-ins but to protect workers if one occurs. It is one of several protective systems allowed under OSHA 1926 Subpart P, along with sloping, benching, and shoring. Trench boxes must be designed by a registered professional engineer or manufactured to a recognised standard, extend at least 18 inches above the excavation face, and be properly installed with no lateral movement. They are commonly used for utility work, pipe laying, and foundation excavation.

Related: excavation-safety, confined-space, risk-assessment

Any work where a person could fall and be injured.

Regulatory thresholds vary: OSHA general industry ≥4 ft; construction ≥6 ft; OSHA scaffolding ≥10 ft. Controls follow the hierarchy: elimination (working at ground), passive protection (guardrails), fall restraint, fall arrest (full-body harness + lanyard or PFAS), then administrative (rescue plan, supervision). Rescue capability is a mandatory part of any fall arrest programme.

Related: ppe, ptw, control-hierarchy

FDA regulation governing electronic records and electronic signatures.

21 CFR Part 11 is the FDA regulation that governs the electronic records and the electronic signatures a regulated manufacturer creates, maintains, or submits under the GxP regulations, and it is the rule that lets an electronic record carry the legal weight of a paper one when the controls are met. The four pillars are the audit trail — the time-stamped, user-attributable, computer-generated, and secure record of every create, read, update, and delete — the access controls that limit who sees and who signs, the system validation that proves the software does what it claims under the use it is put to, and the electronic-signature controls that bind the signature to the record and the signer with the two-component identity and the meaning of the signature. Part 11 is what makes the modern GxP record possible, because the paper batch record and the paper signature do not scale to the volume and the complexity the regulator now expects, and the electronic record is only acceptable when the audit trail and the validation back it. The non-compliance is the one that invalidates the submission and triggers the FDA Form 483 observation or the Warning Letter, and the inspection is where the auditor asks for the audit trail, the validation evidence, and the e-signature controls on the system that holds the record. The relationship to NCR and CAPA is direct: the deviation, the corrective action, and the change control on a validated system run under Part 11, with the audit trail and the e-signature on every action. See NCR and CAPA.

Related: ncr, capa

The quality management standard for aerospace, space, and defence suppliers.

AS9100 Rev D is the quality management system standard for the aerospace, space, and defense supply chain, and it layers the aerospace-specific requirements onto the ISO 9001:2015 base — the product and process risk management, the configuration management that controls the part and the change across the lifecycle, the first article inspection that proves the first part of a new run meets the drawing, the key characteristics the customer designates as the ones that matter, and the foreign object damage — FOD — prevention that keeps the debris out of the engine and the airframe. The standard is published by SAE and overseen by the International Aerospace Quality Group, the IAQG, and the certification is by the IAQG-recognised registrars under the OASIS database. AS9100 is required by the aerospace primes — Boeing, Airbus, Lockheed Martin, the space and defense primes — as a condition of doing business, and the Tier 1 supplier that does not hold the certification does not bid. The aerospace quality burden is heavier than the generic ISO 9001 because the consequence of a defect is different — a defect in a consumer product is a return, a defect in a flight-critical part is a hull loss — so the standard adds the risk management, the configuration management, the traceability, and the FAI on top of the base. The relationship to FMEA and NCR is direct: the AS9100 system runs the risk analysis and the nonconformance loop on the same record the base system would, with the aerospace-specific evidence the registrar audits. See ISO 9001, FMEA, and NCR.

Related: iso-9001, fmea, ncr

A structured framework for managing an organisation's environmental responsibilities.

An EMS follows the Plan-Do-Check-Act cycle and is formalised through ISO 14001. Core elements: environmental policy, aspects and impacts assessment, legal register, objectives and targets, operational controls, emergency preparedness, monitoring and measurement, nonconformity management, and management review. An EMS can be certified by an accredited third party or implemented without certification (self-declaration).

Related: iso-14001, environmental-aspect, esg

A structured comparison of current practice against a standard or target state.

A gap analysis maps each requirement of a standard (ISO 9001, 45001, etc.) against evidence of current conformance, rating each clause as conforming, partially conforming, or non-conforming. Results produce a prioritised implementation plan. Typically conducted before a first certification audit or after a significant regulatory change. ISO 9001 Annex C and OSHA VPP self-evaluation tools are common frameworks.

Related: internal-audit, capa, management-review

The global quality management standard for automotive production and service parts.

IATF 16949:2016 is the quality management system standard for the automotive production and service-parts supply chain, developed by the International Automotive Task Force and published with the ISO 9001:2015 base plus the automotive-specific requirements the OEM customer builds into the contract. The core methods are the automotive five: APQP for the advanced product quality planning that gates the launch, PPAP for the production part approval that proves the part is repeatable, FMEA for the failure-mode analysis, MSA for the measurement-system analysis, and SPC for the statistical process control that runs the line. The customer-specific requirements — CSRs — the OEM attaches to the contract layer on top of the standard. IATF 16949 is required for the Tier 1 supplier and often the Tier 2, because the OEM does not let a part onto the vehicle without the certification behind it, and the certification is by the IATF-recognised certification body under the annual surveillance audit the standard mandates. The automotive quality system is heavier than the generic ISO 9001 because the volume is higher and the cost of a recall is higher — a defect in a million-unit run is a million-unit recall — and the standard adds the launch discipline, the PPAP, the run-at-rate, and the CSR on top of the base. The relationship to FMEA and NCR is the same as in aerospace: the IATF system runs the failure-mode analysis and the nonconformance loop on the automotive record the registrar audits. See ISO 9001, FMEA, and NCR.

Related: iso-9001, fmea, ncr

A planned, systematic review of a management system by the organisation itself.

An internal audit is a planned, systematic review of a management system by the organisation itself, governed by the ISO 19011 guidance on auditing management systems. To meet the ISO 9001, ISO 14001, and ISO 45001 expectation it has to be planned (a programme covering every process and area on a cycle), competence-based (auditors independent of the area being audited), documented (findings, nonconformities, and opportunities for improvement), and followed up to corrective-action closure. The independence rule is the one that gets missed. An auditor who audits their own area is auditing their own work, and the finding rate collapses — not because the area is clean but because the auditor knows where not to look. A defensible internal-audit programme rotates auditors across areas, scopes them against the standard rather than the procedure, and feeds the findings into the management review so that leadership sees the systemic gaps, not the individual nonconformities. The internal audit is the check in Plan-Do-Check-Act; without it, the act has nothing to act on. See management review, NCR, and CAPA.

Related: management-review, ncr, capa

Environmental Management System standard.

ISO 14001:2015 is the international standard for environmental management systems and the most widely adopted environmental standard globally. It uses the Annex SL structure shared with ISO 9001 and ISO 45001. The core is a life-cycle perspective on environmental aspects and impacts, a compliance-obligations register, and emergency preparedness for environmental releases — the spill, the fugitive emission, the unauthorised discharge. An EMS under ISO 14001 is what turns environmental compliance from a reactive incident response into a planned program. The aspects-and-impacts register identifies what the site does that touches the environment, the compliance register lists the permits and limits that govern it, the operational controls keep the site inside those limits, and the management review closes the loop. For a QEHS platform the value is that the environmental data — emissions, water, waste, energy — lives beside the safety and quality data, so the ESG disclosure and the regulatory return read from one source. See ISO 45001, ISO 9001, and ESG.

Related: iso-45001, iso-9001

International standard for Occupational Health and Safety Management Systems.

ISO 45001:2018 is the international standard for occupational health and safety management systems. It replaced OHSAS 18001 in 2018 and uses the Annex SL high-level structure shared with ISO 9001 and ISO 14001, so a site certified to two or three of the standards runs one integrated management system rather than parallel ones. The ten clauses follow Plan-Do-Check-Act: context of the organisation, leadership, planning, support, operation, performance evaluation, and improvement. The clauses that change day-to-day work are clause 6 (hazard identification, risk assessment, and the hierarchy of controls), clause 7 (competence and worker participation), and clause 9 (monitoring, internal audit, and management review). ISO 45001 is the OH&S overlay that a customer or a regulator asks for; it is not a substitute for the operational safety program underneath it, and a certificate without the underlying program is a finding waiting to be written. See ISO 14001, ISO 9001, and internal audit.

Related: iso-14001, iso-9001, internal-audit

The international standard for energy management systems.

ISO 50001:2018 is the international standard for the energy management system, and it follows the Annex SL high-level structure shared with ISO 9001, ISO 14001, and ISO 45001, so a site that runs one management system can integrate the energy one without a parallel bureaucracy. The standard is built on the energy baseline — the measured energy use the site starts from — the energy performance indicators, the EnPIs, that normalise the use against the driver (energy per unit of product, per degree-day, per occupancy), the significant energy uses, the SEUs, that are the loads worth managing, and the energy objectives and targets that the management review tracks. The certification is voluntary, but the supply chain and the public-sector procurement increasingly require it, and the EU Energy Efficiency Directive points large companies at it. ISO 50001 is the standard that turns the energy bill from a fixed cost into a managed variable, and the reason it works is the EnPI — the number that separates the production-driven energy from the waste, so a site can show the energy went up because the volume went up, not because the efficiency dropped. The standard pairs with ISO 14001 on the environmental side, because the Scope 1 and Scope 2 emissions the energy use produces are the carbon the ISO 14001 system and the ESG report both count, and the EnPI is the operational measure underneath the disclosed footprint. The management review is where the energy performance is judged against the target, and the target the standard asks for is the improvement, not the absolute — the site that holds its EnPI steady while it grows is the site that is actually reducing its energy intensity. See ISO 14001 and ESG.

Related: iso-14001, esg

Quality Management System standard.

ISO 9001:2015 is the international standard for quality management systems and the most widely certified management-system standard in the world. It is built on seven quality principles — customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management — and runs on the process approach and the PDCA cycle as its operating philosophy. Risk-based thinking is what the 2015 revision adds: it asks the organisation to identify the risks and opportunities that affect the quality of its product or service, rather than treating quality as a corrective-action problem alone. The clauses that drive day-to-day quality work are clause 8 (operational planning, design, and control of nonconforming output) and clause 10 (corrective action and continual improvement, where CAPA lives). A site running ISO 9001 beside ISO 14001 and 45001 shares the document control, the internal audit, and the management review across all three, which is the integration thesis a QEHS platform is built for. See ISO 45001, ISO 14001, and CAPA.

Related: iso-45001, iso-14001, capa

A living list of applicable laws, regulations, and voluntary commitments relevant to EHS.

The Legal and Other Requirements Register is the living list of every law, regulation, permit condition, and voluntary commitment that applies to the site, maintained under the ISO 14001 and ISO 45001 clauses that require the organisation to identify and maintain access to its applicable legal requirements. The register captures, for each obligation, the regulation reference, the jurisdiction, the activities at the site it applies to, the specific compliance obligation — what the law actually requires the operator to do — the responsible person, and the evidence of compliance. The register is the bridge between the legal scan and the operational programme, because a law on the list that does not translate into a task on the floor is a law the site is not actually meeting. The register lives or dies on the periodic review. New regulations publish continuously — the federal register, the state rule, the permit renewal, the customer contract clause — and the register that is not scanned against the new law drifts out of compliance without anyone noticing, until the inspection or the incident surfaces the gap. The standard practice is the annual review and the gap analysis against the new and the amended regulations, with the gap assigned to a corrective action and closed against the evidence. The register that a QEHS platform holds links the obligation to the task to the evidence, so the compliance status is a live view, not a spreadsheet the audit catches out of date. See ISO 45001, ISO 14001, and gap analysis.

Related: iso-45001, iso-14001, gap-analysis

A periodic top-management assessment of a management system's performance.

The management review is the periodic assessment the top management of the organisation runs on the management system, required by ISO 9001, ISO 14001, ISO 45001, and ISO 50001 — the four standards that share the Annex SL structure and the clause 9.3 review requirement. The inputs are the evidence the system is working or not: the audit results, the nonconformities and the CAPAs, the performance metrics and the EnPIs and the TRIR, the customer and stakeholder feedback, the status of the corrective actions, and the progress on the objectives and targets. The review is the one place the system is judged against the outcomes it was built to produce, and the inputs are the data that lets the judgement be evidence and not opinion. The outputs are the decisions — the resource needs, the improvement opportunities, and the changes to the system, the policy, and the objectives — and the records are the documented information the standard mandates, because the review that is not recorded is the review that did not happen, from the perspective of the auditor. The failure mode of the management review is the meeting that reviews the inputs and records the minutes and changes nothing, the box-tick that satisfies the clause but not the intent, and the review that does not change the system is the one that leaves the system stuck. The honest management review is the one where the inputs drive the outputs, the outputs drive the resources and the changes, and the next review measures whether the changes moved the metrics. See ISO 9001, ISO 45001, ISO 14001, and CAPA.

Related: iso-9001, iso-45001, iso-14001, capa

An integrated Quality, Environment, Health and Safety management platform — one tenant, one data model, every program.

A QEHS management system integrates the three management-system standards — ISO 9001 for quality, ISO 14001 for environment, and ISO 45001 for occupational health and safety — into one platform on one tenant, rather than three siloed systems that each hold their own locations, users, and audit trail. The integration is not a marketing layer over three databases; it is one data model where a location, a person, an audit, and a corrective action each carry their quality, environmental, and safety dimensions on the same record. ISO calls the shared structure the high-level structure (Annex SL), and the common clauses — context, leadership, planning, support, operation, performance evaluation, improvement — are why a single platform can hold all three without forcing the workflow of one domain into another. The value of the integration is that the same discipline runs across the three programs. The root-cause method that closes a quality nonconformity closes a near-miss; the audit that finds a gap in the environmental aspects register finds a gap in the safety inspection schedule; the corrective action that fixes a process deviation fixes a hazard. Leadership reads one dashboard instead of three, and the audit preparation that used to reconcile three exports collapses into one. The trade-off is governance: a unified system needs one owner for the management system, or the three programs drift back apart even when the software does not. See ISO 9001, ISO 14001, ISO 45001, and management review.

Related: iso-9001, iso-14001, iso-45001, management-review

A systematic approach to managing workplace safety, including policies, procedures, risk assessments, and performance monitoring.

A Safety Management System is the structured framework an organisation uses to identify hazards, assess risks, implement controls, monitor performance, and continuously improve. Key elements include a safety policy, hazard identification and risk assessment, operational controls, emergency preparedness, incident reporting and investigation, training and competency, performance measurement, and management review. ISO 45001 provides the international standard for occupational health and safety management systems.

Related: iso-45001, risk, hazard, leading-indicator, management-review

The process of comparing a measurement instrument against a traceable standard of known accuracy — and adjusting if necessary.

Calibration ensures that measurement equipment produces results within specified tolerances, traceable to national or international standards (NIST, ISO 17025). A calibration program includes an equipment register, calibration intervals based on usage and drift history, out-of-tolerance procedures (assessing impact on products tested since last calibration), and calibration certificates. ISO 9001 and IATF 16949 require documented calibration procedures and records. In QEHS platforms, calibration management links to equipment inspection schedules and preventive maintenance workflows.

Related: iso-9001, iatf-16949, internal-audit

Actions taken to fix a nonconformity and prevent its recurrence.

CAPA separates corrective action — eliminate the cause of a detected nonconformity — from preventive action — eliminate the cause of a potential nonconformity before it occurs. ISO 9001:2015 places CAPA across clause 10.2 (nonconformity and corrective action) and clause 10.3 (continual improvement), and the same logic appears in ISO 14001 and ISO 45001 because all three share the Annex SL structure. The corrective half closes the finding; the preventive half stops the same root cause from producing a different finding later. The failure mode of a CAPA system is closure without cause. A corrective action that closes a nonconformity by retraining the worker, without addressing the process or the design that let the worker make the error, guarantees the nonconformity returns. A CAPA tied to a root cause analysis — and to a verification that the action actually broke the cause chain — is the one that prevents recurrence. The measure of a CAPA program is not the count of actions closed but the count of nonconformities that did not come back. See NCR, root cause analysis, and Five Whys.

Related: ncr, rca, five-whys

The systematic management of documents — creation, review, approval, distribution, revision, and obsolescence — ensuring the right version is used.

Document control is the systematic management of documents through creation, review, approval, distribution, revision, and obsolescence, and it is required by every ISO management-system standard — ISO 9001, ISO 14001, and ISO 45001. The controlled elements are unique document identification, version control, approval before issue, distribution to the points of use, prevention of the unintended use of obsolete documents, and periodic review. A controlled document is one whose distribution and revision are managed; the uncontrolled copy printed from a shared drive is the opposite, and it is the version an auditor reads when the controlled one says something different. In a modern QEHS platform document control is digital: review-and-approval workflows, read-receipt tracking, and automatic notification when a new revision is published, so the crew on the floor cannot miss a revision the safety lead issued last week. The audit question is always the same — is the version at the point of use the current version? — and a paper system answers it with a drawer of signed master copies that no one checks, while a digital system answers it with a read-receipt and a version number. See ISO 9001, ISO 14001, ISO 45001, and internal audit.

Related: iso-9001, iso-14001, iso-45001, internal-audit

Cause-and-effect diagram grouping causes by category.

A fishbone diagram — also called an Ishikawa diagram — is a cause-and-effect tool that puts the problem at the head of the fish and draws the causes back along the spine, grouped into categories so a team does not fixate on the first cause someone names. The classic manufacturing categories are the six Ms: Man, Method, Machine, Material, Measurement, and Environment, and the service-sector variant is the six Es. The diagram forces a team to populate every branch before it reaches for a solution, because the cause that closes the problem is often on the branch no one wanted to look at. The fishbone is the companion to Five Whys, not a competitor. Five Whys drills a single cause chain to its root; the fishbone maps the full cause space so the team can see which chains to drill. It is the better tool for a multi-cause problem where a defect has several contributors, and the worse tool for a single-fault problem where one chain is obviously the cause. The output is a diagram an auditor can read — the problem, the categories, the verified causes — and the discipline that makes it work is the same as any RCA: the causes have to be verified against the process, not brainstormed into a diagram. See root-cause analysis and Five Whys.

Related: rca, five-whys

Iterative asking of "why" to trace a cause chain.

Five Whys is the root-cause-analysis technique developed at Toyota that asks why, and then why again, until the answer stops describing a symptom and starts describing a system. The rule of thumb is that five iterations are enough to cross from the visible failure to the process or management cause underneath it, and the discipline is to keep asking past the first plausible answer, because the first why almost always names a human error and the fifth why names the system that let the human error matter. It is the lightest RCA tool and the fastest, and a team that cannot run a Five Whys cannot run a heavier method. The limit of Five Whys is the single-fault path. It traces one chain of cause and effect to its root, and it breaks down on a problem where several causes interact — a defect with a material cause and a method cause and a measurement cause, each necessary, none sufficient. For that problem the fishbone is the better tool, because it maps the cause space before the team drills a chain. The other failure mode is the why that stops at training — a human did not follow the procedure, so train the human — when the root cause is the procedure itself or the design that made the procedure impossible to follow. See root-cause analysis and fishbone.

Related: rca, fishbone

Gauge Repeatability and Reproducibility — a measurement system analysis that quantifies how much variation comes from the measurement tool, the operator, and the part.

Gauge R&R is part of Measurement System Analysis (MSA) required by IATF 16949. Repeatability is the variation when the same operator measures the same part with the same gauge repeatedly. Reproducibility is the variation between different operators measuring the same parts. Total GR&R below 10% is excellent; below 20% is acceptable; above 30% requires corrective action. A high GR&R means the measurement system cannot distinguish between good and bad parts, making process control impossible.

Related: spc, six-sigma, iso-9001, iatf-16949

A leadership practice of going to the actual workplace to observe and engage.

"Gemba" (現場) means "the actual place" in Japanese — the shop floor, the worksite, the clinic, wherever the value-creating work happens. A structured gemba walk follows a standard observation sheet covering safety, quality, delivery, and housekeeping. It is not a management inspection; questions are open-ended and the goal is learning, not fault-finding.

Related: bbs, kaizen, leading-indicator

Japanese for "change for the better" — continuous, incremental improvement.

Kaizen events (3–5 day focused improvement workshops, also called "blitzes") bring cross-functional teams together to eliminate waste in a targeted process. Sustained kaizen is a culture, not just events — every employee, every day, improving their work. Kaizen is a foundational element of the Toyota Production System and Lean manufacturing.

Related: six-sigma, rca, pareto

A failure to meet a specified requirement — the trigger for corrective action in quality and compliance programs.

A nonconformity is any deviation from a defined standard, procedure, or customer requirement. In ISO 9001 and IATF 16949, nonconformities drive the corrective action process: identify the nonconformity, contain it, determine root cause, implement corrective action, and verify effectiveness. Nonconformities can be identified through internal audits, customer complaints, inspections, process monitoring, or employee observations. They are distinct from observations (which are advisory) and incidents (which involve harm or damage).

Related: ncr, capa, rca, internal-audit, iso-9001

A record of a product, process, or system that does not meet a requirement.

A Nonconformity Report is the record a quality program raises when a product, a process, or a system does not meet a requirement — a dimension out of tolerance, a step skipped, a document missing, a test failed. ISO 9001 clause 8.7 requires the nonconformity to be controlled: identify it, contain it so it does not reach the customer, decide whether to rework, re-grade, reject, or accept on concession, and record the disposition. The NCR is the artefact that holds that chain, and in a regulated industry it is the record an auditor reads first to see whether the program catches its own failures. The NCR is not the end of the line; it is the start of the corrective-action chain. Each nonconformity links to a CAPA — containment of the immediate failure, correction of the unit, and preventive action against the cause — and the root-cause analysis that sits under the preventive action is what turns a recurring defect into a one-time defect. The discipline that makes an NCR system work is closure: an open NCR is a known risk, and a program that raises nonconformities it never closes has a reporting system, not a quality system. See CAPA and root-cause analysis.

Related: capa, rca

The 80/20 rule applied to quality defects — 80% of problems from 20% of causes.

Pareto analysis ranks defect categories by frequency or cost, cumulating until 80% of the total is explained. The resulting Pareto chart (bar + cumulative line) shows which few causes account for most defects, directing corrective action effort. A standard tool in Six Sigma DMAIC and ISO 9001 continual improvement cycles.

Related: rca, capa, ncr

A structured method to find the underlying cause of a problem.

Root Cause Analysis is a structured method to find the underlying cause of a problem rather than its symptoms. Common methods are Five Whys (iterative questioning to push past the first answer), the Fishbone or Ishikawa diagram (cause categories such as people, process, equipment, materials, environment), Fault Tree Analysis, and the Apollo method. The output of an RCA is a cause chain, not a list of symptoms, and the chain is only useful if the corrective action it produces breaks the chain. The discipline that makes an RCA honest is that it stops at a system cause, not a person cause. An RCA that ends at human error has stopped one step too early — human error is a symptom of a system that let the error happen and that did not catch it. The regulator expectation, and the ISO 9001 and 45001 expectation, is that an RCA traces from the incident back through the failed controls to the management-system gap that owned them. The test of a finished RCA is whether the CAPA it generates prevents the same incident on a different crew. See Five Whys, fishbone, and CAPA.

Related: five-whys, fishbone, capa

A data-driven improvement methodology targeting 3.4 defects per million opportunities.

Six Sigma uses the DMAIC cycle (Define, Measure, Analyse, Improve, Control) for improvement projects and DMADV for new designs. Practitioners are certified at White, Yellow, Green, Black, and Master Black Belt levels. Motorola originated it; GE popularised it. When combined with Lean (waste elimination), the result is Lean Six Sigma — the dominant manufacturing excellence framework.

Related: pareto, rca, ncr

A method of monitoring and controlling a process through statistical analysis of process outputs — detecting variation before it produces defects.

Statistical Process Control uses control charts (X-bar, R, p, c, u charts) to distinguish between common-cause variation (inherent to the process) and special-cause variation (assignable to a specific factor). When a process is "in control," all variation is common-cause and the process is predictable. SPC is a core tool in Six Sigma DMAIC, ISO 9001 quality management, and IATF 16949 automotive quality. Key concepts include control limits (typically ±3σ), process capability indices (Cp, Cpk), and the Western Electric rules for detecting out-of-control conditions.

Related: six-sigma, iso-9001, iatf-16949, ncr

The use of control charts to monitor process variation and detect abnormalities.

Statistical Process Control — SPC — is the method that uses the control chart to watch the process vary and to tell the common-cause variation from the special-cause, so the operator acts on the signal and ignores the noise. The common-cause variation is the inherent randomness of the process, the spread the stable system produces; the special-cause variation is the assignable, the non-random signal that something changed — the tool wore, the supplier switched, the temperature drifted — and the control limits at plus or minus three sigma are calculated from the process data itself, not from the specification, because the limit that flags a change is the one that reflects the process, not the tolerance the customer set. The discipline of SPC is the reaction rule. The point outside the limit, the run of seven on one side, the trend — these are the patterns that trigger the investigation and the corrective action, and the operator who reacts to the common-cause variation by adjusting the process makes the variation worse, the over-control that Shewhart and Deming warned against. The control chart is the operational measure underneath the nonconformance: the SPC catches the drift before it produces the out-of-tolerance part, the way the FMEA catches the failure mode before it produces the defect, and the two run on the same process. SPC is a core IATF 16949 requirement and a standard tool in the pharmaceutical, food, and aerospace quality systems. See Six Sigma, NCR, and FMEA.

Related: six-sigma, ncr, fmea

The measurement of a chemical, its metabolite, or a biochemical effect in a worker's biological sample (blood, urine, breath).

Biological monitoring assesses worker exposure by measuring the chemical agent or its metabolites in biological specimens. It complements air sampling by capturing all routes of exposure (inhalation, dermal, ingestion) and accounting for individual factors like metabolism and workload. Biological Exposure Indices (BEIs) published by ACGIH provide reference values. Common applications include blood lead monitoring, urinary mercury, and breath sampling for volatile organic compounds.

Related: tlv, pel, industrial-hygiene, sds

An OSHA-required written program for laboratories using hazardous chemicals, specifying procedures, equipment, and work practices.

Under OSHA 29 CFR 1910.1450 (Occupational Exposure to Hazardous Chemicals in Laboratories), any laboratory that uses hazardous chemicals must develop and implement a Chemical Hygiene Plan. The CHP must designate a Chemical Hygiene Officer, describe standard operating procedures for handling hazardous chemicals, specify control measures (engineering controls, PPE, administrative controls), detail fume hood and ventilation requirements, provide for employee training and medical consultation, and designate particularly hazardous substances requiring prior approval.

Related: industrial-hygiene, tlv, pel

The science of designing work, equipment, and the workplace to fit the worker — preventing musculoskeletal disorders.

Ergonomics addresses the physical, cognitive, and organisational factors that affect worker health and performance. Physical ergonomics focuses on posture, repetition, force, and vibration — the risk factors for work-related musculoskeletal disorders (WMSDs) like carpal tunnel syndrome, tendonitis, and low back pain. Assessment tools include RULA, REBA, NIOSH Lifting Equation, and the Strain Index. An effective ergonomics program includes hazard identification, risk assessment, control implementation, and medical management.

Related: rula, reba, risk-assessment

UN-harmonised system for classifying and labelling chemicals.

The Globally Harmonized System of Classification and Labelling of Chemicals — GHS, the United Nations Purple Book — is the standard that gives every chemical the same hazard classes, the same label elements, and the same 16-section safety data sheet across every country that adopts it, so a chemical classified as flammable in one jurisdiction carries the same pictogram and the same signal word when it crosses a border. The hazard classes split into physical (flammable, gases under pressure, explosives), health (acute toxicity, carcinogenicity, reproductive toxicity), and environmental (aquatic toxicity, ozone layer), and the label carries the pictogram, the signal word Danger or Warning, the hazard statement, and the precautionary statement. The point is that the worker and the emergency responder read the same hazard in the same language on every label. GHS is a framework, not a law — each jurisdiction adopts it into its own regulation, and the adoption is not uniform. OSHA adopted GHS into HazCom 2012 under 29 CFR 1910.1200, with the US building-specific revisions; the EU adopted it into the CLP Regulation (EC 1272/2008); and other jurisdictions adopted it with their own cut-offs and mandatory substance lists. The practical effect for a manufacturer is that the same chemical can carry a different signal word or a different SDS section in different markets, and the QEHS system that holds the SDS has to hold the jurisdiction-specific version, not a single global one. The 16-section SDS is the part that is most consistent, and it is the document a worker, a first responder, and an industrial hygienist all read. See SDS and HazCom.

Related: sds, hazcom

An OSHA-mandated program for workplaces where noise exposure equals or exceeds 85 dBA as an 8-hour TWA.

A hearing conservation program is required under OSHA 29 CFR 1910.95 when noise exposure reaches the action level of 85 dBA TWA. Required elements include noise monitoring, audiometric testing (baseline within 6 months, annual thereafter), hearing protection devices (HPDs) with appropriate NRR, employee training, and recordkeeping. The program must be reviewed annually and updated when changes in equipment or processes affect noise levels.

Related: noise-exposure, ppe, tlv

The physiological strain imposed by a hot environment exceeding the body's cooling capacity.

Heat stress disorders range from heat cramps and syncope to heat exhaustion and heat stroke (a medical emergency). Wet Bulb Globe Temperature (WBGT) is the standard exposure metric. OSHA has proposed a heat rule (29 CFR 1910/1926) requiring heat illness prevention programmes, rest/water/shade, and acclimatisation schedules. ACGIH publishes TLVs for heat stress.

Related: ppe, leading-indicator, tlv

The quality of air inside buildings affecting occupant health and comfort.

Indoor Air Quality — IAQ — is the measure of the air inside the building the occupant breathes, and the concern the industrial hygienist investigates when the workforce reports the headache, the fatigue, and the respiratory complaint that cluster into the sick-building report. The contaminants are the carbon dioxide that flags the ventilation adequacy — the ASHRAE 62.1 target sits below 1,000 ppm, and a reading above it says the outside-air rate is not keeping up with the occupancy — the volatile organic compounds off-gassed from the finishes and the furnishings, the particulates, the biological contaminants of the mould and the Legionella and the allergens, and the radon in the geology under the building. Each one has its source, its pathway, and its control. The regulatory gap is that OSHA has no comprehensive IAQ standard, and the agency enforces the indoor air under the General Duty Clause, the Section 5(a)(1) catch-all that requires the employer to keep the workplace free of the recognised hazard — a weak lever that puts the burden on the employer to recognise the IAQ risk the standard does not define. The NIOSH IAQ investigation is the response to the sick-building complaint, and the investigation that finds the source — the under-ventilated floor, the mould in the air handler, the VOC from the renovation — is the one that closes the complaint. The IAQ programme that monitors the CO2, the VOC, and the humidity proactively is the one that catches the drift before the report. See Legionella, hazard, and TLV.

Related: legionella, hazard, tlv

The science of anticipating, recognising, evaluating, and controlling workplace conditions that may cause injury or illness.

Industrial hygiene is the discipline of protecting worker health from chemical, physical, biological, and ergonomic hazards. Core activities include exposure monitoring (air sampling, noise dosimetry, heat stress monitoring), establishing exposure limits (TLV, PEL, REL), implementing controls (ventilation, substitution, administrative), and maintaining exposure records for the duration of employment plus 30 years (OSHA requirement). A strong industrial hygiene program integrates sampling schedules, lab results, and control recommendations into the broader QEHS platform.

Related: tlv, pel, noise-exposure, heat-stress, sds, control-hierarchy

Assessment and control of Legionella bacteria in water systems.

Legionella pneumophila thrives in water at 20–45 °C, especially in stagnant, scale-laden systems. Risk sites: cooling towers, hot water systems, decorative fountains, dental units. Control: maintain hot water >60 °C, cold <20 °C, regular disinfection, and routine sampling. In the UK, HSE ACoP L8 and HTM 04-01 are the standards. CDC MMWR guidance applies in the US.

Related: iaq, ptw, hazard

The minimum concentration of a gas in air at which ignition can occur.

The Lower Explosive Limit — LEL — is the minimum concentration of a gas or vapour in air at which the mixture will ignite and propagate a flame, and below it the mixture is too lean to burn. The companion is the Upper Explosive Limit, the UEL, above which the mixture is too rich to burn, and the band between the LEL and the UEL is the flammable range the gas detector watches for. The detector alarms in per cent of the LEL, not in per cent of the gas, so the reading is the fraction of the way to the ignitable mixture, and the alarm points are typically 10 per cent LEL as the action level and 25 per cent LEL as the evacuation, set below the ignition threshold to give the worker time to leave. The LEL is the number that governs the confined-space entry and the hot-work permit, because the atmosphere a worker puts a torch or a grinder into has to be below the LEL or the spark closes the circuit. The hazard that catches the worker is the oxygen-displaced atmosphere — the inert gas purge that drops the oxygen below the 19.5 per cent the body needs, which suppresses combustion and reads as a safe LEL while it asphyxiates the entrant — so the LEL reading is necessary but not sufficient, and the confined-space monitor reads the LEL, the oxygen, and the carbon monoxide and the hydrogen sulfide together. The calibration and the bump-test of the monitor are the controls that keep the reading honest. See hot work, confined space, and SDS.

Related: hot-work, confined-space, sds

Occupational noise management to prevent noise-induced hearing loss.

Noise exposure is the occupational health hazard the hearing-conservation programme under OSHA 29 CFR 1910.95 is built to prevent, and the standard triggers the programme at the 85 dBA time-weighted average — the Action Level — at which the worker begins to accumulate the noise dose that produces the noise-induced hearing loss over years. The programme has five parts: the noise monitoring that finds who is at the action level, the audiometric testing that baselines the worker and tracks the threshold shift, the hearing protector the employer provides, the training, and the recordkeeping. The engineering controls — the enclosure, the damper, the quiet machine — are the preferred control, and the hearing protector is the fallback when the engineering cannot bring the level down. The tension in the noise standard is the gap between the OSHA numbers and the NIOSH numbers. OSHA sets the Action Level at 85 dBA and the Permissible Exposure Limit at 90 dBA TWA, with the five-dB exchange rate that halves the allowed time per five-dB increase; NIOSH recommends the REL at 85 dBA and the three-dB exchange rate the physics of hearing loss actually follows, so the OSHA PEL permits exposure the NIOSH limit does not. The standard threshold shift on the audiogram — the early hearing loss the programme is designed to catch — is the leading indicator the recordable hearing loss is the lagging one, and the worksite that acts on the threshold shift prevents the recordable. See PPE, PEL, and TLV.

Related: ppe, pel, tlv

OSHA's legally enforceable occupational exposure limits.

The Permissible Exposure Limit — PEL — is the legally enforceable airborne concentration of a chemical OSHA sets under 29 CFR 1910, the level the employer is required to keep the worker below, and the number that carries the citation if the industrial-hygiene monitoring shows the exposure past it. The PELs are codified in the 29 CFR 1910.1000 Z-tables for the air contaminants, and the substance-specific standards — 1910.1025 for lead, 1910.1028 for benzene, 1910.1048 for formaldehyde — carry the medical-surveillance and the exposure-assessment obligations on top of the limit. The PEL is the floor the law sets, and the eight-hour time-weighted average is the form most of them take, with the ceiling and the short-term limits on the few the acute risk demands. The weakness of the PEL is its age. Most of the OSHA PELs were adopted from the 1968 ACGIH TLVs at the founding of the agency in 1971, and the agency has not been able to update them in bulk since, so the PEL for a chemical is the science of fifty years ago frozen into law, and many are not health-protective by the modern toxicology. The result is that the industrial hygienist who works to the PEL alone protects the worker to a 1968 standard, and the honest EHS programme treats the PEL as the legal floor and the ACGIH TLV or the NIOSH REL as the health target the monitoring is actually designed to. The PEL is what the inspector reads; the TLV is what the worker needs. See TLV, SDS, and HazCom.

Related: tlv, sds, hazcom

An ergonomic tool assessing whole-body posture for musculoskeletal risk.

The Rapid Entire Body Assessment — REBA — is the ergonomic tool that extends the upper-body RULA to the whole body, so the assessor can score the dynamic, unpredictable task where the worker moves through postures rather than holds one — the patient transfer, the bag lift, the construction handling, the warehouse pick. REBA scores the trunk, the neck, the legs, the upper arm, the lower arm, and the wrist, adjusts for the coupling, the load, and the activity, and combines them into a 1-to-15 action level that maps from negligible risk to very high, with the investigate and the change thresholds between. The tool was built for healthcare, where the patient-handling injury is the dominant musculoskeletal risk, and it spread to every sector with an unpredictable manual task. REBA is the companion to RULA — RULA for the seated, fixed workstation, REBA for the standing, dynamic one — and the two cover the musculoskeletal risk across the office and the floor. The pair is used alongside the NIOSH Lifting Equation, which is the tool that calculates the recommended weight limit for a specific symmetric lift, where REBA scores the posture of an asymmetric and dynamic one the Equation does not fit. The discipline that makes REBA useful is the same as any ergonomic screen — the assessment that produces an action, the re-assessment after the intervention, and the trend the programme reports as a leading indicator. See RULA and leading indicator.

Related: rula, leading-indicator

An ergonomic assessment tool scoring upper body posture and muscle use.

The Rapid Upper Limb Assessment — RULA — is the ergonomic screening tool that scores the posture of the upper body at a workstation and flags the musculoskeletal risk before it becomes the reportable disorder. The assessor observes the worker, scores the upper arm, the forearm, the wrist, the neck, the trunk, and the legs on a posture scale, adjusts for the muscle use and the force, and combines the scores into a single 1-to-7 action level — 1 and 2 acceptable, 3 and 4 investigate and change, 5 and 6 investigate soon, 7 investigate immediately. RULA is the fast tool an ergonomist runs in minutes, and it is the one a line supervisor can be trained to run on every new workstation. RULA is the upper-body tool, and it is the right tool for the workstation where the risk is in the arms and the hands — the assembly cell, the laboratory bench, the office desk, the surgical theatre. It is not the right tool for the whole-body lifting task — the patient transfer, the bag lift, the construction handling — where the Rapid Entire Body Assessment, REBA, is the method that scores the lower body and the load. The two are paired, not competing, and a musculoskeletal programme that runs RULA on the seated tasks and REBA on the lifting tasks covers the two risk populations the office and the floor both carry. The honest use is the repeat assessment after the intervention, to prove the score moved. See REBA and leading indicator.

Related: reba, leading-indicator

An OSHA-required program covering selection, fit-testing, use, cleaning, and medical evaluation for respirator users.

Under OSHA 29 CFR 1910.134, any workplace that requires respirator use must implement a written respiratory protection program. Elements include: hazard assessment to determine airborne contaminant levels, respirator selection based on assigned protection factor (APF), medical evaluation to ensure fitness to wear a respirator, fit-testing (quantitative or qualitative), training on use and limitations, cleaning and maintenance procedures, and program evaluation. The program administrator must be qualified and the program must be updated as conditions change.

Related: ppe, tlv, pel, sds, industrial-hygiene

16-section document describing a chemical hazard and its controls.

A Safety Data Sheet is the 16-section document a chemical supplier provides to communicate the hazard of a substance and the controls for handling it. OSHA HazCom 2012 aligned the US with the Globally Harmonized System and adopted the 16-section format: identification, hazard identification, composition, first-aid, fire-fighting, accidental release, handling and storage, exposure controls and PPE, physical and chemical properties, stability and reactivity, toxicological information, ecological information, disposal, transport, regulatory, and other. Each section is in the same place on every sheet, so a responder or a worker can find the first-aid measure or the PPE requirement without reading the sheet front to back. The SDS is the document a HazCom program is built around: the chemical inventory, the labels, and the training all trace back to the hazard data on the sheet, and OSHA requires an SDS for every hazardous chemical in the workplace, accessible to the worker on the shift they are exposed. The section that drives most controls is section 8 — exposure controls and PPE — which carries the permissible exposure limit and the respirator and glove selection, and section 4 — first-aid measures — is what the clinic reads after an exposure. A QEHS platform holds the SDS against the chemical, the inventory against the SDS, and the exposure against both, so the data sheet is not a filing exercise but the source the controls draw from. See HazCom, GHS, and PPE.

Related: hazcom, ghs, ppe

ACGIH occupational exposure guideline values for airborne contaminants.

A Threshold Limit Value — TLV — is the airborne concentration of a chemical the American Conference of Governmental Industrial Hygienists, the ACGIH, judges nearly all workers can be exposed to repeatedly without adverse health effect, published annually in the TLVs and BEIs booklet. The TLV comes in three forms: the TLV-TWA, the eight-hour time-weighted average for a normal workday, the TLV-STEL, the fifteen-minute short-term exposure limit not to be exceeded at any time during the day, and the TLV-C, the ceiling concentration never to be exceeded even instantaneously. The industrial hygienist uses the TLV to design the ventilation, select the respirator, and set the exposure-monitoring programme. The TLV is a guideline, not a regulatory limit — the OSHA Permissible Exposure Limit, the PEL, is the enforceable one — and the practical difference is that the ACGIH revises the TLV on the science every year, where the OSHA PEL is mostly frozen at the 1971 levels the agency adopted and has not been able to update. The result is that the TLV for a chemical is usually lower — more health-protective — than the PEL for the same chemical, and the industrial hygienist who works to the TLV protects the worker where the PEL would not. The honest EHS programme monitors to the lower of the two and treats the OSHA PEL as the legal floor, not the health target. See PEL, SDS, and noise exposure.

Related: pel, sds, noise-exposure

The systematic tracking of all chemicals on site — quantities, locations, SDS documents, and regulatory reporting triggers.

Chemical inventory management is foundational to both safety (knowing what hazards are present) and environmental compliance (EPCRA Tier II reporting, TRI Form R reporting). A modern chemical inventory links each chemical to its Safety Data Sheet (SDS), tracks quantities per location, flags chemicals that exceed regulatory thresholds, and auto-generates reports for fire departments, LEPCs, and environmental agencies. Integration with procurement and waste manifests provides cradle-to-grave tracking from purchase to disposal.

Related: sds, tier-ii, form-r, ghs, hazcom

Generator accountability for hazardous waste from generation to final disposal.

Under RCRA, hazardous waste generators remain legally responsible for their waste until it is properly treated, stored, or disposed of. This is enforced through the Uniform Hazardous Waste Manifest system, which tracks waste from the generator site through transporters to the permitted Treatment, Storage, and Disposal Facility (TSDF). e-Manifest (EPA myRCRAid) is the electronic manifest system.

Related: esg, iso-14001, tier-ii

Corporate Sustainability Reporting and Environmental, Social, and Governance disclosures — increasingly mandated for enterprises.

Corporate Social Responsibility (CSR) and Environmental, Social, and Governance (ESG) reporting has moved from voluntary to mandatory in many jurisdictions. Frameworks include GRI (Global Reporting Initiative), SASB (Sustainability Accounting Standards Board), TCFD (Task Force on Climate-related Financial Disclosures), and the EU CSRD (Corporate Sustainability Reporting Directive). QEHS platforms support ESG data collection by capturing environmental metrics (emissions, waste, water, energy) alongside safety and quality data in a single audited system.

Related: esg, scope-1, scope-2, scope-3, ghg

A market-based approach to controlling pollution by creating economic incentives for reducing emissions — cap-and-trade systems.

Emissions trading (cap-and-trade) is a regulatory mechanism where a government sets a cap on total emissions, allocates allowances to emitters, and allows trading of allowances. Emitters who reduce emissions below their allocation can sell surplus allowances; those who exceed must buy. The EU ETS (Emissions Trading System) is the world's largest carbon market. In the US, the Acid Rain Program (SO₂ and NOₓ trading) demonstrated that market mechanisms can achieve environmental goals at lower cost than command-and-control regulation.

Related: ghg, scope-1, scope-2, esg

An element of an organisation's activities that can interact with the environment.

ISO 14001 requires organisations to identify environmental aspects — fuel combustion, wastewater discharge, chemical storage, noise, land disturbance — and determine which are "significant" based on their actual or potential environmental impact. Significant aspects drive objectives, operational controls, and emergency preparedness. The aspect-impact register is the environmental equivalent of a safety risk register.

Related: iso-14001, esg, risk-register

A framework for reporting non-financial sustainability performance.

Environmental, Social, and Governance — ESG — is the framework the capital markets built to report the non-financial performance the investor and the regulator now ask for alongside the financials, and it sits above the operational EHS data the way the financial statement sits above the ledger. The reporting standards are consolidating: the GRI is the multi-stakeholder standard, the SASB is the investor-materiality standard, the TCFD is the climate-financial-risk standard, the ISSB merged the SASB and the TCFD into the IFRS Sustainability Disclosure Standards, and the EU CSRD is the mandatory regime that turns the disclosure into law for the in-scope company. The EHS programme is the source of the data underneath — the emissions, the water, the waste, the injuries, the diversity — and the ESG report is the disclosure on top. ESG is distinct from the environmental management system under ISO 14001, though the two overlap and most mature programmes run both. ISO 14001 is the operational system that runs the site and produces the data; ESG is the disclosure framework that aggregates the data across the company and reports it to the market, and the gap between them is the gap the auditor and the investor both read. The honest ESG report is the one where the disclosed number traces back to the operational record — the Scope 1 to the meter, the TRIR to the 300 log, the water to the withdrawal record — and the report that cannot trace is the one that becomes the greenwashing claim the regulator and the plaintiff pursue. The CSRD assurance requirement is what forces the trace. See ISO 14001.

Related: iso-14001

A quantified account of greenhouse gas emissions from an organisation.

Governed by the GHG Protocol Corporate Standard. Emissions are organised into Scope 1 (direct combustion, fugitive releases, company vehicles), Scope 2 (purchased electricity/heat/steam), and Scope 3 (supply chain, employee travel, use of sold products). ISO 14064-1 provides an auditable reporting standard. GHG inventories feed ESG disclosures, TCFD reports, and carbon offset programmes.

Related: scope-1, scope-2, scope-3, esg

A methodology for evaluating the environmental impacts of a product, process, or service across its entire life cycle — from raw material extraction to disposal.

Life cycle assessment (LCA) is standardised under ISO 14040 and 14044. It quantifies environmental impacts across multiple categories (global warming potential, acidification, eutrophication, resource depletion) for each life cycle stage: raw material extraction, manufacturing, distribution, use, and end-of-life. LCAs inform product design (design for environment), environmental product declarations (EPDs), and regulatory compliance. In QEHS platforms, LCA data feeds ESG reporting, supplier scorecards, and sustainability disclosures.

Related: environmental-aspect, esg, ghg, iso-14001

A class of synthetic chemicals called "forever chemicals" due to environmental persistence.

PFAS encompass thousands of compounds (PFOA, PFOS, GenX, etc.) used in non-stick coatings, firefighting foam (AFFF), food packaging, and stain repellents. They accumulate in groundwater and living tissue. EPA has set MCLs for PFOA/PFOS at 4 ppt in drinking water (2024). Sites with AFFF use or manufacturing must assess and potentially remediate PFAS contamination.

Related: reach, esg, iso-14001

EU regulation requiring registration, evaluation, and restriction of chemical substances.

REACH — the EU Regulation on the Registration, Evaluation, Authorisation and Restriction of Chemicals, EC 1907/2006 — is the chemical regulation that put the burden of proof on the manufacturer and the importer, so a chemical is treated as unsafe until the company that places it on the market demonstrates otherwise. The registration obligation applies to substances manufactured or imported at or above one tonne per year, and the dossier has to cover the intrinsic properties, the uses, and the exposure scenarios. The Substances of Very High Concern — the carcinogens, the mutagens, the reproductive toxicants, the persistent and bioaccumulative — go on the Candidate List, and an article containing an SVHC above 0.1 per cent by weight has to be disclosed to the recipient and on request to the consumer. REACH works in three layers that escalate with the risk. The Candidate List is the disclosure trigger; the Authorisation List is the list a company cannot use after the sunset date unless an authorisation was granted, which forces the substitution to a safer alternative; and the Restriction List is the EU-wide ban on a specific use. The compliance burden is the supply-chain communication — the SDS, the exposure scenario, and the SVHC disclosure cascade down the supply chain, and the article manufacturer a step removed from the chemical still has to know what is in the product it bought. The enforcement is by the member-state authorities and the ECHA, and the penalty for a non-compliant import is the market access. See SDS, GHS, and RoHS.

Related: sds, ghs, rohs

EU directive restricting hazardous substances in electrical and electronic equipment.

RoHS — the EU Directive on the Restriction of Hazardous Substances in electrical and electronic equipment, recast as 2011/65/EU and amended by 2015/863 — restricts the use of ten substances in the equipment placed on the EU market: lead, mercury, cadmium, hexavalent chromium, polybrominated biphenyls, polybrominated diphenyl ethers, and the four phthalates DEHP, BBP, DBP, and DIBP. The restriction is by maximum concentration in the homogeneous material — 0.1 per cent for most, 0.01 per cent for cadmium — and the threshold is measured at the smallest indivisible unit of the product, not the average. The scope covers the product categories in Annex I, with exclusions in Annex III and exemptions in Annex IV that a manufacturer can claim for a specific technical use. The compliance evidence is the EU Declaration of Conformity and the technical documentation the manufacturer maintains for ten years, and the CE mark on the product signals the conformity to RoHS alongside the other applicable directives. The relationship to REACH is the one that confuses most compliance teams: RoHS restricts substances in the electronic equipment; REACH restricts substances across all uses, and the SVHC disclosure under REACH applies to the same product alongside the RoHS restriction. The manufacturer that holds the Bill of Substances against both, with the supplier declarations cascaded down the chain, holds the evidence the market-surveillance authority asks for. See REACH and SDS.

Related: reach, sds

Direct GHG emissions from sources owned or controlled by the organisation.

Scope 1 covers the direct greenhouse-gas emissions from sources the organisation owns or controls — the stationary combustion in the boiler and the furnace, the mobile combustion in the company fleet, the process emissions from the chemistry of making the product (cement calcination, steelmaking reduction, ammonia synthesis), and the fugitive emissions from the refrigerant leak and the methane that escapes the pipeline and the valve. Scope 1 is the most controllable category because the source is on the site the operator runs, and it is the starting point of every decarbonisation roadmap — the emissions the company can cut without a supplier or a customer having to move first. The GHG Protocol is the accounting standard, and the EPA Greenhouse Gas Reporting Program under 40 CFR Part 98 is the US mandatory report for the facilities above the 25,000-tonne threshold. The discipline that makes Scope 1 useful is the inventory boundary — the organisational and the operational boundary that decides which sources count, drawn the same way every year so the number is comparable across years and across sites. The two failures are the boundary that quietly shrinks to make the target and the fugitive emissions that go uncounted because no one measured the refrigerant top-up, and a Scope 1 number that omits the fugitives is the number that looks good until the methane plume shows up on a satellite. The reduction levers are the fuel switch, the efficiency, the electrification of the fleet, and the leak detection on the refrigerants, and the metric that tracks them is the absolute tonnage and the intensity against the unit of product. See GHG Protocol, Scope 2, and ESG.

Related: ghg, scope-2, esg

Indirect GHG emissions from purchased electricity, heat, steam, or cooling.

Scope 2 covers the indirect greenhouse-gas emissions from the electricity, the heat, the steam, and the cooling the organisation purchases — the emissions that happen at the power station, not at the site, but that the site causes by drawing the load. The GHG Protocol requires two accounting methods, and both have to be reported. The location-based method uses the average emissions intensity of the grid the site sits on, so it reflects the actual carbon of the electricity the site burns. The market-based method uses the emissions of the specific contracts and instruments the site bought — the renewable energy certificates, the power purchase agreements, the supplier-specific rates — so it reflects the carbon the site paid to avoid. The reason both numbers have to be disclosed is that they answer different questions, and a company that reports only the market-based number can show zero Scope 2 by buying certificates while the grid it draws from is coal-heavy — which is why the location-based number is the one that tracks the physical decarbonisation and the market-based is the one that tracks the procurement. The reduction levers are different for each: location-based Scope 2 falls when the grid decarbonises and when the site cuts the load, and market-based Scope 2 falls when the site buys renewable power or generates its own. The trap is the certificate that is not additional — the REC from a project that would have been built anyway — and the honest procurement policy is the one that chases the real megawatt-hour, not the paper one. See GHG Protocol, Scope 1, and ESG.

Related: ghg, scope-1, esg

All other indirect GHG emissions in the value chain, upstream and downstream.

Scope 3 covers the indirect greenhouse-gas emissions that happen in the value chain but outside the sources the organisation owns or the power it buys — the emissions embedded in the purchased goods and services, the capital goods, the fuel and energy the supplier burned before delivery, the transportation the logistics provider runs, the waste the haulier takes, the business travel, the employee commute, and the use and the end-of-life of the product the company sold. The GHG Protocol defines 15 categories, split upstream and downstream, and Scope 3 is almost always the largest share of the corporate footprint — 70 to 90 per cent for most companies — because the value chain is bigger than the operator and the power station combined. The difficulty of Scope 3 is the data. Scope 1 and 2 sit on the operator site and the electricity meter; Scope 3 sits in the supplier the operator does not control, and the supplier number is a spend-based estimate or a sector average until the supplier reports its own footprint. The reduction lever is supply-chain engagement — the procurement clause that asks the supplier for its Scope 1 and 2, the contract that rewards the lower-carbon supplier, the design choice that cuts the embodied carbon of the product — and the honest Scope 3 target is the one that names the categories the company can actually move, not the 15 categories reported once and forgotten. The science-based target is the discipline that ties Scope 3 to the 1.5-degree trajectory. See GHG Protocol, Scope 2, and ESG.

Related: ghg, scope-2, esg

EPA-required plans for facilities storing oil above threshold quantities — preventing oil spills and containing them if they occur.

Under 40 CFR 112 (EPA), facilities with aggregate above-ground oil storage exceeding 1,320 gallons (or 42,000 gallons buried) must prepare an SPCC plan. The plan must be certified by a Professional Engineer, describe oil storage locations and quantities, identify spill pathways, specify containment measures (secondary containment, diversion structures), detail inspection procedures, and provide for discharge response. SPCC plans must be reviewed every five years and updated when storage capacity or containment configurations change.

Related: swppp, environmental-aspect, emergency-response-plan

A plan required under NPDES permits to prevent stormwater contamination.

The Stormwater Pollution Prevention Plan — SWPPP — is the document the Clean Water Act NPDES permit requires an industrial facility or a construction site to maintain, to keep the rain that falls on the site from carrying the pollutant off it and into the receiving water. The industrial facility operates under the EPA Multi-Sector General Permit, the MSGP, and the construction site over an acre operates under the Construction General Permit, the CGP, and both permits require the SWPPP before the discharge begins. The plan identifies the pollutant sources — the loading dock, the fuel storage, the material stockpile, the disturbed soil — and the best management practices, the BMPs, that keep the pollutant out of the runoff: the berm, the silt fence, the oil-water separator, the good-housekeeping practice. The SWPPP lives on the inspection, not the document. The permit requires the comprehensive annual site inspection and the quarterly or routine visual assessment of the stormwater discharge, and the inspection that finds the silt fence failed or the stockpile was left uncovered is the one that triggers the corrective action before the runoff carries the pollutant to the creek the regulator samples. The honest SWPPP is the one where the BMP is in the field and the inspection record proves it, not the one where the document is filed and the field is unmanaged — because the NPDES violation is the discharge, and the discharge is what the inspector sees, not what the plan says. The SWPPP pairs with ISO 14001 on the environmental system and the ESG report on the water disclosure. See ISO 14001 and ESG.

Related: iso-14001, esg

Annual chemical inventory report filed with state and local emergency planners.

EPCRA Section 312 requires US facilities storing hazardous chemicals at or above threshold quantities to submit Tier II reports by March 1 each year to the State Emergency Response Commission (SERC), Local Emergency Planning Committee (LEPC), and local fire department. Reports include chemical name, CAS#, quantity, storage locations, and physical/health hazards.

Related: sds, hazcom, esg

Annual EPA report on releases and transfers of listed toxic chemicals.

EPCRA Section 313 requires US facilities meeting SIC code, employee, and threshold criteria to file Form R (or the abbreviated Form A) by July 1 for the prior calendar year. Reports cover on-site releases to air, water, and land, plus off-site transfers for disposal or recycling. Data is published in the EPA TRI National Analysis and accessible via the TRI Explorer database.

Related: tier-ii, esg, iso-14001

The collection, transport, treatment, and disposal of waste — including hazardous, universal, and solid waste streams.

Waste management in a QEHS context covers the full lifecycle from generation to final disposal. Hazardous waste (RCRA Subtitle C) requires cradle-to-grave manifesting, generator classification (LQG, SQG, VSQG), and land disposal restriction compliance. Universal waste (batteries, lamps, mercury devices, pesticides) follows streamlined requirements. Solid waste (Subtitle D) and construction debris have their own regulatory frameworks. Key compliance triggers include monthly generation rates, accumulation time limits, and emergency preparedness requirements.

Related: environmental-aspect, ghg, scope-3, form-r

A structured, non-punitive observation of worker behaviour — the foundation of behaviour-based safety (BBS) programs.

A safety observation is the core data-collection activity in behaviour-based safety (BBS) programs. A trained observer watches a worker perform a task, records both safe and at-risk behaviours, provides immediate positive feedback on safe behaviours, and discusses at-risk behaviours constructively. The data is aggregated (not individualised) to identify behavioural trends and target systemic improvements. Effective observations focus on specific, observable behaviours, not attitudes or personalities, and are never used for discipline. The goal is to increase safe behaviours through positive reinforcement, not to punish.

Related: bbs, leading-indicator, near-miss, safety-culture

The right — and obligation — of any worker to stop work they reasonably believe poses an imminent danger without fear of reprisal.

Stop Work Authority is a cornerstone of mature safety culture. It empowers any worker — employee, contractor, or visitor — to halt work when they observe a condition or behaviour that could cause serious injury, illness, or environmental damage. Effective SWA programs include: clear policy communication, training for all personnel, non-retaliation provisions, a standardised process for resolving the stop (who assesses, who decides, who restarts), and tracking of stop-work events as a positive leading indicator. A high rate of stop-work events signals a healthy reporting culture, not a failing one.

Related: safety-culture, bbs, leading-indicator, hazard