Organizational Memory Loss in HSE: Capturing Tacit Safety Knowledge Before It Walks Out the Door
A plant does not only run on procedures, drawings, permits, and inspection records. It also runs on memory.
The operator who knows a valve always sticks after a cold start. The maintenance technician who remembers why a bypass line was capped. The project engineer who understands why an apparently overdesigned platform access route was installed after a near miss. The supervisor who knows which contractor crew needs extra control during SIMOPS because of a past interface failure.
When those people retire, transfer, leave the contractor, or move to another asset, the organization may keep the role but lose the reason.
That loss is not sentimental. It is an HSE risk. In high-risk industries, tacit safety knowledge often explains the gap between “work as imagined” and “work as done.” When that knowledge disappears, organizations can unknowingly weaken safeguards, repeat old failures, misread equipment behavior, or normalize deviations that earlier teams treated with caution for good reasons.
Why Organizational Memory Matters in High-Risk Work
Organizational memory is the stored knowledge an organization uses to make decisions and act consistently over time. Knowledge-management researchers such as Walsh and Ungson described it as information retained in people, roles, procedures, culture, structures, and physical systems. In safety-critical work, that memory includes formal content, such as engineering records and incident reports, and informal content, such as practical judgment gained through years of abnormal operations.
Tacit knowledge is the hard part. Michael Polanyi’s well-known observation, “we can know more than we can tell,” remains useful here. Experienced workers do not always articulate every cue they use. They know the feel of a pump that is starting to cavitate, the sound of a failing bearing, the smell that precedes a process upset, or the job sequence that avoids exposing a crew to stored energy.
This knowledge becomes safety-critical when it relates to:
A hazard not fully visible in current risk assessments
A control that only works if applied in a specific way
Equipment with known failure modes or unusual behavior
Nonstandard configurations, temporary modifications, or legacy design choices
Workarounds that have become routine but are not well understood
Historical incidents, near misses, and weak signals
Formal HSE systems capture some of this. Management of change records, process hazard analyses, pre-job briefs, permit systems, inspection histories, and lessons learned databases all help. Yet they often fail to capture the “why” behind decisions.
A procedure may say, “Open valve V-204 slowly.” It may not say that ten years ago, rapid opening caused hydraulic shock and damaged downstream equipment. A drawing may show a restraint added to a pipe rack. It may not explain that a vibration issue was observed only during a rare operating mode. A permit template may require continuous gas monitoring for a tank entry. It may not document the previous incident where stratified vapors were found after forced ventilation appeared effective.
That missing context matters when new people ask a reasonable question: “Why do we still do it this way?”
If no one can answer, controls start to look optional, excessive, or outdated.
How Conventional HSE Systems Lose the “Why”
Most HSE management systems are built around documented controls. ISO 45001 requires organizations to determine competence, retain documented information where needed, manage change, and consider organizational knowledge in operational planning. OSHA’s Process Safety Management standard and EPA’s Risk Management Program both place strong emphasis on process safety information, operating procedures, training, mechanical integrity, and management of change for covered processes.
These systems are necessary. They are not enough.
They tend to assume that critical knowledge can be written down, assigned, audited, and retrieved. In practice, several mechanisms cause knowledge loss.
Procedures Capture Tasks, Not Judgment
Standard operating procedures are often written as instructions. They describe normal steps, required permits, PPE, isolations, hold points, and escalation triggers. They rarely describe the judgment experienced operators use to interpret weak signals.
For example, a marine loading procedure may specify pressure limits during transfer. The experienced loading master may also know that a particular hose string responds poorly during certain tidal conditions, or that one berth has a history of mooring tension issues during strong crosswinds. If those details sit only in personal memory, the procedure is incomplete even if it passes a document-control audit.
Human factors research has long shown that people adapt procedures to real conditions. This is not automatically bad. Erik Hollnagel’s work on Safety-I and Safety-II, and broader resilience engineering research, argues that successful performance often depends on adaptation. The HSE challenge is to learn from that adaptation before it disappears.
Lessons Learned Systems Become Archives
Many organizations have lessons learned databases. Fewer have effective lessons learned systems.
Accident investigation bodies have repeatedly found that organizations failed to learn from prior events. The U.S. Chemical Safety Board has identified recurring patterns in major chemical incidents, including inadequate hazard analysis, weak management of change, poor recognition of process safety warning signs, and failure to act on previous incidents. NASA’s Columbia Accident Investigation Board also described how technical concerns and past anomalies can be normalized within organizational culture.
The issue is not only whether a lesson was written. It is whether the lesson changed design standards, procedures, training, assurance, procurement, and supervision.
A lesson stored in a database but not connected to work planning is organizational memory in name only.
Turnover Breaks Informal Control Networks
Work often gets done safely through informal networks. An engineer calls a specific technician before approving a change. A supervisor asks a long-service operator which isolation points are unreliable. A planner knows which subcontractor foreperson understands confined space controls on a particular asset.
These networks can be highly effective, but they are fragile. Retirement, contractor churn, restructuring, outsourcing, and project demobilization can break them quickly. The organization may not notice because the org chart remains intact.
Contractor turnover creates a particular risk. High-risk industries often rely on contractors for maintenance, shutdowns, construction, drilling, marine operations, and specialist inspection. Contractors may carry critical experience from previous campaigns, but that experience can leave between mobilizations. The client may retain the asset risk without retaining the memory of how that risk was controlled.
Digital Systems Store Data Without Context
Digital repositories can preserve information at scale. They can also create a false sense of security.
A historical trend, inspection report, 3D model, or maintenance work order may show what happened. It may not explain why a decision was made. Metadata may be weak. Search terms may be inconsistent. Older drawings may not be linked to management of change records. Temporary repair histories may sit in emails or scanned PDFs. Critical oral explanations may never enter the system.
NIST guidance on knowledge management and cybersecurity-related configuration control, while from a different domain, reinforces a broad principle: information must remain accurate, usable, controlled, and traceable through system changes. In process and operational safety, traceability is often where memory fails.
What Major Accident Learning Tells Us About Memory Loss
Major accident investigations rarely say, “The problem was that one experienced person retired.” They do identify conditions that overlap strongly with organizational memory loss.
Warnings Were Known but Not Retained as Controls
The 2005 BP Texas City refinery explosion, investigated by the CSB, involved significant process safety management failures, including deficiencies in mechanical integrity, training, operating procedures, supervision, and attention to previous incidents and warning signs. The investigation did not reduce the event to memory loss. It did show how organizations can possess warning information without converting it into durable controls.
That distinction matters. Safety knowledge must survive beyond the individuals who experienced the warning. It has to become part of equipment design, operating limits, alarm management, training, scenario planning, and leadership assurance.
Normalization Can Turn History Into Background Noise
The NASA Columbia investigation described normalization of deviance, where repeated foam strikes became accepted as normal because previous missions survived. This concept, also associated with Diane Vaughan’s sociological analysis of the Challenger accident, is relevant to industrial HSE.
If a team repeatedly operates with a known defect, degraded safeguard, or informal workaround without an immediate consequence, the original concern may fade. New personnel inherit the practice but not the anxiety that once surrounded it. The absence of a bad outcome becomes misunderstood as proof of safety.
Examples occur across high-risk work:
A temporary scaffold modification becomes the standard access route for repeated shutdown work.
A nuisance alarm is inhibited during maintenance and later treated as low value.
A blocked drain in a bund is accepted because “it has always been that way.”
A crane lift path avoids an old underground service, but the reason is known only to one planner.
A manual venting step is performed slowly because of a past release, but the incident is no longer discussed.
The operational question is direct: Which current practices depend on history that is no longer visible?
Knowledge Decays When Plants, Projects, and Crews Change
The UK HSE has long emphasized corporate memory in major hazard control, especially where aging assets, organizational change, contractorization, and loss of experienced staff affect risk management. Similar concerns appear in guidance from the Energy Institute, IOGP, CCPS, and other professional bodies.
Physical systems age. Documentation quality varies. Older assets may have undocumented modifications, obsolete components, and legacy design assumptions. New projects create another problem. During design, commissioning, and start-up, teams quickly resolve many safety-critical questions. If those decisions are not captured, the operating team inherits equipment without the full reasoning behind layout, access, operating envelope, alarm settings, or maintenance strategy.
The highest-risk handovers are often not between shifts. They are between life-cycle phases:
Design to construction
Construction to commissioning
Commissioning to operations
Operations to turnaround
Turnaround to restart
Owner team to contractor team
Experienced asset team to new operating model
Each transition can strip context from controls.
Warning Signs That Safety-Critical Knowledge Is Already Leaking
Organizational memory loss is not always visible in lagging injury rates. It often appears first in weak signals.
Look for these patterns.
People cannot explain the reason for controls.
When crews describe controls as “just the rule,” “audit requirement,” or “how we have always done it,” the organization may have lost the risk story behind the control.
Retirements trigger operational anxiety.
If leaders privately worry that a plant, vessel, mine section, or construction package will struggle when one person leaves, that person holds undocumented knowledge.
The same lessons recur.
Repeated findings about isolations, simultaneous operations, dropped objects, line breaking, confined spaces, lifting, energization, or permit quality suggest prior learning did not become durable.
Management of change records are thin.
MOC packages may show approvals but not rejected options, risk tradeoffs, operational concerns, or temporary assumptions that later became permanent.
Maintenance history is fragmented.
A technician may know that a pump fails after long idle periods, but the computerized maintenance management system only shows repeated work orders with generic fault codes.
Contractor performance depends on named individuals.
If a contractor is considered competent only when a specific supervisor or foreperson is present, the competence is personal rather than systemic.
Informal rules govern high-risk tasks.
Examples include “never start that compressor on night shift,” “ask Sam before opening that blind,” or “do not use bay three in heavy rain.” These may contain valid risk intelligence. They may also signal undocumented failures in formal controls.
Digital repositories are searchable but not trusted.
If experienced personnel bypass official records and call “the person who knows,” the official system lacks enough context.
How to Identify Safety-Critical Knowledge Before It Disappears
Capturing tacit knowledge requires more than exit interviews. Exit interviews happen too late, and they often focus on HR themes rather than risk. A stronger approach treats knowledge capture as part of risk management, competence management, asset integrity, and operational readiness.
Map Roles That Carry High Consequence Memory
Start by identifying roles where loss of knowledge could affect major hazard control, serious injury prevention, environmental protection, or business-critical continuity.
Prioritize roles that meet one or more of these conditions:
Long tenure on a specific asset, route, mine, facility, vessel, or project
Frequent involvement in abnormal operations or troubleshooting
Ownership of isolations, lifting plans, energization, commissioning, or SIMOPS
Deep knowledge of legacy equipment, temporary modifications, or degraded safeguards
Informal advisory role across teams
Contractor interface responsibility
Participation in past incident response or major investigations
Do not limit this to senior staff. Some of the most valuable memory sits with operators, mechanics, electricians, scaffold coordinators, riggers, control room technicians, inspectors, and contractor supervisors.
A useful test is simple: “If this person left next month, which risk decisions would become slower, weaker, or more uncertain?”
Use Critical Task Interviews, Not Generic Knowledge Capture
Generic prompts produce generic answers. Interview around real tasks and scenarios.
Ask experienced personnel to walk through specific high-risk work:
Starting up after an extended shutdown
Breaking containment on a known problem line
Lifting near live plant
Entering a vessel with past residue issues
Switching from normal to backup power
Restarting after a trip
Managing bad weather during marine operations
Excavating near legacy utilities
Handing back equipment after maintenance
Use prompts that expose tacit knowledge.
What do you check that is not obvious in the procedure?
Which step would you never rush?
What has gone wrong before?
Which alarm, reading, smell, sound, or vibration gets your attention?
Which drawing or record do you not fully trust?
What conditions change the plan?
Who do you call before approving this?
What safeguards were added after an incident or near miss?
What would a new supervisor misunderstand?
Which “temporary” arrangements have lasted too long?
Record the answer in the language of work, then translate it into controlled documents, training content, risk registers, drawings, inspection plans, and pre-job briefing material where appropriate.
Build Configuration History Into Asset Records
Configuration history is the memory of how the asset became what it is. It includes design changes, field modifications, operating envelope changes, alarm changes, bypass histories, relief system changes, materials substitutions, software revisions, and temporary repairs.
For high-risk equipment, asset records should answer more than “what is installed?” They should also answer:
Why was it installed this way?
What alternatives were rejected?
What assumptions were made?
Which hazards drove the safeguard?
What operating limits protect the design basis?
Which incidents or near misses influenced the current configuration?
Which temporary changes are still present?
This is a practical extension of good MOC discipline. It also supports process safety information, mechanical integrity, and future design work.
A concise “configuration narrative” can help. It does not need to be long. For a critical valve, interlock, vent, bypass, access platform, detector, or lifting point, one paragraph explaining origin and safety basis may prevent years of confusion.
Convert Oral Knowledge Into Tested Controls
Oral knowledge is valuable, but it should not remain oral when it controls serious risk.
Once tacit knowledge is identified, decide where it belongs. The answer is not always “put it in the procedure.” Overloading procedures with history can make them harder to use.
Better options include:
A procedure note that explains a critical caution
A pre-job brief prompt for rare but severe hazards
A field marking or engineered label
An updated drawing or line list
A maintenance strategy change
A simulator scenario or tabletop exercise
A competence assessment question
A critical control verification item
A hazard register update
A design basis note
A shift handover requirement
A lessons learned package for contractors
The goal is to make the knowledge available at the decision point.
For example, if an experienced technician knows that a valve position indicator is unreliable after heavy rain, the durable control may be inspection, repair, replacement, or a verification step before operation. A story in a database is weaker than a control in the field.
Treat Mentoring as Risk Transfer, Not Informal Goodwill
Mentoring often fails because it is left to personality and available time. Safety-critical mentoring needs structure.
Pair experienced personnel with successors around defined risk topics, not general shadowing. Use a short plan:
Critical tasks to observe
Abnormal scenarios to discuss
Historical incidents to review
Equipment quirks to verify in the field
Key drawings and records to compare against reality
Contractor interface risks to explain
Decision thresholds to practice
The mentor’s role is to explain judgment. The successor’s role is to demonstrate understanding. A supervisor or technical authority should review the output and decide what must enter the formal system.
This approach aligns with competence management principles used in high-hazard sectors. Competence is not just attendance at training. It includes knowledge, skill, experience, assessment, and continuing practice under real conditions.
Strengthen Handovers at Life-Cycle Boundaries
Shift handover gets attention because failures are immediate. Project and asset handovers deserve the same discipline.
A strong safety-critical handover should include:
Open hazards and degraded safeguards
Temporary modifications and due dates
Assumptions made during design or construction
Deviations from standards and approved justifications
Critical spares and known obsolescence issues
Alarm, trip, and interlock changes
Commissioning anomalies and unresolved punch list items
Contractor knowledge that must transfer to operations
Lessons from testing, start-up, and early operation
Known gaps in documentation
For major projects, the handover package should include a “risk memory file.” This is a curated record of why significant safety decisions were made, what concerns were raised, and what future teams must not lose.
Make Lessons Learned Operationally Searchable
Lessons learned systems fail when they are organized around events, but work is organized around tasks and hazards.
A supervisor planning line breaking work should be able to find relevant lessons by task, equipment type, energy source, substance, location, contractor activity, or critical control. A project engineer should find previous design issues by system, safeguard, standard deviation, or failure mode.
Good tagging matters. So does ownership. Each serious lesson should have a named function responsible for deciding whether the lesson affects:
Design standards
Operating procedures
Maintenance plans
Training and competence
Procurement specifications
Contractor requirements
Emergency response
Audit protocols
Critical control verification
Without that conversion step, lessons learned become lessons stored.
Use Digital Repositories Carefully
Digital tools can help preserve organizational memory, especially when they connect documents, drawings, work orders, investigation findings, MOC records, training, and field observations.
Useful features include:
Search by asset, system, task, hazard, and control
Links between MOC records and current drawings
Version history and approval traceability
Field access on mobile devices
Media capture for photos, sketches, and short explanations
Retention rules for project and contractor records
Clear ownership for updating safety-critical content
Artificial intelligence and natural language search may improve retrieval, but they do not solve weak source quality. A repository filled with unverified, duplicated, or outdated content can increase risk. Treat digital memory as controlled safety information. Assign owners. Review it. Retire obsolete content. Preserve the reason behind changes.
Leadership Questions That Expose Memory Risk
Senior leaders and project sponsors do not need to personally know every valve history. They do need to know whether the organization can retain critical knowledge without relying on chance.
Useful questions include:
Which retirements, transfers, contractor demobilizations, or reorganizations could affect major hazard control?
What safety-critical knowledge is held by one person or one contractor crew?
Which controls exist because of past incidents, and can current teams explain them?
Where do informal rules indicate a gap in formal systems?
Which MOC records explain why a change was made, not only what was approved?
How do we verify that lessons learned changed work practices?
What knowledge must transfer before project handover, turnaround completion, or commissioning?
Which repositories are trusted by field personnel, and which are bypassed?
How do we test whether new supervisors understand local risk history?
What would we lose if a key operator, planner, inspector, or contractor foreperson left next Friday?
These questions should appear in operational readiness reviews, asset integrity reviews, contractor performance meetings, serious incident reviews, and succession planning.
A Practical Model for Capturing Tacit Safety Knowledge
A simple model works better than a large knowledge-management program that never reaches the field.
Identify
Find roles, tasks, equipment, and transitions where memory loss could create serious risk. Use retirement forecasts, contractor turnover data, incident history, high-risk task lists, asset age, and supervisor nominations.
Elicit
Use structured field interviews, scenario walkthroughs, task observations, and after-action reviews. Focus on abnormal conditions and judgment, not only routine steps.
Validate
Check oral knowledge against evidence. Compare it with drawings, MOC records, incident reports, maintenance history, inspection data, and technical standards. Some informal knowledge will be accurate. Some will be outdated or local folklore. Treat both possibilities seriously.
Convert
Move validated knowledge into the right control. That may be engineering, procedure, training, inspection, labeling, planning, or competence assessment.
Test
Ask new personnel to apply the knowledge in realistic scenarios. Confirm that they can explain the reason for critical controls, recognize weak signals, and escalate when conditions change.
Maintain
Review knowledge after incidents, audits, modifications, shutdowns, and personnel changes. Memory is not captured once. It is maintained.
What Good Looks Like in Practice
A mature organization does not rely on heroic memory. It still respects experienced people, but it designs systems so critical knowledge survives personnel movement.
In practice, that looks like this:
Procedures explain critical cautions where the reason affects compliance.
MOC records include assumptions, rejected options, and safety basis.
Retiring specialists complete structured risk-based knowledge transfer months before departure.
Contractor handovers include asset-specific hazard history, not only scope status.
Lessons learned are tied to tasks, controls, and standards.
Critical equipment has configuration narratives for major safeguards.
Supervisors test understanding of “why” during pre-job planning.
Digital repositories are maintained as controlled safety information.
Mentoring produces verified outputs, not only informal exposure.
Leaders track knowledge risk alongside asset integrity, competence, and operational readiness.
The cultural signal is clear. Experience is respected, but undocumented dependency on individuals is treated as a control weakness.
Professional Takeaway
Organizational memory loss in HSE is not an administrative concern. It is a pathway to repeated incidents, weakened controls, and poorly understood risk. The most valuable safety knowledge often sits in the heads of people who have lived through abnormal operations, failures, repairs, near misses, and design compromises.
Capture that knowledge before farewell events, project demobilization, contract turnover, or restructuring make it unavailable.
Start with the work that can hurt people, damage assets, or release energy and hazardous materials. Ask why controls exist. Trace the history of unusual equipment behavior. Convert validated oral knowledge into durable controls. Then test whether the next person can make the same safe decision without needing the person who just left.
Professional References and Further Reading
U.S. Chemical Safety and Hazard Investigation Board, major accident investigation reports, including BP Texas City and other process safety investigations.
NASA Columbia Accident Investigation Board Report, organizational causes, normalization of deviance, and technical decision-making.
OSHA Process Safety Management standard, 29 CFR 1910.119, for process safety information, operating procedures, training, mechanical integrity, and management of change.
ISO 45001, occupational health and safety management systems, including competence, documented information, operational planning, and management of change.
UK Health and Safety Executive guidance on managing human factors, competence, organizational change, and major hazard industries.
Center for Chemical Process Safety, guidelines on process safety management, management of change, and learning from incidents.
Energy Institute and IOGP guidance on human factors, process safety leadership, competence, and major hazard management.
Walsh, J. P., and Ungson, G. R., research on organizational memory, and Michael Polanyi’s work on tacit knowledge.
