Guarding, Anchors and a Risk Register That Is Not Controlling Anything
During a design-phase HAZOP for a 60,000 t grain terminal, your team finds that the maintenance walkway to the head of the 42 m conveyor has no compliant fall protection on its outboard side, and that clearing a typical blockage requires a worker to stand within 300 mm of an unguarded return idler. The client's project manager argues these are 'construction-phase safety' items and asks that they move to the contractor's risk register to protect the $310 million capital estimate; deleting them saves an estimated $480,000. The design is at 60% and the construction package is due in five weeks. Six weeks later, a worker at a comparable terminal is fatally injured while clearing a blockage. Separately, the project risk register lists 12 high risks, 8 of which have no named owner and 5 with mitigation actions more than 90 days overdue.
1. Are the walkway edge and the return idler 'construction-phase safety'? Analyse the client's instruction and state what you would do with it.
Read the worked answer
No - they are design and operational risks. The walkway edge and the return idler are designed into the asset. They will exist every day for the life of the terminal and will be used by the client's own maintenance staff, not only by the construction workforce. Moving them to the contractor's register does not transfer the hazard; it transfers a piece of paper. The decisive point is that blockage clearing is a maintenance activity, which is operations.
Legal position. In most work health and safety regimes, designers must eliminate or minimise risk so far as is reasonably practicable, and must pass on information about residual risk to those who construct and operate the asset. A guardrail and permanent anchors are well-understood controls near the top of the hierarchy, and they are far cheaper designed in now than retrofitted. The $480,000 is about 0.15% of a $310 million capital estimate - a figure that will not survive scrutiny after a fatality.
What I would do:
- Keep both items in the design and issue a written technical note quantifying severity, exposure frequency and who is exposed.
- Record the client's instruction and your advice in the design risk register and the project decision log.
- Offer the client a way out that is not a safety trade - find $480,000 elsewhere in the estimate, or phase the guarding and anchors into an early works package.
- If the instruction is repeated: escalate internally, state the duty-holder position in plain terms to the client, and consider whether the principal designer or the regulator must be informed where a serious residual risk is left unmanaged. A client can accept commercial risk; it cannot direct an engineer to certify a design that leaves a serious risk uncontrolled.
The fatality at the comparable terminal converts a theoretical severity rating into a demonstrated one. Do not write anything that reads as an admission, but re-run the risk assessment, check this project for unguarded return idlers and blockage access, and issue a safety alert across live projects.
2. The register shows 12 high risks, 8 without owners and 5 with mitigations over 90 days overdue. Diagnose the failure and set out the governance changes you would recommend.
Read the worked answer
Diagnosis: a register in that condition is being used for reporting, not for control. A risk with no accountable name is not a risk - it is a wish. Twelve high ratings with no ownership means the ratings themselves are probably inflated or stale, and the board is being shown activity rather than exposure.
Recommended changes:
- One named accountable owner per risk - a role plus a person, never a department - with a target date and a mitigation action that carries a cost and a schedule allowance.
- A rule with teeth: a risk without a plan gets one within a defined period or is escalated as formally accepted with an executive signature.
- Cadence: monthly review plus a review before every gate and change board. Overdue actions escalate automatically one level.
- Measure exposure, not count: score x cost trend, so the board can see whether exposure is growing after mitigation rather than how many lines are on the page.
- Separate risks from issues. Issues get closed; risks get managed. Enter new risks at the point of change - most late-emerging risks enter through changes nobody scored.
- Contract-reference the register, so that 'accepted' risks are clearly carried by the client and the contingency held against them is visible.
- Independent review before the next funding gate.
Link to the guarding issue: if the register cannot keep an owner and a date on a fatality-severity item, it will not be believed on anything else. Use the guarding item as the test case - name the owner, set the date, cost the control, and report it at the next gate.
3. What do you put in writing on the design record about residual risk, and how do you handle the aftermath of the comparable-terminal fatality?
Read the worked answer
On the design record: a design risk note to the client listing residual risks, the controls assumed, and the information the contractor and the operator need. This is the same content as the safety file or construction-phase information, and it must be formally delivered with the construction package, not conveyed verbally. It should state the operating assumptions - for example that blockage clearing is performed only with the conveyor isolated and with the guarding and anchors installed - because assumptions that are never written down become invisible the day the design team leaves.
If the client's PM keeps pushing items off the design record: escalate to the sponsor with the same note and a clear statement that the designer's duty cannot be discharged by transferring an item to a contractor's register. Keep every exchange factual and dated.
After the fatality at the comparable terminal:
- Coordinate with your firm's safety lead and the client's - information, not speculation, to any investigation.
- Check whether the client has a notification duty and whether any comparable design on your projects has the same access hazard; issue a safety alert.
- Review honestly whether your own design decisions contributed; an internal review now costs far less than discovering a gap after an inquiry.
- Avoid correspondence that reads as an admission, but do not let caution become silence.
Finally, treat the client's risk appetite as a project risk to your own firm: fee at risk, insurance exposure, and the possibility of a reporting obligation. Protecting the fee never justifies staying quiet.