I have spent more than thirty years in high-hazard work: oil and gas, mining, nuclear, aviation, chemical manufacturing and transportation. I have conducted more than fifty fatality investigations. This guide is what I wish someone had handed me at the start.
Every one of those investigations began the same way. A binder arrived. It held the procedure, the permit, the training record, the signatures. On paper, the system had worked. Then I started talking to people, and a different story came out. The worker had been quieter than usual for a week. The crew had been finishing that task faster every month. Somebody had noticed something and said nothing because the last person who spoke up got a lecture. None of that was in the binder.
That is the whole argument of this guide in one sentence: the warning signs were in the psychology, and the procedures never captured them.
I am not against procedures. I have written hundreds of them and I still believe in them. A good procedure is a gift from the people who came before you. What I am against is the belief that a procedure can carry the weight of a human nervous system. It cannot. A procedure describes the task. It says nothing about the state of the person performing it: tired, pressured, frightened of a supervisor, grieving, bored by a job they have done a thousand times. The procedure is the same on a good day and a bad day. The person is not.
Psychology Before Procedures™ is the order of operations I arrived at after watching the binder fail too many times. Look at the person first. Look at the state of the team. Look at how the organization has taught people to feel about speaking up. Then open the procedure, because now you know what it is up against.
This guide has three parts. The first explains, with the research behind it, why compliance-only programs drift toward failure. The second lays out what I build instead: the Cognitive Reliability Model™ and the frameworks that serve it. The third gives you a thirty-day start. It is written for a safety leader, a supervisor, or anyone who has felt the gap between what the paperwork says and what the floor is telling them.
Read it slowly. Argue with it. Then go stand beside someone on your next shift and watch, before you read anything.
Janel Penaflor
The Safety Disruptor™ · Founder and CEO, Safety Sense Inc.
I want to be careful with that title. A compliance program does not fail because the people who built it were careless. It fails because of forces that act on every organization, slowly, in the direction of trouble. The research on these forces is strong, and you should know it.
The sociologist Diane Vaughan studied the decision to launch the space shuttle Challenger and found something more unsettling than recklessness. Engineers had seen the O-ring damage before. Each time, they reviewed it, judged it acceptable, and flew again. The abnormal became the expected. She called this the normalization of deviance: a culture in which signals of danger are reinterpreted, step by step, until they are routine [1].
Nobody decides to accept a hazard. They accept a slightly smaller version of it than last time, and last time was fine.
Jens Rasmussen described how work in any organization migrates under two constant pressures: the push for efficiency and the push for less effort. Over time, practice moves toward the boundary of safe performance, and because nothing bad has happened yet, nobody feels it moving [2]. The procedure still says one thing. The work has quietly become another.
This is why a site can pass an audit in March and lose someone in June. The audit measured the paper.
Erik Hollnagel draws the distinction I use most in the field: work-as-imagined, which is what the procedure writer pictured at a desk, and work-as-done, which is what people have to do when the valve sticks, the radio dies and the day shift is waiting [3]. He argues that safety grows from understanding why things usually go right, including the adjustments people make every day, as much as from counting what went wrong.
When I ask a crew to walk me through a task "the way it really goes," the gap between the two is where the fatality lives. Treat the gap as information your system has not yet collected. Discipline will only teach people to hide it.
None of them shows up in a compliance metric. Normalization, drift and the imagined-versus-done gap are all invisible to a system that measures signatures, completed training and recordable rates. They are visible to a person who knows how to watch another person.
James Reason separated two ways of looking at error. The person approach treats unsafe acts as the product of carelessness and answers them with blame, retraining and more rules. The system approach treats error as a consequence of conditions upstream, and asks what defenses failed to catch it [4]. Sidney Dekker goes further: "human error" is a label we apply after the fact, and the useful question is why the person's actions made sense to them at the time [5].
Every report I have read that stopped at "failure to follow procedure" stopped too early. Why did not following it make sense that day, to that person, in that state?
I have run behaviour-based safety programs. Some of them did good things. But the critique matters. Andrew Hopkins reviewed these programs and concluded that they treat unsafe front-line behaviour as the only cause worth targeting, miss accidents that do not involve front-line workers at all, and would do more good if the observations were pointed at managers, since management behaviour shapes the culture [6]. The UK Health and Safety Executive's guidance on human factors makes a related point: behaviour is shaped by the job, the individual and the organization together, and you cannot change one without the others [7].
Observation cards that count "safe" and "at-risk" acts tell you what a person's hands did. They do not tell you what the nervous system behind the hands was doing.
NIOSH ranks controls by general effectiveness: elimination, substitution, engineering controls, then administrative controls, then personal protective equipment. Administrative controls and PPE, the agency notes, "require significant and ongoing effort by workers and their supervisors" [8]. A procedure is an administrative control. So is a permit. So is a toolbox talk. OSHA's recommended practices put the same idea plainly: "Finding and fixing hazards before they cause injury or illness is a far more effective approach" than reacting afterward, and worker participation is a core element of any program that does so [9].
The controls that depend on sustained human attention are the least reliable ones, and they are the controls most programs lean on hardest.
"Eventually fails" does not mean compliance is worthless. It means a program built only on compliance has no instrument for the thing that actually degrades: the human being. Keep the procedures. Add the instrument.
The philosophy is an order of operations. Before you reach for the procedure, you read three things: the person, the team, and the organization's effect on both. Then the procedure, because now you know what it has to survive.
What state is their nervous system in right now? Connected and curious, rushed and reactive, or flat and absent? The same procedure performed in those three states is three different tasks.
Who speaks and who does not? Whose stress is spreading? What has this crew decided, without ever saying it, about which rules are real?
What has this company taught people to expect when they stop work, report a near-miss or ask a question? That lesson walks into every task with them.
I will not give you a number here, because I did not count the way a researcher would. What I can tell you is what recurred, case after case, across industries that had nothing else in common:
A night-shift operator at a chemical plant is asked to break a line that has been "mostly" isolated. He has been short with people for a week; his crew lead noticed but figured it was personal. The permit is signed by someone who did not walk the line. The day shift is due in forty minutes and the handover notes are thin. He skips the second verification because the first was fine and because the clock says so. The line is not empty.
Every control in that story was an administrative control. Every warning sign was in a person. A system that reads the person first had five chances to interrupt it. The procedure had none.
CRM™ is the operating system. The nine frameworks that follow are the applications that run on it. Five pillars, each with a signal you can hear in the hallway after an incident, and each with the tools built to reach it before then.
Notice that every signal is a sentence someone actually says. That is deliberate. After a serious injury, listen to the first explanations people reach for. "He seemed fine" tells you the baseline was never measured. "They rushed it" tells you pressure was invisible to the system until it was not. The pillar names the capability that was missing. The frameworks are how you build it.
You will rarely find only one pillar degraded. They lean on each other. A fear-based culture (Pillar 4) produces workers who conceal their state (Pillar 1), which blinds the organization to their threat appraisal (Pillar 2). Start where the signal is loudest, but expect to visit the others.
The question behind this pillar is simple: do you know what "normal" looks like for each person, so that you can see the day it changes? Most organizations cannot answer that. They know attendance and certification status. They do not know that a particular rigger goes quiet when he is overloaded, or that a particular operator gets chatty and fast.
The science here is clear enough to act on. Research on stress and the prefrontal cortex, the region associated with planning, working memory and impulse control, finds that even mild, acute, uncontrollable stress can rapidly impair those abilities [10]. Older work on emotion and attention describes how high arousal narrows the range of cues a person takes in [11]. Both findings have a name on the floor: tunnel vision. A stressed worker is a worker whose field of view has shrunk, and carelessness has little to do with it.
For each person on your crew, can you describe their baseline in one sentence? If not, that is your first observation task. You cannot see a departure from a baseline you never recorded.
This pillar is about how a person's brain sizes up a hazard, and why two people can look at the same open excavation and feel entirely different things. Appraisal happens below calculation. It is shaped by experience, by what the person has survived before, by what they have been taught to fear and what they have been taught to shrug at.
Two patterns show up most. The first is underestimation of the familiar: the hazard that has been there for years and has become part of the scenery. The second is miscalibration under load: a person who is already stressed either catastrophizes minor issues or stops registering serious ones. The PERSONA SIF™ framework maps how each archetype tends to misjudge threat, and The Backpack™ asks where that tendency was learned.
Pick the one hazard on your site that everyone knows about and nobody talks about anymore. Ask three people, separately, how dangerous it is today. The spread in their answers is your threat appraisal problem.
A widely used model of human thinking describes two modes, often labeled System 1 and System 2: a fast, automatic mode and a slower, deliberate one [12]. The labels are a simplification, and I treat them that way. The useful point for safety is that pressure pushes people toward the fast mode, and the fast mode is where skipped verification lives. Quantum Safety™ gives supervisors a way to think about the threshold where a reversible decision becomes an irreversible one, and ThresholdIQ™ measures how close to that edge a person habitually operates.
Which task on your site has gotten faster every year without a change in method? That is where the pressure has been absorbed.
Amy Edmondson's study of work teams found that the belief that it is safe to speak up, which she called team psychological safety, was associated with learning behaviour in a way that confidence in the team's ability was not [13]. In the field, that belief is built by what happened to the last person who stopped a job, and posters have little to do with it. PRISM™ addresses how a safety message is received and resisted. BEACON™ gives leaders a conversation structure that lowers threat before it asks for change.
When did someone last stop work on your site, and what happened to them in the following week? Everyone on the crew knows the answer. Do you?
Fidelity means what was sent is what arrived. Most safety communication fails this test quietly: the toolbox talk was delivered, the permit was signed, the observation was logged. None of it was received. VOICE™ works on how a message is carried in the voice itself, pace, pause and tone. NISOS™ gives observers a protocol so that what they record is consistent and includes what they could not see, which is often the most important line on the form.
Take yesterday's permit to the person who signed it. Ask them, without the paper, what the three biggest risks on it were. Their answer is your fidelity score.
CRM™ is the meta-framework. Nine run beneath it, and ThresholdIQ™ is the assessment tool for Pillar 3. This is the map; the pages that follow go deeper on the four you will use first.
| Framework | What it does | Serves pillar |
|---|---|---|
| CRM™ Cognitive Reliability Model™ | The operating system. Five pillars, each with a warning signal, a diagnostic protocol and a deployment chain. | All five |
| 01 PERSONA™ | Twelve behavioural archetypes, each with strengths and a characteristic SIF risk pattern. A coaching lens, never a label. | 1, 3 |
| 02 NISOS™ | Neuroscience-Informed Safety Observation System. The O.B.S.E.R.V.E. protocol for field observation. | 5 (and 1, 2, 4) |
| 03 PERSONA SIF™ | Serious Injury and Fatality precursor framework: the five-stage precursor chain and three intervention windows. | 2 |
| 04 PRISM™ | Psychological Response and Influence Strategy Model: Perception, Response Pattern, Influence Pathway, Safety Integration, Motivation Anchor. Ethical influence only. | 4 |
| 05 BEACON™ | Leadership framework and the six-step BEACON™ Conversation: Build, Explore, Acknowledge, Clarify, Offer, Navigate. | 4 |
| 06 VOICE™ | Vocal Optimization and Intentional Communication Engineering: volume, tone, pace and pause, cadence, emotional resonance. | 5 |
| 07 Vagal Safety Ladder™ | Three nervous-system states and four ladder steps for bringing a person back to a state where they can think. | 1 |
| 08 The Backpack™ | Five layers of script and imprint that shape adult risk behaviour. "Not therapy. Safety intelligence." | 2 |
| 09 Quantum Safety™ | Five physics ideas used as analogies for how observation, teams and thresholds behave in a safety system. | 3 |
| ThresholdIQ™ | Risk tolerance assessment: how close to the edge a person operates before judgment breaks down. | 3 (tool) |
You do not deploy ten frameworks at once. You pick a chain that matches the situation and run it in order.
SIF prevention
PERSONA™ → PERSONA SIF™ → Vagal Safety Ladder™ → NISOS™
Culture rebuild
PRISM™ → Quantum Safety™ → BEACON™ → VOICE™
Post-incident
PERSONA™ → The Backpack™ → Vagal Safety Ladder™ → PERSONA SIF™
New site baseline
CRM™ audit → PERSONA™ → NISOS™ → PRISM™
On Quantum Safety™: the observer effect, superposition and entanglement are borrowed as analogies for how safety systems behave. They are teaching devices, and I do not claim a worker is a quantum particle.
The Vagal Safety Ladder™ applies polyvagal theory, a model of the autonomic nervous system proposed by Stephen Porges, to the front line [14]. The theory is widely used in clinical and coaching settings and is still debated; a 2023 critique challenges several of its physiological premises [15]. I use it because the three states it describes are the three states I have watched people work in, and because the practical steps that follow from it work whether or not the underlying anatomy is settled.
State 3 is the one that compliance programs reward. The person agrees to everything, signs everything and argues with nothing. On a card, they are the safest worker on the crew. In my investigations, they are the ones everyone described afterward as "fine."
PERSONA™ describes twelve patterns in how people meet risk. Each has a strength your crew needs and a way it tends to fail under load. Read the table as a set of starting questions. Nobody belongs in one row.
| Archetype | Strength | Pattern | SIF risk |
|---|---|---|---|
| Guardian | Reliability and consistency | Rule-follower, comfort in structure, catastrophizes change | Freezes under novel hazards not covered by procedure |
| Analyst | Rigor and evidence | Data-driven, decision paralysis under time pressure | Overthinks when rapid response is required |
| Achiever | Drive and standards | Production-first, cuts steps to hit targets | Rationalizes shortcuts as "experience" |
| Connector | Cohesion and trust | Team-driven, hates conflict | Will not speak up against the group even when the group is wrong |
| Adventurer | Energy and adaptability | Thrill-seeker, normalizes risk | The one who "always got away with it" until they don't |
| Mentor | Transfer of experience | Experience-based, teaches what worked | Passes normalized risk to new workers |
| Visionary | Systems view and improvement | Systems-thinker, disengages from tactical detail | Misses immediate environmental hazards |
| Enforcer | Clarity and accountability | Authority-driven, fear-based compliance | Workers hide near-misses |
| Harmonizer | Steadiness and de-escalation | Conflict-avoider, absorbs stress | Operates impaired by accumulated tension without signaling distress |
| Skeptic | Critical questions that catch flaws | Questions everything | Creates a permission structure for others to disengage |
| Pragmatist | Practical problem solving | Gets it done, improvises | Unapproved workarounds become standard practice |
| Stabilizer | Calm and continuity | Steady under pressure, resistant to change | Misses emerging hazards because routine feels safe |
PERSONA™ archetypes are a behavioural lens for understanding and coaching. They are never a diagnosis. They are never used to label, rank, hire or discipline anyone. Most people show two or three patterns depending on the day and the load. If you ever hear "he's an Adventurer, so of course he did that," the lens has become a label, and it is time to stop and reset.
An archetype tells you where to look. An Achiever under pressure goes faster and starts calling controls overkill. A Connector under pressure goes quiet and skips the shared break. Same stress, opposite signals. If you only know one picture of "a stressed worker," you will miss half your crew.
Serious injuries and fatalities are rarely sudden from the inside. PERSONA SIF™ describes five stages, with a window of time at each where intervention is still possible.
| Archetype | Observable precursor | First move |
|---|---|---|
| Achiever | Celebrating past shortcut "wins"; dismissing controls as overkill; production-versus-safety tradeoff talk | PRISM™ |
| Adventurer | Near-misses framed as achievements; thrill in the voice when discussing hazardous tasks; increasingly complex workarounds | VOICE™, BEACON™ |
| Harmonizer | Flat affect replacing warmth; agreeing without processing; present but cognitively absent | Vagal Safety Ladder™ |
| Connector | Uncharacteristic quietness; avoiding team interactions; missing shared breaks | NISOS™, BEACON™ |
| Pragmatist | "We can't stop for that"; incremental erosion of non-negotiable controls; complaints about the productivity cost of safety | PRISM™, NISOS™ |
Five of the twelve are shown. The full PERSONA SIF™ map covers all twelve with their intervention windows.
NISOS™, the Neuroscience-Informed Safety Observation System, replaces the "safe / at-risk" tally with a seven-step protocol. The difference is where it begins: with the observer's own state, before a single thing is recorded.
Quantum Safety™ borrows the observer effect as an analogy: the act of observing changes what is observed. A supervisor's presence on the floor is a safety variable in its own right. The O in O.B.S.E.R.V.E. exists because the observer is part of the scene, and an unregulated observer makes the scene worse.
Most safety conversations open with the correction. BEACON™ puts the correction fourth. The first three steps exist to lower the threat level enough that the fourth can be heard. The lines below are illustrative; use your own words.
PRISM™ sits underneath the conversation. It describes the worker's response spectrum, from Shutdown through Resistance, Compliance and Engagement to Commitment, and reminds you that resistance is a threat response before it is anything else: acknowledge it, validate it, then redirect. It also sets the ethical line. Influence that works by lowering threat and building meaning is the job. Influence that works by pressure, fear or manipulation is not, and it does not last anyway.
A composite from several investigations and several sites that did it differently. No single crew, no single company.
A maintenance supervisor at a processing plant walks to the morning briefing. She stops at the gate for ninety seconds and breathes out slowly, because she had an argument at home and she knows what she is like when she carries that onto the floor. That is Pillar 1, applied to herself first.
At the briefing she scans wide before she looks at anyone in particular. The crew is loud, as usual, except one fitter, who is normally the loudest. He is looking at his boots. She has his baseline in her head because she wrote it down three months ago, and this is not it. Signal emergence. Window 1.
She does not call it out in front of the group. After the briefing she finds a reason to walk with him to the job. Beside him, same direction. "Long week?" He shrugs. She asks him to walk her through the isolation the way it will really go today. He does, and in the telling he mentions that the second verification "usually" gets done by whoever is free. She says that makes sense given how thin the crew is. She means it. Then she tells him, in two sentences, what she is worried about. He does not argue, which worries her more. So she asks the grounding question: "What's the biggest risk you see right now?" There is a pause, and then he gives her a real answer, with detail, and his voice changes while he gives it. He is back.
They agree that he will call her before any verification is skipped today, and that she will pick up. She writes the observation in the NISOS™ format, including the line "could not confirm whether the night shift completed the drain-down," because she could not. She validates that line by calling the night lead before the job starts. The drain-down was not completed.
Nothing happened that Tuesday. That is the whole point, and it is why this work is so hard to see from a spreadsheet. The permit would have been signed either way. The training was current either way. The difference was a supervisor who read a person before she read a form.
You do not need a budget, a consultant or a new software platform to begin. You need a notebook and the discipline to watch before you act. Here is the sequence I give every leader I work with.
Resist the urge to turn this into a scorecard in month one. The early measures are qualitative: how many baselines you can describe, how many work-as-done gaps you found, how many people told you something they would not have told you a month ago. The recordable rate will follow or it will not; it is a lagging indicator of a system you are only beginning to see.
The companion Safety Culture Diagnostic Checklist, free at safetysenseinc.com/resources, walks all five pillars with thirty observable statements and a scoring grid, if you want a structured way to name the pillar at day thirty.
Every outside research claim in this guide points to one of the sources below. Field observations and the composite stories are my own and are labeled as such. Where a model is debated in the literature, I have said so in the text.
The CRM™ pillars, the PERSONA™ archetypes, the precursor chain and the protocols in this guide are proprietary frameworks of Safety Sense Inc., built from field experience. They are offered as practice. They are not validated psychometric instruments, and I have tried to say so wherever a reader might otherwise assume more. Timings in the precursor chain are typical ranges from investigations and have not been measured in a study. The physics terms in Quantum Safety™ are analogies.
You now have the map, the vocabulary and a thirty-day start. That is enough to begin on your own, and I mean that. If you want company for the next part, here are three doors. None of them are urgent.
The education arm of Safety Sense Inc. Eight thresholds, from the neuroscience of behaviour to leadership and certification, with a weekly live session on Thursdays at 5:00 pm Pacific. Certifications include PCP (PERSONA™), NCO (NISOS™), LPI (BEACON™) and QSP (Quantum Safety™).
Thirty minutes, no slides. Tell me which pillar signal you heard most this month and what you have tried. I will tell you what I would do next and whether I think I can help. If I can't, I will say so.
The Quantum Mind of Safety™ series goes deeper on everything here, including the investigations this guide only gestures at. The Plastic Organization is the book that holds BEACON™.
Janel Penaflor, The Safety Disruptor™
Founder and CEO, Safety Sense Inc. · Buckley, Washington · safetysenseinc.com/contact
© Safety Sense Inc. Psychology Before Procedures™, People Before Paperwork™, PERSONA™, NISOS™, PERSONA SIF™, PRISM™, BEACON™, VOICE™, Vagal Safety Ladder™, The Backpack™, Quantum Safety™, Cognitive Reliability Model™, CRM™, ThresholdIQ™ and HAVEN University™ are trademarks of Safety Sense Inc. This guide is educational material and is not a substitute for site-specific hazard assessment, regulatory compliance or professional medical or psychological advice. PERSONA™ archetypes are a coaching lens and must not be used to label, rank, hire or discipline anyone.