Traditional HSE – an administrative approach
For many years, the traditional approach to managing health, safety and environmental protection was primarily based on meeting regulatory requirements, which essentially establish minimum standards. In practice, this meant preparing risk assessment documents, policies and procedures, maintaining mandatory records, addressing inspection findings and fulfilling other regulatory obligations. Such systems were focused on demonstrating compliance, i.e. the organization’s ability to show that the required documentation was in place and that formally prescribed activities had been completed. As a result, the HSE function in many organizations was viewed primarily as an administrative and control function.
The problem arises when documentation becomes an objective in itself. The existence of a procedure does not necessarily mean that employees understand it, apply it or that it reflects actual working conditions. An organization may have well-maintained records, numerous completed training sessions and formally closed corrective actions, while serious risks remain present in the field without being properly identified or addressed. Modern HSE therefore does not reject administration and documentation; instead, it treats them as support for genuine risk management. A document should be evidence and a control tool- not a substitute for actual safety.
Why an administrative approach is not enough
One of the key shortcomings of a predominantly administrative HSE system is the assumption that work will be performed exactly as described in procedures. In real working conditions, there are often time pressures, limited resources, changes in work organization, equipment failures, workarounds and situations that were not anticipated in advance. This creates a gap between how work is designed and described in documentation and how it is actually performed. Understanding the real way work is carried out and the actual needs of workers therefore becomes one of the fundamental tasks of a modern HSE system.
An administrative approach also often reacts only after an unwanted event has already occurred. Following an injury or incident, an investigation is conducted, a procedure is revised, additional training is organized, or a new checklist is introduced. Although such activities are necessary, they represent a reactive approach. A modern HSE system seeks to identify weaknesses before an incident occurs. The focus therefore shifts from asking, “Do we have the document?” to questions such as, “Do we understand the risk?”, “Are the controls effective?” and “How do we know that the system will function when unplanned circumstances arise?”
Moving to a risk-based HSE system
A risk-based approach starts from the premise that an organization can never eliminate all hazards, but it can systematically identify, assess and control risks. The focus of the HSE system therefore shifts from fulfilling individual administrative requirements to understanding scenarios that could result in injuries, events with serious consequences for people and property, environmental pollution or business interruption.
The key questions become:
- What could happen?
- How likely is it to happen?
- What could the consequences be?
- Which controls prevent or mitigate the event?
Different methodologies can be used for this type of management, depending on the complexity of the process and the nature of the risk. Simpler activities can be analyzed through risk assessments, JSA/JHA analyses and checklists, while complex industrial processes may require HAZOP, Bow-Tie, FMEA or other structured methods. The hierarchy of controls is particularly important. It prioritizes the elimination of hazards, substitution of hazardous processes or materials, engineering controls and technical safeguards, while administrative measures and personal protective equipment are considered lower levels of protection. This shifts responsibility for safety from individual behavior toward the quality of the system itself.
From monitoring injuries to monitoring risk controls
Traditional HSE systems often measure performance using indicators that describe events that have already occurred. These may include the number of occupational injuries, lost workdays, environmental incidents or employee injury rates. Known as lagging indicators, these measures are important because they allow organizations to track historical performance and compare results over time. However, their main limitation is that they provide a view of the past. A low number of injuries does not automatically mean that a system is safe because an organization may still have serious uncontrolled risks that have not yet resulted in an incident.
For this reason, modern HSE increasingly relies on leading indicators – measures that provide insight into the status of preventive activities and protective controls. These may include the percentage of completed inspections, the number of identified near-miss events, the condition of safety-critical equipment, the time required to close corrective actions, the quality of risk assessments or the percentage of verified critical controls. The key change is that the organization does not wait for a negative event to obtain information about its safety performance. Instead, it continuously monitors signals that may indicate a weakening of the system. HSE thus becomes a tool for preventive management rather than merely a system for recording consequences.
Critical risks instead of treating all risks equally
Not all risks within an organization are equally significant. A minor cut and a fall from a significant height may appear in the same incident database, but their potential consequences are not comparable. Modern HSE systems therefore focus particular attention on risks that can result in serious consequences, including activities that may lead to severe injuries, major fires, explosions, exposure to hazardous substances or significant environmental impacts. Depending on the industry, these may include high-risk activities associated with the working environment, processes, equipment or long-term consequences arising from the work itself.
For every critical risk, key controls should be defined and verified to ensure they are present and functional enough to prevent a serious event. For example, when working at height, it is not enough to have a procedure and proof that an employee has received training. It is also necessary to verify the condition of fall-protection equipment, connection methods, anchor points, opening protection, rescue arrangements and the competence of the people performing the work. A modern system therefore does not ask only whether a control exists, but whether it is actually present, effective and reliable when needed. Managing critical controls is one of the most important differences between a formal HSE system and a genuinely effective one.
Management’s role – HSE is no longer the responsibility of the HSE department alone
In the traditional model, the HSE department was often viewed as the primary owner of safety responsibilities. HSE professionals were expected to inspect workplaces, identify non-conformities, develop procedures, conduct training and request corrective actions. This approach can easily create the misconception that production, maintenance, logistics and other departments are responsible for business results, while the HSE department is responsible for safety.
However, the people who manage processes, resources, deadlines and equipment are also making decisions that determine the level of risk.
The modern approach therefore emphasizes that managing HSE risks is primarily the responsibility of operational management. The HSE function acts as a technical advisor, analyst, facilitator and independent assurance mechanism, but it cannot manage every organizational risk on its own. Managers must understand the key risks within their areas, know which controls are critical and regularly verify their effectiveness. This integrates HSE into day-to-day management, production planning, maintenance, investment decisions and work organization rather than treating it as a parallel system managed only by a specialized department.
Safety culture and the human factor
When an incident occurs, the simplest explanation is often that an employee was careless, failed to follow a procedure or made a mistake. However, this is rarely the full explanation. Human behavior is influenced by the quality of work instructions, equipment design, workload, fatigue, deadline pressure, resource availability, communication, supervision, experience and organizational culture. If a particular rule is difficult to apply or significantly slows down the work, employees may gradually develop an alternative way of working that the organization eventually begins to accept informally.
Modern HSE therefore increasingly examines human and organizational factors instead of automatically treating individual error as the root cause. Learning from events and encouraging open reporting are intended to enable employees to raise concerns without fear that every mistake will automatically result in punishment. This does not mean eliminating accountability; it means distinguishing between an unintentional error, at-risk behavior and a deliberate violation of rules. An organization with a mature safety culture uses information from the field as a source for improving the system, not merely as a basis for assigning responsibility.
Digitalization of HSE systems
Digital technologies are significantly changing the way organizations manage HSE processes. Paper checklists can be replaced by mobile applications and platforms, corrective actions can be tracked in real time, and sensor data can provide information on hazardous-substance concentrations, temperature, vibration, employee location or equipment condition. Advanced software can also use predictive analytics to identify changes in behavior within a team or among individual employees. Digital dashboards allow management to quickly understand trends, open actions, critical risks and the status of preventive activities. This enables HSE professionals to shift their time away from administrative data entry toward analysis and risk management.
However, digitalization alone does not make an HSE system more effective. If a complicated paper form is simply transferred from paper to a smartphone, the essence of the process remains unchanged. Modern digitalization should simplify work, improve information quality and enable earlier risk identification. Advanced analytics and artificial intelligence also create opportunities to connect large volumes of data and identify patterns that may not be easily visible to humans. However, the quality of digital analysis always depends on the quality of the underlying data and how the organization uses that information when making decisions.
Integrating HSE with business management
HSE risks are not only a matter of employee safety or regulatory compliance. They can have direct business consequences. A serious incident can cause production downtime, property damage, loss of customers or even entire markets, regulatory penalties, legal proceedings, increased insurance costs and long-term reputational damage. An environmental incident can have consequences that last for years and require significant financial resources for recovery. HSE risk management should therefore be viewed as an integral part of the broader business risk management system.
Integration means considering HSE when making investment decisions, purchasing equipment, designing new processes, selecting contractors, planning maintenance and setting production targets. For example, a decision to postpone equipment maintenance is not solely a maintenance or financial decision if it simultaneously increases the likelihood of a serious incident. A modern HSE system enables management to understand these connections and make decisions based on the organization’s overall risk profile. In this way, HSE ceases to be an isolated specialist area and becomes part of the company’s strategic and operational management.
What a mature HSE system looks like
A mature HSE system cannot be recognized simply by the number of procedures, certifications or injury-free days. Its defining characteristic is the organization’s ability to understand and manage its own risks. Management knows which events have the potential for the most severe consequences, which controls prevent them and what the current condition of those controls is. Employees understand the risks associated with their work, have the ability to stop unsafe work and can report problems, while incidents and near misses are used as opportunities for learning. Procedures exist, but they are practical, understandable and connected to the way work is actually performed.
The highest level of maturity is achieved when an organization does not simply react to incidents but actively looks for weak signals that may indicate a future problem. These may include recurring minor deviations, temporary solutions that become permanent, maintenance delays, increasing overtime, declining inspection quality or repeated similar near-miss events. In such a system, HSE is not assuming that the absence of incidents means the absence of risk. Instead, the organization continuously tests how resilient its system is to errors, changes and unexpected events.
Conclusion
The transformation of modern HSE systems can be described as a shift from asking, “Have we met the requirement?” to asking, “Is the risk actually under control?”. Administration, procedures, records and regulatory compliance remain important elements of the system, but they are no longer sufficient to assess its effectiveness. The true value of an HSE system lies in its ability to identify critical risks, establish reliable controls, monitor their effectiveness and recognize weak signals before they develop into serious incidents.
Modern HSE is therefore more than a function responsible for occupational safety and environmental protection. It is becoming an integral part of organizational management. Companies with mature HSE systems do not simply seek to comply with rules; they seek to understand how their systems operate under real conditions, how people make decisions and where future risks may emerge. The fundamental shift is therefore from managing documentation to managing risk, from reacting to consequences of preventing them, and from seeing HSE as the responsibility of one department to recognizing it as a shared responsibility across the entire organization.