When Controls Create False Comfort | Part 2 of 3

This is the second in a three-part Forge Journal series exploring vulnerability in safety risk management. Building on Part One, it examines where vulnerability often hides — inside ordinary risk assessments, documentation, and controls that appear stronger on paper than they are in practice.

In the first part of this series, I argued that vulnerability is one of the missing dimensions in safety risk management. Hazard matters, but so too does the susceptibility of what is exposed to harm and the real capacity left in the system when conditions tighten. The next issue is this: why do so many ordinary risk systems still flatter the true state of protection?

The Illusion of Control

Many risk assessments are built around a familiar pattern. A hazard is identified. A risk rating is assigned. Existing controls are listed. A residual risk score is then recorded after those controls are taken into account. Often the visual endpoint is a colour: red, amber, or green.

This process can be useful, but it can also conceal the very thing that most needs attention.

Most leaders are not reading a risk register and interrogating every listed control against likely failure modes, maintenance history, verification arrangements, and the actual operating conditions in which the job is done. More often, they are scanning for assurance. They want to know whether the issue has been considered, whether something is in place, and whether the organisation appears to be on top of it.

Their eye pauses at the final column. The box is green. Low risk.

There are many controls listed above it: training, supervision, procedures, PPE, toolbox talks, signage, monitoring, competence, awareness, and reporting. It looks comprehensive. It looks managed. It looks safe enough to move on from.

But this is precisely where vulnerability often hides.

The problem is not merely that the hierarchy of controls may be applied weakly. The deeper issue is that many risk assessments flatten the distinction between control presence and control strength. They can make weak and strong controls look interchangeable. They can make behavioural dependence appear equivalent to engineered protection. They can conceal the difference between a barrier that exists, a barrier that is partial, and a barrier that is assumed.

There is also a strange discomfort, often visible when risk assessments are being completed, with leaving empty space in the control section beside a serious hazard. Where an entry appears thin, there is a tendency to keep adding controls so the line does not look exposed or incomplete. Over time, this can produce long lists of controls that are vague, weak, unallocated, or aspirational. Usually this is not a deliberate attempt to mislead. Yet the cumulative effect can still be significant. The risk assessment begins to present the image of a strong system simply because many controls have been recorded against the hazard. Attention shifts from the quality, strength, and ownership of controls to their number. In that way, administrative density can slowly be mistaken for actual protection.

A long list of controls does not necessarily mean the hazard is well controlled. In many cases, much of what is listed does not control the hazard itself, but instead places expectations on people around it. These measures rely on a worker recognising the problem, a supervisor noticing drift, a contractor following instructions, a team remembering a rule, or someone acting in time before energy is released. They may all have value, but they are not equivalent to physically separating people from harm.

Sometimes the listed controls are not even actual protections, but future intentions. An engineering solution has been proposed but not funded. A redesign has been discussed but not implemented. A review is planned. A procedure is in draft. Training is due next quarter. Yet on paper these future steps may sit beside actual controls, and the overall picture looks mature.

This is how vulnerability can sit quietly inside a green box.

When Documentation Becomes Evidence

Across our review of hundreds of New Zealand health and safety prosecutions, a consistent pattern has emerged: serious harm often occurs not because the hazard was unknown, but because the organisation’s protection was weaker than assumed. In many cases, the defendant had identified the hazard, had some form of system in place, and could point to policies, training, procedures, expectations, or management activity. What failed was the strength, implementation, maintenance, or verification of the controls relied upon in practice.

That pattern matters because it cuts against the simplistic view that harm occurs only in obviously chaotic or unmanaged environments. Often the evidence shows that the organisation knew the broad nature of the risk, understood the seriousness of the potential harm, and had already articulated measures that ought to have stood between people and the hazard. The problem was that those measures were not strong enough, not sustained, not checked, or not translated into real separation from the source of harm.

Documentation can become double-edged. Many organisations build extensive safety management systems full of policies, procedures, standards, and plans. Those documents are often intended to demonstrate diligence. But when something goes wrong and an investigation begins, the same documents can become evidence that the organisation knew about the hazard, understood the risk, and had identified controls, yet did not implement, maintain, or verify them in a way that genuinely controlled exposure. Documentation intended to demonstrate good management can instead become evidence of foreseeability and a failure to act on known risks.

That is not merely a documentation problem. It is a vulnerability problem. It shows that the organisation’s exposure often lies not in ignorance of the hazard, but in the weakness of the safeguards it relied upon.

The Gap Between Paper and Practice

One of the places vulnerability grows most quietly is in the gap between the formal system and the operating system.

The formal system is what the organisation can point to. It sits in procedures, inductions, training packages, standards, risk assessments, permit systems, role descriptions, forms, and assurance reports. It reflects how the organisation intends work to be done and how risk is supposed to be controlled.

The operating system is what happens when the job meets reality. It is shaped by production demands, fatigue, weather, access constraints, competence, time pressure, contractor interfaces, equipment condition, supervision quality, and human judgement. It is the system that exists in workshops, warehouses, forests, vessels, construction sites, plant rooms, roads, and processing environments where exposure to hazardous energy is real.

The problem is not that reality is untidy. All meaningful work contains variation. The problem arises when the organisation assumes that the formal system and the operating system are closely aligned when, in critical areas, they are not.

That is where vulnerability takes hold.

A control may exist in a procedure but not in reliable practice. A pre-start check may be required but routinely abbreviated. An exclusion zone may be specified but difficult to maintain in a live job. A permit may be formally required but treated in practice as an administrative routine. A risk assessment may record strong separation from the hazard while the work actually depends on verbal coordination, timing, judgement, and people noticing when things begin to drift.

In these situations, the organisation may still believe the hazard is well managed because the formal system looks complete. But the real test is not whether the system can be described. The real test is whether it is operating reliably where the hazard exists.

Vulnerability grows when documented intention is mistaken for actual protection.

The Quiet Degradation of Controls

Controls do not remain effective forever. They drift, degrade, fatigue, corrode, go out of adjustment, are bypassed, misunderstood, or only partially implemented. They may be weakened by poor design, by production pressure, or simply because the organisation stops really seeing them; they become familiar, assumed, and unexamined.

Seen another way, organisations are always working against a quiet entropic pull: the gradual tendency for systems, controls, and assumptions to move away from their intended condition unless energy, attention, and verification are continuously applied. Entropy, and its implications for safety systems over time, deserves more attention than this article can give it. I will return to that in a future piece.

This matters because controls are often treated as though their mere existence is evidence of protection. In reality, controls are part of a living system. They must be implemented, maintained, verified, and understood in context. If they are not, the control itself can become a source of vulnerability.

A procedural control that no longer reflects the way work is actually carried out becomes vulnerable. A permit system that is routinely treated as paperwork becomes vulnerable. A guarding solution that is removed or compromised to maintain output becomes vulnerable. A reliance on training as the primary defence against serious energy transfer becomes vulnerable the moment worker attention, recall, judgement, or situational awareness is weakened by fatigue, ambiguity, haste, or pressure.

There is also a cumulative point here. Controls can absorb only so much reliance, so many cycles, and so much operational variation before their strength begins to weaken. A barrier that is repeatedly depended upon without reinforcement, redesign, maintenance, or verification may remain visible while no longer being robust. In that sense, a control can still be present and yet no longer be trustworthy.

This is one of the most important distinctions for leaders to understand. The existence of controls is not the same as control integrity. The presence of documentation is not the same as system strength. A control environment can look mature at a distance while containing deep vulnerability close up.

Yet vulnerability does not disappear simply because a system appears strong, or even because a court later accepts that it was.

In Part Three of this series, I examine that harder truth: the residual exposure that can remain even in strong systems, what happens after failure begins, and why vulnerability is as much a governance issue as it is a safety one.

Continue reading: Residual Capacity, Governance, and the Second Event | Part 3 of 3

Author Note

Perennia Forge is a New Zealand risk advisory business focused on hazard and vulnerability intelligence, critical risk, and practical judgement about whether safeguards are likely to remain trustworthy when conditions tighten and consequences are real.

References

Perennia Forge. (2026). How Strong Is Your Control?