Information-Rich, Command-Poor: The Emerging Executive Risk in the Age of AI

An infographic illustrating the transition from available information to commanded information, leading to organizational influence. The left side shows various data visuals and graphs, the center depicts a professional engaging with tools and checklists, and the right portrays a business meeting with individuals discussing strategies against a backdrop of an industrial landscape.

Artificial intelligence is transforming executive access to information. But having the answer is not the same as understanding it, defending it, or using it to lead.

Artificial intelligence is rapidly eliminating one of the historical constraints on executive decision-making: access to information. Complex analyses that once required days of research, consultation, and preparation can increasingly be completed in minutes. An executive equipped with sophisticated AI tools or a personalized digital twin can examine operating performance, regulatory developments, industry research, organizational history, and strategic alternatives at a speed and scale previously unavailable to most leaders.

This represents an extraordinary advancement in professional capability. It also introduces an emerging leadership risk that receives considerably less attention than AI accuracy, hallucinations, or automation.

The amount of information available to an executive can now increase much faster than the executive’s ability to understand, internalize, challenge, and credibly command that information.

The result is what I call the Information-to-Command Gap.

An executive can arrive at a meeting with an exceptionally well-prepared, AI-assisted analysis and still be less prepared to lead the discussion than the quality of that analysis might suggest. The information may be accurate, the recommendations technically sound, and the presentation compelling. Yet the executive may lack sufficient personal command of the evidence, assumptions, competing interpretations, or business implications to respond effectively when challenged.

This is a leadership challenge involving the relationship between access to intelligence and the capacity to exercise judgment and influence. I have experienced it myself.

The Executive Meeting That Changed My Thinking

During an acquisition opportunity discussion in my current professional practice, I conducted extensive research to prepare for an important project review with our executive team. My preparation included conventional research methods, supplemented by substantial AI-assisted information identification and retrieval. The combination allowed me to explore a much larger body of information and examine the opportunity more comprehensively than would have been practical using traditional methods alone.

I entered the discussion feeling well prepared.

The executive review was effective. We had a productive conversation about the opportunity, and the research contributed meaningfully to the discussion. However, as the questions became more specific and the conversation moved deeper into certain issues, I began recognizing a gap between the information I had researched and my ability to recall and apply important details in the moment.

I knew I had encountered relevant information during my preparation. I could remember reviewing material that addressed the questions being raised, and I understood its significance at the time. Yet as the discussion became more probing, I could not always readily recall the specific details necessary to provide the depth of explanation I wanted.

The meeting was productive, and the underlying analysis was not necessarily wrong. Nevertheless, I left with the sense that I could have contributed considerably more if I had developed stronger personal command of the extensive research I had conducted.

That realization stayed with me. I had invested significant effort in gathering and analyzing information, but I had not been equally deliberate about preparing to retrieve, connect, and apply the most important elements under questioning.

The problem was not insufficient access to information. I had more information than I could have reasonably assembled through conventional methods alone. The problem was determining which portions I needed to internalize and how to develop the depth of understanding necessary to use them effectively.

That experience led me to begin developing a more intentional approach to maximizing information command. I became less concerned with simply expanding the research available to me and more focused on identifying the essential evidence, examining competing interpretations, and testing whether I could explain the conclusions without relying on the underlying research materials.

The lesson applies beyond AI. Professionals have always faced challenges absorbing large quantities of information. What is changing is the scale and speed at which AI can expand the material available for consideration, often far beyond what an executive has sufficient time to examine personally.

The value of executive preparation is not measured by how much information we have reviewed, but by how effectively we can use the right information when it matters.

Information Is Not Understanding, and Understanding Is Not Influence

For decades, executive advantage has depended partly on privileged access to information. Senior leaders typically had better access to analysts, technical experts, historical records, business intelligence, and professional networks. Their positions gave them visibility into information that others could not easily obtain.

Artificial intelligence is progressively changing that advantage. Information is becoming easier to retrieve, analyze, and synthesize, even as proprietary knowledge, specialized expertise, and organizational context remain important differentiators.

I believe executives increasingly need to distinguish three levels of information capability.

Information Available represents everything the executive can access through personal knowledge, organizational systems, professional networks, conventional research, and AI-enabled resources. This includes historical reports, operating data, regulatory requirements, technical research, industry comparisons, and potential recommendations. AI dramatically expands this layer.

Information Commanded is the portion of that information the executive has personally understood, interrogated, prioritized, and reconciled with experience. It has been transformed from an external information source into an informed professional perspective. The executive understands what the evidence establishes, where uncertainty remains, how competing explanations compare, and which conclusions can be defended.

Information Converted to Influence is where leadership creates organizational value. The executive uses that understanding to communicate clearly, respond to challenges, establish priorities, recommend decisions, build alignment, and move people toward effective action.

These three levels are related, but they are not interchangeable.

Information Available ≠ Information Commanded ≠ Organizational Influence

Infographic illustrating the transition from information to influence through AI, showing three stages: Information Available, Information Commanded, and Organizational Influence. Each stage includes specific insights and actions related to data analysis, personal understanding, and actionable recommendations.

Figure 1. From Information to Influence: The three levels of executive information capability.

The distinction does not imply that executives must memorize extensive technical details or personally reproduce every calculation. Effective leadership has always relied on specialists, analytical tools, and distributed expertise. Command involves knowing which information matters, understanding the essential reasoning, recognizing the boundaries of one’s expertise, and knowing when additional verification or technical judgment is necessary.

In fact, knowing what does not require personal command is increasingly important. The executive who attempts to absorb everything AI can produce will quickly encounter human cognitive limits. The executive who can distinguish essential understanding from supporting information may gain a substantial leadership advantage.

The Hidden Cost of Cognitive Offloading

The underlying issue has a connection to cognitive science known as cognitive offloading, the use of external resources to reduce the mental effort required to perform a task.

Humans have always used tools to extend cognitive capabilities. Written records reduce the need to remember details. Calculators perform computations. Databases store information, and search engines accelerate retrieval. These technologies allow people to devote attention to activities that may create greater value.

Research by Risko and Gilbert (2016) describes cognitive offloading as a normal feature of human thinking rather than an inherently undesirable behavior.

Generative AI introduces an important difference. Instead of simply storing information or performing predefined calculations, it can participate in activities traditionally considered higher-order cognitive work: synthesis, evaluation, comparison, reasoning, and the generation of arguments or recommendations.

This means executives can delegate not only the collection of evidence but also portions of the intellectual process through which they would ordinarily develop understanding.

The potential to extend human reasoning is among AI’s most valuable characteristics. The concern arises when reliance on AI-produced conclusions reduces the personal engagement necessary to develop independent judgment.

A 2026 study published in Frontiers in Psychology distinguishes between dependent and autonomous cognitive offloading. Dependent offloading involves delegating core thinking to AI, while autonomous offloading uses AI to support thinking while retaining personal cognitive agency. In a study involving 589 university students and early-career knowledge workers, the researchers found that these different patterns of engagement were associated with different perceived cognitive outcomes despite offering comparable immediate benefits (Zhu et al., 2026).

Related research involving 319 knowledge workers found that greater confidence in generative AI was associated with less self-reported critical-thinking effort, while greater confidence in one’s own abilities was associated with more critical engagement. The researchers also identified a shift in cognitive effort toward verification, integration, and oversight (Lee et al., 2025).

These studies do not establish that AI causes deterioration in executive judgment. Much of the research remains exploratory or observational, and the findings are not specific to senior executives. However, they reinforce the importance of examining how AI changes the cognitive activities involved in professional work.

In my experience, preparing a complex executive recommendation has traditionally required considerable time reading reports, examining supporting evidence, comparing interpretations, and constructing an argument. These activities are time-consuming, but they also create familiarity with the subject. The effort involved in developing the analysis contributes to the ability to explain and defend it.

AI can compress much of that process. The efficiency benefit is substantial, but some of the intellectual engagement that previously developed understanding can disappear along with the time required to complete the work.

The fastest route to an answer is not always the fastest route to understanding.

The practical challenge is deciding which cognitive activities should be delegated and which deserve deliberate personal attention. Repetitive research, information organization, and routine analysis are obvious opportunities for efficiency. Evaluating uncertain evidence, reconciling competing conclusions, and determining what an organization should do often require deeper engagement.

Some intellectual friction is unnecessary. Other friction is precisely what develops understanding.

Your Digital Twin Should Challenge You, Not Simply Agree With You

In my work with executive digital twins, I have become increasingly interested in using AI to challenge my own thinking rather than simply accelerate analysis.

A personalized digital twin can become extremely effective at understanding its user’s established perspectives. A system contextualized around an executive’s experience, preferences, professional history, and strategic priorities can generate recommendations that feel immediately familiar and credible.

That familiarity has enormous value, especially when applying accumulated professional experience to new challenges. It can also reinforce existing assumptions if the user does not deliberately request alternative viewpoints.

I now see intellectual challenge as an essential part of effective human-AI collaboration.

When developing a recommendation, I can ask the system to identify its weakest assumptions, construct a credible argument against my preferred conclusion, or explain what evidence would justify changing direction. Before an important executive discussion, I can use the digital twin to adopt the perspective of a skeptical CEO, board member, operations leader, or regulator.

The resulting conversation can be uncomfortable, particularly when the AI identifies a weakness in an argument I believed was well developed. But that is precisely where much of the value lies.

For example, an executive preparing to recommend a significant capital investment could ask AI to construct the strongest argument for delaying the expenditure, identify evidence that might favor another alternative, and explain which assumptions would be most difficult to defend under questioning.

This is a useful way to move from having a persuasive recommendation to having a recommendation that has survived meaningful intellectual challenge.

Research on cognitive ownership provides additional context. Su et al. (2026) examined associations between habitual AI dependency and concerns about whether AI-assisted work still felt intellectually attributable to the person producing it. The study measured perceived concerns among pre-service teachers rather than demonstrated deterioration in professional capability, but it raises an interesting question about maintaining ownership of one’s thinking.

For an executive, intellectual ownership is demonstrated through the ability to assess evidence, challenge assumptions, and defend conclusions.

A valuable digital twin should be capable of thinking with you, but it should also be capable of thinking against you.

The Executive Command Protocol: Turning Information into Leadership

My acquisition-review experience prompted me to think more deliberately about how to prepare for consequential executive discussions. I began developing an approach that takes advantage of AI’s analytical capacity while ensuring that the most important information becomes part of my own working understanding.

I call this the Executive Command Protocol.

The approach is built around four repeating phases that connect information gathering, personal understanding, leadership interaction, and subsequent learning.

A flowchart illustrating 'The Executive Command Protocol' which explains a leadership cycle involving AI expansion, human compression, human commands, and a final AI expansion for decision-making and accountability.

Figure 2. The Executive Command Protocol: AI Expands → Human Compresses → Human Commands → AI Expands Again.

Phase 1: AI Expands

The process begins by taking advantage of AI’s ability to expand the information environment.

The executive uses AI alongside conventional research to retrieve and organize relevant information, examine operating data, compare historical experience, identify potential patterns, explore alternative explanations, and anticipate stakeholder questions.

During this phase, I want the analysis to be broad enough to reveal issues that might otherwise be overlooked. This includes actively searching for contrary evidence rather than limiting research to material supporting an initial position.

Source verification remains important. AI-generated interpretations should be distinguished from documented facts, and the reliability of critical evidence must be established before it informs consequential decisions.

Phase 2: Human Compresses

This is the most important transition in the protocol and the area where my own experience revealed a need for greater discipline.

Once the research has expanded, the executive needs to determine which information deserves personal command. The goal is to build sufficient understanding to exercise judgment and participate effectively in the discussion, without attempting to memorize every fact uncovered during the research.

I organize this process around four questions:

What matters? Which facts, risks, assumptions, or uncertainties fundamentally affect the decision?

What do I believe? After considering the evidence and alternative interpretations, what is my professional conclusion?

What do I recommend? What course of action should be taken, and why is it preferable to the alternatives?

What am I prepared to defend? Can I explain the reasoning, evidence, tradeoffs, and uncertainties when challenged?

To make these questions practical, I separate the research into three categories.

Must Command includes the central conclusion, critical supporting evidence, material uncertainty, business implications, recommended decision, and strongest counterargument. These are issues I should be able to explain and defend without relying heavily on reference material.

Should Recognize includes supporting trends, secondary operating information, historical context, stakeholder perspectives, and related initiatives. I need to understand their relevance and recognize when they become important, but precise recall is less essential.

Available on Demand includes detailed statistics, extensive historical records, secondary calculations, technical references, and background information that can be reliably retrieved when needed.

This classification is particularly useful because an executive discussion rarely follows a perfectly predictable sequence. Details that initially seem secondary can become central when a participant raises a new issue. Good preparation therefore includes knowing where supporting evidence resides and how to retrieve it efficiently.

I have also begun thinking about information command as something that should be tested rather than assumed.

One practical approach is to prepare a short, decision-focused summary identifying the recommendation, essential evidence, assumptions, uncertainties, and strongest alternative. Each consequential claim should be traceable to its supporting source. The summary becomes a guide for developing understanding rather than another lengthy briefing to memorize.

The second step is to use AI to challenge that understanding. Have the digital twin ask progressively more detailed questions, beginning with the business implications and moving into the supporting evidence. Ask it to introduce competing interpretations and challenge conclusions that rely on uncertain assumptions.

Then rehearse explaining the recommendation without the briefing in front of you. When an answer requires specific evidence that cannot be recalled, return to the relevant material, examine it, and determine whether it belongs in the Must Command category or can reasonably remain available for retrieval.

This method combines the efficiency of AI-assisted research with deliberate cognitive engagement. It helps distinguish information that feels familiar because I have read it from information I understand well enough to use.

Phase 3: Human Commands

During the leadership interaction, preparation becomes visible through the executive’s ability to listen, evaluate new information, explain tradeoffs, respond to challenges, and adapt recommendations as the discussion evolves.

The AI may remain available as a reference or analytical resource. There is nothing inherently deficient about consulting supporting information or acknowledging that a particular detail requires verification.

Strong information command allows the executive to recognize when additional information is necessary without losing sight of the central issue.

This matters because executive discussions often move quickly between strategic considerations, operational consequences, financial implications, and technical details. A leader needs sufficient command to maintain the integrity of the recommendation while responding constructively to different perspectives.

Phase 4: AI Expands Again

After the discussion, AI can help capture decisions, identify follow-up actions, organize new information, and preserve lessons for future work.

The questions raised during the meeting also become useful evidence about the quality of preparation. Were there recurring gaps in understanding? Did a competing explanation emerge that had not been adequately examined? Did the discussion reveal information that should have been classified as essential?

These observations can improve the next cycle of research and preparation.

Where confidential business information is involved, including potential acquisitions, AI use must remain within authorized systems and established information-security requirements.

AI Expands → Human Compresses → Human Commands → AI Expands Again

The protocol is intended to improve professional capability and leadership effectiveness. Its ultimate value should be measured through better-informed decisions, stronger executive discussions, and improved organizational outcomes.

Developing Information Command Across the Executive Team

Although I began developing this approach in response to my own experience, its potential extends beyond individual preparation. Executive teams regularly make consequential decisions based on information assembled by different functions, advisors, and analytical systems. Each participant may have substantial expertise in their own discipline while possessing only a partial understanding of the broader decision.

The Executive Command Protocol can provide a common preparation discipline for leadership teams. Before a major investment, acquisition, or operational review, participants can agree on the essential evidence, material assumptions, principal uncertainties, and decisions requiring resolution. AI can help identify gaps and generate competing interpretations, while structured discussions allow leaders to challenge one another’s reasoning and establish a shared understanding of the issues.

This also creates an opportunity for leadership development. Rather than evaluating managers primarily on the quality of their presentations, senior executives can develop their teams by probing how recommendations were formed, asking what evidence could change their conclusions, and examining how decisions performed against expectations. Reviewing the questions that exposed gaps in understanding can improve future preparation and reinforce independent judgment.

The objective is not for every executive to command every technical detail. It is to ensure that the leadership team collectively possesses the understanding necessary to make sound decisions, knows where specialized expertise is required, and can explain the reasoning behind its recommendations.

Used consistently, this discipline could make AI-supported preparation part of developing stronger executive judgment across the organization.

From Human in the Loop to Human in Command

The broader discussion of responsible artificial intelligence has long emphasized human oversight. The European Commission’s High-Level Expert Group on Artificial Intelligence identified human-in-the-loop, human-on-the-loop, and human-in-command approaches in its 2019 Ethics Guidelines for Trustworthy AI.

In that established governance context, Human in Command refers to meaningful human oversight of AI systems, including authority over their use, discretion, and ability to override decisions.

I believe the concept has an important additional application to executive leadership: maintaining personal command of the information and reasoning that AI systems help produce.

A leader can participate in an AI-assisted decision process without fully understanding its conclusions. Reviewing or approving a recommendation does not necessarily demonstrate independent judgment. Effective executive command requires sufficient understanding to question the analysis, recognize uncertainty, and take responsibility for the recommendation.

The distinction becomes particularly important as digital twins move beyond information retrieval into increasingly sophisticated analysis, decision support, and potentially autonomous actions.

For executives, my preferred formulation is straightforward:

AI proposes. I evaluate. I decide. I own the outcome.

This does not mean the executive must personally possess every technical skill represented in the analysis. It means that delegating analytical work to AI does not transfer the leadership responsibility to exercise appropriate judgment.

Why This Matters for EHS and Operational Integrity

The consequences of inadequate information command can be particularly significant in environmental, health, safety, and operational integrity functions. Decisions frequently involve serious hazards, regulatory obligations, capital investments, process controls, emergency preparedness, and potentially irreversible consequences.

Consider an EHS professional presenting an AI-generated risk assessment recommending a substantial investment in engineered safeguards.

The analysis may identify a high-consequence scenario and develop a compelling business case. Yet an operations executive might reasonably ask whether the probability assumptions are credible, whether existing safeguards were properly evaluated, or whether another intervention could provide comparable risk reduction with less operational disruption.

The professional needs to understand the underlying hazard, potential consequences, safeguards, exposure scenarios, and uncertainties. The recommendation must also account for the real operating environment in which the controls will be implemented.

This is closely related to a familiar EHS distinction: the availability of a control does not establish its effectiveness.

A written procedure can exist without being followed. Training can be completed without producing competence. A safeguard can be installed without performing reliably under actual operating conditions.

Similarly, an organization can possess an excellent AI-generated risk assessment without having developed the professional understanding necessary to implement and sustain effective controls.

EHS professionals recognize the importance of verifying whether critical controls actually work. We should apply similar discipline to AI-supported professional judgment by testing whether those presenting recommendations can explain the assumptions, identify material uncertainty, and connect the analysis to the operational conditions being evaluated.

I expect AI to significantly improve our ability to identify patterns, examine complex operating conditions, and recognize emerging risks. Realizing those benefits will require professionals who understand both the capabilities and the limitations of the technology.

The greater the analytical sophistication, the more important that understanding becomes.

The New Executive Differentiator

The implications extend well beyond EHS.

Across finance, operations, engineering, sustainability, supply chain, legal affairs, and enterprise risk management, AI is changing the economics of knowledge work. Information that was historically difficult or expensive to obtain can increasingly be made available with relatively little effort.

An executive who can produce a comprehensive strategic analysis in minutes may no longer possess an unusual advantage if other executives have access to similar capabilities. Greater value may come from interpreting that analysis, recognizing where the evidence is weak, understanding the organizational context, and exercising judgment when the appropriate course of action is uncertain.

Consider the commercial implications in a potential acquisition. Research may uncover extensive information about operating performance, regulatory obligations, environmental liabilities, capital requirements, and integration challenges. However, creating business value depends on distinguishing which findings are material to the investment thesis and understanding how they could affect valuation assumptions, transaction terms, future capital commitments, or post-acquisition integration priorities.

An executive who commands those relationships can help the leadership team recognize risks that might otherwise be underestimated, challenge assumptions behind projected returns, and identify opportunities that may not be apparent from the information alone. The same principle applies to major capital projects, market-entry decisions, restructuring, and other strategic investments. The ability to convert information into sound judgment has direct implications for enterprise value creation.

This introduces an interesting organizational performance concern.

Companies can become dramatically more efficient at generating reports, analyses, presentations, and recommendations without necessarily improving the capabilities of the people responsible for interpreting and acting upon them.

If organizations measure AI adoption primarily through time savings and output volume, they may overlook whether professional understanding, independent reasoning, and decision quality are also improving.

There is an opportunity to approach AI implementation differently. Organizations can deliberately design AI-supported workflows to strengthen professional competence, incorporate intellectual challenge, improve knowledge retention, and develop better decision-making skills.

The executive digital twin is particularly promising in this respect. It can preserve accumulated experience, introduce alternative perspectives, connect current problems to historical decisions, and provide realistic opportunities to test professional reasoning.

My own experience has made me more conscious of the need to develop both sides of this capability. I want my digital twin to become increasingly effective at helping me research, analyze, and challenge complex issues. At the same time, I want to become more effective at identifying what I personally need to command and developing the understanding necessary to use that information.

The opportunity is to make technology and human capability advance together.

The Executive Command Test

Before an important executive discussion, I have come to value a simple test: temporarily put the AI-generated materials aside and determine whether I can explain the issue without them.

Can I identify the evidence supporting my conclusion and distinguish what is established from what remains uncertain? Do I understand the strongest competing explanation? Can I describe what would cause me to change my position? Can I explain the recommended action, its business implications, and the principal risks?

The test becomes more valuable when another person—or an AI acting as a skeptical stakeholder—asks follow-up questions that were not anticipated during preparation.

It is not a memory examination. Executives should continue relying on technical specialists, reliable reference materials, and appropriate analytical tools. The purpose is to determine whether the essential reasoning has become part of their professional understanding.

When the answers reveal gaps, additional preparation can be targeted rather than simply expanding the research again.

This is especially important because sophisticated AI-generated material can create a misleading sense of preparation. A clear, comprehensive briefing may make an issue feel familiar even when the underlying evidence and reasoning have not been sufficiently internalized.

Recognizing that difference before entering the meeting is far preferable to discovering it under questioning.

Putting the Executive Command Protocol into Practice

To help professionals apply this approach, I developed the Executive Information Command Drill, a reusable AI prompt designed to turn completed research into demonstrated executive readiness. Rather than generating another summary or presentation, the tool challenges users to identify what they must personally command, defend their conclusions against increasingly difficult questions, and recognize gaps in their understanding before entering an important discussion.

The drill follows the Executive Command Protocol and can be applied to strategic planning, acquisition reviews, capital investment proposals, operational risk assessments, and other consequential decisions.

[Access the Executive Information Command Drill — AI Prompt]

In an Information-Rich World, Command Becomes the Scarce Resource

Artificial intelligence and executive digital twins offer professionals an unprecedented opportunity to extend their capabilities. They can bring decades of accumulated knowledge into current decisions, identify relationships across large bodies of information, challenge assumptions, and help leaders prepare for complex issues with greater breadth and depth.

I believe these technologies will become indispensable to effective executive leadership. Their value should be measured through the quality of the decisions and actions they enable, not simply the volume of work they produce.

My acquisition-review experience revealed a gap in my own approach to preparation. I had conducted extensive research and participated in a productive executive discussion, yet I recognized afterward that I could have contributed more. There was important information I had encountered but could not readily bring into the conversation when more detailed questions arose.

The experience changed how I approach AI-assisted preparation. I now place greater emphasis on deciding what I need to command, examining the evidence behind important conclusions, and testing my understanding before consequential discussions.

The lesson is becoming more relevant as AI continues to advance. Executives will have access to increasingly sophisticated analysis and recommendations, but that access will not eliminate the need for personal judgment, intellectual discipline, or leadership capability.

I remain highly optimistic about what artificial intelligence will enable. The opportunity to extend professional knowledge and improve executive decision-making is extraordinary. Realizing that opportunity requires us to become as deliberate about developing human understanding as we are about expanding technological capability.

Let AI expand what you can know. Be deliberate about what you must understand. Use the technology to challenge and strengthen your judgment, and develop the command necessary to apply that knowledge when it matters most.

In an information-rich world, command becomes the scarce resource.


References

High-Level Expert Group on Artificial Intelligence. (2019). Ethics guidelines for trustworthy AI. European Commission. https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai

Lee, H.-P., Sarkar, A., Tankelevitch, L., Drosos, I., Rintel, S., Banks, R., & Wilson, N. (2025). The impact of generative AI on critical thinking: Self-reported reductions in cognitive effort and confidence effects from a survey of knowledge workers. Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, Article 1121, 1–22. https://doi.org/10.1145/3706598.3713778

Risko, E. F., & Gilbert, S. J. (2016). Cognitive offloading. Trends in Cognitive Sciences, 20(9), 676–688. https://doi.org/10.1016/j.tics.2016.07.002

Su, J., Wang, Z., Qiang, Z., & Wang, Z. (2026). Is it mine or not mine? Cognitive offloading to generative AI and concern over the erosion of cognitive ownership. Journal of Intelligence, 14(8), Article 182. https://doi.org/10.3390/jintelligence14080182

Zhu, Q., Li, X., Dong, Y., Chang, P., & Fan, M. (2026). Not all cognitive offloading is equal: Distinguishing dependent and autonomous offloading to generative AI. Frontiers in Psychology, 17, Article 1878629. https://doi.org/10.3389/fpsyg.2026.1878629

Concept Elements Poster

Infographic titled 'Information-Rich, Command-Poor: The Emerging Executive Risk in the Age of AI' discussing the impact of AI on executive decision-making.
Posted in Leadership, Business Accumen, Career Skills, Artificial Intelligence, AI, Digital Twin, Leading at Scale | Tagged , , , , , , , , , , , , , , , | Leave a comment

Executive Information Command Drill

From Information Available to Information Commanded

About the Executive Information Command Drill

The Executive Information Command Drill is a reusable AI prompt designed to help professionals move beyond gathering and analyzing information to developing the personal command necessary for effective executive discussions. Based on the Executive Command Protocol, the drill uses AI as both a preparation coach and a challenging executive examiner. After completing a research session, users can run the prompt to identify the information they must personally understand, distinguish essential evidence from supporting details, and test their ability to explain and defend conclusions under increasingly difficult questioning. The interactive process identifies gaps in understanding, challenges assumptions, and helps strengthen decision-making readiness. Its purpose is not to generate another polished briefing, but to ensure professionals can confidently apply their research, exercise independent judgment, and influence consequential organizational decisions.

Below is the prompt you can use in your AI chat screen to use AI to also help you command the information it shares with you

Executive Information Command Drill Prompt

Your role

Act as my Executive Information Command Coach and a rigorous, constructive executive examiner.

I have completed a substantial research session using conventional sources, AI-assisted research, analysis, and supporting documents. I am preparing to use that information in an important executive meeting.

Your objective is to help me develop sufficient personal command of the essential information to explain my conclusions, respond to difficult questions, evaluate alternatives, and influence decisions.

Do not simply summarize my research or generate talking points. Help me demonstrate that I understand and can defend the material.

Use the research, documents, analyses, and discussion history available in this session. Do not invent facts, sources, or conclusions. Distinguish verified evidence from inference, assumptions, and unresolved questions. If important research materials are unavailable in your context, identify those limitations.

Tailor your approach to the actual meeting, decision, participants, and research. If these are already established in the conversation, do not ask me to repeat them.


PHASE 1 — HUMAN COMPRESSES: Identify What I Must Command

Review the research and organize its findings into three categories.

Tier 1: MUST COMMAND

Identify the 5–7 most consequential issues I personally need to understand and defend during the executive discussion.

For each issue, provide:

  • The central finding or conclusion.
  • Why it matters to the organization or decision.
  • The strongest supporting evidence and its source.
  • Critical assumptions, uncertainties, and limitations.
  • The most credible competing explanation or objection.
  • The business, operational, financial, regulatory, or strategic consequences.
  • What information or developments could change the conclusion.

Prioritize materiality, decision relevance, and potential consequences rather than simply the volume of available information.

Tier 2: SHOULD RECOGNIZE

Identify important secondary information I should recognize and understand contextually, even if precise recall is unnecessary.

Explain when each item could become material to the discussion.

Tier 3: AVAILABLE ON DEMAND

Identify detailed statistics, historical records, technical references, and other supporting information that can reasonably remain accessible for retrieval.

Indicate where the information can be found, when those sources are available.

Do not confuse information that must be understood with details that merely need to be accessible.

PHASE 2 — DEVELOP MY EXECUTIVE POSITION

Help me personally establish clear answers to four questions:

  1. What matters? What are the few findings or risks that fundamentally affect the decision?
  2. What do I believe? What conclusion is best supported by the available evidence?
  3. What do I recommend? What specific action or decision should I advocate, and why?
  4. What am I prepared to defend? Which conclusions can I credibly explain under challenge, and where are my remaining knowledge gaps?

Propose an initial decision position based on the research, clearly identifying any assumptions.

Then require me to articulate my own position before proceeding. Do not assume your proposed conclusion is the one I should adopt.

Help me distinguish among facts, professional judgment, recommendations, and risk acceptance decisions.

Produce a concise Executive Command Brief, preferably one page, containing the essential issues, decision, evidence, tradeoffs, and principal uncertainty.

This brief should facilitate understanding rather than substitute for it.

PHASE 3 — HUMAN COMMANDS: Conduct the Executive Challenge

Now switch from research assistant to skeptical executive examiner.

Simulate a realistic meeting involving the relevant executive stakeholders, such as a CEO, COO, CFO, business-unit leader, board member, technical expert, or regulator.

Use the perspectives most relevant to my actual meeting.

Ask me one question at a time and wait for my answer.

Challenge me progressively across four levels.

Level 1 — Fundamental Understanding

Determine whether I can explain the issue, its significance, and the central conclusions in clear business language.

Level 2 — Evidence and Reasoning

Probe the specific evidence, source reliability, assumptions, competing interpretations, calculations, and uncertainty underlying my conclusions.

Level 3 — Decisions and Tradeoffs

Challenge my priorities, recommendations, resource requirements, risk acceptance, financial implications, operational consequences, and alternative courses of action.

Level 4 — Executive Pressure Test

Introduce unexpected questions, skeptical objections, changing assumptions, conflicting priorities, and scenarios that may require me to reconsider my position.

Ask the kinds of questions a well-prepared executive might use to determine whether I genuinely understand the issue.

Do not ask generic questions when the research supports more specific challenges.

After each answer

Evaluate my response against the available evidence.

Identify:

  • What I demonstrated that I understand.
  • What important evidence or reasoning I omitted.
  • Whether I confused facts with assumptions.
  • Whether my answer addressed the actual question.
  • Where I need stronger command.

Score my response from 1 to 5:

1 — Limited: Unable to explain the issue or defend the conclusion.

2 — Developing: Understands the general issue but lacks important supporting detail.

3 — Functional: Explains the essential issue and recommendation but has material weaknesses under challenge.

4 — Strong: Demonstrates sound evidence-based understanding, recognizes uncertainty, and responds credibly.

5 — Executive Command: Integrates evidence, business consequences, uncertainty, alternatives, and judgment into a compelling, defensible response.

Briefly explain the score.

If my answer is incomplete, challenge me with a follow-up question before showing me a stronger answer. Do not reward confident delivery when the underlying reasoning is weak.

If the available evidence does not support my answer, say so explicitly.

Do not automatically agree with me.

Continue for at least 10 substantive questions, adapting their difficulty and focus to my responses. Concentrate on issues that could materially affect the executive decision.

PHASE 4 — CLOSE THE COMMAND GAPS

After completing the questioning, produce an Executive Command Readiness Assessment.

Include:

1. Demonstrated strengths

Identify the issues I can credibly command, supported by my actual responses.

2. Command gaps

Identify essential issues where I struggled with recall, evidence, assumptions, reasoning, or decisions.

3. Targeted research review

Specify which original sources, documents, calculations, or findings I should revisit. Do not recommend more research merely to expand the amount of information available.

4. Most dangerous unanswered questions

Identify the three executive questions most likely to expose weaknesses in my current preparation.

5. Priority improvement actions

Recommend a focused preparation sequence addressing the most consequential gaps.

6. Overall command readiness

Assess whether I am:

  • Not yet prepared
  • Partially prepared
  • Prepared with qualifications
  • Strongly prepared
  • Ready to command the discussion

Base this assessment on demonstrated performance, not the apparent quality of the research or my confidence.

FINAL STEP — THE NO-NOTES COMMAND TEST

After I have addressed the identified gaps, conduct a final five-question examination.

Do not provide suggested answers before I respond.

Require me to explain:

  1. What matters most and why.
  2. The strongest evidence supporting my conclusion.
  3. The most credible challenge to my position.
  4. The decision I recommend and its consequences.
  5. What could make my recommendation wrong.

Assess my answers against the original evidence and report any remaining critical weaknesses.

Conclude with a concise final Executive Command Card containing:

  • Central conclusion
  • Three essential supporting findings
  • Principal uncertainty
  • Strongest competing argument
  • Recommended decision
  • Critical business consequence
  • One question I must be prepared to answer

Operating principle:

AI expands what I can know. I determine what I must understand. You help me test that understanding. I retain responsibility for the judgment, recommendation, and outcome.

Begin with Phase 1 using the research available in this conversation.

The Thinking Behind the Executive Information Command Drill

The Executive Information Command Drill is a practical companion to my LeadingEHS article, Information-Rich, Command-Poor: The Emerging Executive Risk in the Age of AI.

In that article, I examine a leadership challenge I encountered firsthand: having access to extensive research and sophisticated AI-assisted analysis without always having sufficient personal command of the information to contribute the depth of understanding I wanted during an executive discussion.

That experience led me to develop the Executive Command Protocol, a four-phase approach to converting information into understanding, judgment, and organizational influence:

AI Expands → Human Compresses → Human Commands → AI Expands Again

The Executive Information Command Drill puts this framework into practice, helping professionals identify what they must understand, challenge their assumptions, test their reasoning, and strengthen their ability to defend consequential recommendations.

Read the original LeadingEHS article: Information-Rich, Command-Poor

Posted in Uncategorized | Tagged , , , , | 1 Comment

Why Decision Rights Are Critical for EHS Success

A diverse group of professionals reviewing data on a digital screen in an industrial setting, with oil refineries in the background and workers in safety gear.

Aligning authority, accountability, and expertise to improve risk management and business performance.

By Chet Brandon, CSP, CHMM | LeadingEHS.com

Organizations invest considerable resources in environmental, health, and safety (EHS) programs. They establish policies, implement management systems, conduct audits, introduce technology, and hire qualified professionals to manage risk. Despite these investments, many still struggle to consistently translate EHS expectations into effective operational decisions.

The problem is not always a lack of commitment, technical expertise, or resources. Sometimes, the organization has simply failed to establish who has the authority to make critical decisions.

An EHS professional may identify a significant risk but lack the authority to require corrective action. A plant manager may be accountable for safety performance but believe the corporate EHS function owns the decisions necessary to achieve it. A corporate EHS leader may establish standards that operating managers treat as recommendations rather than requirements. Meanwhile, capital investments, operational changes, and risk acceptance decisions move through approval processes that are poorly understood or inconsistently applied.

These are more than communication problems. They are weaknesses in organizational governance that can affect regulatory compliance, operational effectiveness, employee confidence, and business performance.

Decision rights are among the most important—and frequently overlooked—elements of an effective EHS operating model.

What Are Decision Rights?

Decision rights establish who has the authority to make specific decisions, the conditions under which that authority may be exercised, and when consultation, approval, or escalation is required.

They answer questions every organization should be able to resolve without confusion: Who makes the decision? Who provides the technical expertise? Who must approve it? Who implements it? And what happens when the individuals involved disagree?

These questions become particularly important in EHS because decisions routinely cross organizational boundaries. Operations, engineering, maintenance, legal, finance, human resources, and EHS may all have legitimate responsibilities within the same issue. Participation in a decision, however, does not necessarily convey the authority to make it.

Four concepts are fundamental to understanding decision rights.

Responsibility describes the work assigned to a person or function. An EHS professional may be responsible for evaluating risks, interpreting technical requirements, or recommending corrective actions.

Authority defines what that person can decide, approve, require, or stop. Technical responsibility does not automatically convey authority over operating resources or business decisions.

Accountability establishes who ultimately answers for the decision and its consequences. Accountability should be supported by sufficient authority to influence the outcome.

Decision competence encompasses the technical expertise, operational knowledge, regulatory understanding, and organizational context necessary to make an informed decision. A person may have formal authority without possessing all the knowledge needed to exercise it effectively.

Consider a significant machine-guarding deficiency identified during an EHS inspection. The EHS professional evaluates the hazard and determines applicable requirements. Engineering or maintenance develops an appropriate technical solution. Operations owns the equipment and the resources needed to implement the correction.

But who can prohibit continued operation? Who can authorize temporary protective measures? Who determines when the equipment can safely return to service? And who resolves a disagreement when production priorities conflict with technical recommendations?

A well-designed decision-rights framework establishes those answers before the conflict occurs.

Why Decision Rights Matter

Aligning Authority with Accountability

One of the most common weaknesses in organizational design occurs when individuals are held accountable for outcomes over which they have limited control.

EHS leaders may be evaluated on injury rates, regulatory compliance, audit results, and management system effectiveness while operating managers control equipment, staffing, production schedules, maintenance priorities, and capital expenditures.

There is nothing inherently wrong with this division of responsibilities. Effective EHS governance generally depends on operations owning operational risks. The problem arises when the authority needed to fulfill those responsibilities is not clearly defined.

EHS professionals need the authority to establish technical requirements within their delegated scope, challenge unacceptable practices, initiate or require escalation, and exercise stop-work authority when necessary. Operations must remain accountable for controlling the risks associated with its activities and implementing corrective actions.

EHS should not manage operations, nor should operations be free to disregard EHS requirements. Both functions need clearly established authority, and executive leadership must resolve conflicts when those responsibilities intersect.

Improving Decision Speed and Quality

Unclear decision rights often produce two undesirable outcomes. Decisions are delayed because everyone believes someone else must approve them, or decisions are made without involving the people who best understand their consequences.

A maintenance supervisor may wait for corporate approval to address an urgent condition that should be resolved locally. Conversely, a site manager may authorize a process modification without realizing that it requires engineering review, management of change, or environmental permitting evaluation.

Both situations reveal weaknesses in the decision-making process.

Routine decisions should generally be made close to the work, provided the individuals involved have sufficient competence, information, and authority. Decisions involving serious consequences, regulatory exposure, or enterprise-wide implications may require additional technical review or executive approval.

The objective is to move decisions to the lowest competent level with the appropriate authority—not automatically to the lowest organizational level.

This approach preserves operational responsiveness while maintaining appropriate risk controls.

Preventing Inappropriate Risk Acceptance

Risk acceptance is one of the most consequential decisions an organization makes, yet the authority to accept risk is often poorly defined.

Consider a facility operating with a degraded engineering control. Site management believes temporary administrative measures provide sufficient protection. EHS disagrees, and engineering recommends a capital improvement that will take several months to implement.

Who can authorize continued operation?

The answer should depend on the significance of the risk, the effectiveness of interim safeguards, legal requirements, and the organization’s established risk tolerances.

Not every risk can be accepted. A manager cannot legitimately authorize continued operation in violation of a non-waivable legal requirement or mandatory safety condition simply because stopping production would be expensive.

Decision rights should distinguish risk evaluation from risk acceptance, temporary operating authorization, and the approval of corrective actions. They should also establish when decisions require independent review outside the affected operating unit.

This independence is particularly important when production pressures could influence risk judgments.

Enabling EHS Programs to Scale

Decision-making becomes more complicated as organizations expand across facilities, businesses, and countries.

Corporate EHS establishes global expectations. Regional professionals interpret regulatory requirements and support implementation. Site leadership manages daily operations and controls local risks.

Without clear authority, corporate standards may be applied inconsistently, routine decisions may become trapped in excessive approval processes, and significant risks may be treated differently across the organization.

An effective operating model defines what must be standardized and where local flexibility is appropriate.

Corporate leadership may own enterprise EHS standards and minimum performance expectations. Regional teams provide specialized regulatory and operational expertise. Site leaders remain accountable for implementation and local risk management.

The challenge becomes particularly significant in multinational organizations. People authorized to make decisions may be thousands of miles from those who best understand the problem.

That separation becomes dangerous when local expertise is excluded from the decision.

When Corporate Control Becomes a Liability: A Lesson from Mexico

During my career in the industrial materials industry, I encountered a situation that demonstrated how transferring decision rights during a crisis can make an already difficult problem worse.

A manufacturing facility in Mexico had come under significant environmental regulatory scrutiny because of its proximity to surrounding businesses and residential communities. Concerns from the community and pressure from municipal government contributed to the environmental regulator issuing an order requiring the facility to cease operations.

The company recognized the seriousness of the situation and transferred decision-making authority from local leadership to corporate executive management, legal, and EHS.

The reasoning was understandable. The organization faced regulatory exposure, significant business interruption, and potential reputational consequences. Corporate leadership wanted direct control over the response and the decisions required to restart operations.

However, this shift in authority created an unintended problem.

Corporate decision-makers approached the regulatory situation largely through the lens of U.S. legal and regulatory practices. The response reflected assumptions about how enforcement agencies operate, how regulatory disputes are resolved, and what actions would be necessary to demonstrate compliance.

Those assumptions did not adequately reflect the expectations of the Mexican regulator.

Local leadership possessed a better understanding of the regulatory environment, the expectations of government officials, and the practical considerations involved in resolving the matter. But with decision authority transferred to corporate management, that expertise did not have sufficient influence over the response strategy.

The result was a prolonged delay in restarting operations.

Looking back on this experience, the problem was not the decision to involve corporate leadership. The regulatory situation was serious enough to justify that involvement. The mistake was assuming that corporate authority, supported by U.S. legal and regulatory experience, would produce a better outcome than a response shaped by people who understood the local regulatory environment.

Authority had been centralized, but the expertise needed to resolve the problem had not been adequately incorporated into the process.

A better governance arrangement would have preserved executive oversight of the company’s regulatory and business risks while assigning meaningful responsibility to local leadership for developing the regulatory response and engaging with government authorities. Corporate EHS and legal functions could have provided strategic support, independent review, and approval of decisions exceeding established risk thresholds.

The broader lesson extends well beyond regulatory enforcement. Similar problems can occur during significant incidents, capital projects, acquisitions, operational changes, and other situations where corporate leaders become deeply involved in local operations.

Decision authority and decision expertise are not always located at the same organizational level.

Organizations need to assign authority based on the nature of the decision, the expertise required, and the consequences of getting it wrong. Senior leaders should maintain appropriate oversight without unnecessarily displacing the people closest to the problem.

Decision Rights Versus a Traditional RACI Matrix

Many organizations use RACI matrices to define responsibilities. RACI identifies who is Responsible, Accountable, Consulted, and Informed for a particular activity.

These matrices are useful for managing processes and projects, but process responsibility is not necessarily the same as decision authority.

A RACI matrix might identify a plant manager as accountable for corrective actions and an EHS manager as responsible for evaluating the associated risks. It may not explicitly identify who can authorize continued operation, approve a temporary exception, or resolve a disagreement between operations and technical experts.

Decision-rights models address these distinctions more directly.

Bain & Company’s RAPID framework, for example, identifies five decision roles: Recommend, Agree, Perform, Input, and Decide. It emphasizes clarifying final authority and the contribution of other participants to the decision.

For EHS governance, I recommend a modified approach that explicitly recognizes technical review, implementation, and escalation.

RoleDecision Function
D — DecideHolds final authority within defined limits
R — RecommendDevelops and presents the proposed decision
C — ConsultProvides required technical, operational, legal, or regulatory input
X — ExecuteImplements the authorized decision
E — EscalateReceives decisions exceeding delegated authority or requiring independent resolution

This is a proposed EHS-specific decision-role model, not a reproduction of Bain’s RAPID framework. It must be supported by separately defined requirements for mandatory technical concurrence, legal approval, stop-work authority, and risk acceptance limits.

The purpose is to make authority visible and enforceable without creating another administrative process that delays decisions.

The EHS Decision Rights Matrix

The following matrix provides an illustrative framework for assigning decision rights within a multi-site industrial organization.

It reflects an operating model where operations owns operational risk, EHS provides technical expertise and governance, and executives retain oversight of enterprise-level decisions.

Critical DecisionDecision Authority (D)Technical Lead / Recommendation (R)Implementation (X)
Enterprise EHS strategy and risk appetiteCEO / Executive LeadershipGlobal EHS LeaderBusiness Unit Leaders
Corporate EHS technical standardsGlobal EHS LeaderCorporate EHS SpecialistsRegional / Site Leaders
Site EHS implementation plansSite ManagerSite EHS LeaderOperations / Site Functions
Routine hazard correctionArea Operations ManagerSupervisor / EHSOperations / Maintenance
Immediate stop-work for unsafe conditionsAny employee or contractorNot requiredAffected Work Team
Restart following a critical safety stopDesignated Operations LeaderEHS / EngineeringOperations
Temporary operation with degraded safeguardsAuthorized Senior Operations LeaderEHS / EngineeringOperations
Significant residual risk acceptanceDesignated Executive Risk AuthorityOperations / EHSSite Leadership
Management of Change approvalDesignated MOC AuthorityEngineering / EHS / Process SafetyOperations / Project Team
Return to service after significant modificationDesignated Operating AuthorityEngineering / EHSOperations
Significant incident investigation findingsInvestigation Governance AuthorityInvestigation LeaderCorrective Action Owners
Significant corrective-action selectionAccountable Operations LeaderInvestigation Team / EHSOperations / Engineering
EHS capital investment prioritizationCapital Committee / ExecutiveOperations / EHS / EngineeringProject Team
Regulatory interpretations and compliance positionsDelegated Regulatory AuthorityRegulatory / Legal / Local ExpertsAffected Business Functions
Regulatory notifications and submissionsAuthorized Regulatory / Site RepresentativeEHS / Legal / RegulatoryDesignated Filing Owner
Significant regulatory enforcement responseDesignated Executive Risk AuthorityLocal Regulatory / EHS / LegalLocal Regulatory / Site Team
Regulatory-mandated shutdown strategyDesignated Corporate ExecutiveLocal Management / Regulatory / EHS / LegalLocal Leadership with Corporate Support
Regulatory engagement and resolutionDelegated Local Regulatory AuthorityLocal EHS / Legal / Technical ExpertsLocal Regulatory / Site Team
Restart following regulatory shutdownAuthorized Operating Executive, subject to regulator approvalLocal Regulatory / EHS / Legal / EngineeringSite Leadership
Corporate EHS audits and conclusionsCorporate EHS Audit AuthorityEHS Audit TeamAudit / EHS Function
Significant audit finding closureDesignated Verification AuthorityEHS / EngineeringCorrective Action Owner
Exceptions from corporate EHS standardsAuthorized Corporate Standard OwnerSite Leadership / EHSAffected Site
EHS technology and data standardsEnterprise System OwnerEHS / IT / OperationsDigital / IT Teams

This matrix should be adapted to the organization’s operating structure, legal obligations, risk profile, and delegated authorities. Each decision requires one clearly identified final decision-maker, even when the illustrative table identifies a committee or organizational function. Mandatory technical concurrence and escalation requirements should be documented in supporting procedures.

Importantly, corporate approval cannot replace authorization required from a regulatory agency, nor can internal management discretion override legal obligations or mandatory safety controls.

Essential Safeguards

The matrix becomes effective only when the organization establishes clear boundaries for exercising authority.

Technical concurrence: Certain decisions require approval or formal concurrence from engineering, EHS, process safety, industrial hygiene, environmental, or legal specialists. General operating authority does not eliminate these requirements.

Risk acceptance: Only specifically authorized leaders should accept residual risks, and only within established limits. Non-waivable legal violations and prohibited operating conditions cannot be accepted through an internal approval process.

Stop-work and restart: Employees and contractors should be empowered to initiate a safe stop when they reasonably believe conditions are unsafe. Restart authority should be more restricted and require verification that applicable controls are effective.

Escalation: Decisions exceeding delegated authority should move through defined channels. Significant unresolved technical disagreements should receive independent review.

Local expertise: Decisions elevated to corporate leadership should preserve meaningful participation by the people with the relevant operational, regulatory, and cultural knowledge.

Put the Decision Rights Framework to Work

Understanding decision rights is only the first step. Organizations also need to evaluate whether their current decision-making authority is clearly established, consistently applied, and supported by the appropriate expertise.

To help EHS leaders conduct this evaluation, I developed the LeadingEHS Decision Rights Assessment Tool, an Excel-based resource containing 23 critical EHS decision categories, an assessment register, governance gap scoring, and an executive dashboard.

The tool can help identify gaps between assigned authority and actual practice, evaluate escalation requirements, and prioritize improvements to the organization’s EHS governance model.

[Download the LeadingEHS Decision Rights Assessment Tool (Excel)]

Use the assessment with your EHS, operations, and executive leadership teams to identify where decision rights are working effectively—and where unclear authority may be creating unnecessary risk or operational delays.

Establishing Risk-Based Decision Thresholds

A decision-rights framework should not require corporate approval for every operational issue. That would slow decision-making and weaken local accountability.

Equally, decisions with potentially severe consequences should not be left entirely to individual sites without adequate oversight.

A practical approach is to establish decision levels based on credible consequences, legal obligations, control effectiveness, and the organization’s risk tolerance.

Decision LevelTypical AuthorityExamples
Level 1 — Routine Operational RiskSupervisor / Area ManagerRoutine corrections, established operating procedures, minor issues within approved controls
Level 2 — Elevated Site RiskSite Manager with technical reviewSignificant corrective actions, nonroutine operating conditions, site-level changes
Level 3 — Significant Enterprise RiskDesignated Executive Risk AuthorityHigh-consequence exposure, major regulatory enforcement, substantial capital requirements
Level 4 — Prohibited or Unacceptable ConditionsNo discretionary acceptanceNon-waivable legal violations, failed mandatory safeguards, prohibited operating conditions

These thresholds should be based on the organization’s hazards and operating environment. Serious injury and fatality potential, critical control failures, major environmental releases, regulatory enforcement, and process safety consequences are all relevant considerations.

Escalation should be based on credible potential consequences rather than actual outcomes alone. A near miss revealing multiple failed safeguards may warrant executive attention even when nobody was injured.

The purpose is not to elevate as many decisions as possible. It is to ensure that decisions receive scrutiny proportional to the consequences of getting them wrong.

Two Additional Examples of Decision Rights in Practice

A Critical Safeguard Fails During Production

A manufacturing facility discovers that a critical machine safeguard has failed. Production leadership wants to continue operating while maintenance prepares a repair plan. EHS believes continued operation presents an unacceptable risk.

Under a clear decision-rights framework, personnel can initiate a safe stop without waiting for senior management approval. Engineering and EHS evaluate the condition and establish the technical requirements for safe operation. Operations remains accountable for implementing corrective actions.

Restart can occur only when designated authorities verify that the applicable requirements have been satisfied. If operations and technical functions disagree, a defined escalation process determines how the conflict will be resolved.

The decision does not become a contest of influence between the EHS manager and plant manager.

A Capital Investment Competes with Production Priorities

An EHS assessment identifies an exposure requiring an engineering improvement. The project competes with investments intended to increase production capacity or improve product quality.

EHS evaluates the risk and applicable requirements. Engineering develops technical alternatives and cost estimates. Operations evaluates implementation and production impacts. The appropriate capital authority determines funding within the organization’s mandatory risk-control requirements.

If the investment is deferred, the organization must determine whether interim controls are adequate, whether continued operation is permissible, and who has authority to accept any remaining risk.

This example highlights an important distinction. Approving a capital expenditure and authorizing continued operation while a risk remains are two different decisions. They may require different authorities and approval criteria.

The Hidden Danger of Informal Decision Rights

Organizations do not need a formal matrix for decision authority to exist. Decisions will be made regardless of whether the governance structure is documented.

When authority is unclear, decisions often depend on seniority, personal relationships, budget ownership, organizational influence, or an individual’s willingness to challenge others.

A technically qualified EHS professional may recognize a significant hazard but hesitate to challenge a powerful operating executive. A site manager may believe corporate EHS has veto authority that was never formally assigned. A corporate executive may unintentionally override a technical review process simply by communicating a preferred outcome.

These informal arrangements may appear effective during normal operations. Their weaknesses become visible when decisions are urgent, commercially consequential, or involve disagreements among influential leaders.

Crises add another complication. Corporate leadership may quickly assume authority over decisions normally managed locally. Greater executive involvement may be appropriate, but it should not automatically eliminate the role of personnel possessing specialized knowledge.

A mature EHS operating model should function regardless of which individuals occupy particular positions.

If a critical EHS control depends primarily on an individual’s ability to influence management, rather than clearly established governance, that control may not be institutionally reliable.

Integrating Decision Rights into EHS Management Systems

Decision rights should not exist as an isolated document maintained by corporate EHS. They belong within the processes where decisions actually occur.

Management of Change procedures should establish who approves technical modifications, evaluates regulatory implications, and authorizes startup. Incident investigation protocols should identify who approves findings, selects corrective actions, and verifies completion. Capital approval procedures should distinguish funding decisions from the authority to accept residual risk.

Corporate standards, regulatory response procedures, internal audits, and operational reviews should reinforce the same governance principles.

For multinational companies, these processes should also identify when local regulatory or operational concurrence is required. The Mexico experience illustrates the consequences of elevating authority without preserving local expertise.

Digital EHS management systems can help enforce decision rights through approval routing, authority limits, technical review requirements, and documented escalation. However, automating a poorly designed approval process does not improve governance. It merely makes the weaknesses more systematic.

Artificial intelligence introduces an additional dimension. AI-enabled systems may increasingly identify hazardous conditions, recommend interventions, prioritize corrective actions, or initiate predefined activities.

Organizations will need to determine which actions can be automated, which require human authorization, and who remains accountable for outcomes. Human oversight should be designed around the significance of the decision and the potential consequences of an error, rather than added as a routine approval step without meaningful review.

Technology can improve the quality and speed of information, but it does not eliminate the need for human and organizational accountability.

How to Implement Decision Rights Across an EHS Organization

Establishing decision rights does not need to become a major restructuring project. A practical assessment can begin with the decisions most likely to affect risk exposure, regulatory compliance, or business performance.

1. Identify consequential decisions. Start with 15–20 decisions involving serious injury potential, environmental consequences, regulatory obligations, business interruption, significant resource commitments, or important technical disagreements. The accompanying EHS Decision Rights Assessment Tool provides a starting register of 23 decision categories.

The accompanying LeadingEHS Decision Rights Assessment Tool provides a practical starting point, with 23 predefined EHS decisions and a framework for evaluating decision authority, expertise, and governance gaps.

2. Compare formal authority with actual practice. Interview EHS professionals, operational leaders, engineering, and executive management. Determine who is formally authorized to make decisions and who actually makes them. Pay particular attention to decisions that become centralized during significant events.

3. Establish authority and limits. Assign one clearly identified final decision-maker for each category. Define mandatory technical concurrence, delegated authority, risk acceptance boundaries, and escalation requirements. Confirm that decision-makers have access to the knowledge needed to exercise their authority competently.

4. Integrate decision rights into existing processes. Update management-of-change procedures, incident investigations, regulatory response protocols, capital approval processes, corporate standards, and digital workflows. Avoid unnecessary additional bureaucracy.

5. Evaluate performance and revise the framework. Use incident reviews, audits, management reviews, and tabletop exercises to test whether the assigned authorities work as intended. Reassess after reorganizations, acquisitions, significant operational changes, or repeated decision delays.

Success should be evaluated through observable results. Are significant issues resolved more quickly? Are technical disagreements escalated appropriately? Are risk acceptance decisions consistent? Do operational leaders understand their authority? Does corporate intervention improve decision quality or unintentionally slow the organization?

One particularly useful question for executive management reviews is:

Did the person accountable for the outcome have the authority, expertise, information, and resources necessary to make the right decision?

If the answer is no, the problem may involve organizational governance rather than individual performance.

Executive Leadership Must Own Decision Governance

Although EHS can help design and administer the framework, executive leadership must ultimately support and enforce it.

Decision rights determine how authority is distributed throughout the business. They influence capital allocation, operational priorities, accountability, and the resolution of competing interests. These are enterprise governance issues, not decisions that should be left entirely to a staff function.

Executives must establish clear expectations for operational risk ownership, technical independence, and escalation. They must also recognize that formal authority does not guarantee complete knowledge of the circumstances surrounding a decision.

The Mexico regulatory shutdown demonstrated how easily this distinction can be overlooked. Corporate executives had legitimate reasons to become directly involved, but the transfer of authority reduced the influence of the people who understood the local regulatory environment.

Good executive leadership requires knowing when to retain authority, when to delegate it, and how to preserve the expertise necessary to make sound decisions.

This discipline matters most when disagreements involve significant business consequences. The value of decision rights becomes apparent when a plant manager and EHS professional disagree about continuing operations, or when local leadership and corporate executives disagree about resolving a regulatory crisis.

The response to those disagreements reveals whether decision rights are genuinely embedded in the operating model or merely documented in a procedure.

Conclusion: Decision Rights Turn EHS Expectations into Organizational Capability

Strong EHS performance requires more than effective policies, competent professionals, and committed leadership. Organizations need a governance structure that explicitly assigns decision authority and aligns it with accountability and the expertise required to act effectively.

Without that structure, EHS performance can become overly dependent on informal relationships, organizational influence, and the judgment of individuals whose authority is poorly defined.

Clear decision rights allow organizations to resolve routine issues efficiently, preserve technical independence, strengthen operational ownership, and ensure significant risks receive appropriate executive scrutiny.

Effective governance does not mean placing every consequential decision in the hands of the highest-ranking leader. It means establishing the right balance between delegated authority, technical expertise, local knowledge, and enterprise oversight.

For EHS executives, this represents an important evolution in leadership. The objective is not to own every decision affecting safety, health, or the environment. It is to help build an organization capable of making sound decisions consistently, regardless of which individuals happen to be involved.

The ultimate measure of EHS leadership is not how many decisions the EHS function controls. It is how effectively the organization makes and executes decisions that manage risk—even when EHS is not in the room.


References and Further Reading

Bain & Company. (2011). Great decisions—Not a solo performance. Decision Insights, No. 10. https://www.bain.com/contentassets/cc22bf15ebfb467094fa88c8533742b3/decision_insights-10_great_decisions.pdf

Occupational Safety and Health Administration. (n.d.). Management leadership. U.S. Department of Labor. https://www.osha.gov/safety-management/management-leadership

Occupational Safety and Health Administration. (n.d.). Worker participation. U.S. Department of Labor. https://www.osha.gov/safety-management/worker-participation

Occupational Safety and Health Administration. (n.d.). Recommended practices for safety and health programs. U.S. Department of Labor. https://www.osha.gov/safety-management/

Posted in EHS Management, EHS Management Systems, enterprise risk management, Leadership, Leading at Scale | Tagged , , , , , , , , , , , , | Leave a comment

Earning Executive Influence: Six Lenses for EHS Innovation and Payback

A businesswoman presenting to a group of professionals in a modern conference room, with digital graphics displaying industry data and environmental themes in the background.

What if your EHS team had to earn the business before it could earn the influence?

EHS leaders frequently talk about wanting greater influence with executive management. We want to be involved earlier in business decisions, have operating leaders seek our advice before problems occur, and gain support for technology, staffing, training, capital, and new approaches to risk. Ultimately, we want EHS to be viewed as part of how the organization performs, not simply as the function responsible for compliance.

The usual response is that EHS needs to do a better job of “selling safety.” I think that starts in the wrong place.

A better approach may be to think less like an internal staff function and more like an independent EHS consulting firm competing for the organization’s business. Imagine that your company was not required to use your EHS team. Would Operations choose to engage you? Would Engineering ask for your help? Would business leaders bring you into their most important projects? Would executives seek your perspective before major decisions? Most importantly, would your internal customers believe the resources invested in EHS produced enough value to engage you again?

Those questions create a different mindset. An outside consulting firm cannot rely on the organizational chart to establish its relevance. It has to identify important problems, understand the customer, differentiate its capabilities, innovate when appropriate, deliver results, and demonstrate value. Internal EHS organizations should apply much of the same discipline.

Opportunity identification + disciplined innovation + measurable payback = executive influence.

The payback works in two directions. First, EHS creates payback for the organization through reduced risk, stronger capability, improved execution, innovation, avoided loss, efficiency, or other measurable results. Then the organization effectively pays EHS back through credibility, trust, earlier access, resources, and greater influence.

Create payback for the business, and the business pays EHS back with influence.

What If Your EHS Team Had to Win the Business?

Most corporate EHS teams occupy a unique position. The organization cannot simply decide that environmental regulations no longer matter or that occupational safety requirements are optional. Some level of EHS capability must exist, and that can unintentionally create a captive-customer mindset.

We establish requirements, conduct audits, provide training, review incidents, write standards, and implement programs. All of those activities may be necessary, but necessity is not the same as value. An internal EHS team can technically fulfill its responsibilities while gradually losing influence if its internal customers experience the function primarily as a source of requirements, delays, administration, or additional work.

An independent consulting firm would not survive long that way. It would continually ask what problems the customer needs solved, how those problems have changed, what it can do better than someone else, where innovation might help, what the solution costs the customer, what measurable value is being produced, and whether the customer would hire the firm again.

That mindset does not commercialize safety or weaken professional responsibility. It forces EHS to become clearer about where its expertise can have the greatest organizational impact.

Start With Problems Worth Solving

One of the most common traps in EHS is beginning with the solution. We decide that we need a new training program, a software platform, another audit, an AI application, or another corporate standard before fully defining the problem.

A consulting firm walking into a prospective client and beginning with its preferred solution would probably lose the engagement. The first question should be simpler and more disciplined:

What problem are we trying to solve?

This becomes even more important as innovation accelerates across EHS. Artificial intelligence, advanced analytics, connected-worker technology, wearables, computer vision, digital twins, predictive systems, and new learning technologies are creating extraordinary capabilities. But something can be innovative without being useful. The objective should not be to implement more technology. It should be to solve important organizational problems better.

That requires a disciplined way of evaluating opportunities. I use six lenses: Strategic Fit, Organizational Need, Right to Win, Willingness to Invest, Scalability, and Payback.

Lens 1: Strategic Fit

The first question is whether the opportunity aligns with what the organization is trying to accomplish. An effective consulting firm begins with the client’s strategy, not its own service catalog. Internal EHS should do the same.

If the organization is increasing manufacturing capacity, EHS should ask where safety, process risk, environmental constraints, workforce capability, or permitting could interfere with that strategy. If the business is pursuing acquisitions, EHS should examine how it can improve identification of inherited risk. If productivity is a priority, the team should look for unnecessarily complex EHS requirements that consume operational capacity without proportional risk reduction. If digital transformation is a priority, EHS should identify where AI, analytics, or automation can improve decisions rather than simply digitize existing processes.

The EHS strategy should not exist parallel to the business strategy. It should help deliver it.

Lens 2: Organizational Need

The second lens asks whether there is a meaningful problem worth solving. Good consultants spend significant time diagnosing before prescribing, and EHS leaders should do the same.

That means talking with Operations, Engineering, Maintenance, Supply Chain, Human Resources, Finance, Commercial leaders, supervisors, and employees. Where is work difficult? Where is risk poorly understood? Where are decisions slow? Where are experts becoming bottlenecks? Where are incidents repeating? Where is unnecessary complexity consuming time? Where is information failing to reach the right decision-maker?

These questions often uncover better opportunities than simply reviewing last year’s EHS plan. A recurring incident may not be a training problem; it may be a work-design problem. A risk-assessment backlog may not require another EHS professional; it may require a better process or technology. A large corporate standard may not represent insufficient information; it may represent an information-access problem.

Innovation begins with correctly diagnosing the problem.

Lens 3: Right to Win

An external consulting firm must answer a difficult question: why should the client choose us? Internal EHS should ask the equivalent question: why are we particularly well positioned to solve this problem?

EHS may possess capabilities that are unusual within the enterprise. We see risk across operations and locations, understand regulatory requirements, investigate failures, have access to incident and exposure data, understand management systems, and often see the gap between written procedures and actual work. Because we operate across organizational boundaries, we may also have a broader perspective than many individual functions.

That does not mean EHS should own everything involving risk. Sometimes Operations has the right to win. Sometimes Engineering does. Sometimes IT, Quality, Human Resources, Sustainability, Legal, or an outside specialist is better positioned. The objective is not to make the EHS empire larger. It is to deploy EHS expertise where it creates the greatest value.

Lens 4: Willingness to Invest

A consultant eventually discovers whether the client believes a problem is important enough to fund. Internal EHS should apply the same test.

The question is not simply whether management will approve a budget request. It is whether the issue is important enough for the organization to invest the resources required to solve it. Those resources may include money, but they also include management attention, supervisor time, IT support, engineering resources, production downtime, capital, training, and organizational change.

Everything EHS asks the organization to do has a cost. Understanding that cost is critical to influence. Instead of saying, “We need funding for an EHS initiative,” the stronger framing is, “Here is the problem. Here are its implications. Here is what solving it will require. Here is what the organization should receive in return.”

Now EHS is not defending its budget. It is presenting an investment case.

Lens 5: Scalability

A consulting firm that wants to grow cannot solve every customer problem through heroic individual effort. Neither can an enterprise EHS organization.

The question is whether a successful solution can scale. Could a process that works at one plant work across 30? Can technology make scarce expertise available more broadly? Can the core solution be standardized while allowing appropriate local flexibility? Can learning from an incident at one location reach every location exposed to the same risk? Can an expert’s knowledge be embedded into systems or workflows so that the expert does not personally have to make every decision?

This is one of the most important opportunities for innovation. AI and digital technology may create their greatest EHS value not by eliminating professionals or merely making existing tasks faster, but by helping scarce expertise reach more decisions. A highly experienced industrial hygienist cannot personally assist every supervisor. A process-safety expert cannot attend every field decision. A corporate EHS leader cannot participate in every investigation. Technology can help portions of that expertise scale.

That is a much more important innovation question than asking whether EHS is “using AI.”

Lens 6: Payback

The final lens asks what the organization receives in return. This is where the consulting-firm mindset becomes particularly powerful because an outside client will eventually decide whether the engagement produced sufficient value. Internal EHS should hold itself to a similar standard.

Payback can include reduced risk, lower incident costs, avoided downtime, faster permitting, stronger regulatory confidence, reduced environmental liability, improved operational continuity, faster problem solving, stronger workforce capability, elimination of unnecessary work, better decision-making, or the ability to safely implement a business opportunity.

Some payback is readily financial and some is not. Not every EHS benefit should be artificially converted into dollars, but EHS should be able to explain what changed. That is different from reporting activity. Conducting 100 audits, delivering 5,000 hours of training, or closing 97 percent of corrective actions tells management what EHS did. It does not necessarily explain the value created.

Payback asks: What became better because we did it?

That is the first half of the payback equation.

When the Business Pays EHS Back

The second half is what happens after EHS repeatedly creates visible value. The organization begins to pay EHS back, not primarily with money, but with influence.

Operations experiences EHS helping solve a difficult problem and engages the function earlier next time. Engineering sees EHS improve a design decision and includes the team earlier in the next capital project. Executives see EHS identify inherited risk during an acquisition and ask for its perspective during the next transaction. Finance sees EHS improve risk-based capital decisions and increasingly values its judgment.

For an outside consultant, one of the strongest indicators of success is not simply completing an engagement. It is being invited back, particularly when the next problem is larger, earlier in the decision process, and more important to the client. Internal EHS should think the same way.

Influence is not demonstrated by how many meetings EHS attends. It is demonstrated when leaders voluntarily bring EHS into important decisions because previous experience has shown that its involvement improves the outcome.

Results create credibility. Credibility creates trust. Trust creates access. Access creates greater opportunity to produce results.

Use the Six Lenses to Drive Innovation

The six lenses should be more than a business-case tool. They can become part of how EHS manages its improvement portfolio.

Periodically, an EHS leadership team should look across the organization and ask where important problems are emerging, which align most strongly with enterprise priorities, where EHS has a right to win, which issues justify organizational investment, what solutions could scale, where innovation might create a fundamentally better result, and what the payback could be.

That discussion should lead to choices. Some opportunities deserve investment. Some should be piloted. Some are better pursued through partnership. Some should simply be monitored. And some should be stopped.

EHS programs should not become permanent simply because they existed last year. A consulting company that continued selling a service customers no longer valued would eventually fail. Internal EHS organizations may not face that market discipline directly, which makes it even more important to impose the discipline on ourselves.

Pilot Before You Institutionalize

The consulting mindset also changes how EHS approaches new ideas. Instead of moving directly from idea to standard, training, metrics, and enterprise rollout, a better path is often to begin with a hypothesis, test it, measure the result, learn, and then decide whether to scale, modify, or stop.

Hypothesis → Pilot → Measure → Learn → Scale, Modify or Stop

Suppose EHS believes AI can improve incident investigations. Start with the problem: can AI help investigators identify missing information, patterns, or relevant lessons while preserving human judgment? Pilot it, measure investigation quality and time, determine whether useful insights improve, and look for unintended consequences. Then decide what happens next.

The same logic can apply to serious-injury prevention, training modernization, wearables, exposure assessment, contractor management, ergonomics, digital permitting, critical-control verification, audits, and many other areas.

Stopping an initiative can be one of the clearest demonstrations of executive discipline. If a new idea fails the six-lens test—or if an existing program cannot demonstrate enough value to justify the resources it consumes—EHS leaders should be willing to end it, redesign it, or redeploy those resources elsewhere. That can be difficult, particularly when a program has history, executive sponsorship, or strong internal advocates. But continuing low-value work simply because it is familiar weakens the overall EHS portfolio. Executive leadership requires making choices for the good of the whole system, not protecting individual programs. Every hour, dollar, and unit of organizational attention committed to an initiative that no longer produces adequate results is capacity that cannot be invested in a stronger opportunity. The discipline to stop is therefore not a retreat from EHS leadership; it is part of managing EHS as a strategic portfolio and demonstrating that the function is willing to hold itself accountable to the same performance expectations it asks of the rest of the organization.

Innovation becomes disciplined experimentation rather than technology adoption.

Stop Trying to Sell Safety

Perhaps “selling safety” is the wrong objective. A good consulting firm does not succeed because it becomes better at persuading customers to buy things they do not need. It succeeds because it understands the customer, identifies important problems, creates differentiated solutions, innovates intelligently, delivers results, and earns repeat business.

Internal EHS can operate with the same mindset. Use the six lenses to determine whether an opportunity advances an important business objective, solves a problem that matters, matches EHS’s differentiated capabilities, justifies the resources required, can scale, and produces identifiable payback.

Then ask one additional question:

If the organization could choose whether to hire us again, would it?

That may be a more meaningful test of EHS influence than whether we have been given a seat at the table. The most influential EHS organizations will not need to continually argue for their relevance because their results will have already established it.

Create payback for the business, and the business pays EHS back with influence.

Posted in Business Accumen, Career Skills, EHS Management, enterprise risk management, Innovation, Leadership, Leading at Scale, Sustainable Strategy | Tagged , , , , , , , , , , , , , , | Leave a comment

AI Won’t Need to Become Evil to Become Dangerous: What the AI Doomsday Debate Means for EHS

A woman in a hard hat and glasses observes a large industrial facility with oil tanks and towering structures. Digital icons representing data analysis, automation, and safety are overlayed, showcasing a smart factory environment.

October 2026 Update

Since this article was first published, the AI safety debate has moved even closer to the issues familiar to EHS professionals. Researchers from leading AI laboratories have raised new concerns about self-improving systems and the pace of development, while frontier models are demonstrating cybersecurity capabilities that increasingly require isolation, monitoring, access controls and other layered safeguards. At the same time, policymakers are debating whether voluntary industry controls are sufficient or whether more independent oversight is needed.

These developments reinforce the central argument of this article: the risk posed by advanced AI will depend not only on intelligence, but on capability, autonomy, access, connectivity and consequence—and whether safeguards advance at the same pace.


Recent headlines have raised an extraordinary question: Could artificial intelligence actually kill us all?

The language naturally attracts attention, but it can also distract from the more useful issue for environmental, health and safety professionals.

The important question is not whether an artificial intelligence system will someday become “evil.” It is what happens when increasingly capable autonomous systems enter complex operating environments faster than organizations develop the controls necessary to manage them.

That is a much more familiar problem.

Catastrophic events rarely require malicious intent. Refineries do not intend to explode. Aircraft systems do not intend to fail. Chemical reactions do not intend to run away, and organizations do not intend to create fatal exposures.

Serious events develop when capability, complexity, changing conditions and imperfect controls interact in ways people did not anticipate.

Artificial intelligence may create another version of that problem, except this technology can learn, reason, communicate with other systems and increasingly initiate actions without continuous human direction.

That makes advanced AI more than an information technology issue.

It is becoming an operational risk issue.

This builds on a theme I have explored previously: AI’s greatest value in EHS will come not from replacing professional judgment, but from combining machine capability with human knowledge, context and decision-making. See Human + AI: The Power of Synergistic Collaboration (Brandon, 2025).

What Is Behind the AI “Doomsday” Debate?

The current debate has intensified as researchers working on frontier AI systems have publicly questioned whether increasingly capable AI could eventually create catastrophic risks. Former Anthropic researcher Jacob Coxon, for example, recently raised concerns about the possibility of severe outcomes from advanced AI systems. Other researchers have made similar warnings, while critics argue that extinction scenarios remain highly speculative and may divert attention from more immediate and measurable harms.

There is no scientific consensus that AI is likely to cause human extinction.

There is considerably more agreement that future AI systems are likely to possess greater autonomy, broader capabilities and deeper integration into organizational systems than the tools most companies use today.

Two broad risk pathways tend to dominate the discussion.

The first is human misuse. A sufficiently capable AI system could greatly increase someone’s ability to conduct cyberattacks, design biological threats, manipulate information, compromise infrastructure or automate other harmful activities.

The second is loss of effective human control over autonomous systems.

That does not require an AI system to hate humans, develop consciousness or deliberately decide to cause harm. A system only needs sufficient capability, access and autonomy to pursue an objective in a way its designers did not anticipate.

Industrial safety professionals already understand the distinction between intent and consequence.

An automated process control system does not need malicious intent to create a catastrophic condition. It needs the wrong inputs, an unexpected interaction, inadequate safeguards and enough authority over the process.

AI adds another dimension because the system may increasingly be able to reason about how to accomplish the objective it has been given.

From AI Tool to AI Agent

(Oct 2026 Update) Recent frontier-model developments make this progression increasingly tangible. OpenAI reported in September 2026 that GPT-6 Astra reached its Critical cybersecurity capability threshold, meaning that with sufficient tools and access it could discover previously unknown vulnerabilities and develop new exploitation techniques without continuous human direction. The response included stronger isolation, trajectory monitoring and blocking controls—an example of capability growth directly driving the need for stronger engineered safeguards.

Most people still experience AI primarily as a tool.

We ask a question. The model responds.

We provide a document. It analyzes the information.

We ask it to create something. It generates an output.

The human remains clearly involved in each step.

AI agents operate differently. An agent can receive an objective, determine intermediate steps, use software tools, retrieve information, communicate with other systems and take actions intended to accomplish that objective.

From a risk perspective, the progression matters:

AI recommends → AI decides → AI acts → AI coordinates → AI adapts

An AI system that analyzes process-safety information presents a very different risk from one authorized to modify operating parameters.

A maintenance model that recommends priorities differs significantly from an agent that can automatically initiate work orders or equipment shutdowns.

An AI system that identifies an unsafe condition differs again from one directly connected to safety-critical systems.

The underlying model could be identical. The risk changes because of what the system is allowed to do.

This progression is closely related to the broader idea I explored in AI as a Strategic Partner: Building a Digital Twin to Advance Safety and Sustainability: AI becomes significantly more consequential when it moves from providing insight to becoming embedded in the operating model itself.

The DeepMind Issue EHS Should Notice

One of the more interesting recent contributions to this discussion comes from Google DeepMind researchers.

In From AGI to ASI, Tim Genewein and colleagues examine possible pathways through which artificial general intelligence might progress toward artificial superintelligence. They discuss continued scaling, changes in AI paradigms, recursive improvement and the possible emergence of superintelligence through large-scale multi-agent collectives.

The multi-agent pathway deserves particular attention from systems-safety professionals.

The concern is not that individual AI agents will necessarily decide to “join forces” against humanity. The more interesting possibility is that capability could emerge at the system level that is greater than the capability represented by any one agent operating independently.

We already understand the principle in human organizations.

A manufacturing enterprise collectively possesses knowledge and capabilities that no single employee possesses. Engineering, operations, maintenance, chemistry, supply chains, software systems, contractors and management all contribute different information and capabilities to the whole.

AI systems may eventually create similar distributed structures, but with one major difference: digital agents may communicate, analyze and execute decisions at machine speed.

DeepMind has separately discussed the prospect of very large numbers of AI agents from different organizations interacting, negotiating and transacting across digital environments.

For EHS, that raises an important systems principle:

We cannot evaluate the risk of an AI-enabled operation solely by evaluating the individual model.

We need to understand the ecosystem in which that model operates.

That systems-level perspective is also consistent with my work on process digital twins, where the emphasis is not simply on one model or one data stream but on the interaction between live operating conditions, controls, people and decisions. See Harnessing the Process Digital Twin: Building Live Operating Models for Foresight, Control, and Safer Work (Winful & Brandon, 2026).

The Hazard Is Not Intelligence Alone

Intelligence by itself is probably not the best way to think about AI risk.

A more useful EHS framing is:

Capability × Autonomy × Access × Connectivity × Consequence

This is not intended as a mathematical risk equation. It is a way to structure the hazard discussion.

A highly capable AI system operating inside a controlled sandbox may present relatively little operational risk.

A less sophisticated AI system with access to plant networks, procurement systems, laboratory automation, production scheduling or safety-critical equipment may present considerably more.

The practical questions are therefore familiar ones.

What information can the system access? What can it change? What decisions can it make independently? What systems can it communicate with? Can it initiate physical actions, spend money, execute code or modify another system? Can it delegate work to additional agents? Under what circumstances can it bypass human approval?

And perhaps most importantly: What happens when the system is wrong?

Those are not science-fiction questions.

They are hazard-review questions.

This is also where AI increasingly intersects with cyber-physical risk. In the four-part Cyber-Physical Risk in the Age of AI series, Fay Feeney and I argued that once digital systems can influence physical operations, cyber and AI risks become operational risks with potential safety, environmental and business consequences.

AI Needs a Hierarchy of Controls

(Oct 2026 Update) The current industry debate increasingly supports this approach. Former AI safety leaders have argued that frontier AI should adopt safety disciplines more similar to aviation, nuclear power and other high-consequence sectors, where redundancy, independent protection layers and conservative operating boundaries are expected rather than optional. That is a familiar principle for EHS professionals: when the potential consequence is severe, safety cannot depend on a single control or on the assumption that the primary system will always behave as intended.

One of the most useful contributions EHS can make to AI governance is bringing traditional control philosophy into the conversation.

Organizations should be cautious about treating human oversight as the primary safeguard for powerful autonomous systems.

In occupational safety, we would never accept “be careful” as the principal control for a serious energy hazard. We should not accept the digital equivalent for AI.

Humans experience fatigue, automation bias, time pressure and normalization of deviance. We also cannot reliably supervise systems capable of processing thousands of decisions faster than people can evaluate them.

The hierarchy-of-controls mindset offers a stronger approach.

If a level of AI autonomy creates unacceptable risk, the first question should be whether that autonomy is necessary.

When autonomy is justified, engineering controls can limit the system through network segmentation, restricted permissions, authentication, rate limits, transaction limits, sandboxing and independent interlocks.

This is also where supervisory systems for AI may become increasingly important. In my manuscript submitted to Professional Safety for peer review, When AI Supervises AI: Reliability, Repeatability and Error Stack Up in Multi-Agent Systems, I examine the potential for a separate supervisory reasoning channel to monitor and challenge AI-generated decisions. The concept is analogous to an independent safety channel in a high-integrity industrial control system: one AI application performs the work, while a separate supervisory layer evaluates outputs against defined constraints, risk rules, causal relationships and safe operating boundaries before higher-consequence actions are allowed to proceed.

This matters because multi-agent systems can propagate uncertainty rather than eliminate it. Correlated errors, hidden bias, contextual drift and confidence amplification can accumulate as outputs pass from one AI agent to another. A supervisory system should therefore be designed for independence and challenge, not simply to repeat the reasoning of the primary model. The operating philosophy can be summarized simply:

AI proposes. Supervisory reasoning verifies. Humans retain authority over consequential decisions.

Administrative controls can then define approved use cases, competency expectations, escalation requirements and accountability. Monitoring becomes one layer in a broader defense-in-depth strategy rather than the only safeguard.

This is increasingly consistent with the direction major AI developers are taking. Google DeepMind, for example, has described control approaches involving restricted permissions, detection, prevention and response for powerful AI agents.

The familiar safety principle applies: a system capable of creating a hazardous condition should not be the only system responsible for preventing that condition.

AI Management of Change

Management of Change may be one of the most immediately useful tools EHS professionals can bring to AI deployment.

Organizations are integrating AI rapidly, often one application at a time.

An engineer connects an AI tool to maintenance records. Procurement introduces an agent to evaluate suppliers. Operations deploys AI to recommend production adjustments. Human resources adds automated scheduling. EHS develops an AI agent capable of reviewing incident histories and recommending corrective actions.

Each deployment may look reasonable when considered individually.

Taken together, however, the organization may be building an entirely new operating architecture without ever formally recognizing that a significant change has occurred.

That is exactly the type of problem Management of Change was designed to address.

Before introducing an AI system into a safety-significant process, the organization should understand its purpose, decision authority, data sources, access, failure modes and interdependencies. It should also know how actions can be reversed, how abnormal behavior will be detected, who can withdraw authority and how incidents or near misses involving the system will be captured.

The principle is straightforward:

Increasing capability is a change. Increasing autonomy is a change. Increasing access is a change. Connecting previously independent systems is a change.

Any of those changes may alter the risk profile of an operation.

If changing a process chemistry, operating limit or control-system logic warrants formal review, increasing the decision authority of an AI system should at least trigger the question of whether similar scrutiny is appropriate.

The same principle appeared in our process digital twin work, where validation, cybersecurity, governance and Management of Change were identified as critical conditions for moving digital models from observation toward operational control.

Think About AI Like a SIF Exposure

EHS professionals have become much more sophisticated in how we think about serious injury and fatality prevention.

We increasingly recognize that a low recordable injury rate tells us relatively little about whether catastrophic-risk conditions exist.

AI governance may require the same evolution.

An organization could experience thousands of successful AI interactions while gradually building a small number of high-consequence failure pathways.

Suppose an AI system performs 99.99% of its tasks correctly. That sounds impressive.

But reliability alone is not enough if the remaining failures include the ability to manipulate safety-critical equipment, authorize a dangerous material transfer, alter an engineering specification or compromise a control system.

The more useful question is:

Does the system have exposure to high-consequence decision pathways?

That is fundamentally a SIF question.

We should therefore pay attention not only to errors but also to AI high-potential events: situations in which an AI action, recommendation or system interaction could reasonably have produced a severe consequence under slightly different circumstances.

An agent attempting an unauthorized connection should not be dismissed because the safeguard worked.

A model producing an incorrect process parameter should not automatically be categorized as simply a poor response.

An AI workflow bypassing an expected approval step may be more than an IT issue.

Those events can be weak signals of control-system vulnerability.

This connects directly to the predictive-risk principle I explored in Seeing Risk Before It Hurts: the most valuable safety opportunity often exists during the period when risk is forming but before an injury or major event occurs.

AI Will Create Inherited Risk

There is another reason EHS professionals should be involved early.

The worker exposed to AI-generated risk may have had almost nothing to do with creating it.

In traditional operations, workers frequently inherit risk created upstream through design decisions, maintenance practices, staffing, production pressures, purchasing specifications, procedures or management systems.

I explored this concept in Inherited Risk Ecosystem: How Upstream Decisions Shape Human Error at the Point of Work. The central premise is that what appears to be a frontline error may actually be the final expression of risk created much earlier elsewhere in the organization.

AI will expand that inherited-risk pathway.

An employee may interact with one visible AI interface, while the underlying risk was created through decisions involving model selection, software architecture, permissions, procurement, system integration, cybersecurity configuration, automation strategy or human-machine-interface design.

The risk may also originate in another AI system entirely.

By the time the hazard reaches the operator, technician or maintenance employee, the individual performing the work may have very little ability to influence it.

That should change how we think about responsibility.

AI risk may increasingly be inherited by the worker rather than created by the worker.

The appropriate question is therefore not simply whether the employee used the AI tool correctly.

We should be asking:

What risk has this worker or operation inherited from the AI-enabled systems surrounding the work, where was that risk created, and where can the pathway be interrupted?

That extends the Inherited Risk Ecosystem directly into AI-enabled operations.

It also prevents organizations from making the same mistake they have historically made with other hazards: placing responsibility at the point of work for risk that was actually created much farther upstream.

Humans + AI Must Remain the Operating Model

The goal should not be humans versus AI.

It should be Humans + AI.

AI can identify patterns across datasets that no safety professional could manually review. It can connect incident information, audits, maintenance records, process conditions and operating experience across an enterprise. It can extend scarce technical expertise across dozens of facilities and help identify weak signals that might otherwise remain invisible.

Those capabilities could materially improve workplace safety.

This is the core argument of my earlier article Human + AI: The Power of Synergistic Collaboration: the competitive and safety advantage comes from combining human judgment, context and ethical reasoning with AI’s analytical and predictive capacity.

But collaboration is not the same as giving up control.

AI may be exceptionally good at helping us answer:

What are we missing?

People still need to determine:

What risk are we willing to accept, and what decisions must remain ours?

That boundary becomes more important as systems move from recommendation toward independent action.

Where EHS Professionals Have Influence

EHS professionals do not need to become machine-learning engineers to influence this transition.

We already work with many of the disciplines advanced AI governance will require: hazard identification, barrier management, Management of Change, human factors, assurance, organizational learning and low-frequency/high-consequence risk.

That expertise gives the profession several practical points of influence.

EHS should participate in AI governance when systems affect workers, hazardous materials, equipment, operational decisions or critical infrastructure.

We can help organizations establish risk-based autonomy levels so that an AI used to generate training material is not governed in the same way as one connected to a chemical process.

We can bring AI-related changes into existing MOC processes, help determine when pre-startup reviews are appropriate, and ensure that high-consequence AI failure scenarios are incorporated into emergency planning.

We can also help establish AI incident and near-miss reporting. A control that prevents an AI system from taking an unsafe action is evidence that the control worked, but it may also be evidence that the organization encountered a significant precursor.

Human factors will be equally important. Automation bias—the tendency to trust automated recommendations because they appear authoritative—could become one of the most significant risks as AI becomes embedded in daily operations.

Finally, EHS can reinforce the principle of defense in depth.

No single human reviewer, model safeguard, permission setting or shutdown mechanism should stand between a highly autonomous system and a catastrophic consequence.

This broader role for EHS also reflects an argument I made in If Everything Still Comes to You, You Haven’t Scaled Leadership: enterprise leaders increasingly create value not by personally making every decision, but by designing systems that enable good decisions to occur consistently across the organization. AI governance is becoming one more part of that operating system.

A Familiar Risk in an Unfamiliar Technology

Google DeepMind’s Frontier Safety Framework now considers scenarios involving AI systems that could interfere with an operator’s ability to direct, modify or shut down their operation. Researchers are also examining whether future AI systems could significantly accelerate AI research itself.

Those possibilities remain uncertain.

That uncertainty cuts both ways.

We do not know that advanced AI will produce catastrophic outcomes. We also do not know that humans will always maintain effective control over increasingly capable and interconnected autonomous systems.

Safety professionals operate in that space all the time.

We do not require certainty that a pressure vessel will rupture before installing relief protection. We do not wait for a combustible dust explosion before managing dust accumulation. We do not require a fatality before acting on a high-energy exposure.

We identify credible scenarios, evaluate consequences and install controls proportionate to the potential loss.

Advanced AI deserves the same discipline.

The Lesson Behind the Headline

The phrase AI could kill us all may ultimately prove dramatically overstated or remarkably prescient. EHS professionals do not need to resolve that debate to recognize what is already changing.

Artificial intelligence is advancing from generating information to shaping decisions, from shaping decisions to taking action, and from individual action toward coordinated, increasingly autonomous systems.

AI generates → recommends → decides → acts → coordinates → adapts → potentially improves its own capabilities.

That final step—self-improvement—raises a different class of risk. If AI systems begin materially improving their own reasoning, tools, software, or successor models, capability growth could occur faster than governance, testing, or human oversight can adapt. The concern is not simply that AI becomes “smarter.” It is that the rate of capability change itself may become a hazard, because safeguards validated for one level of performance may no longer be adequate for the next.

From an EHS perspective, that makes continuous reassessment essential. Increasing capability should be treated as a change in the risk profile, not as a background technology upgrade. A safeguard should not be assumed effective merely because it worked before the system’s capabilities changed.

The risk associated with this transition will not be determined only by how intelligent AI becomes. It will also depend on where organizations deploy it, what they connect it to, what authority they grant it, how quickly those boundaries expand, and whether the surrounding controls evolve at the same pace.

For EHS, this is familiar territory. We are dealing with another complex system containing powerful capabilities, interacting components, imperfect information, and uncertain failure modes.

AI may be a new technology, but the underlying obligation is familiar: understand the hazard before expanding the exposure, and reassess the controls when the capability changes.

The EHS profession has learned that lesson repeatedly in factories, chemical plants, aircraft, laboratories, and energy systems. We now have the opportunity to apply it earlier in the development of AI-enabled operations rather than after the first major failures force us to.

That may become one of the most important contributions the profession makes to the age of artificial intelligence.

References

Brandon, C. (2024, November 24). Harnessing AI to revolutionize EHS management: A vision for the future. LeadingEHS.com.

Brandon, C. (2025, August 3). AI as a strategic partner: Building a digital twin to advance safety and sustainability. LeadingEHS.com.

Brandon, C. (2025, November 2). Human + AI: The power of synergistic collaboration. LeadingEHS.com.

Brandon, C. (2026, January 11). Seeing risk before it hurts: An example of how predictive analytics are redefining safety. LeadingEHS.com.

Brandon, C. (2026, July 24). Inherited Risk Ecosystem: How upstream decisions shape human error at the point of work. LeadingEHS.com.

Brandon, C. (2026, September 5). If everything still comes to you, you haven’t scaled leadership. LeadingEHS.com.

Brandon, C. (2026). When AI supervises AI: Reliability, repeatability and error stack up in multi-agent systems [Manuscript submitted for publication]. Professional Safety.

Brandon, C., & Feeney, F. (2026). Cyber-Physical Risk in the Age of AI [Four-part series]. LeadingEHS.com.

Genewein, T., Franklin, M., Lerchner, A., Orseau, L., Albanie, S., Bales, A., Wyeth, C., Chan, S., Gabriel, I., Leibo, J. Z., Dafoe, A., Hutter, M., Graepel, T., & Legg, S. (2026). From AGI to ASI. arXiv. https://doi.org/10.48550/arXiv.2606.12683

Google DeepMind. (2026, June 11). Investing in multi-agent AI safety research: Scaling AI safety research for a multi-agent world.

Google DeepMind. (2026). Strengthening our Frontier Safety Framework.

Shah, R., & Flynn, F. (2026, June 18). Securing the future of AI agents. Google DeepMind.

The Wall Street Journal. (2026, September 10). How would AI actually kill us all? What to know about the AI doomsday debate.

Winful, E., & Brandon, C. (2026, July 6). Harnessing the Process Digital Twin: Building live operating models for foresight, control, and safer work. LeadingEHS.com.

Posted in AI, Artificial Intelligence, Design for Safety, Digital Twin, Innovation, Technical Skills | Tagged , , , , , , , , , , , | Leave a comment

If Everything Still Comes to You, You Haven’t Scaled Leadership

Building an Operating System for EHS Leadership at Scale

One of the most important leadership lessons of my career came during a period of extraordinary growth. At ATI Worksite Solutions, our operation grew from approximately 15 people to roughly 300. Over about five years, revenue grew from approximately $7 million to $36 million—more than a fivefold increase and a compound annual growth rate of approximately 39%.

Early in that journey, I could stay close to much of what was happening. I knew the people, understood the problems, participated directly in important decisions, and could intervene when something needed attention. That approach became impossible as we grew.

At 300 people, I couldn’t personally coach every employee, solve every operational problem, ensure every customer received the same experience, or make every important decision. More importantly, I shouldn’t have tried. Working harder wasn’t the answer. I had reached one of the fundamental constraints of leadership: you can’t scale yourself. You have to scale your impact.

We built organizational structure, developed managers, established processes and expectations, and deliberately transferred knowledge, authority, and accountability to others. We also created a formal leadership-development program that ultimately reached approximately 100 employees. My job was changing. I was no longer primarily responsible for producing results myself. I was responsible for creating an organization capable of producing results at a scale I could never achieve individually.

Years later, I see the same leadership principle taking another evolutionary step through artificial intelligence. I have been working extensively with AI as a tool for EHS and organizational decision-making. What interests me most isn’t simply what AI can do for an individual professional. It is what happens when we use it to distribute expertise, improve access to knowledge, recognize patterns, challenge assumptions, accelerate learning, and help people throughout an organization make better decisions.

These experiences, separated by many years and very different technologies, are versions of the same leadership challenge: how do you expand your professional impact beyond the limits of your own time and attention?

From Doing to Multiplying

Early in our careers, professional impact is largely additive. We solve problems, improve processes, complete projects, and help teams succeed. Our contribution is primarily defined by what we personally accomplish.

As responsibility grows, that model reaches a limit. There are only so many meetings we can attend, people we can coach, facilities we can visit, and decisions we can make.

Leadership therefore progresses from doing, to leading, to building, and eventually to multiplying. First, our expertise creates value. Then we learn to create value through other people. Eventually, we build systems that enable entire organizations to perform. Technology and AI now give us the potential to multiply that capability even further.

For an enterprise EHS leader, that progression ultimately requires something deliberate: an operating system for leadership at scale.

Building the EHS Leadership Operating System

An EHS management system establishes how an organization manages risk. A leadership operating system addresses a related but different question: how does the senior EHS leader make that system work across an enterprise without becoming part of every transaction?

I see nine interconnected elements in that operating system: purpose and strategy; the EHS management system; organization and people; governance and accountability; data, AI and digital tools; communication and influence; performance and continuous improvement; culture and engagement; and executive focus and delegation.

To make the framework practical, I developed an EHS at Scale Operating System Assessment Tool that translates the nine elements into a detailed leadership checklist. The tool allows leaders to evaluate how effectively their organization is executing each element, identify gaps, assign ownership and actions, and generate an overall maturity score. It also includes an Executive Work Organizer that challenges leaders to examine what they should personally own versus delegate, automate, simplify, or stop, along with a leadership cadence for governance, communication, talent development, and performance review. The intent is not simply to score an EHS organization, but to create a structured way for leaders to ask a more important question: Are we building a system that can perform at scale without depending on constant senior-leader intervention?

You can download the EHS at Scale Operating System Assessment Tool at this link. Try it out and let me know how well is helps you scale your influence.

The objective is not to create another layer of bureaucracy. It is to create clarity around what must be standardized, what should be delegated, how information moves, where decisions are made, what gets escalated, and where senior leadership attention creates the greatest value.

At scale, the management system becomes one of the leader’s most important forms of leverage. Critical-risk requirements, management of change, assurance, investigations, corrective actions, performance measures, and other core processes should not depend on whether the senior leader is personally paying attention to them that week. The system creates repeatability.

That does not mean identical execution everywhere. Different businesses, operations, cultures, and regulatory environments require room for adaptation. My preference is to standardize the architecture while empowering execution. Define the critical requirements, decision rights, controls, data definitions, and accountability, then allow capable leaders closest to the work to execute within those boundaries.

Developing Leaders and Distributing Decisions

This was perhaps my most important lesson from ATI. As the organization grew, people closest to the work needed the judgment, skills, confidence, and authority to lead without waiting for senior management to provide every answer.

One of our most effective mechanisms was surprisingly simple: the weekly operations meeting. My direct reports participated, but we also used the meeting as a development opportunity for their designated alternates. It became far more than a performance review.

For me, it provided organizational intelligence. I could hear what was happening from leaders closest to the work, recognize patterns, and identify emerging workforce or customer issues. For my direct reports, it became a peer-learning forum where a solution developed in one part of the organization could quickly become useful somewhere else. For the alternates, it provided leadership development in real time. Future leaders gained exposure to broader business issues and observed how decisions were made before assuming larger responsibilities.

The meeting also became a two-way communication conduit. Information traveled upward from operations, expectations moved back into the workforce, and knowledge traveled horizontally among leaders. One management mechanism supported performance, communication, learning, succession, culture, and leadership development. That is leadership leverage.

A scalable organization also cannot depend on the senior leader personally following every initiative. Clear ownership, operating reviews, enterprise councils, escalation thresholds, executive sponsorship, transparent measures, and disciplined follow-through allow accountability to operate without constant intervention.

This creates a useful test of organizational maturity: how many good decisions can the organization make without requiring senior executive involvement?

If routine decisions continually migrate upward, the organization may have hierarchy, but it has not achieved scale. This idea also has a strong foundation in research on high-reliability organizations. Weick and Sutcliffe describe deference to expertise as an important characteristic of organizations operating successfully in complex, high-risk environments. Decision-making does not automatically remain with the highest-ranking person. When conditions require it, authority moves toward those with the expertise and operational knowledge needed to understand the situation.

That principle has important implications for enterprise EHS leadership. The executive should become directly involved when an issue requires something only that level can provide, such as enterprise direction, significant resource decisions, executive influence, resolution of systemic barriers, major risk decisions, talent decisions, or governance. Everything else should occur at the lowest appropriate accountable level.

Delegation is not disengagement. The leader remains accountable for the system without personally performing the work of the system.

Technology, AI and Continuous Visibility

Historically, one reason senior leaders became deeply involved in operational detail was simple: that was often how they learned what was happening. Digital systems increasingly remove that constraint.

A well-designed EHS technology architecture can provide continuous visibility into critical controls, serious-risk indicators, overdue high-risk actions, audit findings, incidents, environmental performance, regulatory issues, and management-system effectiveness. Instead of repeatedly asking people to create presentations explaining what happened last month, leaders can increasingly operate from continuous information and exception-based reporting.

AI extends that capability. Properly designed AI systems can identify patterns across incidents, audits, corrective actions, risk assessments, operational data, and lessons learned that would be extremely difficult for an individual leader, or even a team, to recognize manually.

AI can also help distribute institutional knowledge. Experienced professionals accumulate decades of expertise in investigations, regulations, critical controls, human performance, process safety, and environmental management. Historically, transferring that expertise depended largely on procedures, training, mentoring, or direct consultation. AI can make portions of that knowledge available much closer to the moment someone needs it.

That creates another form of leadership leverage: the scarce expertise of a few becomes more accessible to many.

There is an important boundary, however. Scaling judgment is not the same as outsourcing accountability. AI can surface information, test reasoning, identify patterns, and expand analytical capacity. Qualified people must remain accountable for consequential decisions. The objective should be Humans + AI: machine capability expanding the reach of human expertise while people retain judgment and responsibility.

Lead Through Cadence, Communication and Capability

The operating system also needs rhythm. At ATI, the weekly operations meeting created that rhythm. At enterprise scale, the mechanisms may include weekly leadership forums, monthly operating reviews, critical-risk councils, communities of practice, quarterly executive reviews, talent and succession reviews, and board reporting.

The exact cadence matters less than its purpose. Each forum should exist for a reason: decision, escalation, learning, accountability, talent development, or information exchange. If a meeting exists only to move information that a dashboard could provide, it should probably be redesigned.

The leader’s interactions with direct reports should be frequent enough to maintain alignment and influence without creating dependence. Those conversations should increasingly focus on priorities, emerging risks, barriers, talent, cross-enterprise learning, and decisions, not detailed supervision of work that has already been delegated. In that sense, leadership communication itself becomes part of the operating system.

Traditional EHS measures remain useful, but most tell us what has already happened. TRIR, DART rates, spills, regulatory events, and lost-time cases provide important information. They do not necessarily tell us whether the organization is becoming more capable of preventing tomorrow’s event.

An operating system for EHS at scale therefore needs measures of capability and resilience, including critical-control reliability, leadership engagement, learning effectiveness, corrective-action quality, management-system performance, risk reduction, digital adoption, and other indicators that reveal whether the underlying system is strengthening.

The question shifts from “What were our results?” to “Are we building an organization increasingly capable of producing the results we want?” That is a much more powerful management question.

Focus on What Only You Can Do

Perhaps the most difficult element of leadership at scale is deciding what not to do.

Successful professionals are often promoted because they are good at solving problems. Knowing the details, making decisions, and personally driving work helped make them successful. At enterprise scale, those same behaviors can become constraints.

A senior EHS leader should periodically examine their calendar and ask what they are doing that someone else should own, and what can be delegated, automated, simplified, or stopped. Routine investigation details, low-risk approvals, manually assembling reports, chasing site corrective actions, and attending meetings that function perfectly well without the executive are usually poor uses of senior leadership capacity.

That time should migrate toward activities where executive leverage is greatest: enterprise strategy, critical risks, leadership development, executive and board influence, organizational capability, governance, major transformation, and removing barriers others cannot remove.

This may be the most important test of whether the operating system is actually working: can the leader step away without routine execution slowing down? If not, the organization may still be scaling the leader’s effort rather than scaling the leader’s impact.

Building an Adaptive Learning Organization

The final multiplier is learning.

Incidents, near misses, audits, operational experience, successful practices, and weak signals should not remain isolated within the locations where they occurred. Information needs to move across the enterprise, become organizational knowledge, and ultimately change decisions.

Again, I can trace this idea back to our ATI operations meeting. Information came upward, moved horizontally among leaders, and traveled back into the organization. Today, digital systems and AI allow us to imagine that same learning loop operating continuously across a global enterprise.

An incident at one facility should not simply become a report stored in a database. It can become part of an organizational knowledge system capable of connecting the event with previous experience, identifying similar exposures elsewhere, recognizing emerging patterns, and delivering relevant insight to people confronting similar circumstances.

The technology has changed dramatically. The principle has not. Information only creates value when it moves, becomes knowledge, and ultimately influences decisions.

The Leadership Paradox

There is a paradox at the center of scaling professional impact: as your responsibility becomes larger, your personal involvement in individual activities often has to become smaller.

That can be uncomfortable. I experienced it as ATI Worksite Solutions grew. An operating style that worked with 15 people could not possibly work with 300. The answer was not to work 20 times harder. It was to create leverage through people, systems, governance, communication, technology, and organizational learning.

Today, AI gives us another potentially powerful multiplier. But none of these mechanisms removes the need for leadership. They change where leadership is applied.

The enterprise leader becomes less valuable as the person who personally knows every detail and more valuable as the architect of the system that ensures the right people know the right details, make the right decisions, escalate the right issues, and continuously improve the organization.

Early in our careers, the equation is largely additive: my expertise plus my effort equals my contribution. Leadership changes the equation. Your knowledge develops other leaders. Those leaders influence hundreds or thousands of employees. Management systems shape actions you will never personally see. Governance distributes accountability. Communication networks move knowledge. Digital tools create visibility. AI expands access to expertise. Organizational learning improves future decisions.

That is the Leadership Multiplier.

The job is not to make thousands of good decisions. The job is to build an organization capable of making thousands of good decisions every day.

References and Further Reading

Weick, K. E., & Sutcliffe, K. M. (2015). Managing the unexpected: Sustained performance in a complex world (3rd ed.). Jossey-Bass. https://doi.org/10.1002/9781119175834

Christianson, M. K., Sutcliffe, K. M., Miller, M. A., & Iwashyna, T. J. (2011). Becoming a high reliability organization. Critical Care, 15(6), 314. https://doi.org/10.1186/cc10360

Kouzes, J. M., & Posner, B. Z. (2023). The leadership challenge: How to make extraordinary things happen in organizations (7th ed.). Jossey-Bass.

Pertusa-Ortega, E. M., & Molina-Azorín, J. F. (2018). A joint analysis of determinants and performance consequences of ambidexterity. BRQ Business Research Quarterly, 21(2), 84–98. https://doi.org/10.1016/j.brq.2018.03.001

Sadowski, J. P., & Howard, J. (2026, January 18). Practical strategies to manage AI hazards in the workplace. National Institute for Occupational Safety and Health.

Posted in Business Accumen, EHS Management, enterprise risk management, Leadership, Leading at Scale, operational integrity | Tagged , , , , , , , , , , | Leave a comment

Inherited Risk Ecosystem: How Upstream Decisions Shape Human Error at the Point of Work

By Chet Brandon, CSP, CHMM

The Risk Was Already There

After a serious workplace event, organizations often move quickly to the final action. A worker reached into a pinch point. A mechanic cleared a jam under pressure. An operator opened the wrong valve. A contractor misunderstood the permit boundary. A technician accepted an exposure because the task had become routine.

Those actions matter. They need to be understood. But they are rarely the full story.

Across my career, I have seen many events where the final action was easy to identify, but the real risk was created much earlier. A worker made the last move, but the exposure had already been shaped by equipment design, planning decisions, staffing assumptions, maintenance history, production pressure, and accepted workarounds. That is why serious investigations need to follow risk upstream before settling on conclusions about behavior at the point of work.

In industrial work, risk often exists long before the final task begins. It may have been created by a design compromise, increased by deferred maintenance, reinforced by production pressure, normalized by repeated workarounds, and left unresolved by weak corrective action. By the time the worker performs the task, the risk environment may already be built around them.

The better question is not simply, “Why did the worker make the mistake?”

The better question is, “What risk environment did the worker inherit before the task ever began?”

That question is the foundation of what I call the Inherited Risk Ecosystem.

Defining the Inherited Risk Ecosystem

An Inherited Risk Ecosystem is created when upstream decisions, risk actions, weak controls, workarounds, and cultural norms interact in ways that shape the risk present at the point of work.

Put more simply:

Risk is created upstream, combined and amplified within the work environment, inherited downstream, and revealed at the point of work.

This concept builds on established human performance, hierarchy of controls, and Operational Integrity principles. Its specific contribution is to focus on how upstream decisions and interacting work conditions are inherited by the person performing the final task. Human error by itself has limited value as an incident cause unless the organization understands why the behavior occurred, and stronger controls reduce dependence on perfect human performance.

The word ecosystem is important. This concept is not just about a list of separate hazards. It is about the interaction of risk actions and risk conditions that accumulate inside the work environment.

A maintenance deferral may not create a serious exposure by itself. A tight production schedule may not create a serious exposure by itself. A difficult access point may not create a serious exposure by itself. A procedure that is slightly out of date may not create a serious exposure by itself. But when those conditions interact, the work environment changes. The worker is no longer managing one hazard or one imperfect condition. The worker is operating inside a combined risk environment shaped by multiple upstream choices.

That is the ecosystem.

Risk Interaction Is the Multiplier

Industrial risk is often nonlinear. One weak condition may be manageable. Two or three weak conditions interacting can create a serious exposure. The combined risk can be greater than the sum of the individual parts.

A design compromise interacts with a maintenance backlog. A maintenance backlog interacts with production pressure. Production pressure interacts with a workaround. The workaround interacts with weak supervision. Weak supervision interacts with a procedure that no longer reflects the real task. Over time, these conditions do not remain isolated. They begin to define the operating reality.

This is why leaders must look not only at individual risk factors, but at the way those factors connect, reinforce, and amplify each other. The organization may believe it is managing several small issues. In reality, those issues may be combining into one larger exposure.

This is where many serious events begin. Not with one dramatic failure, but with several ordinary weaknesses interacting in a way no one has fully recognized.

Human Error Is Shaped by the Context of Work

The concept of inherited risk connects directly to the human performance principle that error is shaped by context. People do not perform work in a vacuum. They work inside real conditions: production pressure, heat, fatigue, noise, limited access, incomplete tools, unclear procedures, poor lighting, conflicting priorities, peer norms, and leadership expectations.

The Department of Energy’s Human Performance Improvement Handbook, Volume 1 states it well: “Human error is not random; it is systematically connected to features of people’s tools, the tasks they perform, and the operating environment in which they work.” That statement aligns directly with the Inherited Risk Ecosystem concept: the final human action is often connected to the work environment created upstream.

A worker may not bypass a step simply because of poor judgment. The worker may be responding to a procedure that does not match the actual job, equipment that is difficult to access, a schedule that rewards speed, a history of tolerated shortcuts, and a supervisor who has seen the practice before without intervening.

In that moment, the human error is not isolated from the work system. It is a predictable response to the combined conditions in the ecosystem.

The goal is not to excuse error. The goal is to understand why the error made sense to the person at the time, inside the conditions they were facing. If we only label the act as a mistake, we may miss the system that made the mistake more likely. If we understand the context, we have a better chance of changing the conditions that shaped the behavior.

A Practical Way to Express Inherited Risk Quantitatively

There is value in expressing the Inherited Risk Ecosystem concept quantitatively, as long as the number is used as a leadership aid rather than false precision. The purpose is not to create a perfect mathematical model. The purpose is to make interacting risk visible.

A useful model is:

Inherited Risk Ecosystem Score = Base Task Risk × Ecosystem Interaction Multiplier

In practical terms, a higher Inherited Risk Ecosystem Score means the task is carrying more inherited risk into the field and should receive a higher level of planning, verification, and control before work proceeds.

Where:

Base Task Risk = Severity × Exposure × Likelihood

A simplified expression would be:

IRES = S × E × L × [1 + ΣM + ΣI]

In this model, S is severity potential, E is exposure frequency or duration, and L is likelihood under normal task conditions. M represents individual inherited risk modifiers, such as poor access, deferred maintenance, staffing limitations, unclear procedures, or production pressure. I represents interaction effects between risk factors, such as poor access combined with time pressure, an outdated procedure combined with weak supervision, or deferred maintenance combined with restart urgency.

The value of the model is that it forces leaders to ask whether the task is being evaluated as it appears on paper or as it actually exists in the field.

A maintenance task may have moderate base risk when viewed by itself. But if poor access, production pressure, deferred maintenance, weak supervision, and a procedure gap are all present, the risk profile changes. If those conditions also reinforce each other, the task may function as a high-risk activity even though it was not originally classified that way.

The number matters less than the discipline behind the number. The real leadership value is recognizing that ordinary risk factors can combine into extraordinary exposure.

This approach fits the EHS data-analysis method I outlined in “EHS Data Analysis Heuristics: Turning Performance Data Into Better Decisions”: start with trend review, identify the top recurring drivers through Pareto logic, compare the Best of the Best with the Worst of the Worst, look for severe exposures that may be hidden in the data, and test whether corrective actions are strong enough to control the real risk.

To make this concept easier to apply, I have also developed a practical Inherited Risk Ecosystem Score spreadsheet in excel that allows leaders, EHS professionals, supervisors, and work teams to evaluate a task using the model described above. The tool walks the user through base task risk, inherited risk modifiers, and interaction effects so the team can see whether the task is being evaluated as it appears on paper or as it actually exists in the field. The spreadsheet is not intended to replace professional judgment, pre-job planning, or required risk assessment processes. Its value is that it creates a disciplined conversation about the combined work conditions that may be increasing risk before the task begins. A downloadable copy is available here: [download link].

Trained AI models could significantly improve how organizations evaluate incidents and audit findings through the Inherited Risk Ecosystem Score framework. By rapidly reviewing narratives, observations, corrective actions, and recurring themes, AI can help identify inherited risk modifiers, interaction effects, upstream decision points, and control gaps that may be difficult to detect through manual review alone. This could enable faster screening, more consistent analysis, and earlier recognition of systemic patterns across multiple events or locations. I have created a purpose-built GPT to explore this concept and demonstrate how AI can support IRES-based analysis while keeping field verification, professional judgment, and leadership accountability at the center of the process. Explore the AI IRES tool: https://chatgpt.com/g/g-6a63ed2c0b8c819181357d09292c328c-inherited-risk-ecosystem-evaluation-tool

Understanding the Ecosystem Interaction Multiplier

The Ecosystem Interaction Multiplier is the part of the model that makes the Inherited Risk Ecosystem concept different from a traditional task risk score. Traditional risk scoring often evaluates the task as if the conditions around it are stable and independent. In real work, they rarely are.

The multiplier accounts for two things. First, it recognizes the presence of individual inherited risk modifiers, such as poor access, production pressure, deferred maintenance, unclear procedures, fatigue, contractor unfamiliarity, or weak supervision. Second, it recognizes the interaction between those modifiers. This is where the ecosystem effect occurs.

Poor access is one issue. Poor access combined with time pressure is a larger issue. Poor access, time pressure, an outdated procedure, and a normalized workaround create a different risk environment altogether. The multiplier is a practical way to show that risk factors can combine, reinforce, and amplify each other.

The value of the multiplier is not mathematical perfection. Its value is discipline. It forces the organization to ask, “Are we looking at this task by itself, or are we looking at the real work environment that surrounds the task?”

This fits the broader EHS analysis approach of looking for trends, recurring drivers, clusters, outliers, and high-impact exposures rather than reacting only to the visible event at the end of the process.

Connection to Operational Integrity and the Operating Envelope

The Inherited Risk Ecosystem concept also connects directly to Operational Integrity, particularly the idea of the operating envelope.

In many organizations, the operating envelope is understood mainly as the technical boundary of the process: pressure, temperature, flow, speed, concentration, load, or equipment capacity. Those limits matter, but they are not the whole envelope. CCPS guidance on operating procedures recognizes the importance of establishing a safe operating envelope and keeping procedures current when operating methods or related information change.

In real industrial work, the operating envelope also includes the work conditions required to keep the task safe, reliable, compliant, and under control. Procedures, permits, staffing, supervision, competency, tools, maintenance readiness, engineering controls, and field verification are all part of the practical operating envelope. CCPS also frames conduct of operations as deliberate, structured execution of operational and management tasks, tied closely to culture and the minimization of performance variation.

A process may still be within pressure and temperature limits, but the work may already be outside the safe operating envelope if the task depends on a tired crew, an accepted workaround, poor access, an outdated procedure, and a supervisor under restart pressure.

That is the practical value of the Inherited Risk Ecosystem concept. It helps leaders see that the technical process can look stable while the work system is becoming unstable.

A Simple Quantitative Example

Assume a maintenance task has a base risk score of 60, based on severity, exposure, and likelihood:

Base Task Risk = S × E × L = 5 × 4 × 3 = 60

Under normal conditions, that score may suggest a controlled but meaningful risk. However, the field conditions show several inherited risk modifiers: poor access, production pressure, a deferred repair, and an outdated procedure. Those modifiers add 0.60 to the multiplier.

The task also has interaction effects. Poor access is made worse by time pressure. The outdated procedure is made worse by weak field verification. The deferred repair is made worse by restart urgency. Those interactions add another 0.40.

The 0.40 interaction value is estimated by identifying combinations of risk factors that make each other worse. For example, poor access combined with time pressure may add 0.15, an outdated procedure combined with weak field verification may add 0.10, and deferred maintenance combined with restart urgency may add 0.15. These values are not intended to imply mathematical precision. They are a disciplined way to make risk interaction visible and to prevent leaders from treating connected weaknesses as isolated issues.

The calculation becomes:

IRES = 60 × [1 + 0.60 + 0.40]

IRES = 60 × 2.0

IRES = 120

The point is not that 120 is a perfect mathematical value. The point is that the task no longer functions like a 60. Once inherited risk modifiers and their interactions are considered, the work behaves more like a 120. That should trigger a different level of planning, verification, and control.

Inherited Risk as Operating-Envelope Stress

Inherited risk can be understood as stress on the operating envelope.

The operating envelope is not only the boundary of what the equipment or process can safely tolerate. It is also the boundary within which work can be performed safely, reliably, and predictably. That boundary depends on more than technical limits. It depends on the strength of controls, the quality of planning, the accuracy of procedures, the availability of tools, the readiness of equipment, the competency of people, and the discipline of supervision.

When upstream decisions and weak controls interact, they consume margin.

A deferred repair consumes margin. A workaround consumes margin. A procedure that no longer matches the task consumes margin. Production pressure consumes margin. Poor access consumes margin. Weak supervision consumes margin. Each condition may appear manageable on its own, but together they can push the work outside the real operating envelope.

Leaders do not need a second formula to recognize this. They need to ask a disciplined question:

Are the combined conditions of the work still within the capacity of our controls?

If the answer is no, the task has moved into abnormal risk, even if the equipment is running, the job is scheduled, and the work appears routine.

This is where Operational Integrity has to become practical. It is not enough to know that the process is within technical limits. Leaders also need to know whether the work system is still strong enough to control the risk being inherited at the point of execution.

Applying the Concept in the Workplace

The practical value of this concept is not academic. It changes how leaders review work, investigate events, design corrective actions, and manage operational risk.

In pre-job planning, leaders should ask whether the task is carrying inherited risk. Was the risk created by design? Was it increased by maintenance backlog? Was it compressed by schedule pressure? Was it transferred through contractor scope? Was it normalized through prior workarounds? Are workers being asked to compensate through attention, PPE, skill, body positioning, or judgment?

In field verification, supervisors and EHS professionals should look for combinations of weak signals, not just individual deficiencies. A missing tool is one issue. A missing tool combined with time pressure, poor access, and a known workaround is a different risk picture. That combination may indicate the task has moved outside the operating envelope.

In incident investigation, the review should not stop at the final act. A weak investigation says, “Employee failed to follow procedure.” A stronger investigation asks, “What upstream decisions made this failure more likely?” An executive-level investigation asks, “Where did our management system allow this risk to be created, transferred, normalized, or left unresolved?”

In corrective action development, corrective actions must move upstream. Retraining may be necessary, but it is rarely sufficient if the inherited risk remains in the system. Stronger corrective actions address design, access, tools, staffing, planning, scheduling, supervision, maintenance reliability, contractor management, and management of change.

In Operational Integrity governance, leaders should treat recurring workarounds, high-energy near misses, repeated procedure deviations, unresolved maintenance issues, and production-driven risk acceptance as evidence of operating-envelope stress. These are not just local problems. They may be signals that the organization is allowing inherited risk to accumulate faster than controls are being strengthened.

A Workplace Example: Line-of-Fire Exposure

Consider a line-of-fire injury during equipment clearing. The immediate finding may be, “Employee placed hand in pinch point.” That may be true, but it is incomplete.

The Inherited Risk Ecosystem view asks a different set of questions. Was the equipment designed for safe jam clearing? Was the jam condition recurring? Was jam frequency being tracked and escalated? Was the right tool available? Did production pressure influence the decision? Had supervisors seen the workaround before? Did the procedure match the real task? Was lockout practical for the frequency and nature of the issue? Had maintenance, engineering, and operations begun treating the jam as normal?

The worker’s hand in the pinch point is the final event. The inherited risk may include design weakness, poor reliability, production pressure, weak supervision, inadequate tools, and normalized deviation. Corrective action should not stop at retraining. Retraining may be necessary, but if the organization leaves the equipment condition, production pressure, procedure weakness, and workaround culture unchanged, the risk remains in the system.

A Workplace Example: Process Still Stable, Work System Unstable

Consider a process unit preparing for restart. The process parameters may be within acceptable limits. The equipment may not be in alarm. The control room may show a stable picture. From a technical standpoint, the system may appear to be inside the operating envelope.

But the work system may tell a different story. Maintenance was delayed. A valve is difficult to access. The restart window is compressed. The procedure has not been updated after a field modification. The crew is working extended hours. A supervisor is focused on production recovery. Operators have developed an informal workaround because the formal method is slow and awkward.

In this case, the equipment may still be within technical limits, but the work is drifting outside the practical operating envelope. The inherited risk ecosystem has become the real exposure.

That is exactly the type of situation leaders need to see before the event occurs.

Questions Leaders Should Ask

The leadership test is straightforward. When reviewing high-risk work or investigating an event, leaders should ask whether the work is still operating within the assumptions of the design. They should ask whether procedures match the real work, whether controls are strong enough for current conditions, whether workarounds have become normalized, whether production demands have exceeded the capacity of the control system, whether workers are being asked to compensate for upstream weakness, and whether multiple small deviations have combined into a material exposure.

Those questions move the conversation from blame to control. They also place accountability at the right level.

Workers are accountable for choices within their control. Supervisors are accountable for expectations and verification. Managers are accountable for planning, resources, staffing, and production pressure. Engineering is accountable for design and maintainability. Procurement is accountable for supplier and contractor risk. Executives are accountable for the system of priorities, governance, and risk tolerance. EHS is accountable for helping the organization see the ecosystem clearly before inherited risk becomes injury, exposure, release, or fatality.

Final Thought

The Inherited Risk Ecosystem concept gives EHS and operational leaders a more complete way to understand work. It recognizes that risk flows through the organization. It can be designed in, purchased in, scheduled in, normalized in, supervised in, or left in place by weak corrective action.

More importantly, those risks interact. They combine, reinforce, and amplify each other inside the work environment.

When I review a serious event, I am less interested in finding the first person to blame and more interested in finding the earliest point where the risk could have been recognized and controlled.

If we want better safety performance, we need to stop treating human error as the starting point of investigation. More often, human error is the point where upstream decisions and operating conditions finally become visible.

Risk is created upstream, combined and amplified within the work environment, inherited downstream, and revealed at the point of work.

The organizations that understand that will investigate better, plan better, lead better, and protect the operating envelope before normal work quietly becomes abnormal risk.


References and Further Reading

Brandon, C. — EHS Data Analysis Heuristics: Turning Performance Data Into Better Decisions. This article provides the EHS data-analysis framework referenced in this discussion, including trend review, Pareto logic, BOBs/WOWs comparison, severe-exposure review, hierarchy-of-controls thinking, corrective-action strength, prioritization, and ethical defensibility. It supports the Inherited Risk Ecosystem concept by showing how leaders can recognize patterns, recurring drivers, weak controls, and high-impact exposures before they become serious events. (leadingehs.com)

Brandon, C. — Operational Integrity: The Operating Model Heavy Manufacturing Needs. This article provides the broader Operational Integrity framework referenced in this discussion, including the operating envelope, operational discipline, operational reliability, operational resilience, and leadership cadence. It is especially relevant to the Inherited Risk Ecosystem concept because it describes how heavy manufacturing risk often fails “in layers” through bypassed procedures, degraded equipment condition, normalized workarounds, weak signals, and erosion of operational control.

CCPS / AIChE — Introduction to Conduct of Operation and Operational Discipline This source supports the Operational Integrity connection by defining conduct of operations as deliberate, structured execution of operational and management tasks tied to culture and consistency of performance. This reference also discusses operational discipline and it supports the broader operating-discipline concept that reliable execution of work is an essential part of process safety and operational excellence.

CCPS / AIChE — Introduction to Operating Procedures. This source supports the discussion of operating procedures, safe operating envelopes, and the need to keep procedures current when operating methods or related information change.

Energy Institute — Human Factors Briefing Note No. 12: Human Error and Non-Compliance. This reference supports the article’s position that “human error” alone is an incomplete incident cause and that different forms of human failure have different causes and require different remedial actions.

James Reason — Human Error: Models and Management. Reason’s work remains foundational for understanding the difference between person-focused and system-focused approaches to human error, including active failures, latent conditions, and system defenses.

NIOSH — Hierarchy of Controls. NIOSH presents the hierarchy of controls as a preferred order of actions to reduce or remove workplace hazards, with elimination, substitution, and engineering controls generally more effective because they control exposures with less reliance on human interaction.

U.S. Department of Energy — Human Performance Improvement Handbook, Volume 1: Concepts and Principles, DOE-HDBK-1028-2009. This handbook provides a useful foundation for the human-error-prevention concepts behind the Inherited Risk Ecosystem model. Volume 1 addresses human performance principles, error-likely situations, flawed controls, latent organizational weaknesses, and the role of leaders and organizations in reducing error and strengthening defenses. It supports the article’s premise that human error should not be treated as an isolated final act, but as an outcome shaped by work context, organizational conditions, and the quality of controls at the point of work.
https://www.energy.gov/ehss/articles/doe-hdbk-1028-2009

Posted in Artificial Intelligence, Culture, Design for Safety, EHS Management, enterprise risk management, Innovation, operational integrity, psychological-safety, risk management, Technical Skills | Tagged , , , , , , , , , , , , , , , , , , , , | Leave a comment

Leonardo’s Lesson: Harmony Begins With Observation

The Method Behind the Genius

I have been reading Walter Isaacson’s biography of Leonardo da Vinci. I expected to be impressed by the art, the inventions, and the range of Leonardo’s mind.

I was.

But what has stayed with me most is not simply the genius. It is the method.

Leonardo observed.

He observed water moving around obstacles. He studied birds in flight. He examined muscles, bones, light, shadow, plants, machines, geometry, and motion. He wanted to know how things worked. Not approximately. Not casually. Deeply.

That is an important distinction.

Many people look. Leonardo studied.

He also practiced something that anticipated what we now recognize as the scientific method. He observed carefully, questioned accepted explanations, tested ideas against experience, and revised his understanding when reality demanded it. That matters for leadership because organizations are full of inherited assumptions. Some are useful. Some are outdated. Some are simply wrong. The leader’s job is not to defend the assumption. The leader’s job is to test it against the work.

Isaacson’s portrait of Leonardo’s curiosity and observational discipline caused me to think about what modern leaders can learn from that same method. Leonardo did not seem satisfied with knowing that something happened. He wanted to know why it happened, how it behaved, what forces shaped it, and how that knowledge could be applied.

That habit of disciplined observation may be the most useful leadership lesson in his life. His work reminds us that nature is not random disorder. It is full of pattern, proportion, adaptation, force, resistance, flow, and consequence. When we take the time to observe those patterns, we learn how to work with reality rather than simply impose our will on it.

Proportion, Pattern, and the Human Place in Nature

That brings me to one of Leonardo’s most recognized images: Vitruvian Man.

The drawing is familiar to almost everyone. A human figure stands with arms and legs extended in two positions at once, inscribed inside a circle and a square. The body is centered, but not static. It reaches. It measures. It connects geometry, movement, and human proportion in one image.

At one level, it is a study of the human body. At another, it is a statement about the relationship between human beings, design, structure, and the natural order.

Walter Isaacson captures the importance of the drawing well. He describes Vitruvian Man as a moment when “art and science combined,” and later as humanity “standing naked at the intersection of the earthly and the cosmic.” (Issacson, 2017)

“It’s an idea worth sitting with…”

That is part of what fascinates me about Leonardo. He was not only an artist creating images. He was a discoverer of truths about ourselves and our world. Through observation, measurement, imagination, and disciplined curiosity, he gave us a lens on humanity that still feels alive centuries later. In Vitruvian Man, we see the human body as physical form, but also as a question: How do we fit within the larger order of nature, reason, and the universe?

It is beautiful, but it is not merely decorative.

It is disciplined thinking made visible.

The circle and square suggest structure. The body reminds us that human beings are not separate from nature. We are part of it. Leonardo was exploring whether the human form reflected a broader pattern of order, proportion, and relationship.

That idea is worth sitting with.

Not because every natural form should be forced into a mathematical claim. That is a trap. Not every shell, leaf, river, wing, or face needs to become proof of the golden ratio to be meaningful. Overstating the math weakens the lesson.

The stronger point is this: nature operates through relationships.

Proportion matters. Balance matters. Form and function are connected. Systems have limits. Forces interact. What appears beautiful is often also effective.

Nature rewards fit.

Operations do too.

A manufacturing site, laboratory, maintenance job, transportation network, chemical process, or sustainability program all have their own proportions. People, equipment, energy, materials, procedures, supervision, environmental limits, customer expectations, and regulatory obligations all operate in relationship to each other.

When those relationships are healthy, the work has flow. Planning is clear. Energy is controlled. People understand the risk. Environmental obligations are built into the process. Maintenance supports reliability. Contractors know the boundaries of the job. Leaders verify the critical controls. Corrective actions close the weakness, not just the finding.

When the proportions are wrong, the operation tells us.

It tells us through injuries, near misses, spills, permit deviations, quality defects, production interruptions, excessive waste, employee frustration, weak audit findings, and recurring corrective actions that never stay corrected.

The operation is speaking.

The question is whether we are observing closely enough to hear it.

What Light Reveals

Leonardo’s study of light adds another important lesson. He understood that light does not simply illuminate an object. It reveals form, depth, texture, distance, and relationship. He studied how light moved across surfaces, how shadows softened edges, how reflection changed perception, and how careful use of light could make a painting feel alive.

That was not just artistic technique. It was disciplined observation of physical reality.

Leadership has a similar requirement.

A leader’s job is not only to look at the obvious object in front of them. It is to understand what the light is revealing and what the shadows may be hiding. The same process can look very different depending on where you stand, what questions you ask, and how much of the surrounding condition you are willing to see.

The Risk of Motion Without Understanding

That matters greatly in manufacturing organizations.

There is a common pressure on incoming leaders and newly promoted leaders to move quickly, make visible changes, and disrupt the status quo. Some of that pressure is understandable. Leaders want to show energy. They want to demonstrate value. They want to prove that their selection was justified.

But speed without understanding is not leadership.

It is motion.

Too often, the result is blind action taken in the hope of better outcomes. A structure is changed before the work is understood. A metric is replaced before the behavior behind it is known. A meeting cadence is disrupted before its real purpose is clear. A procedure is rewritten before the field condition is observed. A team is reorganized before the informal operating system is understood.

That kind of change may look decisive from a distance, but inside the organization it often creates chaos, confusion, and wasted energy.

People stop improving the work and start reacting to the leader.

That is not transformation. It is turbulence.

There are certainly times when leaders must act quickly. High-risk conditions, ethical concerns, regulatory exposure, and serious performance failures require timely intervention. Observation is not an excuse for delay when credible risk is present.

But in most situations, the first obligation of a new leader is to understand the pattern before changing the geometry.

Where is the real constraint?

Which practices are outdated, and which are holding the system together?

Where are people compensating for weak design?

Which routines create control, and which merely consume time?

Where is the organization stable for good reasons?

Where is the status quo protecting risk rather than controlling it?

Those questions require disciplined observation. They require time in the plant. They require listening to operators, maintenance personnel, supervisors, EHS professionals, engineers, planners, and site leaders. They require enough humility to recognize that every existing practice has a history. Some practices need to be challenged. Others need to be understood before they are disturbed.

Observe deeply. Plan intelligently. Act decisively. Adapt when reality teaches you something.

Strategy and action have to survive contact with operational reality. A leader who changes the work before understanding the work may create movement, but not improvement.

No plan survives long unless it is tested against reality. In manufacturing, that reality is the work itself: the equipment, the people, the energy, the constraints, the culture, and the conditions in the field. Strategy and action have to survive contact with operational reality.

Leonardo would not have painted light before studying how it behaved.

Leaders should not redesign work before studying how it operates.

Better Light, Better Questions

An incident report may show that an employee stepped into the line of fire. Better light may reveal poor layout, unclear work sequencing, schedule pressure, inadequate tools, weak supervision, or a job plan that did not match the work as performed.

An environmental finding may show a missed inspection. Better light may reveal aging infrastructure, unclear ownership, inadequate training, insufficient management review, or a compliance process that depends too much on memory.

A repeated corrective action may show that people did not follow a procedure. Better light may reveal that the procedure is compensating for poor design.

That is where Leonardo’s method becomes practical. He did not begin with the answer. He began with attention. He followed curiosity. He connected disciplines. Anatomy informed art. Water informed engineering. Geometry informed design. Light informed perception. Observation informed imagination.

That is a good model for modern leadership.

Too often, organizations rush to the solution before they understand the condition. A procedure is revised. A training module is assigned. A campaign is launched. A dashboard is built. A slogan is introduced. Some of those actions may be useful. They may also miss the real issue.

The value is not in activity.

The value is better control of the process.

If a site has repeated line-of-fire exposures, the issue may not be awareness alone. It may be poor job planning, equipment layout, supervision quality, schedule pressure, inadequate tools, weak pre-task review, or a culture that has normalized exposure because “that is how the job gets done.”

If energy isolation findings repeat, the issue may not be that people do not know the rule. It may be unclear system boundaries, inconsistent lockout points, production pressure, poor drawings, contractor interface problems, or a permit process that works better on paper than in the field.

If environmental compliance issues continue to return, the issue may not be lack of intent. It may be weak ownership, aging infrastructure, poor inspection routines, ineffective change management, or operating conditions that have drifted away from the assumptions in the permit.

In each case, the leader has a choice.

React to the event, or study the work.

Leonardo would study the work.

That does not mean paralysis by analysis. It means disciplined observation before action. It means looking for proportion, relationship, pattern, light, shadow, and consequence. It means asking better questions.

Where is the energy?

Where are people placed in relation to that energy?

Where does the process depend too heavily on perfect human behavior?

Where do we see recurring variation?

Which sites, teams, or shifts are performing better, and what are they doing differently?

Where are we asking a procedure to compensate for a design problem?

Where are we treating sustainability as a reporting exercise instead of an operating discipline?

Those are not abstract questions. They are leadership questions.

Sustainability as Operating Discipline

Sustainability especially requires this kind of thinking. Real sustainability is not just a report, a rating, or a public commitment. Those things may matter, but they are not the work itself. The work is understanding how the organization uses energy, water, raw materials, transportation, packaging, land, technology, and human capability to create value.

A sustainable enterprise learns to operate with the pattern instead of against it. It reduces waste because waste is a signal of poor fit. It controls emissions because emissions are material leaving the intended process. It protects workers because people are not disposable inputs. It designs safer products because stewardship does not end at the shipping dock. It treats compliance as the floor, not the ceiling.

Compliance is the floor.

Harmony is not a substitute for discipline. It is the result of discipline.

That is important. It is easy to talk about harmony in nature in a soft or sentimental way. That is not what I mean. Harmony in an operating environment is not passive. It is engineered, led, verified, and maintained.

It requires standards. It requires accountability. It requires curiosity. It requires leaders who will go see the work, listen to the people closest to the risk, and take timely action when things are out of balance.

Leonardo’s genius was not disconnected dreaming. It was disciplined imagination anchored in observation.

Seeing the Whole

That is the leadership challenge for us.

We have to look at our operations with enough curiosity to see what is really happening. Safety, sustainability, compliance, quality, reliability, and culture are not separate realities. They are connected signals from the same operating environment.

When people are too close to energy, when procedures carry too much of the burden, when environmental controls depend too much on memory, when corrective actions are too narrow, or when business pressure distorts risk judgment, the geometry of the work is wrong.

The same is true when leadership action becomes disconnected from operational understanding. Change that is not grounded in observation can distort the organization’s geometry. It can move people, metrics, meetings, and priorities without improving control. It can consume attention without reducing risk. It can make the organization busier without making it better.

Vitruvian Man endures because it captures a powerful idea: the human being exists within a larger order. Leonardo saw proportion in the body, but he also saw the body as connected to design, movement, nature, and the world around it.

His study of light reinforces the same lesson. To understand a thing, we must see how it is shaped, where the shadows fall, and what the surface alone does not reveal.

Modern leaders need that discipline of connection.

We need to see the whole.

Safety, sustainability, and regulatory integrity are not side programs. They are expressions of whether the organization understands and controls its work. When they are strong, the business is usually stronger. When they are weak, the business may still operate for a while, but the imbalance is already there.

Eventually, the operation will reveal it.

Nature is patient, but it is not forgiving of poor design.

Neither are high-risk operations.

Neither are organizations.

The Practical Test

The practical test is simple:

Are we observing deeply enough to understand the pattern, or are we forcing solutions onto work we have not fully studied?

Leonardo reminds us that harmony is not discovered by accident. It is found through observation, clarified by light, tested through discipline, and sustained through better control of the process.

Observe first.

Study what the light reveals.

Connect the patterns.

Respect the system.

Then act.

References

Isaacson, Walter. Leonardo da Vinci. New York: Simon & Schuster, 2017.

Posted in Career Skills, EHS Management, Leadership, Personal Growth, Professional Skills, Sustainability Leadership | Tagged , , , , , , , , , , , , , , , , , , | 1 Comment

Beyond the Factory Fence: Why Scope 3 Defines the Next Generation of Sustainable Operations

An organization can reduce energy consumption, modernize manufacturing equipment, electrify its vehicle fleet, purchase renewable electricity, and substantially lower the greenhouse gas emissions generated by its own facilities.

Those accomplishments matter. But they may not be enough to move the business meaningfully forward on emissions.

For many organizations, most greenhouse gas emissions occur outside the assets they own or directly control. They are embedded in purchased raw materials, supplier operations, transportation networks, employee activities, customer processes, product use, waste treatment, and end-of-life disposal.

An organization may therefore reduce its operational carbon footprint by 30 or 40 percent while making far less progress across its total value-chain footprint.

That distinction is becoming increasingly important.

Customers, investors, employees, regulators, communities, and other stakeholders no longer evaluate an organization’s environmental performance solely by what happens within its factories, offices, and warehouses. They increasingly expect businesses to understand and influence emissions across the broader systems through which products and services are created, delivered, used, and ultimately retired.

It is no longer good enough to reduce only the organization’s own emissions footprint. Meaningful progress must extend across the supply chain and throughout the product lifecycle. That is why Scope 3 emissions have become an essential component of sustainable operations.

The globally accepted framework for categorizing and reporting greenhouse gas emissions is the Greenhouse Gas Protocol, developed by the World Resources Institute (WRI) and the World Business Council for Sustainable Development (WBCSD). Its Corporate Accounting and Reporting Standard and Corporate Value Chain (Scope 3) Standard have become the foundation for greenhouse gas inventories used by governments, investors, customers, and organizations worldwide (Greenhouse Gas Protocol, 2004; Greenhouse Gas Protocol, 2011).

Scope 3 moves the emissions discussion beyond operational efficiency and into enterprise leadership. It requires organizations to engage suppliers, rethink specifications, redesign products, improve transportation systems, collaborate with customers, strengthen data, and influence activities they do not directly control.

Scope 3 is not simply another greenhouse gas reporting category. It is where sustainability becomes a test of how effectively an organization can manage and influence an interconnected business system.

The Evolution of Sustainable Business Performance

Corporate environmental management has evolved significantly.

Early programs focused primarily on regulatory compliance: securing permits, controlling releases, managing waste, and preventing violations. The next stage emphasized operational efficiency. Organizations began recognizing that reducing energy consumption, material losses, water use, and waste could lower both environmental impacts and operating costs. Sustainability then expanded into enterprise-level commitments involving climate targets, environmental, social, and governance reporting, product stewardship, responsible sourcing, and long-term business resilience.

The emerging stage is value-chain sustainability.

In this stage, organizations recognize that their environmental impact is not limited to the property they own. It is shaped by the materials they purchase, the suppliers they select, the transportation they use, the products they design, the customers they serve, and the end-of-life systems associated with those products.

This progression can be summarized as:

Compliance → Operational Efficiency → Enterprise Sustainability → Sustainable Value Chains

Scope 3 emissions sit at the center of this evolution.

Understanding Scope 1, Scope 2, and Scope 3

The Greenhouse Gas Protocol Corporate Accounting and Reporting Standard establishes the internationally accepted framework for categorizing organizational greenhouse gas emissions into three scopes. Scope 1 includes direct emissions, Scope 2 includes indirect emissions associated with purchased energy, and Scope 3 includes other indirect emissions that occur throughout the organization’s value chain (Greenhouse Gas Protocol, 2004).

Scope 1: Direct Emissions

Scope 1 includes emissions from sources an organization owns or directly controls.

Examples include:

  • Fuel burned in boilers, furnaces, kilns, heaters, and process equipment
  • Emissions from company-owned vehicles
  • Process-related chemical emissions
  • Refrigerant leakage
  • Fugitive emissions
  • Emissions from on-site power generation

These emissions are generally the most visible because they occur within the organization’s operational boundary. Facility leaders can meter fuel consumption, inspect equipment, modify processes, repair leaks, replace assets, and verify many resulting improvements.

Scope 2: Indirect Emissions From Purchased Energy

Scope 2 includes indirect emissions associated with purchased electricity, steam, heating, and cooling.

The emissions physically occur at the utility or energy-producing facility, but they are attributed to the organization that consumes the energy.

Scope 2 reduction strategies may include:

  • Improving energy efficiency
  • Reducing electricity demand
  • Electrifying processes where the grid is becoming cleaner
  • Installing on-site renewable generation
  • Purchasing renewable electricity
  • Entering power-purchase agreements
  • Improving load management

Scope 2 emissions are indirect, but organizations usually have access to utility invoices, meter readings, contractual information, and grid-emissions factors. This makes Scope 2 comparatively measurable and manageable.

Scope 3: Other Indirect Value-Chain Emissions

Scope 3 includes other indirect emissions associated with the organization’s upstream and downstream value chain that are not included in Scope 1 or Scope 2.

These emissions occur from sources the organization does not own or directly control, but they are connected to its business activities.

The Corporate Value Chain (Scope 3) Accounting and Reporting Standard expands this framework by defining Scope 3 emissions across both upstream and downstream activities and establishing standardized methods for identifying, calculating, and reporting value-chain emissions (Greenhouse Gas Protocol, 2011).

They can arise from:

  • Purchased raw materials
  • Supplier manufacturing processes
  • Transportation and warehousing
  • Business travel
  • Employee commuting
  • Waste disposal
  • Customer processing
  • Product use
  • Product end-of-life treatment
  • Leased assets
  • Franchises
  • Investments

The Scope 3 emissions reported by one organization will generally appear as Scope 1 or Scope 2 emissions in another organization’s inventory.

A steel producer’s furnace emissions may be part of an automaker’s purchased-material footprint. The automaker’s product may then become part of a retailer’s or financial institution’s Scope 3 footprint. This interconnectedness is not a flaw in Scope 3 accounting. It reflects the reality that different organizations have different opportunities to influence the same emissions. The producer can change the manufacturing process. The customer can change material specifications. The logistics provider can change transportation modes. The investor can influence capital allocation.

Scope 3 makes those relationships visible.

Place the “Greenhouse Gas Protocol Scopes Across the Value Chain” infographic here.

The 15 Categories of Scope 3 Emissions

The Greenhouse Gas Protocol divides Scope 3 emissions into 15 categories: eight upstream categories and seven downstream categories.

These fifteen categories were established by the Greenhouse Gas Protocol Corporate Value Chain (Scope 3) Standard to provide organizations with a comprehensive and consistent approach for evaluating greenhouse gas emissions across their value chains (Greenhouse Gas Protocol, 2011).

Not every category will be equally important to every organization. The purpose is to establish a complete view of the value chain and identify where emissions, risks, and opportunities are concentrated.

Upstream Scope 3 Emissions

Upstream emissions occur before goods and services reach the reporting organization.

1. Purchased Goods and Services

This category includes emissions associated with producing the raw materials, components, packaging, contract services, information technology, and other inputs purchased by the organization.

For industrial companies, purchased chemicals, metals, resins, minerals, glass, cement, fabricated parts, electronics, and packaging can represent major emissions sources.

2. Capital Goods

Capital goods include long-lived assets such as buildings, machinery, production lines, laboratories, warehouses, vehicles, and information-technology infrastructure.

The emissions generated when those assets are manufactured are generally accounted for in the year of acquisition under the Scope 3 framework.

3. Fuel- and Energy-Related Activities Not Included in Scope 1 or Scope 2

This category includes upstream emissions associated with extracting, producing, refining, and transporting fuels and energy purchased by the organization.

It may also include certain electricity transmission and distribution losses.

4. Upstream Transportation and Distribution

These are emissions from transportation and distribution services purchased by the reporting organization.

Examples include inbound freight, third-party transportation, and certain warehousing activities.

5. Waste Generated in Operations

This category includes emissions associated with transporting, treating, recycling, incinerating, landfilling, or otherwise managing waste generated by the organization.

6. Business Travel

Business travel emissions may arise from air travel, rail travel, rental vehicles, hotels, and other transportation undertaken for business purposes.

7. Employee Commuting

This category includes emissions generated as employees travel between their homes and workplaces.

Some organizations also evaluate emissions associated with remote work when relevant to their reporting methodology.

8. Upstream Leased Assets

This category covers emissions from leased assets operated by the reporting organization when those emissions are not already included in Scope 1 or Scope 2.

Downstream Scope 3 Emissions

Downstream emissions occur after products or services leave the reporting organization.

9. Downstream Transportation and Distribution

These emissions arise from transporting, storing, and distributing sold products when those activities fall outside the reporting organization’s operational boundary.

10. Processing of Sold Products

This category applies when an organization sells an intermediate product that another company further processes.

Chemical producers, metals manufacturers, component suppliers, and materials companies may have significant emissions associated with how customers transform their products into finished goods.

11. Use of Sold Products

This category includes emissions generated during the expected use of products sold by the organization.

For manufacturers of vehicles, engines, appliances, industrial equipment, fuels, and other energy-consuming products, the use phase may represent the largest portion of the total lifecycle footprint.

12. End-of-Life Treatment of Sold Products

These emissions are associated with the disposal, recycling, recovery, incineration, or other treatment of products and packaging at the end of their useful lives.

13. Downstream Leased Assets

This category includes emissions from assets owned by the reporting organization and leased to other entities when the emissions are not included in the owner’s Scope 1 or Scope 2 inventory.

14. Franchises

These are emissions from franchise operations that fall outside the reporting organization’s direct operational boundary.

15. Investments

Financial institutions and other organizations with significant investment portfolios may account for emissions associated with equity investments, debt, project finance, and other financial activities.

Why Scope 3 Changes the Sustainability Conversation

Scope 3 changes the conversation because it reveals that environmental performance is shaped by business decisions throughout the enterprise.

  • Procurement decisions influence supplier emissions.
  • Engineering decisions determine material selection, product efficiency, durability, and recyclability.
  • Logistics decisions affect transportation modes, distances, load factors, and distribution systems.
  • Finance determines which capital projects and technologies receive investment.
  • Sales and marketing influence customer expectations and product demand.
  • Product stewardship helps the organization understand how products are used, processed, regulated, recycled, and disposed of.

Scope 3 is therefore not primarily an environmental department problem. It is a systems-management problem.

Carbon data exposes how decisions travel through the enterprise and across the value chain. It reveals the connections among supplier selection, product design, operational efficiency, transportation, customer behavior, and end-of-life management.

Organizations cannot manage Scope 3 effectively through an annual reporting exercise. It must become part of how the business makes decisions.

Why Scope 3 Is Difficult to Manage

The importance of Scope 3 is matched by its complexity.

The Data Resides Outside the Organization

Much of the information required to calculate Scope 3 emissions belongs to suppliers, customers, carriers, contractors, and other business partners.

Some suppliers maintain sophisticated greenhouse gas inventories and can provide product-level information. Others report only company-wide emissions. Smaller suppliers may not measure emissions at all.

Organizations must therefore rely on a hierarchy of data that may include:

  • Supplier-specific emissions information
  • Product carbon footprints
  • Physical activity data
  • Material weights and volumes
  • Transportation distances and modes
  • Fuel and energy consumption
  • Industry-average factors
  • Financial spend multiplied by economic emissions factors

The result is often a combination of measured data, supplier estimates, industry averages, and financial proxies.

Estimation Can Obscure Actual Improvement

Spend-based methods can be useful for establishing an initial inventory, but they have important limitations. If the cost of a raw material increases because of inflation, calculated emissions may rise even when the physical quantity purchased remains unchanged. A supplier may invest in lower-carbon production, but the customer may receive no calculated benefit if it continues using a generic industry-average emissions factor. Spend-based information is therefore often useful for screening and prioritization but less useful for measuring specific operational improvements.

Organizations need a deliberate progression toward activity-based and supplier-specific data in the areas that are most material.

Value Chains Are Large and Complex

A multinational industrial organization may purchase thousands of materials and services from suppliers operating across numerous countries, regulatory systems, technologies, and energy markets. Tier-one suppliers may depend on extensive networks of lower-tier suppliers that are largely invisible to the reporting organization. A product’s total footprint may include mining, agriculture, chemical processing, refining, energy generation, manufacturing, packaging, transportation, customer processing, product use, recycling, and disposal. Mapping those relationships requires cross-functional collaboration and sustained supplier engagement.

Influence Is Not the Same as Control

An organization can direct its own facilities to complete an energy-efficiency project or repair a refrigerant leak.

It cannot command an independent supplier or customer in the same manner.

A company may ask suppliers to disclose emissions, establish targets, purchase renewable energy, improve efficiency, or redesign materials. Whether suppliers can respond depends on cost, technical capability, commercial leverage, infrastructure, and market conditions.

The same is true downstream.

A manufacturer can design a more efficient product, but actual emissions may depend on how customers operate, maintain, power, and dispose of it.

Managing Scope 3 therefore depends on influence, collaboration, incentives, specifications, contracts, product design, and shared value.

Reduction May Require Fundamental Business Decisions

Some Scope 3 improvements are relatively straightforward. Others challenge important elements of the business model.

Meaningful reductions may require an organization to:

  • Substitute materials
  • Redesign products
  • Change suppliers
  • Regionalize supply chains
  • Increase recycled content
  • Reduce product weight
  • Improve product durability
  • Develop circular recovery systems
  • Change transportation modes
  • Shift from product sales toward service models
  • Alter customer-use patterns
  • Invest in emerging technologies
  • Discontinue high-emission products

These decisions can affect cost, quality, performance, supply continuity, intellectual property, customer acceptance, and operational risk.

They cannot be delegated solely to the sustainability function.

Data Quality Can Become an Excuse for Inaction

Organizations sometimes delay Scope 3 action while waiting for complete supplier data, standardized methodologies, precise product footprints, or more advanced information systems. Better data is important, but perfect information is unlikely. Leaders must distinguish between numerical precision and decision usefulness. Early estimates can identify major categories, high-emission materials, critical suppliers, transportation hotspots, and carbon-intensive product-use phases. More precise information can then be developed where it will improve decisions or substantiate external claims.

Uncertainty should be disclosed and managed. It should not become a reason to avoid action.

An Industrial Example: Why Plant-Level Reductions Are Not Enough

Consider a specialty chemical or resin manufacturer that reduces emissions from its own facilities by 35 percent. The company improves boiler efficiency, lowers process energy demand, purchases renewable electricity, repairs fugitive leaks, and reduces manufacturing waste. This represents meaningful operational progress.

However, the company’s larger value-chain footprint may still be driven by:

  • Carbon-intensive chemical feedstocks
  • Energy used by raw-material suppliers
  • Rail, marine, and truck transportation
  • Production of packaging materials
  • Customer heating, curing, or processing requirements
  • The use of the resin in downstream products
  • Disposal or recovery of those products at end of life

The organization may have improved its Scope 1 and Scope 2 performance substantially while leaving most of its total lifecycle emissions largely unchanged. Moving the business further requires a broader strategy. The manufacturer may need to work with suppliers on lower-carbon feedstocks, improve product yield, redesign formulations, increase renewable content, reduce customer processing temperatures, optimize logistics, and help develop circular end-of-life pathways.

This is the central Scope 3 challenge.

The organization must improve not only the facility it controls, but also the system in which that facility operates.

Moving From Carbon Accounting to Carbon Intelligence

Many organizations begin with carbon accounting.

They collect data, apply emissions factors, calculate inventories, and publish results.

That work is necessary. But it is not the destination.

The progression should be:

Carbon Accounting → Carbon Analytics → Carbon Intelligence

Carbon Accounting

Carbon accounting establishes what emissions occurred and where they are categorized.

It creates the baseline.

Carbon Analytics

Carbon analytics identifies patterns, hotspots, trends, uncertainties, and potential reduction opportunities.

It helps the organization understand why emissions occur.

Carbon Intelligence

Carbon intelligence converts emissions information into sourcing, engineering, logistics, capital, product, and strategic decisions.

It can be defined as:

The organizational capability to transform greenhouse gas data into decision-ready information that reduces emissions while strengthening operational performance, resilience, and enterprise value.

Carbon intelligence allows an organization to answer more useful questions:

  • Which suppliers create the greatest emissions exposure?
  • Which product specifications lock in carbon-intensive materials?
  • Which logistics changes reduce both emissions and cost?
  • Which capital investments produce the greatest lifecycle improvement?
  • Which products create the largest downstream emissions?
  • Which lower-carbon alternatives introduce new quality, safety, or supply risks?
  • Where can collaboration create benefits for both the company and its suppliers?

The objective is not simply to calculate carbon more precisely.

It is to make better decisions.

How AI Can Accelerate Scope 3 Management

Scope 3 generates a difficult combination of large datasets, missing information, inconsistent formats, uncertain assumptions, and complex supplier relationships.

Artificial intelligence can help organizations manage that complexity.

Potential applications include:

  • Mapping supplier and lower-tier supplier networks
  • Estimating emissions where supplier-specific data is unavailable
  • Comparing supplier disclosures with industry benchmarks
  • Identifying anomalies or inconsistencies in reported data
  • Automating the classification of purchases into Scope 3 categories
  • Evaluating product design alternatives
  • Supporting lifecycle assessments
  • Optimizing transportation modes and routes
  • Forecasting supplier emissions and transition risks
  • Identifying high-impact supplier engagement opportunities
  • Modeling the effects of material substitutions
  • Monitoring progress against reduction targets

AI does not eliminate the need for reliable data, professional judgment, or human review.

Models can amplify poor assumptions, incomplete data, and inconsistent supplier information. Important sourcing, engineering, and sustainability decisions should therefore remain subject to appropriate governance, verification, and expert oversight.

Used responsibly, however, AI can accelerate the transition from periodic carbon reporting to continuous carbon intelligence.

Digital Product Passports and the Future of Value-Chain Transparency

Future Scope 3 management will increasingly depend on digital information that moves with products and materials.

Digital product passports and similar data systems can provide structured information about:

  • Material composition
  • Product origin
  • Recycled content
  • Manufacturing emissions
  • Repairability
  • Durability
  • Recyclability
  • Hazardous substances
  • End-of-life pathways
  • Product carbon footprints

Supplier application programming interfaces, interoperable sustainability platforms, digital twins, and automated lifecycle databases may eventually allow emissions information to flow more efficiently across supply chains. This could reduce dependence on static questionnaires and generic averages. It could also allow procurement, engineering, product stewardship, and sustainability teams to evaluate emissions information closer to the point of decision.

The long-term opportunity is not simply better disclosure. It is the creation of a digital value-chain infrastructure capable of supporting more sustainable products and operations.

Moving From Scope 3 Measurement to Scope 3 Management

A Scope 3 inventory describes emissions.

A Scope 3 management system changes them.

Begin With Materiality

Organizations should conduct an initial screening across applicable Scope 3 categories and identify where emissions are concentrated.

Materiality should consider more than total emissions volume. It should also evaluate:

  • Ability to influence the emissions source
  • Strategic importance of the supplier or product
  • Availability of lower-carbon alternatives
  • Customer expectations
  • Regulatory exposure
  • Data quality
  • Technology readiness
  • Cost
  • Supply continuity
  • Reputational significance

The objective is to identify where intervention can create the greatest credible impact.

Segment the Supply Base

Not every supplier requires the same level of engagement.

Strategic suppliers and carbon-intensive categories may require:

  • Detailed emissions reporting
  • Product-level carbon information
  • Reduction targets
  • Supplier improvement plans
  • Contractual expectations
  • Audits
  • Joint engineering projects
  • Renewable-energy commitments
  • Engagement with lower-tier suppliers

Lower-impact suppliers may be managed through standardized requirements or industry-average assumptions.

This allows resources to be directed toward the relationships that matter most.

Integrate Carbon Into Procurement

Carbon performance should gradually become part of normal sourcing and category-management processes.

This can include:

  • Supplier qualification criteria
  • Emissions disclosure requirements
  • Product carbon-footprint information
  • Carbon considerations in bid evaluations
  • Preference for suppliers with credible reduction plans
  • Contractual reporting provisions
  • Joint efficiency projects
  • Recognition of verified reductions

Carbon cannot remain an optional questionnaire reviewed after sourcing decisions have already been made.

Use Design and Engineering as Reduction Levers

Many downstream emissions are determined before a product enters production.

Material selection, product weight, durability, energy efficiency, repairability, recyclability, packaging, and customer operating requirements are heavily influenced during research, development, and design.

Scope 3 considerations should therefore be incorporated into:

  • Product-development gates
  • Design reviews
  • Material-selection processes
  • Lifecycle assessments
  • Management-of-change reviews
  • Capital project evaluations
  • Product stewardship assessments

The earlier carbon is considered, the more options remain available.

Improve Data in Proportion to Its Decision Value

Organizations do not need supplier-specific information for every transaction before beginning.

A practical data-development strategy can progress through stages:

  1. Establish a screening inventory.
  2. Identify the largest categories and suppliers.
  3. Replace spend-based estimates with physical activity data.
  4. Obtain supplier-specific information.
  5. Request product-level footprints for priority materials.
  6. Verify significant data and reduction claims.
  7. Integrate emissions information into sourcing and design decisions.

Data quality should improve where it will change decisions, measure performance, or support important claims.

Establish Cross-Functional Governance

Scope 3 requires clear executive sponsorship and shared accountability.

  • Procurement may lead supplier engagement.
  • Engineering and product development may own design-related reductions.
  • Logistics may address freight emissions.
  • Human resources may influence travel and commuting.
  • Finance may incorporate carbon into capital allocation.
  • Product stewardship may address customer use and end-of-life impacts.

Sustainability may establish methodologies, reporting systems, assurance processes, and overall program coordination. Senior leaders must resolve tradeoffs when emissions objectives conflict with cost, quality, capacity, delivery, safety, or short-term financial performance.

Without governance, Scope 3 becomes an environmental request sent to departments with different incentives and little accountability for the outcome.

Executive Questions About Scope 3

Executives and boards should ask:

  • Where do most of our Scope 3 emissions originate?
  • Which suppliers and materials drive the largest share of the footprint?
  • Which emissions are measured directly, and which are estimated?
  • How rapidly is the quality of our data improving?
  • Which product-design decisions lock in downstream emissions?
  • Which reductions could also lower cost, improve resilience, or reduce supply risk?
  • Are carbon considerations integrated into sourcing, engineering, and capital decisions?
  • Are suppliers being asked only to disclose emissions, or are we helping them improve?
  • How are customers being engaged in reducing product-use emissions?
  • Where can AI improve value-chain visibility and decision making?
  • Who has executive accountability for Scope 3 progress?
  • Are our emissions commitments aligned with the decisions being made across the enterprise?

The answers reveal whether Scope 3 is being treated as a report or as a business-management system.

Why Scope 3 Is Essential to Sustainable Operations

Sustainable operations cannot be defined solely by the efficiency of company-owned facilities.

An organization is not operating sustainably if its efficient plants remain dependent on carbon-intensive materials, fragile supply chains, inefficient logistics, wasteful product designs, or downstream applications that generate significant lifecycle emissions.

Scope 3 is critical because it reveals the organization’s broader impact.

It also creates opportunities to:

  • Strengthen supply-chain resilience
  • Reduce exposure to energy and carbon-price volatility
  • Improve supplier relationships
  • Accelerate product innovation
  • Increase resource efficiency
  • Support circular business models
  • Meet customer expectations
  • Protect the credibility of climate commitments
  • Improve long-term competitiveness

The importance of Scope 3 extends beyond voluntary sustainability reporting. The Science Based Targets initiative (SBTi) requires organizations whose Scope 3 emissions represent a significant portion of their total greenhouse gas inventory to establish Scope 3 reduction targets as part of a credible science-based decarbonization strategy. This reflects the growing recognition that meaningful climate commitments cannot ignore the largest sources of an organization’s emissions (Science Based Targets initiative, 2024).

Scope 3 also forces sustainability out of its functional silo.

It moves the discussion into procurement, engineering, operations, logistics, product stewardship, sales, finance, strategy, and executive governance.

It demonstrates that emissions are not produced only by boilers, vehicles, utilities, and manufacturing processes.

They are also shaped by specifications, contracts, product designs, transportation routes, investment decisions, supplier relationships, and business models.

Beyond the Factory Fence

Sustainable operations are no longer defined only by what happens within an organization’s facilities.

They are defined by how effectively the organization improves the environmental performance of the broader value chain.

Scope 1 asks what the organization emits directly.

Scope 2 asks how the energy it purchases is generated.

Scope 3 asks a more difficult and strategically important question:

What emissions occur across the value chain because of the way the organization conducts business?

The Greenhouse Gas Protocol provides organizations with a consistent framework for answering this question. Increasingly, however, competitive advantage will come not from simply applying the accounting methodology, but from using it to improve decisions across procurement, engineering, logistics, product stewardship, finance, and executive governance.

Answering that question requires procurement to source differently.

It requires engineering to design differently.

It requires logistics to operate differently.

It requires finance to evaluate investments differently.

It requires suppliers and customers to collaborate differently.

And it requires executives to govern differently.

Organizations that embrace Scope 3 will discover that reducing value-chain emissions is not simply about lowering carbon. It is about creating stronger supply chains, better products, improved resource efficiency, greater transparency, deeper stakeholder trust, and more resilient business systems.

The factory fence may define where an organization owns assets.

It no longer defines where its responsibility—or its opportunity—ends.

This is also where Scope 3 connects directly to operational integrity.

Operational integrity requires an organization to understand and manage the conditions necessary for reliable, responsible, and sustainable performance. Those conditions do not stop at the property line. They extend to critical suppliers, materials, logistics networks, product applications, customers, and end-of-life systems.

An organization cannot claim full operational integrity while ignoring material risks and impacts embedded throughout its value chain.

The progression is therefore clear:

Operational Integrity → Operational Excellence → Sustainable Value Chains

Scope 3 represents the extension of operational integrity beyond the factory fence.

It is the discipline of applying systems thinking, governance, decision-ready information, and continuous improvement to the emissions sources that an organization influences—even when it does not directly control them.

That is the next generation of sustainable operations.

References

  • Greenhouse Gas Protocol. (2004). The Greenhouse Gas Protocol: A Corporate Accounting and Reporting Standard (Revised Edition). World Resources Institute & World Business Council for Sustainable Development.
  • Greenhouse Gas Protocol. (2011). Corporate Value Chain (Scope 3) Accounting and Reporting Standard (Supplement to the GHG Protocol Corporate Accounting and Reporting Standard). World Resources Institute & World Business Council for Sustainable Development.
  • Science Based Targets initiative. (2024). Corporate Net-Zero Standard. (or the latest applicable version if you update the article before publication).
Posted in #ESG, ESG Investing, Sustainability Leadership, Sustainable Strategy | Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , | Leave a comment

Harnessing the Process Digital Twin: Building Live Operating Models for Foresight, Control, and Safer Work

By Emmanuel Winful and Chet Brandon

At ASSP Safety 2026 in Anaheim, Emmanuel Winful and I presented “Harnessing and Integrating Digital Twin Technology into EHS Management Systems.” This article is a follow-up to that presentation, with a deeper focus on how to actually build a functional Process Digital Twin. A link to the presentation PDF is provided below for readers who want to review the original session material.

Harnessing and Integrating Digital Twin Technology into EHS Management Systems, Session 7034, Presented on June 17, 2026 in Anaheim CA, at the ASSP SAFETY2026 Professional Development Conference.

The session introduced the basic concept: a digital twin is a digital or virtual replica of a physical object, person, or process where continuous, bidirectional, real-time data is exchanged between the digital and physical objects. That is a useful definition, as it helps EHS leaders understand that the twin is not just a viewer but an active control and intervention tool. It is worth noting, however, that this definition describes a high-maturity implementation. In practice, digital twin programs exist along a maturity spectrum from read-only condition monitoring to simulation and scenario testing to fully bidirectional real-time control. Early-stage implementations may not yet meet every element of this definition, and that is acceptable, provided the organization understands where it is on that spectrum and where it is headed.

But after the conference discussion, the more practical question is the one most leaders eventually ask:

How would we actually build one?

For this discussion, the best term is Process Digital Twin.

A Process Digital Twin is a live, data-connected model of how work, equipment, people, materials, energy, controls, and environmental conditions interact within an operating process. It is more than a drawing, dashboard, 3D model, or training simulation. The model becomes valuable when it helps people understand current conditions, anticipate what could happen next, and test decisions before making changes in the physical operation.

The value is not the technology label. The value is better control of the process.

Figure 1. A Process Digital Twin connects the physical process to a live digital representation, allowing teams to monitor conditions, evaluate risk, and improve decisions before failure occurs.

A good process twin can serve operations, maintenance, engineering, reliability, quality, environmental compliance, emergency response, training, and EHS. It is not owned by one function. It is a shared operating tool.

Start With the Problem, Not the Software

The easiest way to weaken a digital twin project is to start by shopping for platforms. That usually produces a polished visualization looking for a use case.

The better starting point is a field-level question:

What condition, decision, failure mode, or exposure are we trying to understand before it creates a problem?

That answer determines the scope.

A component twin may be enough for a pump seal, valve, bearing, or sensor. An asset twin may be needed for a pump skid, conveyor, compressor, press, robotic cell, or reactor feed system. A system twin is useful when multiple assets, utilities, controls, and people interact. A process twin is broader. It represents the way the work actually happens. The choice of scope level is not merely technical; it reflects the decision the organization actually needs to make. A team focused on predictive bearing failure does not need a process twin. A team trying to understand how pressure upset propagates across interdependent systems does.

That is why “Process Digital Twin” is the right frame. The point is not just to model a piece of equipment. The point is to model the interaction among people, assets, materials, energy, procedures, control points, environmental conditions, and decision pathways.

Figure 2. Digital twins can represent components, assets, systems, or full processes. A Process Digital Twin is often the most useful for operational leaders because it shows how work, equipment, energy, materials, procedures, and controls interact during real operations.

The first deliverable should be a clear use case, not a model. Good candidates include reducing lockout/tagout error, predicting equipment failure before loss of containment, improving ergonomic design, identifying mobile equipment interaction, evaluating emergency response routes, monitoring environmental control limits, or training workers on high-risk tasks before field execution.

Start with a problem that matters. A useful test for determining the problem: if the use case cannot be described in one or two sentences, with a measurable outcome, the scope is probably too broad to start. Narrow the problem first. Scale later.

Define the Physical Process

A process twin has to reflect reality. That means the work starts in the field.

The team needs to define the boundaries of the process. What equipment is included? What materials are involved? What energy sources are present? Who interacts with the system? Which procedures govern the work? What controls are supposed to hold? What happens during startup, shutdown, maintenance, upset conditions, and emergency response?

P&IDs, layout drawings, electrical one-lines, control narratives, standard operating procedures, job safety analyses, maintenance records, inspection findings, environmental permits, alarm histories, and incident records all become source material. For facilities covered under OSHA’s Process Safety Management standard (29 CFR 1910.119), Process Hazard Analyses, HAZOP studies, Layer of Protection Analysis outputs, Safety Instrumented System documentation, Pre-Startup Safety Reviews, and mechanical integrity records are equally important source documents and, in many cases, represent the most rigorous structured risk data the organization already has. Industrial hygiene sampling records are valuable for exposure monitoring and emissions-related use cases. Near-miss data, which is addressed later in this article, belongs in this list as well.

But the documents are only the start. Anyone who has walked down a job knows the drawing and the field condition do not always tell the same story. A good build team asks uncomfortable but necessary questions: Where can stored energy remain after shutdown? Where do people enter the line of fire? Where do pedestrians and mobile equipment cross paths? Where can a release pathway develop? Where has the procedure drifted from actual practice?

The model should be built around operational truth, not design intent alone.

Identify the Data That Matters

Once the process is defined, the team has to decide what data belongs in the twin.

More data does not always mean better insight. The useful data is the data that helps the organization detect degradation, predict failure, verify controls, or intervene earlier.

Depending on the use case, that may include pressure, temperature, vibration, flow, amperage, valve position, equipment status, emissions readings, gas detection, noise levels, worker location, ergonomic motion, task frequency, maintenance condition, inspection results, permit status, or alarm history.

The filter is simple:

Will this data help someone make a better decision sooner?

For predictive maintenance, the critical data may be vibration, temperature, current draw, runtime, lubricant condition, and failure history. For environmental compliance, it may be emissions readings, flow rates, pH, tank levels, scrubber performance, pressure drop, or permit thresholds. For ergonomics, it may be posture, force, repetition, reach distance, cycle time, and fatigue indicators. For real-time hazard identification, it may be worker location, equipment movement, temporary layout changes, geofencing, and spatial risk scoring.

Two practical data quality issues deserve attention before the model is built. First, sensor drift: a miscalibrated sensor feeding a digital twin produces systematically wrong outputs, which can create false confidence that is more dangerous than having no model at all. Calibration schedules, drift detection logic, and out-of-range flagging should be part of the data architecture from the beginning. Second, sensor failure states: the twin must have a defined behavior for what it displays and signals when a sensor goes offline or stops reporting. A gap in the data feed should never be silently treated as a normal condition.

Figure 3. A Process Digital Twin can identify changing spatial risk in real time, such as worker-equipment interaction, scaffold changes, temporary layout changes, and emerging line-of-fire exposure.

The best twins are active. They do not simply display information. They point attention to changing conditions while there is still time to act.

What Equipment Is Needed?

A Process Digital Twin sounds abstract until we break it down into the equipment required to make it function. In practical terms, the twin needs five layers.

The first is the sensor and data-capture layer. This may include pressure sensors, temperature sensors, vibration monitors, flow meters, amperage monitors, valve-position indicators, emissions monitors, gas detectors, noise monitors, proximity sensors, cameras, LiDAR, RFID tags, GPS, wearable devices, motion-capture sensors, or ergonomic wearables. The use case determines the equipment. A twin for hazardous energy control needs different inputs than one built for emissions monitoring or mobile equipment interaction.

The second is the connection and integration layer. Sensors have to communicate with the system. That may require industrial gateways, programmable logic controllers, distributed control systems, SCADA connections, wireless access points, Bluetooth beacons, cellular routers, edge devices, industrial network switches, or secure application programming interfaces. In older facilities, the issue is often not the absence of data. It is that the data is trapped in isolated systems.

The third is the edge-computing and data-management layer. Some decisions need to happen close to the process, especially where latency matters. Edge computers, local servers, data historians, and industrial PCs can clean, filter, store, and analyze data near the equipment. This is important for high-speed equipment, critical alarms, machine-interface conditions, and environmental parameters that require timely escalation.

The fourth is the modeling and analytics layer. This is where the digital representation is built and maintained. It may include CAD files, BIM models, process simulation tools, physics-based models, AI or machine-learning analytics, data historians, dashboard tools, control-system data, and EHS or maintenance management system integrations.

Figure 4. The functional anatomy of a Process Digital Twin includes data capture, connectivity, analytics, visualization, and action.

The fifth is the human interface. A twin has limited value if the output does not reach the person who needs to act. Interfaces may include control-room displays, maintenance dashboards, tablets, operator workstations, AR/VR headsets, training simulators, alarm panels, EHS software workflows, or executive dashboards.

There is one more practical requirement: cybersecurity and reliability protection. A twin connected to operating equipment becomes part of the operational technology environment. Firewalls, network segmentation, secure gateways, access controls, backup power, redundant communication paths, and monitored data storage are not afterthoughts. Organizations building process twins should reference IEC 62443, the recognized international standard for industrial cybersecurity, and CISA’s published guidance on OT network security.

The right sequence is not “buy technology, then find a purpose.” The right sequence is “define the decision, then identify the minimum equipment needed to support it.”

Build the Model Logic

The model logic is where the twin becomes useful. This is where operating limits, engineering rules, control logic, risk thresholds, and analytical models are built into the tool.

Some logic will be rule-based. If pressure exceeds a defined limit, trigger an alert. If a worker enters the swing radius of mobile equipment, flag the conflict. If an emission reading approaches a threshold, escalate. If a required energy isolation step is skipped in a simulation, stop the exercise and coach the correct sequence.

Other logic may be pattern-based. Machine learning may detect vibration changes that are hard to see in routine review. Wearable data may show fatigue patterns. AI-enabled tools may identify combinations of conditions that historically preceded quality failures, equipment breakdowns, environmental deviations, or injury events.

The distinction matters. Traditional rule-based software is strong when the rules are clear. AI-enabled tools are useful when patterns are complex or ambiguous. But AI outputs still need verification. A confident answer is not the same thing as a correct answer.

The twin should support judgment. It should not replace engineering review, operator knowledge, field verification, or management accountability.

Validate Against the Field

A digital model that does not match the physical process will create false confidence. That is worse than having no model at all.

Validation should include field walkdowns, operator review, engineering review, maintenance review, EHS review, and scenario testing. The team should compare model outputs against actual sensor readings, known operating conditions, historical incidents, near misses, maintenance findings, failure modes, and abnormal events.

The test is straightforward:

Does the twin accurately represent the process?
Does it identify the conditions that matter?
Does it help people make better decisions?

If not, it is not ready to scale.

This is also a good place to compare high-performing and low-performing operations. If one line, crew, site, or operating condition consistently performs better, the twin may help show why. The answer may be better sequencing, equipment condition, layout, training, alarms, staffing, supervision, or control discipline. The point is not only to find what failed. The point is to transfer what works.

A Practical Example: The LOTO Process Digital Twin Built in ChatGPT

One practical follow-up to our ASSP Safety 2026 presentation is a model LOTO Process Digital Twin created in ChatGPT. Before describing it, a definitional note is warranted: Given that the twin was not connected to a physical reactor, the example does not fully meet the bidirectional, real-time data exchange described at the opening of this article. It is more precisely a decision-practice simulation scaffold: a structured, scenario-based tool, based on a physical process, that makes hazardous-energy isolation decisions visible and repeatable in a safe learning environment.

Figure 5. A lockout/tagout Process Digital Twin can allow employees to practice hazardous energy isolation in a safe, repeatable environment before performing the work in the field.

This tool is not intended to replace a company’s lockout/tagout procedure, field verification, authorized employee training, or site-specific energy-control program. It demonstrates how a process twin can support interactive learning and decision-making practice.

In the presentation, we showed the concept of a LOTO process twin as a safe, repeatable simulator for practicing energy isolation before field execution. The example allows a learner to work through a feed pump and feed line isolation scenario, make decisions, receive feedback, and see the consequences of incorrect sequencing before doing similar work in the field.

That kind of practice matters. In the field, the hard part of LOTO is not usually reciting the basic steps. The hard part is recognizing the real energy pathways, understanding the sequence, identifying stored or residual energy, and knowing what can go wrong when a step is missed or performed out of order.

The ChatGPT-based LOTO twin is designed to make those decisions visible. A user can work through questions such as: What equipment needs to be isolated? Which valves must be closed? Where could pressure remain trapped? What must be locked and tagged? How should zero energy be verified? What happens if the pump is isolated but the line remains pressurized? The tool should never be the sole or primary means of LOTO training. It is a supplemental practice aid, not a substitute for authorized-employee training, procedure-specific competency, or field verification required by the employer’s energy-control program under 29 CFR 1910.147.

It also demonstrates an important point. A useful process twin does not have to begin with a fully instrumented facility or a large enterprise software project. It can begin with one high-risk task, one clearly defined process, and one decision pathway where better understanding can reduce serious risk.

A first-generation version may use written process logic, prompts, diagrams, and scenario-based questions. A more advanced version may incorporate equipment data, valve status, pressure readings, procedure libraries, training records, or augmented reality. A fully mature version may connect to live operational data and maintenance planning systems.

The development path should be disciplined: define the hazardous energy scenario, map the equipment and isolation points, build the decision logic, test the simulation against the actual procedure, validate it with qualified operations, maintenance, engineering, and EHS personnel, and use it as a training and planning aid rather than a substitute for authorized procedures or competent supervision.

A LOTO twin should be governed like any other safety-critical training or decision-support tool. It needs review, version control, and updates when equipment or procedures change.

Connect the Twin to the Management System

A process twin should strengthen the systems already used to manage work.

That includes risk assessment, management of change, operating procedures, training, preventive maintenance, inspections, emergency planning, incident learning, corrective actions, and leadership review.

The connection between the twin and the Management of Change (MOC) system requires careful consideration. If physical changes occur, such as installing new equipment, modifying layouts, revising procedures, or shifting staffing, and the twin is not updated accordingly, it risks providing inaccurate information instead of serving as a reliable control tool. The twin should be managed as a controlled document within the MOC framework, not just a system that passively receives notifications. This involves establishing who has authority to approve updates, how version control is maintained, and what triggers a mandatory review of the model. An outdated twin is not neutral; it can become a liability.

For facilities subject to OSHA PSM (29 CFR 1910.119), the twin can support the work processes associated with Process Hazard Analysis revalidation, mechanical integrity, operating procedure updates, incident investigation, and emergency planning. For facilities subject to the EPA Risk Management Program (40 CFR Part 68), twin data on process conditions, release pathways, and control effectiveness may inform program analysis, planning, and internal documentation. Organizations should consult with legal and regulatory counsel to understand how twin outputs are characterized under applicable recordkeeping and disclosure requirements before integrating them into formal compliance documentation.

For electrical energy control specifically, NFPA 70E provides the recognized standard for safe work practices around electrical hazards. A LOTO or electrical isolation twin should be developed and validated against NFPA 70E requirements, not independently of them. ISO 55000, the international standard for asset management, provides a useful framework for integrating twin outputs with maintenance strategies, reliability programs, and lifecycle planning

The strongest twins eventually become part of the normal work rhythm. They inform pre-job planning. They support MOC reviews. They guide preventive maintenance. They test emergency response plans. They help teams see where controls are holding and where they are starting to degrade.

The twin does not replace the procedure, inspection, work permit, or supervisor. It makes those systems more visible and easier to test before the stakes are real.

Phase the Implementation

Start small and scale with discipline.

Phase 1: Define the use case. Select one meaningful operating problem with measurable value.

Phase 2: Map the physical process. Define assets, boundaries, workflows, energy sources, materials, people, operating states, controls, and failure modes.

Phase 3: Select the data. Identify the minimum information needed to monitor condition, detect change, predict risk, and support action.

Phase 4: Build and test the model. Create the digital representation, apply operating logic, set thresholds, and simulate normal, abnormal, and emergency conditions.

Phase 5: Validate with operators and technical experts. Compare the model to actual field conditions and correct inaccuracies.

Phase 6: Integrate with management systems. Connect outputs to training, inspections, maintenance, MOC, emergency planning, corrective actions, and leadership review.

Phase 7: Scale based on value. Expand after the first use case proves it improves decisions.

Figure 6. Process Digital Twins should be implemented in phases: define the use case, map the system, connect data, validate the model, integrate with management systems, and scale only after value is proven.

The most impressive twin is not always the most useful one. Build the version that helps people control the work.

Build the Team Before You Build the Twin

Process twins require shared ownership. EHS cannot build them alone. IT cannot build them alone. Engineering cannot build them alone.

A capable team includes operations, engineering, maintenance, EHS, IT, data analytics, frontline employees, and leadership sponsors. Operators understand how the job is really done. Maintenance understands failure and repair history. Engineering understands design intent and system constraints. EHS understands exposure, compliance obligations, control effectiveness, and incident learning. IT and data teams understand architecture, integration, cybersecurity, and analytics.

Shared ownership requires defined governance. The team should establish before the build begins who owns the twin, who has authority to approve changes to the model logic, how version control is managed, and the escalation path when model outputs conflict with operator field judgment. Without those answers, cross-functional teams often reach consensus during the build phase and then fragment during the operational phase when disagreement about the model’s accuracy or authority creates pressure. A RACI framework defining who is Responsible, Accountable, Consulted, and Informed for each decision category is a practical tool for establishing clarity early.

Without that mix, the project can go wrong in two predictable ways: technically elegant but operationally irrelevant, or operationally interesting but technically fragile.

This is not just an IT project. It is a performance, reliability, and risk-control project enabled by technology.

Manage the Risks

Process twins create new capability, but they also create new responsibilities.

Bad data can drive bad decisions. A weak model can create false confidence. Overreliance on AI can reduce field verification. Cybersecurity gaps can create operational exposure. Poor data governance can create privacy, labor relations, confidentiality, or compliance concerns. A model that is not maintained can become outdated quickly as equipment, layouts, procedures, staffing, and operating conditions change.

Every process twin should have an owner, a defined purpose, approved data sources, validation criteria, update frequency, cybersecurity review, access rules, and revision triggers. Treat it like a management system tool, not a one-time technology project.

One rule should hold: the twin must improve control of the actual process. If it does not, it is just a visualization.

The Future Is Foresight

Process Digital Twins are not replacements for leadership, engineering discipline, field knowledge, or worker engagement. They are tools that make process conditions and emerging risk more visible before failure occurs.

The future will not be built only on better dashboards and after-the-fact metrics. It will be built on live systems that help teams see weak signals, test scenarios, verify controls, and act earlier. Our presentation closed with the point that digital twins are live, intelligent models powered by IoT and AI, and that practical, proactive, predictive, and preventive applications already exist.

The organizations that benefit most will be the ones that start with real operating problems, build carefully, validate relentlessly, and connect the twin to the way work is actually managed.

In operations, maintenance, quality, sustainability, and EHS, the measure of innovation is not how advanced the tool appears. The measure is whether the process is better understood, better controlled, and less likely to fail.

That is how a Process Digital Twin becomes more than a model.

It becomes a working part of prevention.

About the Guest Author

Emmanuel Winful, CSP, MPH, MS is a health and safety leader with experience across higher education, underground mining, environmental and recycling operations, and the oil and energy sector. He is currently a Health and Safety Manager at Auburn University’s Samuel Ginn College of Engineering and serves part-time as a Workplace Safety Consultant with the National Safety Council.

Emmanuel’s work focuses on developing, organizing, and implementing environmental, health, and safety management-system initiatives that drive continuous improvement. He has a proven record of leading complex projects using risk-based safety strategies, strengthening employee and management engagement, and improving organizational safety performance.

He holds a Master of Public Health in Environmental Health Science from Georgia Southern University, a master’s degree in Industrial and Systems Engineering from Auburn University, and a Graduate Certificate in Occupational Safety and Ergonomics from Auburn University. He is also pursuing a PhD in Industrial and Systems Engineering at Auburn University. Emmanuel is a Certified Safety Professional and brings expertise in safety engineering, emergency management, lockout/tagout, ergonomics, OSHA compliance, and environmental health.

https://www.linkedin.com/in/emmanuelwinfulcsp

Posted in AI, Artificial Intelligence, Digital Twin, Innovation, Machine Learning, Uncategorized | Tagged , , , , , , , , , | Leave a comment