Safety, Standards, and Compliance
Three different kinds of obligation
Many questions in this domain turn on distinguishing what is legally required, what is expected by a standard, and what is merely good practice. A regulation is mandatory and enforceable. A standard is often a consensus document that may be voluntary in itself but becomes effectively mandatory when cited in regulation, contract, or policy. Guidance and "best practice" describe recommended approaches that carry no direct enforcement.
Concepts you must hold
- Hazard versus risk: a hazard is a source of harm; risk is the combination of likelihood and severity of that harm.
- Hierarchy of controls: elimination, substitution, engineering controls, administrative controls, then personal protective equipment. Controls earlier in the hierarchy are preferred because they do not depend on sustained human behaviour.
- Compliance evidence: a written policy is not compliance; compliance is demonstrated by records showing the practice actually occurred.
- Incident and near-miss reporting: near misses are leading indicators and are systematically under-reported; a healthy reporting culture treats reports as learning, not blame.
- Confidentiality and data protection: lawful basis, minimum necessary data, retention, and access control.
- Competence: training, authorisation, and supervision requirements attached to particular tasks.
Traps
Calling a best practice a legal requirement. Assuming a policy document proves compliance. Choosing PPE when an engineering or design control would remove the hazard. Treating zero reported incidents as evidence of a safe environment when under-reporting is the likelier explanation.
Rule of thumb
Rank controls by how little they rely on people remembering to do the right thing. Then, when unsure whether something is an obligation, ask: who could enforce this, and under what instrument?
Worked example
Staff repeatedly forget a manual logging step, and the proposed fix is a refresher poster. That is an administrative control aimed at behaviour. A stronger response redesigns the process so the step is automatic or cannot be skipped - an engineering control that removes reliance on memory.