When Procedures Become the Hazard: The Problem of HSE Bureaucracy

There is an uncomfortable question that HSE professionals occasionally need to ask ourselves: Have we made safety too complicated?

Most HSE requirements begin with good intentions. An incident occurs, so a new control is introduced. An audit identifies a weakness, so another approval is added. A regulator raises an expectation, so the procedure expands. A client introduces a requirement, so another form is created. A corporate standard is issued, so another layer of documentation appears.

Individually, each decision can make perfect sense.

Collectively, they can create a system that becomes increasingly difficult to use.

Procedures grow longer. Forms become more complicated. Approval chains expand.

Employees are required to enter similar information into multiple systems. Supervisors spend increasing amounts of time demonstrating that safety activities have occurred rather than being present where the work is happening.

Eventually, an organisation can reach a point where the administration of safety begins competing with the management of safety.

This does not mean procedures are unnecessary. High-risk work requires clear standards, defined controls and disciplined execution. But complexity is not the same as control, and documentation is not the same as risk management.

Sometimes, adding another safety requirement can actually make the system weaker.

How HSE Bureaucracy Grows

Few organisations deliberately set out to create a bureaucratic HSE management system. It usually develops gradually.

Imagine an incident investigation identifies that a supervisor failed to verify a particular control. The organisation responds by adding a supervisor verification box to the permit.

Later, an audit finds inconsistent verification, so a second-level approval is introduced. A client then requests additional evidence, so another checklist is created. Eventually, the same control is confirmed in the risk assessment, method statement, permit, pre-job checklist and supervisor verification form.

Each addition can be justified when considered in isolation.

The problem becomes visible only when we look at the complete system from the perspective of the person expected to use it.

This process is sometimes described as organisational accretion: requirements accumulate over time but are rarely removed. Organisations are generally much better at adding controls than retiring them.

There is also a simple reason for this. Adding something feels safer.

After an incident, recommending a new checklist or approval demonstrates action.

Removing an existing requirement feels considerably harder to defend. If something later goes wrong, nobody wants to explain why a control was eliminated.

The result is predictable.

Safety systems tend to grow.

Every Requirement Has a Cost

When we talk about the cost of an HSE requirement, we should not think only about money.

Every requirement consumes attention, time and organisational capacity.

If a supervisor spends an additional 30 minutes completing administrative requirements before work begins, those 30 minutes must come from somewhere. Perhaps they spend less time discussing the task with the crew. Perhaps they conduct fewer field observations. Perhaps planning starts earlier. Perhaps the schedule absorbs the delay.

The point is not that paperwork is inherently wasteful. Some documentation is critical. A permit-to-work system, for example, provides structure for controlling hazardous work and coordinating activities. Isolation certificates, lifting plans and confined-space documentation can provide essential evidence that important controls have been established.

The question is whether the administrative effort is proportionate to the risk reduction it produces.

HSE requirements should therefore be considered like any other organisational control.

They consume resources and should create value in return.

A ten-minute verification that prevents an uncontrolled energy release is clearly valuable. Ten minutes spent entering information already recorded in three other places may not be.

When organisations fail to distinguish between the two, low-value administration can gradually consume the capacity needed for high-value risk management.

The Frontline Experiences the Whole System

Corporate functions usually see individual requirements.

The workforce experiences their cumulative effect.

The HSE department sees the new safety observation programme. Learning and development sees the additional mandatory course. Quality introduces another assurance checklist. Operations adds a daily production report. The client requires another form. The project introduces a new approval process.

Each department may believe its requirement is reasonable.

The supervisor sees all of them.

This is one reason senior management can underestimate procedural burden. No individual requirement appears excessive when viewed independently, yet the combined workload can become substantial.

The same problem occurs with procedures. A corporate standard may be well written, as may the project procedure, contractor procedure and task-specific method statement.

But if an employee must interpret all four before understanding what is actually required, the system has transferred complexity to the user.

That is poor design.

A good management system should help people navigate complexity, not simply document it.

More Rules Can Mean Less Attention

Human attention is finite.

This matters enormously in safety.

If employees are confronted with hundreds of rules, warnings, forms, signs, procedures and mandatory messages, they cannot treat every requirement with the same level of attention.

People begin prioritising.

Some requirements become routine. Some are skimmed. Some are completed from memory. Some become administrative rituals whose original purpose has been forgotten.

This creates a dangerous possibility: genuinely critical requirements become buried among large numbers of lower-value requirements.

Consider a permit containing 40 verification items. Perhaps five of those items are absolutely critical to preventing a fatal event. If every box looks identical and every requirement receives the same visual weight, the system may actually make it harder to distinguish what matters most.

This is why critical-risk management is so important.

The organisation needs to make certain requirements unmistakable. People should understand which controls absolutely must be present and effective before high-risk work proceeds.

More information does not necessarily create more awareness.

Sometimes it creates noise.

The Checklist Becomes the Job

Checklists can be powerful safety tools. Aviation, medicine, energy, and other high-risk industries have demonstrated their value when they are well designed and used for the right purpose.

But a checklist becomes dangerous when completion of the checklist replaces thinking about the task.

This happens when people become focused on satisfying the administrative process rather than understanding the conditions around them.

The permit is approved, therefore the job is safe.

The risk assessment is signed, therefore the hazards are controlled.

The checklist is complete, therefore the equipment is ready.

The training record is green, therefore the person is competent.

None of those conclusions necessarily follows.

Documents provide evidence that a process occurred. They do not remove the need for judgement.

The strongest safety processes prompt thinking rather than replace it. A good checklist directs attention towards important conditions. A good risk assessment encourages a team to discuss what could realistically go wrong. A good permit creates coordination around hazardous work.

When the primary objective becomes completing the document correctly, the tool has begun to lose its purpose.

Bureaucracy Can Encourage Workarounds

People still need to get work done.

If the official process becomes unnecessarily difficult, informal alternatives inevitably emerge.

Employees create templates containing standard answers. Supervisors pre-populate forms. Old risk assessments are copied and modified. Approvals become automatic.

People learn which words need to appear in which boxes.

The organisation may interpret this as poor safety culture or non-compliance.

Sometimes it is.

But repeated workarounds can also be feedback about system design.

If competent, experienced employees consistently struggle with the same process, leaders should investigate why rather than immediately concluding that the workforce needs more discipline.

Perhaps the requirement is unclear. Perhaps two procedures contradict one another.

Perhaps the process contains unnecessary duplication. Perhaps the approval authority is unavailable when work needs to begin. Perhaps the technology is slow or inaccessible in the field.

None of this means employees should simply ignore requirements they dislike.

It means organisations should treat recurring workarounds as information.

The question is not only, “Why aren't people following the process?”

It is also, “What is it about the process that makes people want to work around it?”

Both questions matter.

The Administrative Response to Incidents

One of the biggest contributors to HSE bureaucracy is the way organisations respond to incidents.

After something goes wrong, there is understandable pressure to demonstrate that action has been taken.

The easiest corrective actions are often administrative.

Revise the procedure. Introduce a checklist. Conduct refresher training. Add an approval. Issue a safety alert. Require another inspection.

These actions are visible, relatively easy to implement, and straightforward to close in an action-tracking system.

They may also be appropriate.

But they should not become the default response.

If an investigation identifies that equipment design made an error likely, changing the design may be stronger than adding another warning to the procedure. If workload contributed to an event, additional training will not reduce workload. If an isolation point is difficult to identify, better engineering may be more reliable than reminding employees to take extra care.

The hierarchy of controls exists for a reason. Administrative controls generally depend heavily on human behaviour and continued compliance.

Yet organisations sometimes respond to failures of administrative controls by adding more administrative controls.

The procedure failed, so we make the procedure longer.

The checklist failed, so we add another checklist.

The training failed, so we repeat the training.

At some point, we need to ask whether we are strengthening the system or simply adding paperwork around the weakness.

Simplification Is Not Deregulation

Calls to simplify safety systems can make HSE professionals understandably nervous.

Simplification can sound like removing controls, weakening standards or prioritising productivity over safety.

That is not what good simplification means.

The objective is not fewer controls at any cost.

It is fewer unnecessary controls and greater focus on the controls that matter.

A simplified HSE system should be easier to understand, easier to navigate and harder to misinterpret. Responsibilities should be clearer. Duplication should be reduced.

Critical requirements should be more visible.

In fact, simplification can make a management system more demanding where it matters.

An organisation might reduce a 40-item generic checklist to 12 meaningful verification points, while making four critical controls subject to much stronger field verification.

The paperwork becomes smaller.

The assurance becomes stronger.

That is not deregulation. It is better risk management.

Apply the Hierarchy of Controls to HSE Management

HSE professionals routinely encourage operations to use the hierarchy of controls. We should apply the same discipline to our own systems.

When a weakness is identified, do not automatically ask what procedure needs to change.

First, ask whether the hazard can be eliminated. Can equipment be redesigned? Can automation remove exposure? Can the work sequence be changed? Can a physical safeguard make the desired behaviour easier or the undesired behaviour harder?

Only after considering stronger controls should we default to additional procedures, warnings, and training.

This approach has another advantage: engineered solutions frequently reduce the ongoing cognitive burden placed on workers.

A physical interlock does not need to remember the procedure. A properly designed guard does not become distracted. An automated warning system does not become complacent because the task has been completed safely 500 times.

Human beings remain essential to complex operations, but good system design should not require them to compensate continuously for weaknesses that could reasonably have been removed.

HSE Professionals Should Design for the User

There is a useful shift in perspective available here.

Instead of asking, “Have we documented every requirement?” ask, “Can the person who needs this requirement understand and use it when they need it?”

That is a design question.

Procedures should be written for users, not auditors. Forms should collect information because the information serves a purpose, not because the field has always existed.

Approval workflows should reflect the level of risk. Digital systems should reduce duplication rather than simply transferring paper bureaucracy onto a screen.

For complex procedures, organisations should also consider whether every user needs the complete document.

A corporate standard may need substantial detail for governance purposes, while a supervisor may benefit from a concise operational guide. A technician may need a task-specific visual. A senior manager may need clearly defined accountabilities and decision points.

One document does not always need to serve every audience.

The measure of success should be usability.

Can people find the requirement? Can they understand it? Can they apply it? Does it help them manage risk?

If not, the fact that the document passed an audit provides limited comfort.

The HSE System Needs a Decluttering Process

Most management systems have processes for creating documents.

Far fewer have effective processes for removing them.

That needs to change.

Organisations should periodically challenge the accumulated HSE system. Which requirements still serve a useful purpose? Which forms duplicate information collected elsewhere? Which procedures are rarely accessed? Which approvals genuinely change decisions? Which controls were introduced following incidents but have never been reviewed for effectiveness?

This should not be a one-off document reduction exercise.

Simplification needs governance.

When a new requirement is proposed, ask what problem it is solving, whether an existing control already addresses the issue, and how much additional burden it will create.

Where possible, consider a simple principle: one in, one out.

If another administrative control is being added, is there something obsolete that can be removed?

Not every situation will allow this, particularly where regulatory or contractual requirements apply. But the discipline forces organisations to consider cumulative complexity rather than viewing every new requirement in isolation.

Measure the Burden as Well as the Compliance

Organisations are very good at measuring whether employees comply with HSE processes.

They are less likely to measure how difficult those processes are to use.

That is a missed opportunity.

Talk to supervisors about the administrative workload. Observe how long key processes actually take. Identify where the same information is entered repeatedly. Review how many documents employees need to access for common activities. Examine how many approvals are required and whether those approvals genuinely add value.

Digital systems provide opportunities here as well. Workflow data can reveal bottlenecks, duplicated activities, and approval delays.

The purpose is not to make safety convenient at the expense of control.

It is to identify friction that does not contribute meaningfully to control.

Every unnecessary administrative step consumes a small amount of organisational capacity. Across thousands of employees and millions of working hours, those small amounts become significant.

Imagine redirecting even part of that capacity towards better planning, supervision, coaching, maintenance, critical-control verification, and learning.

That could create considerably more safety value than another completed form.

Make Safety Easier to Do Properly

There is a principle that should sit behind every HSE management system: make the safe way the easiest practical way to work.

If following the system requires extraordinary effort, employees will continually be placed in conflict between compliance and getting the job done.

That is not a workforce problem.

It is a system-design problem.

Good HSE systems create clarity. They help people understand what matters. They provide strong controls for significant risks while allowing proportionate flexibility for lower-risk activities. They make responsibilities obvious and information accessible.

Most importantly, they preserve attention for the things capable of seriously harming people.

The objective should never be to have the largest HSE management system, the longest procedures, or the most comprehensive collection of forms.

The objective is effective control of risk.

Sometimes achieving that requires adding something.

Sometimes it requires improving something.

And occasionally, one of the most useful things an HSE professional can do is have the confidence to remove something.

Because when safety administration becomes so complicated that people spend more effort servicing the system than managing the risk, bureaucracy is no longer supporting safety.

It has become another hazard we need to manage.

References and Further Reading

UK Health and Safety Executive (HSE). Managing for Health and Safety (HSG65). Guidance on proportionate approaches to managing health and safety, integrating risk management with wider organisational management, and focusing effort on effective control.

UK Health and Safety Executive (HSE). Risk Assessment: A Brief Guide to Controlling Risks in the Workplace (INDG275). Guidance emphasising proportionate risk assessment and practical control rather than unnecessary bureaucracy.

International Organization for Standardization (ISO). ISO 45001:2018 – Occupational Health and Safety Management Systems. Requirements addressing operational planning and control, hierarchy of controls, worker participation, performance evaluation and continual improvement.

International Association of Oil & Gas Producers (IOGP). Operating Management System Framework for Controlling Risk and Delivering High Performance in the Oil and Gas Industry. Guidance supporting risk-based management systems, effective implementation and continuous improvement.

Energy Institute. Human and Organisational Factors resources. Industry guidance addressing human performance, organisational conditions, task design and the factors that influence how work is performed in complex operating environments.