This article was originally published on LinkedIn on 19 May 2025. It has been moved to the riskfacilitator Insights library so the website remains the permanent source.[1]

Primary sources used to verify and contextualise this archive: [2][3]

A recent conversation with international legal ESG expert Michael Tooma brought into sharp focus a persistent global challenge:

Across industries and jurisdictions, many corporations still default to low-level control measures, administrative controls, procedures, PPE, because higher-order controls appear to "cost more" or "take longer." This thinking must change. Choosing low-level controls must become the exception, not the rule.

For too long, safety has been incorrectly framed as a cost burden, a compliance requirement to be satisfied with the minimum possible investment. Yet organisations that understand modern safety thinking know:

Safety is not a cost; it is a value creator. High-order controls, elimination, substitution, and engineering solutions don't simply reduce risk; they strengthen operational resilience, create efficiencies, enable innovation, and build brand trust. They are strategic investments in organisational capacity.

By contrast, administrative controls rely almost entirely on perfect human behaviour in imperfect, dynamic environments.

  • They are vulnerable to fatigue, distraction, production pressure, and normalisation of deviance.
  • They represent a brittle safety system where small variations in performance can cascade into major failures.

As Professor Erik Hollnagel first articulated, there is often a gap between work-as-imagined, how managers, regulators, or designers expect work to happen, and work-as-done, how it actually unfolds on the ground.

This concept, echoed and expanded by leading safety thinkers including Sidney Dekker, Todd Conklin, and Andrew Hopkins, reminds us: real-world work is messy, adaptive, and shaped by conditions that procedures alone cannot control.

Just as there is rarely a single "root cause" to an incident, there is rarely a single voice that has shaped our modern understanding of risk. Instead, there is a broad, evolving body of knowledge reminding us that effective safety must be built into systems, not layered over them through paperwork and hope.

The New Standard for Risk Treatment

Organisations serious about safety, and serious about success, must adopt a new default position:

  • High-order controls first. Lower-order controls should only be selected by documented exception, with clear justification.
  • Cost is a factor, not a barrier. "Reasonably practicable" does not mean "as cheaply as possible."
  • Safety is a value multiplier. Strong controls enhance resilience, operational capacity, and stakeholder trust.
  • Workers must be involved. Those closest to the work are critical to identifying real risks and designing effective solutions.
  • Leadership must own the system. Safety outcomes are shaped more by design and decision-making than by individual behaviour.

Risk is an unavoidable part of operating any business, but how we manage that risk defines whether an organisation is building resilience or fragility. Choosing lower-order controls because it’s "easier" or "cheaper" is not a strategy, it is a ticking liability.

Real safety leadership is measured by the systems we build, not the paperwork we produce.

Low-order controls must be the exception, not the foundation. Strong, systemic safety must become the rule. Organisations that invest in high-order controls aren’t just protecting people, they are strengthening resilience, safeguarding reputation, and securing future success.

(This article was inspired by a conversation with international legal ESG expert Michael Tooma, Australia's leading health and safety lawyer and global ESG legal expert. Michael is a recognised thought leader in regulatory investigations, safety leadership, and ESG transformation, with a global reputation for driving strategic resilience and cultural change.)

References

  1. Paul Chivers, Safety Is Value: Why Settling for Low-Level Controls Must Become the Exception, Not the Rule, LinkedIn, originally published 19 May 2025.
  2. Safe Work Australia, Managing risks, accessed 10 August 2026.
  3. Safe Work Australia, Model Code of Practice: How to manage work health and safety risks, accessed 10 August 2026.