
Aligning authority, accountability, and expertise to improve risk management and business performance.
By Chet Brandon, CSP, CHMM | LeadingEHS.com
Organizations invest considerable resources in environmental, health, and safety (EHS) programs. They establish policies, implement management systems, conduct audits, introduce technology, and hire qualified professionals to manage risk. Despite these investments, many still struggle to consistently translate EHS expectations into effective operational decisions.
The problem is not always a lack of commitment, technical expertise, or resources. Sometimes, the organization has simply failed to establish who has the authority to make critical decisions.
An EHS professional may identify a significant risk but lack the authority to require corrective action. A plant manager may be accountable for safety performance but believe the corporate EHS function owns the decisions necessary to achieve it. A corporate EHS leader may establish standards that operating managers treat as recommendations rather than requirements. Meanwhile, capital investments, operational changes, and risk acceptance decisions move through approval processes that are poorly understood or inconsistently applied.
These are more than communication problems. They are weaknesses in organizational governance that can affect regulatory compliance, operational effectiveness, employee confidence, and business performance.
Decision rights are among the most important—and frequently overlooked—elements of an effective EHS operating model.
What Are Decision Rights?
Decision rights establish who has the authority to make specific decisions, the conditions under which that authority may be exercised, and when consultation, approval, or escalation is required.
They answer questions every organization should be able to resolve without confusion: Who makes the decision? Who provides the technical expertise? Who must approve it? Who implements it? And what happens when the individuals involved disagree?
These questions become particularly important in EHS because decisions routinely cross organizational boundaries. Operations, engineering, maintenance, legal, finance, human resources, and EHS may all have legitimate responsibilities within the same issue. Participation in a decision, however, does not necessarily convey the authority to make it.
Four concepts are fundamental to understanding decision rights.
Responsibility describes the work assigned to a person or function. An EHS professional may be responsible for evaluating risks, interpreting technical requirements, or recommending corrective actions.
Authority defines what that person can decide, approve, require, or stop. Technical responsibility does not automatically convey authority over operating resources or business decisions.
Accountability establishes who ultimately answers for the decision and its consequences. Accountability should be supported by sufficient authority to influence the outcome.
Decision competence encompasses the technical expertise, operational knowledge, regulatory understanding, and organizational context necessary to make an informed decision. A person may have formal authority without possessing all the knowledge needed to exercise it effectively.
Consider a significant machine-guarding deficiency identified during an EHS inspection. The EHS professional evaluates the hazard and determines applicable requirements. Engineering or maintenance develops an appropriate technical solution. Operations owns the equipment and the resources needed to implement the correction.
But who can prohibit continued operation? Who can authorize temporary protective measures? Who determines when the equipment can safely return to service? And who resolves a disagreement when production priorities conflict with technical recommendations?
A well-designed decision-rights framework establishes those answers before the conflict occurs.
Why Decision Rights Matter
Aligning Authority with Accountability
One of the most common weaknesses in organizational design occurs when individuals are held accountable for outcomes over which they have limited control.
EHS leaders may be evaluated on injury rates, regulatory compliance, audit results, and management system effectiveness while operating managers control equipment, staffing, production schedules, maintenance priorities, and capital expenditures.
There is nothing inherently wrong with this division of responsibilities. Effective EHS governance generally depends on operations owning operational risks. The problem arises when the authority needed to fulfill those responsibilities is not clearly defined.
EHS professionals need the authority to establish technical requirements within their delegated scope, challenge unacceptable practices, initiate or require escalation, and exercise stop-work authority when necessary. Operations must remain accountable for controlling the risks associated with its activities and implementing corrective actions.
EHS should not manage operations, nor should operations be free to disregard EHS requirements. Both functions need clearly established authority, and executive leadership must resolve conflicts when those responsibilities intersect.
Improving Decision Speed and Quality
Unclear decision rights often produce two undesirable outcomes. Decisions are delayed because everyone believes someone else must approve them, or decisions are made without involving the people who best understand their consequences.
A maintenance supervisor may wait for corporate approval to address an urgent condition that should be resolved locally. Conversely, a site manager may authorize a process modification without realizing that it requires engineering review, management of change, or environmental permitting evaluation.
Both situations reveal weaknesses in the decision-making process.
Routine decisions should generally be made close to the work, provided the individuals involved have sufficient competence, information, and authority. Decisions involving serious consequences, regulatory exposure, or enterprise-wide implications may require additional technical review or executive approval.
The objective is to move decisions to the lowest competent level with the appropriate authority—not automatically to the lowest organizational level.
This approach preserves operational responsiveness while maintaining appropriate risk controls.
Preventing Inappropriate Risk Acceptance
Risk acceptance is one of the most consequential decisions an organization makes, yet the authority to accept risk is often poorly defined.
Consider a facility operating with a degraded engineering control. Site management believes temporary administrative measures provide sufficient protection. EHS disagrees, and engineering recommends a capital improvement that will take several months to implement.
Who can authorize continued operation?
The answer should depend on the significance of the risk, the effectiveness of interim safeguards, legal requirements, and the organization’s established risk tolerances.
Not every risk can be accepted. A manager cannot legitimately authorize continued operation in violation of a non-waivable legal requirement or mandatory safety condition simply because stopping production would be expensive.
Decision rights should distinguish risk evaluation from risk acceptance, temporary operating authorization, and the approval of corrective actions. They should also establish when decisions require independent review outside the affected operating unit.
This independence is particularly important when production pressures could influence risk judgments.
Enabling EHS Programs to Scale
Decision-making becomes more complicated as organizations expand across facilities, businesses, and countries.
Corporate EHS establishes global expectations. Regional professionals interpret regulatory requirements and support implementation. Site leadership manages daily operations and controls local risks.
Without clear authority, corporate standards may be applied inconsistently, routine decisions may become trapped in excessive approval processes, and significant risks may be treated differently across the organization.
An effective operating model defines what must be standardized and where local flexibility is appropriate.
Corporate leadership may own enterprise EHS standards and minimum performance expectations. Regional teams provide specialized regulatory and operational expertise. Site leaders remain accountable for implementation and local risk management.
The challenge becomes particularly significant in multinational organizations. People authorized to make decisions may be thousands of miles from those who best understand the problem.
That separation becomes dangerous when local expertise is excluded from the decision.
When Corporate Control Becomes a Liability: A Lesson from Mexico
During my career in the industrial materials industry, I encountered a situation that demonstrated how transferring decision rights during a crisis can make an already difficult problem worse.
A manufacturing facility in Mexico had come under significant environmental regulatory scrutiny because of its proximity to surrounding businesses and residential communities. Concerns from the community and pressure from municipal government contributed to the environmental regulator issuing an order requiring the facility to cease operations.
The company recognized the seriousness of the situation and transferred decision-making authority from local leadership to corporate executive management, legal, and EHS.
The reasoning was understandable. The organization faced regulatory exposure, significant business interruption, and potential reputational consequences. Corporate leadership wanted direct control over the response and the decisions required to restart operations.
However, this shift in authority created an unintended problem.
Corporate decision-makers approached the regulatory situation largely through the lens of U.S. legal and regulatory practices. The response reflected assumptions about how enforcement agencies operate, how regulatory disputes are resolved, and what actions would be necessary to demonstrate compliance.
Those assumptions did not adequately reflect the expectations of the Mexican regulator.
Local leadership possessed a better understanding of the regulatory environment, the expectations of government officials, and the practical considerations involved in resolving the matter. But with decision authority transferred to corporate management, that expertise did not have sufficient influence over the response strategy.
The result was a prolonged delay in restarting operations.
Looking back on this experience, the problem was not the decision to involve corporate leadership. The regulatory situation was serious enough to justify that involvement. The mistake was assuming that corporate authority, supported by U.S. legal and regulatory experience, would produce a better outcome than a response shaped by people who understood the local regulatory environment.
Authority had been centralized, but the expertise needed to resolve the problem had not been adequately incorporated into the process.
A better governance arrangement would have preserved executive oversight of the company’s regulatory and business risks while assigning meaningful responsibility to local leadership for developing the regulatory response and engaging with government authorities. Corporate EHS and legal functions could have provided strategic support, independent review, and approval of decisions exceeding established risk thresholds.
The broader lesson extends well beyond regulatory enforcement. Similar problems can occur during significant incidents, capital projects, acquisitions, operational changes, and other situations where corporate leaders become deeply involved in local operations.
Decision authority and decision expertise are not always located at the same organizational level.
Organizations need to assign authority based on the nature of the decision, the expertise required, and the consequences of getting it wrong. Senior leaders should maintain appropriate oversight without unnecessarily displacing the people closest to the problem.
Decision Rights Versus a Traditional RACI Matrix
Many organizations use RACI matrices to define responsibilities. RACI identifies who is Responsible, Accountable, Consulted, and Informed for a particular activity.
These matrices are useful for managing processes and projects, but process responsibility is not necessarily the same as decision authority.
A RACI matrix might identify a plant manager as accountable for corrective actions and an EHS manager as responsible for evaluating the associated risks. It may not explicitly identify who can authorize continued operation, approve a temporary exception, or resolve a disagreement between operations and technical experts.
Decision-rights models address these distinctions more directly.
Bain & Company’s RAPID framework, for example, identifies five decision roles: Recommend, Agree, Perform, Input, and Decide. It emphasizes clarifying final authority and the contribution of other participants to the decision.
For EHS governance, I recommend a modified approach that explicitly recognizes technical review, implementation, and escalation.
| Role | Decision Function |
|---|---|
| D — Decide | Holds final authority within defined limits |
| R — Recommend | Develops and presents the proposed decision |
| C — Consult | Provides required technical, operational, legal, or regulatory input |
| X — Execute | Implements the authorized decision |
| E — Escalate | Receives decisions exceeding delegated authority or requiring independent resolution |
This is a proposed EHS-specific decision-role model, not a reproduction of Bain’s RAPID framework. It must be supported by separately defined requirements for mandatory technical concurrence, legal approval, stop-work authority, and risk acceptance limits.
The purpose is to make authority visible and enforceable without creating another administrative process that delays decisions.
The EHS Decision Rights Matrix
The following matrix provides an illustrative framework for assigning decision rights within a multi-site industrial organization.
It reflects an operating model where operations owns operational risk, EHS provides technical expertise and governance, and executives retain oversight of enterprise-level decisions.
| Critical Decision | Decision Authority (D) | Technical Lead / Recommendation (R) | Implementation (X) |
|---|---|---|---|
| Enterprise EHS strategy and risk appetite | CEO / Executive Leadership | Global EHS Leader | Business Unit Leaders |
| Corporate EHS technical standards | Global EHS Leader | Corporate EHS Specialists | Regional / Site Leaders |
| Site EHS implementation plans | Site Manager | Site EHS Leader | Operations / Site Functions |
| Routine hazard correction | Area Operations Manager | Supervisor / EHS | Operations / Maintenance |
| Immediate stop-work for unsafe conditions | Any employee or contractor | Not required | Affected Work Team |
| Restart following a critical safety stop | Designated Operations Leader | EHS / Engineering | Operations |
| Temporary operation with degraded safeguards | Authorized Senior Operations Leader | EHS / Engineering | Operations |
| Significant residual risk acceptance | Designated Executive Risk Authority | Operations / EHS | Site Leadership |
| Management of Change approval | Designated MOC Authority | Engineering / EHS / Process Safety | Operations / Project Team |
| Return to service after significant modification | Designated Operating Authority | Engineering / EHS | Operations |
| Significant incident investigation findings | Investigation Governance Authority | Investigation Leader | Corrective Action Owners |
| Significant corrective-action selection | Accountable Operations Leader | Investigation Team / EHS | Operations / Engineering |
| EHS capital investment prioritization | Capital Committee / Executive | Operations / EHS / Engineering | Project Team |
| Regulatory interpretations and compliance positions | Delegated Regulatory Authority | Regulatory / Legal / Local Experts | Affected Business Functions |
| Regulatory notifications and submissions | Authorized Regulatory / Site Representative | EHS / Legal / Regulatory | Designated Filing Owner |
| Significant regulatory enforcement response | Designated Executive Risk Authority | Local Regulatory / EHS / Legal | Local Regulatory / Site Team |
| Regulatory-mandated shutdown strategy | Designated Corporate Executive | Local Management / Regulatory / EHS / Legal | Local Leadership with Corporate Support |
| Regulatory engagement and resolution | Delegated Local Regulatory Authority | Local EHS / Legal / Technical Experts | Local Regulatory / Site Team |
| Restart following regulatory shutdown | Authorized Operating Executive, subject to regulator approval | Local Regulatory / EHS / Legal / Engineering | Site Leadership |
| Corporate EHS audits and conclusions | Corporate EHS Audit Authority | EHS Audit Team | Audit / EHS Function |
| Significant audit finding closure | Designated Verification Authority | EHS / Engineering | Corrective Action Owner |
| Exceptions from corporate EHS standards | Authorized Corporate Standard Owner | Site Leadership / EHS | Affected Site |
| EHS technology and data standards | Enterprise System Owner | EHS / IT / Operations | Digital / IT Teams |
This matrix should be adapted to the organization’s operating structure, legal obligations, risk profile, and delegated authorities. Each decision requires one clearly identified final decision-maker, even when the illustrative table identifies a committee or organizational function. Mandatory technical concurrence and escalation requirements should be documented in supporting procedures.
Importantly, corporate approval cannot replace authorization required from a regulatory agency, nor can internal management discretion override legal obligations or mandatory safety controls.
Essential Safeguards
The matrix becomes effective only when the organization establishes clear boundaries for exercising authority.
Technical concurrence: Certain decisions require approval or formal concurrence from engineering, EHS, process safety, industrial hygiene, environmental, or legal specialists. General operating authority does not eliminate these requirements.
Risk acceptance: Only specifically authorized leaders should accept residual risks, and only within established limits. Non-waivable legal violations and prohibited operating conditions cannot be accepted through an internal approval process.
Stop-work and restart: Employees and contractors should be empowered to initiate a safe stop when they reasonably believe conditions are unsafe. Restart authority should be more restricted and require verification that applicable controls are effective.
Escalation: Decisions exceeding delegated authority should move through defined channels. Significant unresolved technical disagreements should receive independent review.
Local expertise: Decisions elevated to corporate leadership should preserve meaningful participation by the people with the relevant operational, regulatory, and cultural knowledge.
Put the Decision Rights Framework to Work
Understanding decision rights is only the first step. Organizations also need to evaluate whether their current decision-making authority is clearly established, consistently applied, and supported by the appropriate expertise.
To help EHS leaders conduct this evaluation, I developed the LeadingEHS Decision Rights Assessment Tool, an Excel-based resource containing 23 critical EHS decision categories, an assessment register, governance gap scoring, and an executive dashboard.
The tool can help identify gaps between assigned authority and actual practice, evaluate escalation requirements, and prioritize improvements to the organization’s EHS governance model.
[Download the LeadingEHS Decision Rights Assessment Tool (Excel)]
Use the assessment with your EHS, operations, and executive leadership teams to identify where decision rights are working effectively—and where unclear authority may be creating unnecessary risk or operational delays.
Establishing Risk-Based Decision Thresholds
A decision-rights framework should not require corporate approval for every operational issue. That would slow decision-making and weaken local accountability.
Equally, decisions with potentially severe consequences should not be left entirely to individual sites without adequate oversight.
A practical approach is to establish decision levels based on credible consequences, legal obligations, control effectiveness, and the organization’s risk tolerance.
| Decision Level | Typical Authority | Examples |
|---|---|---|
| Level 1 — Routine Operational Risk | Supervisor / Area Manager | Routine corrections, established operating procedures, minor issues within approved controls |
| Level 2 — Elevated Site Risk | Site Manager with technical review | Significant corrective actions, nonroutine operating conditions, site-level changes |
| Level 3 — Significant Enterprise Risk | Designated Executive Risk Authority | High-consequence exposure, major regulatory enforcement, substantial capital requirements |
| Level 4 — Prohibited or Unacceptable Conditions | No discretionary acceptance | Non-waivable legal violations, failed mandatory safeguards, prohibited operating conditions |
These thresholds should be based on the organization’s hazards and operating environment. Serious injury and fatality potential, critical control failures, major environmental releases, regulatory enforcement, and process safety consequences are all relevant considerations.
Escalation should be based on credible potential consequences rather than actual outcomes alone. A near miss revealing multiple failed safeguards may warrant executive attention even when nobody was injured.
The purpose is not to elevate as many decisions as possible. It is to ensure that decisions receive scrutiny proportional to the consequences of getting them wrong.
Two Additional Examples of Decision Rights in Practice
A Critical Safeguard Fails During Production
A manufacturing facility discovers that a critical machine safeguard has failed. Production leadership wants to continue operating while maintenance prepares a repair plan. EHS believes continued operation presents an unacceptable risk.
Under a clear decision-rights framework, personnel can initiate a safe stop without waiting for senior management approval. Engineering and EHS evaluate the condition and establish the technical requirements for safe operation. Operations remains accountable for implementing corrective actions.
Restart can occur only when designated authorities verify that the applicable requirements have been satisfied. If operations and technical functions disagree, a defined escalation process determines how the conflict will be resolved.
The decision does not become a contest of influence between the EHS manager and plant manager.
A Capital Investment Competes with Production Priorities
An EHS assessment identifies an exposure requiring an engineering improvement. The project competes with investments intended to increase production capacity or improve product quality.
EHS evaluates the risk and applicable requirements. Engineering develops technical alternatives and cost estimates. Operations evaluates implementation and production impacts. The appropriate capital authority determines funding within the organization’s mandatory risk-control requirements.
If the investment is deferred, the organization must determine whether interim controls are adequate, whether continued operation is permissible, and who has authority to accept any remaining risk.
This example highlights an important distinction. Approving a capital expenditure and authorizing continued operation while a risk remains are two different decisions. They may require different authorities and approval criteria.
The Hidden Danger of Informal Decision Rights
Organizations do not need a formal matrix for decision authority to exist. Decisions will be made regardless of whether the governance structure is documented.
When authority is unclear, decisions often depend on seniority, personal relationships, budget ownership, organizational influence, or an individual’s willingness to challenge others.
A technically qualified EHS professional may recognize a significant hazard but hesitate to challenge a powerful operating executive. A site manager may believe corporate EHS has veto authority that was never formally assigned. A corporate executive may unintentionally override a technical review process simply by communicating a preferred outcome.
These informal arrangements may appear effective during normal operations. Their weaknesses become visible when decisions are urgent, commercially consequential, or involve disagreements among influential leaders.
Crises add another complication. Corporate leadership may quickly assume authority over decisions normally managed locally. Greater executive involvement may be appropriate, but it should not automatically eliminate the role of personnel possessing specialized knowledge.
A mature EHS operating model should function regardless of which individuals occupy particular positions.
If a critical EHS control depends primarily on an individual’s ability to influence management, rather than clearly established governance, that control may not be institutionally reliable.
Integrating Decision Rights into EHS Management Systems
Decision rights should not exist as an isolated document maintained by corporate EHS. They belong within the processes where decisions actually occur.
Management of Change procedures should establish who approves technical modifications, evaluates regulatory implications, and authorizes startup. Incident investigation protocols should identify who approves findings, selects corrective actions, and verifies completion. Capital approval procedures should distinguish funding decisions from the authority to accept residual risk.
Corporate standards, regulatory response procedures, internal audits, and operational reviews should reinforce the same governance principles.
For multinational companies, these processes should also identify when local regulatory or operational concurrence is required. The Mexico experience illustrates the consequences of elevating authority without preserving local expertise.
Digital EHS management systems can help enforce decision rights through approval routing, authority limits, technical review requirements, and documented escalation. However, automating a poorly designed approval process does not improve governance. It merely makes the weaknesses more systematic.
Artificial intelligence introduces an additional dimension. AI-enabled systems may increasingly identify hazardous conditions, recommend interventions, prioritize corrective actions, or initiate predefined activities.
Organizations will need to determine which actions can be automated, which require human authorization, and who remains accountable for outcomes. Human oversight should be designed around the significance of the decision and the potential consequences of an error, rather than added as a routine approval step without meaningful review.
Technology can improve the quality and speed of information, but it does not eliminate the need for human and organizational accountability.
How to Implement Decision Rights Across an EHS Organization
Establishing decision rights does not need to become a major restructuring project. A practical assessment can begin with the decisions most likely to affect risk exposure, regulatory compliance, or business performance.
1. Identify consequential decisions. Start with 15–20 decisions involving serious injury potential, environmental consequences, regulatory obligations, business interruption, significant resource commitments, or important technical disagreements. The accompanying EHS Decision Rights Assessment Tool provides a starting register of 23 decision categories.
The accompanying LeadingEHS Decision Rights Assessment Tool provides a practical starting point, with 23 predefined EHS decisions and a framework for evaluating decision authority, expertise, and governance gaps.
2. Compare formal authority with actual practice. Interview EHS professionals, operational leaders, engineering, and executive management. Determine who is formally authorized to make decisions and who actually makes them. Pay particular attention to decisions that become centralized during significant events.
3. Establish authority and limits. Assign one clearly identified final decision-maker for each category. Define mandatory technical concurrence, delegated authority, risk acceptance boundaries, and escalation requirements. Confirm that decision-makers have access to the knowledge needed to exercise their authority competently.
4. Integrate decision rights into existing processes. Update management-of-change procedures, incident investigations, regulatory response protocols, capital approval processes, corporate standards, and digital workflows. Avoid unnecessary additional bureaucracy.
5. Evaluate performance and revise the framework. Use incident reviews, audits, management reviews, and tabletop exercises to test whether the assigned authorities work as intended. Reassess after reorganizations, acquisitions, significant operational changes, or repeated decision delays.
Success should be evaluated through observable results. Are significant issues resolved more quickly? Are technical disagreements escalated appropriately? Are risk acceptance decisions consistent? Do operational leaders understand their authority? Does corporate intervention improve decision quality or unintentionally slow the organization?
One particularly useful question for executive management reviews is:
Did the person accountable for the outcome have the authority, expertise, information, and resources necessary to make the right decision?
If the answer is no, the problem may involve organizational governance rather than individual performance.
Executive Leadership Must Own Decision Governance
Although EHS can help design and administer the framework, executive leadership must ultimately support and enforce it.
Decision rights determine how authority is distributed throughout the business. They influence capital allocation, operational priorities, accountability, and the resolution of competing interests. These are enterprise governance issues, not decisions that should be left entirely to a staff function.
Executives must establish clear expectations for operational risk ownership, technical independence, and escalation. They must also recognize that formal authority does not guarantee complete knowledge of the circumstances surrounding a decision.
The Mexico regulatory shutdown demonstrated how easily this distinction can be overlooked. Corporate executives had legitimate reasons to become directly involved, but the transfer of authority reduced the influence of the people who understood the local regulatory environment.
Good executive leadership requires knowing when to retain authority, when to delegate it, and how to preserve the expertise necessary to make sound decisions.
This discipline matters most when disagreements involve significant business consequences. The value of decision rights becomes apparent when a plant manager and EHS professional disagree about continuing operations, or when local leadership and corporate executives disagree about resolving a regulatory crisis.
The response to those disagreements reveals whether decision rights are genuinely embedded in the operating model or merely documented in a procedure.
Conclusion: Decision Rights Turn EHS Expectations into Organizational Capability
Strong EHS performance requires more than effective policies, competent professionals, and committed leadership. Organizations need a governance structure that explicitly assigns decision authority and aligns it with accountability and the expertise required to act effectively.
Without that structure, EHS performance can become overly dependent on informal relationships, organizational influence, and the judgment of individuals whose authority is poorly defined.
Clear decision rights allow organizations to resolve routine issues efficiently, preserve technical independence, strengthen operational ownership, and ensure significant risks receive appropriate executive scrutiny.
Effective governance does not mean placing every consequential decision in the hands of the highest-ranking leader. It means establishing the right balance between delegated authority, technical expertise, local knowledge, and enterprise oversight.
For EHS executives, this represents an important evolution in leadership. The objective is not to own every decision affecting safety, health, or the environment. It is to help build an organization capable of making sound decisions consistently, regardless of which individuals happen to be involved.
The ultimate measure of EHS leadership is not how many decisions the EHS function controls. It is how effectively the organization makes and executes decisions that manage risk—even when EHS is not in the room.
References and Further Reading
Bain & Company. (2011). Great decisions—Not a solo performance. Decision Insights, No. 10. https://www.bain.com/contentassets/cc22bf15ebfb467094fa88c8533742b3/decision_insights-10_great_decisions.pdf
Occupational Safety and Health Administration. (n.d.). Management leadership. U.S. Department of Labor. https://www.osha.gov/safety-management/management-leadership
Occupational Safety and Health Administration. (n.d.). Worker participation. U.S. Department of Labor. https://www.osha.gov/safety-management/worker-participation
Occupational Safety and Health Administration. (n.d.). Recommended practices for safety and health programs. U.S. Department of Labor. https://www.osha.gov/safety-management/
























