The Handover That Signed Itself

Classification. The procedure's test is 'could reasonably have resulted in loss of supply', so reason from the counterfactual rather than the outcome. At 06:24 the generator held an unknown level, later measured at 38%. At 38% the unit tripped on low fuel after 40 minutes under load, while battery autonomy is four hours. Any grid loss starting between 06:24 and the refuel would have been carried for four hours and then lost. That is a credible route to loss of supply, so the event is client-reportable. Because no supply was actually lost, it is a near miss or precursor, not an outage - and 'no event' is not an available classification.

What was owed between 06:24 and 14:20. The incoming operator should have treated the handover as incomplete: go to the generator, read and record the level, and escalate. The fuel should then have been topped up or a controlled refill scheduled, the site's readiness re-checked, and a deviation entry opened inside the 24-hour window. The load test confirmed the condition; it did not create it. Discovery by a scheduled test rather than by the operator is itself a finding.

A warning plus retraining treats a system defect as an individual defect. The checklist as written let a signature be applied with a mandatory field blank - that is a design weakness, not a knowledge gap. The interruption was predictable: a vendor call at handover time is a foreseeable event in a 24-hour control room, and no relief or pause rule existed to absorb it. The incoming operator inherited an already-broken handover, and single-person verification meant nobody else looked at item 7 before the sheet closed. Retraining cannot fix any of those, and a warning suppresses future disclosure of exactly the deviations the procedure needs reported.

Stronger controls:

1. Make item 7 a hold point: the handover cannot be signed or timestamped until a fuel reading is entered and validated against the 70-95% band, with an automatic escalation if it is out of band.
2. Add independent verification at shift change - the incoming operator confirms the reading at the physical gauge - plus an automatic low-fuel alarm at 60% so no single missed check can carry the whole risk.

A useful third measure is a handover protection rule: no call, alarm or vendor contact may interrupt checklist completion until the checklist is closed.

Include: the date, times and location; the 06:00 handover, the 06:22 return, the 06:24 signature with item 7 blank; the 14:20 load test, the 38% reading and the 40-minute low-fuel trip; battery autonomy of four hours and that no supply was lost; the client-reportable justification in the procedure's own wording; immediate containment (refuel, readiness check, retest date); interim controls already in force; corrective actions with named owners and dates; and the classification as a near miss pending investigation.

Leave out: any named-individual blame or discipline, conclusions such as 'operator error' before the investigation, speculation about why the level was low, and commentary on cost or client relations. Also leave out any statement that the event was harmless - that contradicts the reportable classification and would undercut the containment rationale.

Framing. Write it as fact, timeline and action, with cause recorded as under investigation. State clearly that the deviation was identified by a scheduled test, since that is materially relevant to the client's confidence and to the corrective action. Route it through the quality or compliance function for a record number and retain it under the site's document retention rule rather than in a personal mailbox.