Compliance Is Not the Same as Safety | Blog No. 128

Why PSM programs have to manage real operational risk, not just legal exposure.

Documentation, procedures, training records, inspection logs, audit findings, and corrective action records all have a place in a well-run PSM program. When something goes wrong, those records can become important very quickly.

But legal defensibility is not the same thing as operational safety.

Consider a common example in ammonia refrigeration: an SOP that technically exists, has been reviewed, and is available in the PSM files, but no longer matches how the task is actually performed in the engine room.

Maybe the procedure was written years ago, before a piping change, equipment replacement, control update, valve relocation, or operating practice changed. Maybe the experienced operators know the difference and have adapted. Maybe they know which step to skip, which valve is mislabeled, which pressure reading to watch, and which part of the procedure is outdated. The work still gets done, so the gap becomes normal.

On paper, the facility has a procedure. In reality, the procedure is no longer controlling the task.

That is the difference between managing liability and managing risk. Liability is usually argued after something goes wrong. Risk has to be managed before it does.

In ammonia refrigeration, the purpose of a PSM program is not simply to prove that a program existed after an incident. The purpose is to make sure the system is understood, maintained, communicated, and controlled before the incident ever happens.

Compliance is the floor. Safety is the work.

Compliance Is Necessary, But It Is Not the Finish Line

Compliance matters. PSM requirements exist because ammonia refrigeration systems carry real hazards, and those hazards have to be managed with discipline. Procedures, training, mechanical integrity, PHAs, MOCs, audits, incident investigations, and corrective actions are all part of that structure.

But having the required elements in place is not the same as having an effective program.

An SOP is a good example. A facility may be able to show that the procedure exists, that it was reviewed, and that operators signed a training record. That matters. But the more important question is whether the procedure still matches the equipment, the controls, the valve lineup, the hazards, and the way the task is actually performed.

If the SOP says to isolate one valve but the valve has been moved, relabeled, replaced, or functionally changed, the document may satisfy a file review while failing the operator. If the procedure describes a manual step that is now handled through a control screen, the risk may have changed. If the task has been modified by informal practice because the written steps are no longer practical, the facility may have a compliance record but not actual control.

Compliance gives the facility a framework. It forces important questions to be asked and documented. But compliance by itself does not operate the system, maintain the equipment, verify the procedure, train the operator, or close the gap between what management believes is happening and what is actually happening in the engine room.

That gap is where risk grows. The better question is not only, “Can we prove we had an SOP?” The better question is, “Does this SOP still control the hazard?”

Legal Liability and Operational Risk: Ask Different Questions

Legal liability and operational risk often overlap, but they are not the same thing.

Legal liability tends to focus on what can be proven after the fact. Was there a written procedure? Was the employee trained on it? Was the procedure reviewed? Was the inspection completed? Was the recommendation tracked? Did the company meet the applicable standard? Could the decision be defended later?

Operational risk asks a more immediate set of questions. Does the operator know what to do? Does the procedure match the actual task? Could the wrong valve be opened? Could equipment be isolated incorrectly? Could ammonia be trapped, released, or overpressurized? Are changes being reviewed before they become normal? Are recommendations being closed in a way that actually reduces risk?

A facility can be defensible and still be fragile. A signed SOP may show that a document exists, but it does not prove the procedure is accurate, usable, or followed. A training record may help show that training occurred, but it does not automatically prove that the operator is competent during an abnormal situation. A closed recommendation may show that an item moved off a list, but it does not always prove that the underlying hazard was eliminated or controlled.

The SOP example makes this clear. If the written procedure no longer matches the real task, the facility may have a defensible-looking file and still have a field-level hazard. The experienced operator may know how to work around the bad procedure. The new operator, contractor, auditor, or night-shift mechanic may not.

The safest facilities do not treat legal defensibility and operational safety as competing goals. They understand that the strongest protection from liability is usually the same thing that protects operators: a program that reflects reality and drives action.

The safest answer is usually also the most defensible answer, but only when the program is tied to actual control.

The Paper Trail Is Not the Safety System

Documentation should be evidence of control, not a substitute for control.

A paper trail can show that something was reviewed, signed, inspected, assigned, or completed. But the paper trail is not the safety system. The safety system is what actually governs decisions, equipment, communication, maintenance, training, and work in the field.

An outdated SOP is a simple example. The document may be in the right folder. It may have a revision date. It may have signatures. It may even describe how the task used to be performed accurately. But if the equipment has changed, the valve lineup has changed, the controls have changed, or the operators have developed an unofficial workaround, the document is no longer doing its job.

The paperwork has to describe reality. When it does not, it can create a false sense of security. Managers may believe a risk is controlled because a procedure exists. Operators may know the procedure is outdated, but they work around it because production still has to continue. Maintenance may perform the job based on experience, not because the written procedure is clear, current, and reliable.

That is not just a documentation problem. It is a control problem.

Good documentation makes the system visible. It creates a record of what was known, what was decided, who was responsible, and what was done. But it only has value if it reflects the real condition of the facility. A binder can show that a requirement was addressed; it cannot, by itself, prove that the facility is safe.

How Facilities Drift Into Defensibility Mode

Most facilities do not drift into paper compliance because they are careless. They drift because they are busy.

The refrigeration team is short-handed. Production needs the system running. Maintenance is reacting to urgent issues. The PSM coordinator is trying to keep up with audits, inspections, training records, contractor paperwork, open recommendations, and management requests. Experienced operators carry years of knowledge in their heads.

Over time, the program can begin to shift. The audit becomes the deadline. The binder becomes the program. Procedures get reviewed on schedule but not verified in the field. Recommendations get closed administratively instead of operationally. Training becomes a signature page. MOCs are treated as forms instead of management decisions. The same one or two experienced people become the real safety control.

The outdated SOP often develops in exactly this way. A change is made to the system. A valve is replaced. A control point is added. A pump is swapped out. A relief line is modified. A sequence is changed to make the task easier or safer in practice. Everyone involved understands the change at the time, but the written procedure does not get updated, or the update is delayed until the next audit cycle.

Then time passes. The informal method becomes the normal method. The experienced operators train newer operators verbally. The old SOP stays in the file. The procedure technically exists, but it no longer reflects the work.

On paper, the program may still look organized. In reality, the facility may be relying on memory, habit, informal communication, and tribal knowledge. That kind of drift is dangerous because it is easy to miss. There may not be one obvious failure. Instead, small gaps accumulate until the written program and the operating reality are no longer the same thing.

The danger is not always that the facility lacks paperwork. The danger is that the paperwork slowly stops describing reality. When that happens, the facility may be managing the appearance of a program instead of the actual risk of the system.

The Hard Questions Should Be Asked Before the Incident

After an incident, the questions become sharp. What did the procedure say? Did the operator follow it? Was the operator trained? Was the procedure current? Did the facility know the task was being performed differently? Was there a change that should have triggered an MOC? Were prior concerns raised? Did management act reasonably?

Those questions matter after an event. But a strong PSM program asks them before the event. That is the difference between using the program as a shield and using it as a management system.

If an SOP no longer matches the work, the question should not wait until after a release, injury, or failed audit. If operators are using an informal workaround, the question should not wait until someone has to explain why the written procedure was not followed. If a change was made in the field but never captured in the procedure, the question should not wait until the facility has to reconstruct the decision later.

The best time to ask hard questions is while the facility still has a chance to act. Is the SOP accurate? Is it usable? Does it reflect the current equipment? Have operators been involved in reviewing it? Does the procedure describe the critical steps clearly? Does it identify the hazards that actually exist today? Does it match how the task is performed on nights, weekends, and during abnormal conditions?

A good PSM program does not just make a company more defensible. It makes the facility less likely to need a defense.

The purpose is not to create a better explanation after something goes wrong. The purpose is to create better visibility and better decisions before something goes wrong.

From Audit-Ready to Reality-Ready

There is nothing wrong with being audit-ready. Facilities should be able to produce records, show completed work, explain decisions, and demonstrate that the program is being managed. But audit-ready is not enough.

Audit-ready means the file is clean. Reality-ready means the system is controlled.

A reality-ready PSM program can answer practical questions: Do the procedures match how work is actually done? Do operators understand the hazards, limits, and abnormal conditions of the system? Are open recommendations visible to the people who need to act on them? Are action items tracked to real closure? Are equipment changes captured before they become normal? Are inspections and PMs tied to actual risk? Does management know what is overdue, unresolved, or dependent on one person’s memory?

The SOP example should be one of the easiest ways to test the health of the program. Pick a covered operating procedure and walk it down in the field with the people who actually perform the task. Do the valve numbers match? Do the steps happen in the order described? Are there missing cautions? Are there steps everyone skips? Are there steps everyone performs that are not written down? Does the procedure match the control screen, the piping, the equipment, and the current operating limits?

If the answer is no, the issue is bigger than one bad document. It means the program has lost contact with reality at the point where operators rely on it most.

A facility does not become safer because documents are stored neatly. It becomes safer when the right people can see the right information, understand what needs attention, and act before small issues become serious failures. That is the difference between a program that exists and a program that works.

The goal is not prettier paperwork. The goal is better control.

What a Healthier PSM Program Looks Like

A healthier PSM program connects documentation to reality.

It keeps procedures current and usable. It connects records to actual equipment and field practice. It makes open recommendations visible. It tracks action items to real closure. It treats management of change as a decision process, not a paperwork step. It involves operators in procedure reviews and hazard discussions. It uses audits to improve the system, not just clean up the file.

For operating procedures, that means review should not be limited to changing dates, formatting pages, or checking a box. The procedure should be compared against the actual task. Operators should be involved. Field conditions should be verified. Changes should be captured. If the task has evolved, the SOP should be updated, training should follow, and any related PHA, MI, or MOC implications should be considered.

A healthy program also makes risk easier to see. Management should not have to guess whether procedures are current. Operators should not have to rely on memory to know which procedure is accurate. Maintenance should not have to search through scattered folders to understand equipment history. PSM coordinators should not have to manually rebuild the same information every time an audit, inspection, or incident investigation occurs.

The best PSM systems create one version of the truth. That does not mean the system has to be complicated. In fact, the opposite is usually true. The stronger the system, the easier it should be to see what is current, what changed, what is overdue, what is assigned, and what still needs a decision.

If the program only works when one person remembers everything, it is not really a system. A good PSM program should support the people doing the work. It should help operators trust the information they are given. It should help managers see unresolved risk. It should help the facility distinguish between “documented” and “done.”

Most importantly, it should help prevent the slow drift between what the paperwork says and what is actually happening.

Compliance Is the Floor. Safety Is the Work.

Legal defensibility matters. No responsible company should ignore it. In a heavily regulated environment, documentation, procedures, training, audits, and records are all part of responsible management.

But in ammonia refrigeration, the stronger goal is not merely to defend what happened after the fact. The stronger goal is to build a system where operators, managers, and executives can see risk clearly enough to act before something goes wrong.

An SOP that no longer matches the work is a small example, but it points to a much larger issue. A PSM program should not just prove that a facility has paperwork. It should help prove, every day, that the facility understands its hazards, maintains its equipment, communicates changes, follows through on recommendations, and gives operators information they can trust.

That is where legal defensibility and real safety come back together. The safest facilities are usually the most defensible because their documentation reflects actual control. Their records are not just a shield after the incident. They are evidence of a system that was working before the incident ever had a chance to happen.

Compliance is the floor. Safety is the work.

Previous Blog: Build vs. Buy: The Software Decision Most Facilities Get Wrong | Blog No. 127

---

For a comprehensive training on Anhydrous Ammonia, click here for our PSM Academy Ammonia Awareness training, to learn and earn a certificate of completion. Training is in English and Spanish. Use code SDS20 for a 20% discount on the entire purchase. For more information, email us at academy@machapsm.com.For a comprehensive training on Anhydrous Ammonia, click here for our PSM Academy Ammonia Awareness training, to learn and earn a certificate of completion. Training is in English and Spanish. Use code SDS20 for a 20% discount on the entire purchase. For more information, email us at academy@machapsm.com.