White Paper: The Illusion of Control

How Safety Systems Can Fail Directors and PCBUs:

Executive Summary

Many organisations believe they are managing health and safety effectively because they have policies, procedures, risk registers, incident reports, and training records. However, under the Health and Safety at Work Act 2015 (HSWA), what matters is not whether these systems exist, but whether they work in practice.

This whitepaper explains why safety systems frequently fail to protect workers and directors, how the illusion of control develops, and what PCBUs and boards must do to close the gap between work as imagined and work as done. It also outlines how Verification of Controls (VOCs) and targeted PCBU and board training can materially reduce governance risk.\

 

1. The PCBU's Primary Duty Under HSWA

A PCBU has the primary duty of care to ensure, so far as is reasonably practicable, the health and safety of workers and others affected by the work. This includes identifying hazards, managing risks, providing safe systems of work, training and supervision, and monitoring whether controls remain effective.

The legal test is not whether systems exist, but whether they actively prevent harm under real operating conditions.

 

2. The Illusion of Control

Boards and PCBUs often rely on documentation and reports to assure themselves that safety is being managed. Policies, registers, and training records can create a false sense of security if they are not tested against reality.

This illusion of control is dangerous because regulators and courts focus on what actually occurred on the ground, not what was written in manuals.

 

3. Work as Imagined vs Work as Done

Work as imagined reflects how leaders believe work should occur based on procedures and training. Work as done reflects how tasks are actually performed under real pressures, constraints, and conditions.

The gap between these two is where most serious risks reside. Systems that fail to account for this gap are unlikely to protect workers or directors.

 

4. The Regulator's Perspective

Investigations frequently identify disconnects between documented systems and actual work practices. Normalised deviations, unreported workarounds, and task pressures are common contributors to serious harm.

From a governance perspective, failure to verify how work is actually done is increasingly treated as a due diligence failure.

It is no longer acceptable to say “I don’t know,” as a Director needs to have direct knowledge of the risks at their site.  Site visits by Directors should now be priority one in managing safety compliance.

 

5. Moving from Assumption to Verification

Verification requires direct observation of work, engagement with workers, and evidence that controls function in real conditions. Independent Verification of Compretency (VOCs) provide PCBUs and boards with objective insight into whether safety systems work in practice.  The results of these VOC’s along with recommended actions and safety training requirements pay an integral role in the ongoing management of safety risks.

 

6. Building Capability Through PCBU and Board Training

Verification is most effective when paired with strong understanding of legal duties. Safety n Action’s Online PCBU Health and Safety Responsibilities course and tailored board seminars support directors and leaders to understand their obligations and act with confidence.

 

Conclusion - Where Oversight Ends and Exposure Begins

Safety systems protect organisations and directors from prosecution only when they operate effectively in reality. Policies, procedures, training records, and risk registers may demonstrate intent, but intent is no longer the standard by which directors and PCBUs are judged.

Evidence of verification and an understanding of PCBU duties, while necessary, are no longer sufficient on their own.

What is now expected — and increasingly examined by regulators and courts — is first-hand governance awareness.

 

Directors must move beyond receiving reports and into direct engagement with how work is actually performed.

This includes observing work, understanding the real pressures and constraints faced by workers, and forming an informed view of whether critical risk controls function as intended under real conditions.

This is not about directors managing operations.
It is about directors being able to demonstrate that their oversight is grounded in reality — not assumption.

When directors rely solely on management assurance, dashboards, or historical documentation, a dangerous gap emerges between what is believed to be happening and what is actually occurring. That gap is where unsafe practices normalise, controls erode, and serious harm becomes possible.

It is also where director exposure begins.

The legal reality is now clear: directors are not judged on what they approved or expected. They are judged on what they actively sought to understand, what they verified for themselves, and how they responded when reality did not match expectation.

Verification without context is weak.
Training without observation is incomplete.
Governance without first-hand insight is increasingly indefensible.

The question for directors and PCBUs is no longer whether safety systems exist, but whether they can confidently say:

“I know how work is actually being done — because I have seen it, tested it, and verified it.”

This whitepaper has explored why safety systems so often fail to deliver that assurance. For a deeper examination of how the gap between work as imagined and work as done has now become a point of personal liability for directors, we recommend reading our companion whitepaper The Gap That Convicts Directors. If you have not done so already.