RISKOPILOT Editorial Team, 16 September 2026, 5 min read

Verification is not protection: the hierarchy of controls for boards

Checks, training and procedures keep barriers healthy. Only elimination and engineering take fatal energy away from people.

The comfortable action plan

Many serious incident reviews end with the same actions: retrain the team, update the procedure, add a check. They are quick to approve and easy to audit. They rarely change fatal risk, because each of them still relies on a person doing the right thing at the right moment.

Protection points make the hierarchy visible

CCHI scores each barrier by how much it relies on people. A passive engineering barrier earns 2.0 points, an automated one 1.0, a barrier a person must activate 0.5, an active human barrier 0.3 and personal protection 0.2. One point is roughly a tenfold reduction in risk. Training, procedures, permits and signage keep barriers healthy but fail the direct-control test and earn nothing on their own.

Independent barriers add up; barriers that share a cause, such as the same crew, count once. Each fatal-energy pathway is capped at 3.0 points, and a task is only as protected as its weakest pathway. The points are planning conventions, not measured failure probabilities.

What two investigations show

At the Buncefield fuel depot in 2005, a tank had a level gauge and an independent high-level switch. The gauge had been sticking intermittently since the tank was serviced months earlier, and the switch was inoperable because a padlock needed to hold its test lever was not fitted, although the switch was tested periodically. The tank overflowed, and the vapour cloud exploded.

At the Texas City refinery the same year, a distillation tower was overfilled during start-up while its level transmitter indicated a safe and falling level. Relief went to a blowdown stack with no flare, close to occupied temporary trailers. Fifteen people were killed and 180 injured. The Chemical Safety Board found that many of the issues were recurring problems already identified in internal audits and investigations.

In both cases, verification activity existed. The engineering that would have kept the energy away from people was absent or not working.

Testing the order of priorities

The CCHI lab applies the same logic to an example organisation over 24 months. Assurance and culture measures alone reduced simulated high-energy events from 83 to 68. An engineering-first plan reduced them to 16. These are illustrative results from a model that assumes the mechanism, not a forecast. They show the order of priorities: eliminate the energy, engineer the barriers, then keep them working and verify them.

The board question

The useful question for a board is not whether checks are being done, but how much of the organisation’s fatal-energy exposure still depends on people.

Sources

Explore the method in the CCHI lab

Request early access The method