Interface Risk Why No One Owns the Space Between Responsibilities
Many serious events in high-risk industries do not begin with a single team doing something wildly outside its role. They begin with two or more teams doing what their systems told them to do, while the risk created between them remains unmanaged.
Operations releases equipment. Maintenance accepts the work pack. Engineering issues a design change. Construction installs what was issued. Procurement buys an approved component. A contractor follows the contract. The night shift hands over what it knows.
Each party can be technically compliant. The combined system can still be unsafe.
That is the uncomfortable reality of interface risk. It sits in the boundary between scopes, disciplines, contracts, shifts, locations, and phases of work. It often escapes conventional HSE systems because those systems are good at assigning responsibility, but less good at managing interaction.
Experienced HSE professionals see this pattern often. The dropped object is traced to a lifting subcontractor, but the real story includes poor deck planning, a late engineering change, congested access, and client schedule pressure that no single contractor controlled. A permit breach is assigned to maintenance, but the underlying problem involved operations isolations, control room assumptions, incomplete drawings, and a shift handover that did not transmit uncertainty.
The issue is not that no one cares. The issue is that ownership is usually drawn around organizational boxes, while risk moves across them.
Why Interfaces Create Risk Even When Roles Are Defined
Responsibility matrices, contract scopes, operating procedures, and work packs all create order. They also create edges. At those edges, information loses context, assumptions multiply, and controls can be split across parties who do not share the same priorities, language, timing, or risk picture.
Organizational accident research has treated this as a core feature of major accidents for decades. James Reason’s work on organizational accidents helped shift attention from the last person touching the task to latent conditions embedded in systems. Charles Perrow’s theory of normal accidents emphasized that tightly coupled, complex systems can produce unexpected interactions. High Reliability Organization research showed that reliability depends on sustained attention to weak signals, deference to expertise, and a reluctance to simplify. Resilience engineering added another useful point: work succeeds because people constantly adapt across boundaries, not because the written system fully captures reality.
Official investigations repeatedly support this systems view. The U.S. Chemical Safety and Hazard Investigation Board has identified organizational and process safety management weaknesses in major refinery and chemical events, including problems with communication, hazard recognition, management of change, contractor oversight, and operational decision-making. NASA’s Columbia Accident Investigation Board described technical failure alongside organizational normalization, communication barriers, and decision processes that prevented weak evidence from being taken seriously. The Cullen Inquiry into Piper Alpha examined how permit-to-work, shift communication, maintenance status, and offshore operational decisions interacted under emergency conditions.
These findings do not mean responsibility is irrelevant. They mean responsibility is not enough.
A department can complete its assigned task while failing to understand how its output becomes another group’s input. A contractor can meet contract metrics while leaving interface hazards unresolved. A project can hand over a facility that meets mechanical completion criteria while operations inherits alarm floods, inaccessible valves, temporary overrides, or maintainability problems.
The risk isn't in one box. It is in the handoff.
The False Comfort Of RACI
RACI charts have value. They clarify who is responsible, accountable, consulted, and informed. They reduce duplication and prevent some gaps. But they can also create false confidence.
A RACI usually answers, “Who owns this activity?” It often does not answer several more important questions:
What unsafe conditions can be created when two activities interact?
Who has authority to stop work when the boundary condition changes?
Which controls are shared, and how will they be verified?
What information must transfer across the interface, in what form, and by when?
What happens when one party’s assumptions conflict with another party’s constraints?
Who owns the risk if all parties meet their individual obligations?
That last question is where many systems struggle.
In practice, RACI can fragment risk. Operations owns process conditions. Maintenance owns task execution. Engineering owns technical standards. Contractors own means and methods. Procurement owns commercial terms. HSE owns assurance. Each may be correct. None may own the combined scenario.
A better approach treats RACI as a starting point, not a control. Interface management requires explicit coordination mechanisms, shared risk reviews, boundary condition monitoring, and named authority for escalation.
The Main Interfaces Where Risk Hides
Interface risk appears in nearly every high-risk operating model. The pattern changes by industry, but the underlying mechanisms are familiar.
Interface | Typical Hidden Risk | Why It Gets Missed |
Operations and Maintenance | Isolation quality, equipment status, permit boundaries, simultaneous operations | Each side assumes the other has verified the operating state |
Client and Contractor | Production pressure, unclear stop-work authority, conflicting metrics | Contract compliance is mistaken for shared risk ownership |
Contractor and Subcontractor | Task sequencing, competency, supervision, dropped objects, lifting plans | Risk is passed down faster than context |
Engineering and Construction | Design intent, field changes, temporary works, constructability | Drawings are treated as complete representations of field reality |
Projects and Operations | Commissioning, startup risk, maintainability, alarm management | Handover focuses on completion rather than operational readiness |
Marine and Land | Mooring, cargo transfer, exclusion zones, weather windows, communications | Different rule sets and command structures meet at the shoreline |
Day and Night Shift | Degraded equipment, temporary controls, unfinished permits, informal decisions | Handover transmits tasks better than uncertainty |
Procurement and Operations | Substitution, quality assurance, maintainability, compatibility | Purchase decisions appear low-risk until equipment is installed |
Operations And Maintenance
This is one of the most familiar and dangerous interfaces.
Operations controls the process envelope. Maintenance controls task execution. The permit-to-work system sits between them, but the real safety margin depends on shared understanding: what is isolated, what remains live, what can change during the job, who monitors those changes, and what conditions require work to stop.
Common failure modes include:
Operations sees isolation as a procedural transaction, while maintenance treats it as proof the system is safe.
Maintenance plans the task around equipment drawings that no longer match field configuration.
Control room operators manage process upsets while field crews continue under permits based on earlier conditions.
A permit boundary is clear for one task but not for adjacent work or simultaneous operations.
The UK Health and Safety Executive and Energy Institute guidance on permit-to-work and process safety has long emphasized that permits are not simply forms. They are communication and control tools. The form matters, but the quality of the conversation matters more.
A practical warning sign is repeated permit revalidation without a fresh field review. Another is when isolations are discussed as administrative status rather than physical energy control. OSHA’s lockout/tagout requirements in the United States focus on hazardous energy control, but many major hazard settings require broader isolation thinking, including process energy, stored pressure, chemical inventory, gravity, heat, and adjacent systems.
Client And Contractor
Client-contractor interfaces carry a structural tension. The client often controls production priorities, site rules, access, SIMOPS, and commercial incentives. The contractor controls labor, supervision, equipment, and execution methods. Serious risk can emerge when neither party fully controls the work system.
Contractor management research and regulator guidance repeatedly point to the need for prequalification, planning, coordination, supervision, and monitoring. OSHA’s multi-employer worksite policy recognizes that more than one employer may have safety responsibilities on a worksite. ISO 45001 also requires organizations to coordinate relevant parts of their occupational health and safety management system with contractors and other external providers.
The problem is that contract language can create distance. A client may believe the contractor owns the risk because the contract says so. A contractor may believe the client owns the risk because site conditions, work windows, and operational constraints are client-controlled. Both may be partly right.
The combined system becomes unsafe when:
The contractor prices the job without full knowledge of site constraints.
Client production milestones conflict with safe sequencing.
Stop-work authority exists on paper but is commercially discouraged.
Contractor supervisors attend coordination meetings but lack authority to change plans.
HSE performance is measured by lagging indicators while serious exposure accumulates.
The question is not, “Who is contractually responsible?” The operational question is, “Who can see the risk, who can change the conditions, and who will be held accountable if the interface fails?”
Contractor And Subcontractor
Risk often becomes more fragmented as work is subcontracted. The prime contractor may hold the client relationship. A specialist subcontractor may understand the technical task. A labor supplier may provide workers. Equipment may come from another vendor. Temporary works may be designed elsewhere.
At each layer, context can thin out.
Subcontractors may receive method statements but not the strategic risk picture. They may know the task but not the surrounding operations. They may understand their equipment but not the project’s change history. Supervision may focus on the prime contractor’s deliverables while detailed task risk sits with a party that has limited influence over schedule, access, or sequencing.
This is especially visible in lifting operations, confined space entry, electrical commissioning, excavation, scaffolding, rope access, diving, and hot work. These tasks depend on shared controls. A lift plan can be technically sound and still fail if the ground conditions, exclusion zone, adjacent work, or communication protocol changes.
An effective contractor-subcontractor interface requires more than cascading documents. It requires verification that critical controls remain intact at the point of work.
Why Conventional HSE Systems Miss The Boundary
Many HSE systems are built around organizational clarity. Procedures define who does what. Audits check compliance against those procedures. Incident investigations identify failed controls. Metrics track actions by owner.
This structure is necessary. It is also incomplete.
Interfaces are dynamic. They change with weather, simultaneous operations, schedule recovery, abnormal process conditions, crew changes, design revisions, fatigue, equipment defects, and commercial pressure. A static responsibility assignment may not detect those changes.
The System Can Be Compliant And Unsafe
The U.S. Chemical Safety Board’s reports often show this problem in process safety events. Organizations may have management systems, procedures, training, and audits, but the event pathway still develops through weak hazard recognition, poor control of change, production pressure, communication failures, or degraded safeguards.
NASA’s Columbia investigation made a similar point in a different domain. The disaster was not explained by technical damage alone. It involved organizational barriers to hearing dissenting technical concerns, flawed risk acceptance, and poor integration of information across groups. The official investigation described a system where signals existed but did not change decisions.
A high-risk industrial equivalent is a startup after a project modification. Engineering has completed the design. Construction has installed equipment. Commissioning has checked systems. Operations has received handover. Maintenance has spares. Procurement has closed purchase orders.
Yet the plant may still be vulnerable if no one has tested how the system behaves during abnormal startup, whether operators understand new failure modes, whether alarms are rationalized, whether temporary bypasses remain, whether procedures match as-built conditions, and whether maintenance access is safe under live operating constraints.
Everyone has delivered. The interface remains unmanaged.
Metrics Can Hide Interface Weakness
Interface risk rarely appears cleanly in standard metrics. Total recordable injury rates, audit closeout rates, training completion, and permit counts may look acceptable while critical coordination fails.
Better signals include:
Increasing number of late design changes affecting field work.
Repeated permit extensions or revalidations.
Work packs returned due to missing information.
Unclear isolation ownership for shared systems.
High volume of daily SIMOPS conflicts.
Frequent “minor” handover discrepancies.
Contractors raising the same access or sequencing issues repeatedly.
Procurement substitutions requiring field workarounds.
Startup punch items carried into operations without clear risk acceptance.
These are not administrative irritants. They are system signals.
Investigations Often Collapse The Interface Into A Single Owner
After an event, organizations naturally search for an action owner. Corrective action systems require a name. Legal processes may require a duty holder. Managers need closure.
That pressure can flatten the system story.
If a maintenance technician opens equipment under the wrong assumptions, the action may be assigned to maintenance training. If a subcontractor enters an exclusion zone, the action may be assigned to contractor supervision. If a night shift misses a change, the action may be assigned to handover compliance.
Some of those actions may be valid. But if the event emerged from poor cross-boundary control, single-owner actions will not prevent recurrence.
A mature investigation asks how the system made the interface unsafe. It examines information flow, authority, incentives, timing, technical uncertainty, control verification, and escalation pathways.
What Good Interface Management Looks Like
Interface management is not more paperwork. It is a disciplined way to identify where work groups can create risk for one another, then make those interactions visible, owned, and controlled.
Build Interface Registers That Track Risk, Not Just Contacts
Interface registers are common in major projects, marine operations, construction programs, and complex turnarounds. Too often, they become contact lists or issue logs.
A useful interface register should capture:
The specific boundary between parties, systems, locations, or phases.
The hazardous interaction that could occur.
The shared controls required.
The party responsible for each control.
The person with authority to resolve conflicts.
The boundary conditions that must remain true.
The trigger for escalation.
The verification method at the point of work.
The residual risk accepted, by whom, and for how long.
For example, an Engineering-Construction interface for a temporary pipe support should not simply say, “Engineering to issue drawing, Construction to install.” It should define design assumptions, load cases, field verification requirements, change control, inspection hold points, and authority if site conditions differ.
An Operations-Maintenance interface for a vessel entry should not simply say, “Operations to isolate, Maintenance to perform work.” It should define isolation verification, atmospheric testing, rescue interface, simultaneous work restrictions, revalidation triggers, and conditions requiring immediate exit.
Treat Shared Controls As Critical Controls
Critical control management, used widely in mining, energy, and other major hazard sectors, is useful here. The core idea is to identify controls that prevent or mitigate fatal and major events, define performance requirements, and verify that those controls are present and effective.
Interfaces often depend on shared controls. No single party owns the whole barrier.
Examples include:
An exclusion zone for lifting near operating plant.
A marine loading arm interlock during product transfer.
A permit isolation boundary involving operations, electrical, mechanical, and instrumentation teams.
A temporary traffic management plan involving civil works, haulage, public road access, and site security.
A commissioning bypass log shared by Projects, Operations, and Automation.
A shared control needs one clearly named control owner, but it also needs participating duty holders who understand their role in keeping it effective. Ownership should not mean isolation. It should mean active coordination.
Define Boundary Conditions
Many interface failures occur because people keep working after the assumptions that made the plan safe are no longer true.
Boundary conditions make those assumptions explicit.
For a night shift maintenance task, boundary conditions may include stable process conditions, no adjacent hot work, ventilation running, gas testing frequency maintained, and no change in isolation status. For a marine-land cargo transfer, they may include weather limits, mooring status, communication checks, emergency shutdown availability, and exclusion zones on both sides of the transfer.
Boundary conditions should be written in operational language. They should answer, “If this changes, what must stop or be reviewed?”
This is where many job safety analyses and method statements fall short. They identify hazards at the start of the task, but they do not always define the conditions that invalidate the plan.
Put Coordination Roles Close To The Work
Complex interfaces need coordination roles with real authority. A SIMOPS coordinator, permit coordinator, commissioning manager, marine transfer lead, turnaround area authority, or construction interface manager can make a large difference when the role is properly designed.
The role must not become a messenger function. It needs authority to:
Stop conflicting work.
Resolve priority conflicts or escalate them quickly.
Verify shared controls.
Challenge incomplete work packs.
Convene the right technical experts.
Track open interface risks.
Confirm that changes reach affected parties.
Coordination roles are most effective when they sit close enough to the field to see drift, but high enough in the organization to resolve cross-functional conflict.
Escalation Must Be Faster Than Drift
Escalation systems often fail because they are too formal, too slow, or too socially expensive. Frontline leaders may know an interface is becoming unsafe but lack a practical path to pause work without creating disproportionate conflict.
Good escalation design answers four questions:
What condition requires escalation?
Who receives it?
What authority do they have?
What happens while the issue is being resolved?
Escalation should not depend on personal courage alone. It should be built into the work system.
A useful test is to ask supervisors, “If the client, contractor, and operations team disagree about whether work can proceed, what exactly happens in the next 30 minutes?” If the answer is vague, the interface is not controlled.
Applying Interface Thinking To Common High-Risk Boundaries
Interface management improves when organizations stop treating it as a project administration task and start applying it to everyday operational boundaries.
Engineering And Construction
Engineering controls design intent. Construction controls field execution. The danger sits where drawings meet reality.
Field changes, temporary works, constructability constraints, material substitutions, and access limitations all have safety implications. A design may meet code yet create unsafe installation or maintenance conditions. A construction workaround may solve a schedule problem while introducing a process safety or structural risk that engineering never evaluated.
Strong Engineering-Construction interface practice includes constructability reviews, field change control, temporary works governance, design query tracking, and engineer involvement in significant deviations. It also includes honest discussion of uncertainty. If drawings are based on incomplete surveys, the work plan should reflect that.
Projects And Operations
Project teams are built to deliver scope, cost, and schedule. Operations teams are built to run assets safely and reliably over time. Those missions overlap, but they are not identical.
A project can achieve mechanical completion while leaving operations with hard-to-maintain equipment, unclear alarm priorities, incomplete procedures, unresolved punch items, or poorly understood startup hazards. This is why operational readiness, pre-startup safety review, management of change, and competency preparation matter.
The Projects-Operations interface should be active from early design, not treated as a handover event. Operations should challenge maintainability, isolation philosophy, alarm loads, human-machine interface design, access, spares, training, and emergency response assumptions before construction locks in the design.
Marine And Land
Marine-land interfaces are inherently complex because they combine different operating cultures, regulatory frameworks, communication systems, and command structures. Cargo transfer, offshore supply, dredging, port construction, diving support, and vessel berthing all create shared risk.
A vessel master may control the vessel. A terminal may control the berth. A project team may control construction activity. A contractor may control lifting equipment. Weather, tide, mooring integrity, emergency shutdown systems, and exclusion zones connect them all.
The controls must be integrated. A pre-transfer checklist helps, but it is not enough if shore personnel and vessel crew interpret emergency stop authority differently. Joint drills, clear communications protocols, agreed weather limits, and defined transfer-stop criteria are practical necessities.
Day And Night Shift
Shift handover often transfers tasks. It may not transfer uncertainty.
Day shift may know that a valve position was questioned, a permit was revalidated under time pressure, a contractor supervisor changed, or an alarm was accepted as nuisance behavior. Night shift may receive only the simplified version: job ongoing, isolation in place, monitor conditions.
Fatigue research from NIOSH, transport investigations by NTSB, and human factors literature all show that performance is affected by circadian disruption, workload, and degraded communication. In high-risk industries, the handover interface needs structured content and room for weak signals.
Good handover includes:
What changed.
What remains uncertain.
Which controls are temporary.
Which assumptions must be checked.
Which decisions were deferred.
What would require escalation.
This is especially important during shutdowns, commissioning, emergency response, and abnormal operations.
Procurement And Operations
Procurement decisions can create operational risk long before equipment reaches the field.
A component may be commercially acceptable but operationally unsuitable. A substitution may meet a general specification but fail in compatibility, certification, maintainability, inspection access, or spare parts support. A low-cost choice can create long-term exposure for maintenance personnel or reduce reliability in safety-critical service.
This interface requires technical authority in purchasing decisions for safety-critical equipment and materials. It also requires management of change when substitutions occur. Procurement should not carry the burden alone. Operations, Engineering, Maintenance, and HSE need a defined review route for items that affect critical controls or major hazard barriers.
Leadership Questions That Expose Interface Risk
Senior leaders do not need to personally manage every interface. They do need to create a system where interface risk becomes visible before it appears as an incident.
Useful questions include:
Where do our highest-risk activities cross organizational boundaries?
Which critical controls depend on more than one party?
Which interfaces are managed by informal relationships rather than defined authority?
What risks are repeatedly “owned” by contractors but controlled by client decisions?
Where do engineering assumptions become construction constraints?
What project risks will operations inherit after handover?
Which procurement substitutions require technical safety review?
What information is lost between shifts, work groups, or locations?
Who can stop work when two responsible parties disagree?
How do we know shared controls remain effective during abnormal conditions?
These questions should be asked in planning meetings, assurance reviews, project gates, contractor forums, incident investigations, and field leadership visits.
The most revealing answers usually come from supervisors, planners, permit issuers, commissioning leads, contractor forepersons, control room operators, deck supervisors, and maintenance coordinators. They see where the formal system meets reality.
Practical Actions Organizations Can Take
Interface risk management does not require a new bureaucracy. It requires sharper use of existing processes and a willingness to manage the spaces between them.
Start with the highest-risk work, not every possible boundary.
Map the critical interfaces
Identify where major accident hazards, fatal risk activities, or high-energy work cross teams, employers, locations, or phases.
Create interface registers for material risks
Use them to manage hazardous interactions, shared controls, boundary conditions, escalation triggers, and decision authority.
Strengthen SIMOPS and permit coordination
Treat simultaneous operations as a control problem, not a scheduling inconvenience.
Review RACI charts for missing interactions
Ask what the RACI does not show. Look for split controls, unclear stop authority, and conditions where every party can comply while the system remains unsafe.
Assign coordination roles with authority
Make sure interface coordinators can pause work, escalate conflict, and verify controls.
Use shared critical control verification
Field-verify controls that depend on more than one party, especially isolations, exclusion zones, bypasses, temporary works, lifting controls, and emergency systems.
Improve handover quality
Require transfer of uncertainty, temporary conditions, degraded controls, and deferred decisions.
Build interface learning into investigations
When incidents occur, examine how boundaries shaped decisions, information, authority, and control effectiveness.
Align contract and operational expectations
Make interface responsibilities explicit in tendering, mobilization, planning, supervision, and performance review.
10. Escalate weak signals early
Repeated minor coordination failures are often precursors. Treat them as learning opportunities before they become events.
Professional Takeaway
Defining responsibility is necessary, but it does not automatically manage interaction risk. High-risk work depends on connections between disciplines, companies, shifts, systems, and phases. Those connections can either carry reliable control or transmit hidden failure.
The practical challenge is to make boundaries visible. Name the interfaces. Define the shared controls. Test the assumptions. Give coordinators real authority. Escalate when boundary conditions change. Hold leaders accountable not only for what happens inside their scope, but for how their scope affects the next one.
Many serious incidents are born in the space between responsible parties. Mature HSE management treats that space as part of the work.
Professional References And Further Reading
U.S. Chemical Safety and Hazard Investigation Board, major accident investigation reports and process safety guidance.
UK Health and Safety Executive, guidance on permit-to-work systems, human factors, contractor management, and major hazard control.
OSHA, multi-employer worksite policy and control of hazardous energy requirements.
ISO 45001, Occupational health and safety management systems, requirements with guidance for use.
NASA Columbia Accident Investigation Board Report, organizational and technical findings.
Lord Cullen, The Public Inquiry into the Piper Alpha Disaster.
Energy Institute, guidance on permit-to-work, process safety, human factors, and contractor management.
James Reason, Charles Perrow, and resilience engineering literature from researchers including Erik Hollnagel, David Woods, and Sidney Dekker.
