A Procedure That Exists in a Binder Is Not a Control

Why written controls and actual controls are not the same thing, and what HECA gets right about closing the gap.

I have spent more than thirty years walking production floors, and I can tell you with confidence that the most dangerous sentence in occupational safety is, "We have a procedure for that."

Not because procedures are bad. Procedures matter. Lockout/tagout, permit-to-work, confined-space entry, energy-control protocols — these documents represent decades of accumulated learning, often paid for in blood. The problem is not the existence of the procedure. The problem is the leap of logic that happens when a leader points to a binder on a shelf and concludes that the hazard is controlled. It is not. The binder describes a control. A control is what actually happens in the field, on the floor, between a worker and an energy source, at a specific moment in time. The two are not the same, and the gap between them is where workers die.

This distinction matters more than any other in serious injury and fatality prevention, which is why I want to spend some time on it.

Consider the numbers. The U.S. Bureau of Labor Statistics recorded 5,070 fatal work injuries in 2024 — a worker every 104 minutes. ISN's analysis of more than 178,000 OSHA recordable incidents from 2017 to 2024 found that while overall recordable rates have steadily declined, serious injuries and fatalities have not followed the same trajectory. Gravity, motion, and mechanical energy sources account for nearly 90 percent of contractor serious injuries. Among nearly 2,400 OSHA fatality inspection records ISN examined, gravity and motion were the leading energy categories. The pattern is consistent across industries: people are not dying from a lack of written procedures. They are dying from a gap between the procedure on paper and the control in the field.

Why does the gap exist? In my experience, three reasons come up again and again.

The first is that procedures are written for ideal conditions. The crew is rested. The tools are present. The information is complete. The supervisor is available. No one is being pushed by a production schedule that does not quite fit the work. In real life, almost none of those conditions hold at once, almost ever. The procedure assumes a world that does not exist. The worker, who actually has to do the work, has to bridge the difference between the procedure and reality, usually without explicit permission and almost always without organizational acknowledgment that they are doing it. Sidney Dekker has written extensively about this gap — what he calls the difference between work-as-imagined and work-as-done — and it sits at the heart of every modern view of safety. The work-as-done is where the energy is. The work-as-imagined is where the binder is.

The second reason is that controls degrade over time, and almost no one checks systematically. A guard that was installed correctly in 2019 may still be there in 2026, but is it the right guard? Is it still aligned? Has the operator removed it and replaced it with something faster? Has the equipment been modified in a way that the guard no longer covers? An interlock that worked at commissioning may have been bypassed by maintenance for an emergency repair and never restored. A lockout point that was identified on day one may no longer be the actual energy isolation point after a process change. None of these failures will appear in a procedure audit. All of them will appear in an incident investigation.

The third reason is that the verification step — the step where someone actually confirms that the control is present, functional, and in use right now — is the step most organizations treat as implicit. Everyone assumes someone else is doing it. The supervisor assumes the worker is checking. The worker assumes that engineering signed off. Engineering assumes the maintenance department maintains. Maintenance assumes the procedure is being followed. In the gap between those assumptions, the energy waits.

This is why the High Energy Control Assessment, or HECA, matters so much. HECA does not invent a new philosophy of safety. What it does is operationalize the verification step that most programs treat as implicit but rarely confirm. The structure is simple: identify the high-energy sources present in a work area or task, inventory the controls specified for each source, and verify in the field that those controls are present, functional, and understood by the workers performing the work. Where gaps are found, they are documented and escalated based on the potential severity of the energy involved — not on whether an injury has yet occurred.

Pair this with the Safety Classification and Learning Model developed by the Edison Electric Institute, and the picture sharpens further. The SCL Model uses four yes/no questions to classify any incident, near-miss, or observation: Was high energy present? Was there a high-energy incident? Was a serious injury sustained? Was a direct control present? The answers locate the event in a hierarchy of learning priority. Crucially, the model defines a direct control with care: a measure specifically targeted to the high-energy source, effective when installed and verified, and robust to unintentional human error. EEI's research found that the same safety professionals who agreed on classification only 65 percent of the time without a structured framework reached 95 percent consensus using SCL. More than 14,000 cases have been submitted to the EEI repository to date, and the framework has shaped how leading utilities, contractors, and industrial operators approach SIF prevention.

What HECA and SCL share is a refusal to conflate the existence of a control with its operation. They demand the verification step in writing, by name, with consequences if the control is found to be absent. They treat the binder as a hypothesis and the field as the test.

I want to make one more point, because it is the one I have seen senior leaders miss most often.

The verification step is not a paperwork exercise. It is a leadership posture. When a supervisor walks through a work area with a HECA checklist in hand and asks the worker, "Show me how this lockout works for what you are about to do," the supervisor is not auditing. The supervisor is partnering. The conversation that follows — about whether the worker understands the energy, whether the control is right for the task, whether anything has changed since the last time this work was done — is the actual control. The checklist is the trigger. The conversation is the safety.

This is the partnership argument my books have been making for a decade, applied to the specific question of high-energy hazards. Compliance treats workers as procedure-followers. Partnership treats them as the most knowledgeable parties in the room about how the work actually happens. The procedure is on the floor. The conversation about whether the procedure matches the work is on the ceiling. The HECA framework gives that conversation a structure. The SCL Model gives the resulting data a common language. Together, they begin to close the gap that has kept the fatality line flat while every other safety metric trends down.

If you are a safety leader reading this, three practical things.

First, walk one job in the next two weeks and ask, of every high-energy source you see, where is the direct control, can I verify it right now, and does the worker understand it? Do not pre-announce the walk. Do not bring a clipboard the size of a steering wheel. Bring questions. Listen to the answers. You will learn more about your safety system in two hours than you will learn from a quarter of recordable data.

Second, if your incident investigations do not classify events by energy and direct control, you are leaving prevention insights on the table. SCL is in the public domain. The four questions take less time to ask than it takes to write "contact with object or equipment" on an incident form.

Third, treat every procedure in your organization as a hypothesis until you have field-verified the control. Most procedures will hold. Some will not. The ones that do not are the ones you need to know about before the next investigation tells you.

A procedure on a shelf is a description of what we wish would happen. A field control determines whether your workers go home. The work of our profession is to close the distance between the two. Everything else is paperwork.

Sources & Further Reading

• Edison Electric Institute. (2023). Safety Classification and Learning (SCL) Model.

• Edison Electric Institute. (2024). Approved Changes to SIF Criteria.

• ISN. (2025). Serious Injury & Fatality Insights, Multi-Framework Analysis 2017–2024.

• U.S. Bureau of Labor Statistics. (2026). Census of Fatal Occupational Injuries 2024.

• Hallowell, M. R., Alexander, D. & Gambatese, J. A. (2017). Energy-based safety research.

• Dekker, S. (2014). The Field Guide to Understanding 'Human Error' (3rd ed.). CRC Press.