Are your checks happening before it is too late?
Gates that hold: the four-part test
Most of the gates in a certified management system are not gates. They are signatures. Four questions tell you which is which.
The gate that never closes
Every certified system has control points. The permit before the plant moves. The inspection before the batch releases. The design review before the drawing goes out. On paper they are the reason the system exists: the places where an irreversible decision is checked before it becomes irreversible.
Read the records and a different picture appears. The checklist is signed after the fact. The approval is a formality because the truck is already loaded. The sign-off happens in a batch on Thursday afternoon for work that was done on Monday, Tuesday and Wednesday, because that is when the person with the authority is at a desk.
In one engagement we read 845 non-conformances raised in under three years. More than half had no root cause recorded at all. The same defects returned. Three ISO certificates were current throughout, and not one of them was linked to the control point that should have caught it.
Those numbers describe one engagement. They are not a benchmark and not an average. But the shape of it is a pattern we find repeatedly, and it has a single cause: a control that cannot refuse is not a control. It is a record of work already done.
The four-part test
A gate that holds has four parts. Not three, and not five. Take any control point you believe in and ask these four questions in order.
What event makes this gate due?
A gate needs a trigger: a specific, observable event in the work that makes the check owed. The permit is requested. The batch reaches the hold point. The drawing reaches issue status.
If the answer is “at the end”, “before handover” or “before the audit”, the gate has no trigger. It has a deadline, and a deadline is met by whatever is cheapest on the day, which is a signature.
The test is mechanical: could someone who does not know the procedure tell, from the record alone, that this gate is now due? If not, it will be missed, and it will be missed in exactly the conditions where it matters most.
Who can refuse?
A gate needs one named owner who can withhold the release. Not a department. Not “QA”. Not a committee that meets fortnightly, on work that moves hourly.
Two failures live here. The first is diffusion: everyone is responsible, so the refusal belongs to nobody and the work proceeds. The second is quieter and worse: the owner is named, and refusing is career-limiting. If the person who stops the line is the person who gets asked why the line stopped, the gate is decorative.
The question is not who signs. It is who can say no, in front of the person under the most pressure, and still be doing their job correctly.
What is the least that must exist for the answer to be true?
Minimum evidence. The smallest artefact that makes the check verifiable: a reading, a photograph, a countersignature, a measurement against a stated limit.
Most systems get this backwards and specify the maximum. A gate that demands fourteen fields, three attachments and two signatures is a gate that will be completed retrospectively, because completing it honestly costs more than the work it guards. Over-specified evidence is a common cause of after-the-fact signing in the systems we read, and it is almost always well-intentioned.
Ask instead: if this gate were audited by someone hostile, what is the least that would prove it actually happened? Specify that, and nothing else. What the audit wants and what the outcome needs are not the same list, and the difference is where most of a manual’s weight sits.
Where does the rule live?
This is the part that gets skipped, and it is the part that does the work.
The gate has to be a rule in the system the work already runs in. If releases are recorded in an ERP, the rule is a status that cannot advance. If plant is released through a works-management system, the permit is a field that blocks the release. If the crew works from a tablet, the hold point is a step the tablet will not pass.
A rule in a manual is a request. A rule in the system is a constraint. The manual asks people to remember, under production pressure, something that is not in front of them; the system makes the shortcut unavailable. That is not a technology argument, and it is not an argument for buying anything. It is about where the rule is enforced. We specify a rule in whatever system the work is already recorded in, however modest that system is. A logbook with a numbered sequence and a controlled stamp is a system. A procedure that says “shall be approved prior to release” is not.
A gate that passes the first three questions and fails the fourth is the most dangerous kind, because it looks complete in every audit and depends entirely on people remembering it at the worst moment.
Why a signature is not a constraint
Leveson’s argument in Engineering a Safer World is that losses do not come from components failing. They come from constraints that were never adequately enforced. Safety, in that reading, is a control problem: something in the system has to be able to stop the process, and it has to be able to stop it at the moment the decision is made, not after.
A certificate audits something narrower. It asks whether a documented control exists, whether it is being followed, and whether there is evidence of it. Those are reasonable questions. None of them asks whether the control has the authority to say no, or whether saying no is survivable for the person who says it.
That is the whole gap. An auditor can find a gate fully conformant and a foreman can tell you, without contradiction, that it has never once stopped anything.
Cutting both ways
Real gates are expensive. Each one costs time at a moment when time is short, and that cost is what makes it credible. Which means you cannot have many.
Rasmussen’s account of how work drifts is the reason. Under sustained pressure for efficiency, and toward least effort, work migrates toward the boundary of functionally acceptable performance. The migration is not misconduct; it is what adaptive people do in a system that rewards output. His recommendation was not to add rules. It was to make the boundary visible.
So the arithmetic runs the other way from the usual instinct. Count the outcomes in your operation that cannot be undone: the ones where the consequence is irreversible, whether that is a person injured, a batch shipped to a client, a structure covered up, a payment made. That count, not the clause list, is your gate budget. Everywhere else, fewer rules and more competence, because a system that gates everything gates nothing, and the crews learn, correctly, that the gates are theatre.
The re-design work is symmetrical, and both halves are unpopular for opposite reasons: remove the constraints that exist only for the audit, and harden the few that protect something irreversible.
Try it on three
Take three control points you would name in a tender as evidence that your system works. For each one, answer the four questions in writing, in under a page.
You may well find that the trigger is a deadline, the owner is a department, the evidence is over-specified, and the rule lives in a manual. That is not a sign of a badly run company. It is the predictable result of building a management system to pass an audit, which is what the certificate asks for and what most consultants are paid to deliver.
It is also fixable, one gate at a time, without touching your certification. The first three are the hard ones, because they are where you find out which of your gates were ever gates.
The ideas here are not ours. Leveson, Engineering a Safer World (2011), on safety as a control problem. Rasmussen, Safety Science 27 (1997), on migration toward the boundary. Hollnagel, Safety-I and Safety-II (2014), on work as imagined and work as done. Dekker, The Field Guide to Understanding ‘Human Error’ (2014), on local rationality. The application to your floor, your gates and your systems is ours.
The engagement figures are from one engagement, published anonymously at the client’s request, and describe that engagement only.