Appendix F — Safety Reference: OSHA Focus Four, Checklists, Competent-Person Duties

How to use this appendix — and how not to

This is a working reference. It is not a rulebook, and it must not be read as one.

Chapter 24 makes an argument that this appendix depends on: the rulebook is the least useful part of safety management. Hazards are outputs of a production system. They are produced by decisions about schedule, sequence, staffing, procurement, and pressure — decisions made weeks earlier, in an office, by people who were not thinking about safety at all. The regulation is the floor. A job that does exactly what the standards require and nothing more will still hurt people, because standards address hazards that are already known and already codified, and your job will produce hazards nobody has codified.

So use the checklists in §F.4 the way a pilot uses a checklist — as a verification of a system that already exists, not as a substitute for one. If the only thing you take from this appendix is a list of things to look at, you have used it exactly backwards. Read §F.11 first if you are short of time.

A note on citations, which is not boilerplate. Federal construction standards in the United States live in Title 29 of the Code of Federal Regulations, Part 1926, organized into lettered subparts by topic. I reference subparts by topic only. I do not print section numbers, citation numbers, or penalty amounts, because section text is amended, penalties are inflation-indexed, and a number quoted from memory is how errors propagate. Every figure below is hedged for a reason. Roughly half the states operate their own OSHA-approved plans, which must be at least as effective as the federal program and several of which are meaningfully more stringent, with requirements and trigger values that have no direct federal analogue. Outside the United States the hazards are identical and the legal architecture is not — the United Kingdom, Canada, Australia, and the European Union each allocate duties differently, and some of them allocate a meaningful share to designers. Verify everything here against the current standard for the jurisdiction you are building in, before you rely on it.

The bodies whose work stands behind this appendix: OSHA, NIOSH, the Bureau of Labor Statistics, CPWR, ASSP, the National Safety Council, and — for electrical safety — NFPA. All publish free material better than most of what you can buy.

The people and the project in the examples — Kestrel Construction Group, the Northgate Outpatient Pavilion, Meridian Health System, and everyone named — are Tier-3 illustrative composites. The regulatory framework is real; the people are not.

F.1 The hierarchy of controls

Everything in this appendix hangs on one ranking. Given a hazard, there are five categories of response, and they are not equal. The ranking reflects how much each control depends on a human being doing something correctly, every time, forever, under fatigue and time pressure.

     MOST EFFECTIVE
  ┌────────────────────────┐
  │    1. ELIMINATION      │  Remove the hazard. Nobody is exposed because it isn't there.
  └────────────────────────┘
   ┌──────────────────────┐
   │   2. SUBSTITUTION    │   Replace it with something less hazardous.
   └──────────────────────┘
    ┌────────────────────┐
    │   3. ENGINEERING   │    Isolate people from it with something physical.
    └────────────────────┘     Works while you sleep.
     ┌──────────────────┐
     │ 4. ADMINISTRATIVE│      Change how people work: procedure, training,
     └──────────────────┘      sequence, permits, restricted hours, signs.
      ┌────────────────┐
      │    5. PPE      │       Protect the person at the point of contact.
      └────────────────┘       Last line. Fails silently.
     LEAST EFFECTIVE

A worked application: respirable crystalline silica from cutting and drilling the level-two deck.

Northgate's imaging change required a deeper depressed slab and new penetrations through a cured concrete deck — saw-cutting and core drilling, in an enclosed building, adjacent to occupied space. Dry-cutting concrete generates respirable crystalline silica, a well-established cause of irreversible lung disease. Here is the hierarchy applied, in order:

We used all five. That is normal and correct — the hierarchy is not a menu where you pick one; it is a ranking that tells you what order to think in, and how much comfort to take from what you have.

💡 And the honest part. Walk onto any job where a hazard has just been identified and listen to the first suggestion. It will almost always be PPE or a sign. Both are fast, cheap, visible — and both move the responsibility from the company to the worker. PPE is the only control on the list that requires the person at risk to do something right, every time, forever, with no feedback when they get it wrong. Every other control keeps working while everyone sleeps. That is why it is last, and why a safety program built on PPE and signage is a safety program built on hope.

None of which makes PPE optional. It makes it the floor of the floor. When you find yourself reaching for it first, stop and ask the four questions above it.

F.2 The Focus Four

Four categories cause the large majority of construction fatalities, and they have been the same four for decades: falls, struck-by, caught-in/caught-between, and electrocution. Construction consistently accounts for roughly one in five workplace fatalities in the United States while employing something closer to one in twenty workers. Those are magnitudes, not this year's numbers — get the current figures from the Bureau of Labor Statistics' fatality and injury surveys, and from NIOSH. Knowing where the number comes from is worth more than knowing the number.

A set of hazards that produces the same four outcomes every year for forty years is not luck. It is a stable property of how we build.

F.2.1 Falls

Falls kill more construction workers than any other category, and it is not close.

Trigger heights vary by standard and by activity, which is the fact the industry most reliably gets wrong. Different subparts govern different work, and a superintendent who says "six feet, always" is wrong in both directions. These are the commonly cited federal figures; state plans may set lower triggers, and other countries use different values entirely. Verify yours.

Four different numbers, four bodies of rules, on one site, on the same day. Your steel erector and your scaffold contractor will legitimately be working to different rules twenty feet apart.

The hierarchy, applied to falls.

1. Eliminate the height. Prefabricate at grade. Assemble the ductwork spool on the deck, not on the lift. Pre-install anchors, lifting points, and perimeter cable brackets on the ground before the steel is stood up. On Northgate we shop-welded the perimeter safety cable brackets to the spandrel beams at the fabricator — about $4,100, which eliminated roughly a hundred hours of exposed perimeter work, and which was bought fourteen months before anybody stood on the steel. Most of the fall protection on a well-run job is procured, not worn.
2. Guardrails and other passive protection. A guardrail protects everyone in the area — the person who forgot, the person who is new, the visitor in the clean hard hat — and it protects them while you are in a meeting. Top rail, mid rail, and toe board where objects can fall. Guardrails are the correct default for perimeters, floor openings, and open-sided platforms, and the fact that they cost more than a harness is exactly the argument for them.
3. Safety nets, where guardrails are impractical and the work is continuous over an area — installed as close as practicable beneath the work surface, with the required clearance and drop testing, and inspected after installation and periodically thereafter.
4. Personal fall arrest — last resort. And now the arithmetic that almost nobody does.

The fall clearance calculation, worked

A personal fall arrest system does not stop you instantly. It stops you over a distance, and if that distance is longer than the distance to the ground, the system worked perfectly and you died anyway.

Five components, measured downward from the anchorage point:

Those device values are illustrative typical numbers, not specifications. Read the label and the manufacturer's instructions on the actual equipment. Those are the ones that count.

Now the case that kills people: a 6-foot lanyard on a 12-foot-high anchor point.

Required clearance below the anchor: 17.5 ft Available clearance below the anchor: 12.0 ft Shortfall: 5.5 ft

He hits the ground. He hits it at close to the speed he would have hit it with no harness at all, and he hits it wearing equipment that everybody on that job — including him — believed was protecting him.

Swap the lanyard for a self-retracting lifeline (SRL), which limits free fall to roughly 2 feet and arrests in roughly 2 feet, and the arithmetic becomes 2.0 + 2.0 + 1.0 + 5.0 + 2.0 = 12.0 ft required against 12.0 ft available. You have moved from certain contact to break-even, which is not a plan. Note also that ordinary SRLs are generally not rated for leading-edge use, where the lifeline can be cut or loaded over a sharp deck edge; leading-edge-rated devices are a different product with different clearance numbers.

The real answer at twelve feet is the one the hierarchy gives you. At low heights, personal fall arrest is frequently the wrong control. Use guardrails. Use nets. Use a work platform. Eliminate the exposure. Fall arrest needs room to work, and low work is exactly where the room does not exist.

⚠️ Safety alert. Low falls are not minor falls. The intuition that twelve feet is "not that high" kills people every year, and produces the specific failure of a fully harnessed worker striking the ground inside a working system. Any time you specify fall arrest, do the clearance arithmetic in writing, on the job hazard analysis, before the crew goes up. If the number does not work, the answer is a different control — not a shorter lanyard and a hopeful shrug.

Anchorage. For personal fall arrest, the familiar requirement is an anchorage capable of supporting 5,000 pounds per attached worker, or one designed by a qualified person as part of a complete system with a safety factor of at least two. The arrest force delivered to the body must also be limited — with a body harness, the widely used design limit is 1,800 pounds of maximum arresting force. Memorize both, because a startling number of field anchor points fail the first one: a piece of unistrut, a plumbing riser, a scaffold frame, a duct hanger. Ask who calculated it. If nobody calculated it, it is not an anchor.

Anchor overhead. A 6-foot lanyard anchored at foot level means the D-ring — about 5 feet above the feet — falls that distance before the lanyard begins to pay out. Free fall becomes roughly 11 feet, which by itself exceeds the 6-foot limit the system is designed around and can produce arresting forces above the design limit. Required clearance becomes roughly 22.5 feet. Anchor at or above the D-ring, or use a device specifically rated for foot-level tie-off — they exist, they are labeled, and they cost more for exactly this reason.

The rest of the fall inventory:

• Floor and roof openings. Every hole big enough to drop through gets a cover secured against displacement, marked ("HOLE" or "COVER"), and rated for at least twice the load that could be imposed. Loose plywood over an opening is not a cover; it is a trap with a lid.
• Leading edges. The deck edge that moves every hour. Controlled access zones, safety monitoring systems, warning lines, and leading-edge-rated SRLs live here, and the plan has to be written before the work starts, because the geometry changes daily.
• Ladders. Right ladder for the job; extend about three feet above the landing; secure it; three points of contact; do not carry material up; do not use the top step; keep it out of doorways and traffic. Ladders are ordinary, which is precisely why they are dangerous — nobody writes a hazard analysis for a ladder.
• Aerial lifts. In a boom lift, tie off to the manufacturer's anchor inside the basket, every time, because the failure mode is catapulting. In a scissor lift, the guardrail is the protection and the rule is to stay inside it — do not climb the rail. Check the ground, the slope, the holes, and the overhead, including power lines.
• Scaffolds. See Chapter 22 and the checklist in §F.4.3.
• Rescue. A worker suspended in a harness after an arrest can deteriorate rapidly from suspension trauma. A written, rehearsed rescue plan specific to that elevation is part of the fall protection system, not an afterthought — with suspension relief straps on the harness and a means of reaching the worker that does not depend on the fire department arriving first.

F.2.2 Struck-by

Underrated because the events sound small: a falling object, a swinging load, a backing truck. A four-pound wrench dropped from level four does not behave like a four-pound wrench.

The tool that ties the first row together is the internal traffic control plan — and it is a document, not a habit. Four rules make one work, and all four are decisions rather than exhortations: one gate in, one gate out; no backing except into a bay with a spotter; one pedestrian crossing; and pedestrians never share a surface with equipment. Every one is an engineering control masquerading as a logistics decision, which is the point — the safest site plan and the most productive site plan are usually the same drawing.

⚠️ Safety alert. The single most dangerous ordinary moment on a building site is a piece of mobile equipment backing up. Blind spots are enormous, the operator has a job to do, and the person walking behind is looking at a phone or a drawing. Design the site so equipment does not have to back up. Where it must, a spotter with a defined position, eye contact, and a stop signal is not optional — and the spotter's own position must be planned so the spotter is not the one who gets pinned.

F.2.3 Caught-in / caught-between

Trench and excavation collapse is the deadliest single activity in construction on a per-exposure basis. A cubic yard of soil weighs roughly the same as a small car — commonly cited around 3,000 pounds — and a collapse buries a person in seconds, in a material that does not compress and does not let the chest expand. Survivability after burial is measured in minutes; rescue is measured in hours.

⚠️ Safety alert. Trench fatalities cluster in two situations: a very short "quick" task ("thirty seconds, I'm just knocking that pipe loose") and a rescue attempt by a coworker. Secondary victims are horribly common. Put it in your orientation in plain words: if the trench collapses, you do not go in. You call, you keep everyone out, you mark where he was, and you wait for a team with the equipment. That is the hardest instruction in construction and it saves the second life.

Caught in or between equipment. Pinch points, rotating shafts, unguarded machinery, and the specific horror of being caught between a swinging counterweight and a wall, or between a truck and a dock. Controls: machine guarding that is present and not defeated; swing-radius barricades on every rotating machine; lockout/tagout before any service; and no-go zones marked on the ground.

Collapse of structures and materials. Formwork and shoring failures; unbraced masonry walls during construction (the limited-access zone requirement exists for exactly this); improperly stacked material; unsecured loads. A precast panel is not safe until it is welded or bolted per the erection drawings, and "we'll come back and finish the connections" is the sentence that precedes the collapse.

F.2.4 Electrocution

The most counterintuitive fact in this section: most construction electrocutions do not involve electricians. They involve laborers, operators, carpenters, painters, and roofers — people who did not think of themselves as doing electrical work, contacting energy they did not know was there. Treat that as a widely reported pattern rather than a precise statistic, and let it change how you write your orientation.

Overhead power lines are the big one, and mostly an equipment problem: a crane boom, a dump body, a scaffold section, an aluminum ladder, a length of rebar on a shoulder.

• For people and hand-carried conductive objects, the commonly taught minimum approach distance is 10 feet for lines up to 50 kV, increasing with voltage.
• For equipment operating near energized lines, the crane standard requires either de-energizing and grounding the line, or maintaining a minimum clearance from a table based on the line's voltage — and where the voltage is unknown, the common default for equipment operation is substantially larger, on the order of 20 feet up to a high threshold. Get the actual table from the current standard, and get the actual voltage from the utility in writing.
• Controls, in hierarchy order: have the utility de-energize or relocate the line (elimination — expensive, slow, and the only control that cannot fail), then utility-installed insulating sleeves, then physical barriers and goalposts, then a dedicated spotter whose only job is clearance, then warning signs.

⚠️ Safety alert — equipment contacts a line. The operator stays in the cab. Everyone else stays back at least the clearance distance, because the ground around the machine can be energized in a gradient and a person walking toward it can be killed by the voltage difference between their two feet. If the operator must exit (fire), the instruction is to jump clear without touching the machine and the ground simultaneously, land with feet together, and shuffle or hop away with feet together. Put that in your orientation. Thirty seconds of content, and the difference between one incident and three.

Temporary power. A construction site runs on cords lying in water, cords run over by trucks, and equipment that never sees a maintenance shop. The protection is either GFCI (ground-fault circuit interrupter) protection on all 120-volt, single-phase, 15-, 20-, and 30-ampere receptacle outlets that are not part of the permanent wiring, or a written assured equipment grounding conductor program with scheduled inspections and color-coded tags. Pick one in writing and audit it. In practice GFCI is simpler, cheaper, and far more reliable than a program depending on somebody inspecting every cord on a schedule — and running a monthly cord audit anyway is still worth it, because GFCI does not fix a damaged cord that trips a breaker and stalls a crew.

Lockout/tagout. Before anyone services equipment where unexpected energization could hurt them, the energy is isolated, locked, tagged, and verified by trying to start it. Every authorized person applies their own lock; the last one off is the person who did the work. On a construction site this gets complicated when the permanent electrical system is partially energized during commissioning — exactly the period when the trades are least sure which panels are live. Write the transition plan before energization, not during it.

Energized work and arc flash. Working on energized equipment should be rare, permitted, and justified; "it's inconvenient to shut it down" is not a justification. Where it happens, NFPA 70E is the governing consensus standard for electrical safety in the workplace — shock and arc-flash boundaries, incident-energy analysis, arc-rated clothing, and a written energized-work permit. Arc flash is not shock. It is an explosion with a pressure wave and temperatures that ignite ordinary clothing, and ordinary cotton coveralls make it worse, not better.

And the quiet one: temporary lighting. When an electrical crew relocates a temporary circuit to serve its own work, three other trades lose light in a stairwell nobody thought about. That is not an electrical hazard; it is a fall hazard created by an electrical decision. Put temporary lighting changes on the same notice requirement as deliveries.

F.3 Competent person and qualified person

These are defined terms with specific meanings, and using them loosely gets people hurt.

A competent person is one who is capable of identifying existing and predictable hazards in the surroundings or working conditions that are hazardous or dangerous to employees, and who has authorization to take prompt corrective measures to eliminate them.

A qualified person is one who, by possession of a recognized degree, certificate, or professional standing, or by extensive knowledge, training, and experience, has successfully demonstrated the ability to solve or resolve problems relating to the subject matter, the work, or the project.

The half everybody forgets is in bold. Competency includes authority. A person who can identify a hazard but must call three people to get a crew moved off a scaffold is not a competent person for that scaffold; they are a knowledgeable observer. When a subcontractor names theirs, ask one question: can this person stop the work and spend money to fix it, without calling you? If the answer is no, you have a paper designation.

Qualified is about engineering judgment — designing the suspended-scaffold rigging, sizing the shoring, designing an anchorage as part of a complete fall protection system. Competent is about field recognition and authority. They are different jobs, and the same person is only sometimes both.

Designations are activity-specific, and must be named — a person, an employer, a qualification basis, and a backup. "The sub will provide one" is not a designation.

Required training rides alongside that table: fall protection user; scaffold user; competent-person training for excavation, scaffold, and fall protection; confined-space entrant, attendant, and supervisor; qualified rigger and qualified signal person; powered industrial truck and telehandler; aerial and scissor lift; lockout/tagout authorized person; respirable crystalline silica; hazard communication; first aid, CPR, and AED — plus whatever your owner and your jurisdiction add.

Track currency, not attendance. A training record with a date and no expiration is a record of an event, not a statement about today. The column that matters is expires.

F.4 Inspection checklists

Use these as verification of a system that exists. Every one of them should have a named owner, a frequency, a form, and a place the record lives — and a corrective-action tracker with a closure target and an aging report. An inspection record with nothing on it, week after week, is evidence of an inspection nobody performs, and any competent investigator will read it exactly that way.

F.4.1 Daily site walk (superintendent, every morning)

1. Access and egress: gates, stairs, ramps, walkways clear and lit.
2. Perimeter and floor openings: guardrails complete; covers secured, marked, and in place.
3. Housekeeping by area; debris removal keeping up; no material in egress paths.
4. Pedestrian route and vehicle route physically separated; the crossing controlled.
5. Excavations: current inspection record, protective system in place, egress within range.
6. Scaffolds: tags current for this shift; no visible modification since yesterday.
7. Ladders in use correctly; no cross-brace climbing; no makeshift platforms.
8. Aerial and scissor lifts: operators tied off in boom lifts; nobody climbing rails.
9. Temporary power: GFCI in use, cords out of water and traffic, panels closed and labeled.
10. Fire: extinguishers accessible and current; flammables stored properly; hot-work permits posted.
11. Overhead work: drop zones barricaded; nobody working under a suspended load.
12. Silica, noise, and dust controls in use where cutting, drilling, or grinding is happening.
13. PPE in use, correct for the task, and in serviceable condition.
14. Pre-task plans completed and present at the work area.
15. Anything corrected on the spot, and anything logged with an owner and a date.

F.4.2 Excavation (competent person, before each shift and after every rain)

1. Protective system in place, correct for the classified soil and the actual depth.
2. Soil classification current — reclassified after rain, vibration, drying, or any change.
3. Trench box or shield undamaged, correctly stacked, and within its tabulated depth.
4. Sloping or benching angles match the classification, and the face has not been undercut.
5. Egress — ladder, ramp, or stair — within 25 feet of lateral travel, extending above the edge.
6. Spoil piles, equipment, and material set back from the edge.
7. No standing water; dewatering functioning; base not softened.
8. Atmospheric testing where required, with results recorded.
9. Utilities located, marked, exposed where required, and supported.
10. Adjacent structures supported or underpinned; monitoring points read if required.
11. Barricades, covers, and warning devices around the open excavation.
12. No workers under suspended loads or in the swing radius of equipment.
13. Inspection recorded, dated, and signed — and workers removed immediately if a hazard exists.

F.4.3 Scaffold (competent person, before each work shift)

1. Base plates on mudsills or another adequate firm foundation; level; no blocks or loose fill.
2. No undermining from erosion, excavation, water, or vehicle traffic since the last inspection.
3. Screw jacks within allowable extension; legs plumb.
4. All frames and braces installed per the manufacturer or the design; nothing removed.
5. Coupling pins and pin locks engaged at every joint.
6. Ties, guys, and braces at the required spacing; height-to-base ratio satisfied (a supported scaffold exceeding four times its minimum base width must be restrained from tipping).
7. No bent, cracked, corroded, or field-modified components; components from a single system, not mixed across manufacturers.
8. Fully planked or decked; no gaps beyond the allowable; platform-to-wall gap within limits.
9. Planks scaffold-grade and sound; correctly overlapped or extended over supports; secured against displacement.
10. Guardrails — top rail, midrail, posts — complete on all open sides and ends.
11. Toeboards, screens, or debris nets where anyone works or passes below.
12. Load class posted and respected — light duty 25 psf, medium 50 psf, heavy 75 psf. Scaffolds and components must support at least four times the maximum intended load; suspension ropes and their connecting hardware at least six times.
13. Material distributed, not concentrated on one bay.
14. Safe access — ladder, stair tower, ramp, or integral access. Cross braces are not a ladder.
15. Platforms clear of ice, snow, mud, mortar droppings, and debris.
16. Required clearance from energized lines maintained; no new overhead exposure.
17. No weather condition making the scaffold unsafe since last use.
18. Tag current: today's date, this shift, printed name and signature of the competent person, load class. A tag with a name and no date, or a date and no name, is decoration.
19. "Did anybody touch this scaffold since yesterday?" — asked of the crew, out loud, every morning. It costs eight seconds and it turns users of a structure into witnesses about it.

F.4.4 Ladders

1. Correct type and duty rating for the load and the task; non-conductive near electrical work.
2. No cracked, split, bent, or missing components; no field repairs; labels legible.
3. Free of oil, grease, mud, and ice on rails and rungs.
4. Straight and extension ladders extend about three feet above the landing and are secured at top, or otherwise held.
5. Correct angle; feet on a firm, level surface; slip-resistant feet intact.
6. Not placed in a doorway or traffic path without barricading.
7. Stepladders fully open with the spreader locked; top step and top cap not used.
8. Three points of contact; face the ladder; material hoisted, not carried.
9. One person per section unless designed otherwise.
10. Defective ladders tagged and physically removed from the site, not leaned in a corner.

F.4.5 Aerial and scissor lifts

1. Operator trained and authorized for this machine; manual present in the machine.
2. Pre-use inspection completed: controls, alarms, tires, hydraulics, guardrails, gates, decals.
3. Ground conditions verified: slope, holes, soft fill, trench edges, buried utilities, floor capacity.
4. Overhead survey done — power lines, structure, ductwork — with clearances confirmed.
5. Boom lift: harness and lanyard attached to the manufacturer's anchor in the basket.
6. Scissor lift: guardrails and chains intact; work from inside the platform; do not climb the rail.
7. Rated capacity and platform load respected; nothing tied to or bridged from the platform.
8. Outriggers and stabilizers deployed where required; machine level.
9. Travel-with-platform-raised rules of the machine followed, not improvised.
10. Area below the platform barricaded where work is overhead.
11. Ground rescue plan and controls known to somebody on the ground.

F.4.6 Electrical and temporary power

1. GFCI protection on all non-permanent 120-volt receptacle outlets, or a documented assured equipment grounding conductor program with current color-coded tags.
2. Cords rated for hard or extra-hard use; no splices outside approved fittings; grounding pins present.
3. Cords out of water and out of traffic; protected where they cross a route.
4. Panels closed, labeled, and with required working clearance kept clear of material.
5. Temporary lighting adequate for the task and secured; guards on lamps.
6. No damaged tools or equipment in service; damaged items tagged out.
7. Lockout/tagout applied and verified by attempting to start, with each authorized person's own lock.
8. Energized work performed only under a written permit with arc-flash and shock protections.
9. Overhead line clearances observed for both people and equipment.
10. Energization sequence during commissioning documented and communicated to every trade.

F.4.7 Fire prevention and hot work

1. Hot-work permit issued for the specific location, task, and shift; posted at the work.
2. Combustibles removed for the required distance, or protected with rated blankets and shields.
3. Openings, cracks, and floor penetrations within the radius covered.
4. Fire extinguisher of the correct type, current inspection, immediately at hand.
5. Fire watch present during the work and for the required period after, with the sign-off returned the same day.
6. Cylinders secured upright, caps on when not in use, hoses and regulators sound, fuel and oxygen separated.
7. Fire protection systems: standpipes and extinguisher coverage maintained as the building rises.
8. Access maintained for fire apparatus; egress routes and stairs unobstructed.
9. Flammable and combustible liquids in approved containers and storage; smoking controlled.
10. Temporary heating equipment installed, fueled, and ventilated per the manufacturer.

F.4.8 Housekeeping

1. Walking and working surfaces clear; no trip hazards in routes or at stair landings.
2. Debris removed to a container on a schedule, not accumulated to a threshold.
3. Material stacked stably, within capacity, banded or blocked, and not in egress paths.
4. Protruding nails and rebar bent, removed, or capped.
5. Waste separated where required; no burning; no dry sweeping where silica is present.
6. Spills cleaned and the cause corrected; hoses and cords coiled.
7. Snow, ice, and standing water managed on routes and platforms.
8. A cleanup responsibility matrix by trade that matches the subcontracts — so the same trade owes the same thing in both documents.

F.4.9 Personal protective equipment

1. Head, eye, foot, and hand protection appropriate to the task and actually worn.
2. High-visibility apparel where mobile equipment operates.
3. Hearing protection where noise exposure requires it, with the exposure assessed rather than guessed.
4. Respiratory protection only under a written program: hazard assessment, correct selection, medical evaluation, and fit testing — an unfit-tested respirator is a costume.
5. Fall protection equipment inspected before each use; removed from service permanently after any arrest event; within the manufacturer's service life.
6. Harnesses correctly fitted and adjusted, with suspension relief straps.
7. Cut-resistant, chemical-resistant, or arc-rated gloves and clothing matched to the actual hazard.
8. PPE stored so it stays serviceable; damaged items replaced, not repaired.

F.5 The site-specific safety plan

Every contractor of any size has a corporate safety manual: 250 pages, every standard the company could ever encounter, satisfies an auditor and a prequalification questionnaire, and after the first week nobody opens it again. That is not a criticism — it is the correct document for its purpose. It is simply not a plan for building anything.

If your site-specific plan is the corporate manual with the project name typed on the cover, you do not have one. That is the most common failure in the industry and it is invisible until the investigation.

Fourteen sections a real one contains, with the part people get wrong:

1. Project description and scope-specific hazard analysis — must name this project's hazards.
2. Roles, responsibilities, and authority — must state who can stop work, by name and by role, and that it includes every worker on site.
3. Competent- and qualified-person designations by activity, by name, with employer and backup.
4. Emergency action plan — see §F.10.
5. Medical and first aid — supplies and AED location; trained responders by name and by shift; the nearest occupational clinic and emergency department with addresses and drive times; and the rule for which one you use.
6. Orientation and training — content, duration, language, who delivers it, the badge system, and refresh triggers.
7. Subcontractor requirements and flow-down — what each sub submits before mobilizing, and what happens when they do not.
8. Inspection regime — who, what, how often, on what form, and where the record lives.
9. Incident reporting and investigation — what gets reported, to whom, within what time, including near-misses, with no penalty attached.
10. High-risk activities requiring a written plan — see §F.6 and §F.7.
11. Housekeeping, PPE, and site rules, tied back to the cleanup matrix in the subcontracts.
12. Fitness for duty, substance policy, heat and cold illness — the heat plan needs a trigger (a temperature and a humidity), not a paragraph of encouragement.
13. Site-specific logistics safety — traffic plan, drop zones, exclusion zones, and any interface with an occupied building.
14. Plan review and revision log — dated revisions. A plan with no revision log after fourteen months is a plan nobody used.

F.6 Job hazard analysis

A job hazard analysis (JHA) — also called an activity hazard analysis or job safety analysis — is the most useful safety document in construction and the one most often produced as theater.

The method is four questions, applied to each step:

1. What are the steps? At the level a foreman would describe them. Not "install curtain wall." Not "pick up the wrench." Eight to fifteen steps for a typical activity.
2. What can hurt somebody at this step? Be specific about the mechanism. Not "fall hazard" — "the platform is not yet secured to the building and can swing when the panel is landed."
3. What is the control, and which level of the hierarchy is it? A JHA in which every control is PPE has told you something important about the JHA.
4. Who verifies it, and when? The field everybody leaves off, and the one that makes the document real.

A JHA written by an office and handed to a crew is paperwork. A JHA written with the crew that will do the work is planning.

The office version is not merely less effective — it is actively harmful, because it produces a signed document asserting that a hazard analysis was performed when the people exposed have never read it. It creates the record without the safety. Two tests for whether yours is real: can any crew member name the two biggest hazards in their own words, unprompted? And has it been revised? A JHA on Rev. 0 after four months describes work that is not being done the way it is described.

A fully worked JHA

Activity: Setting two rooftop air-handling units by mobile crane, north side, over the tie-in to the occupied adjacent clinic. Prepared by: the mechanical foreman, the rigging superintendent, the crane operator, the lift director, and the Kestrel superintendent — together, on site, in fifty minutes. Revision: Rev. 2 — revised after the crane position moved to accommodate the clinic canopy.

Look at what that document does that a rules list cannot. Step 4 records that the highest-value control — relocating the clinic entrance — was purchased by a conversation with the owner, days before anybody put on a harness. Step 12 turns "watch the weather" into a number somebody reads off an instrument. Step 10 makes "anchored before release" a verifiable event with an owner's name on it.

F.7 High-risk activity permits

A permit is a written, time-limited authorization to perform a hazardous activity under stated conditions. Its value is not the paper — it is that it forces someone with authority to look at the specific conditions before the work starts, and that it creates a record that they did.

Two rules that make permits real rather than decorative: the permit is posted at the work, not filed in the trailer; and it is closed out and returned the same day, with the fire watch or the entry supervisor signing what actually happened. A permit book that is issued but never closed is a record that nobody was checking.

F.8 Incident investigation

F.8.1 The sequence

The first three steps are irreversible if you get them wrong.

1. People first. Always, without exception, before anything else. Render aid, call emergency services, execute the emergency action plan — the medical gate, the route, the escort. Do not investigate, photograph, or question an injured person. Somebody's entire job for the next hour is that person.
2. Secure the scene and stop the exposure. Whatever hurt one person can hurt the next one. Stop the work in the affected area, and be generous about the boundary, because you do not yet know what the hazard was. Barricade it. Post someone.
3. Preserve evidence. Photograph everything before anything moves — wide to close, with something in frame for scale. Preserve the equipment, harness, ladder, tool, tag, or cover in the condition it is in. Preserve documents immediately: the JHA, the pre-task plan, the inspection log, the tag, the permit, the daily report, the schedule, and the crew's timecards for the past two weeks. Everybody's instinct is to clean up. That is exactly why this is a discipline.
4. Meet your reporting obligations. A work-related fatality must be reported to OSHA within a short window measured in hours; an in-patient hospitalization, an amputation, or the loss of an eye within a longer but still short window. Those thresholds and timeframes have changed over the life of the rule — verify the current ones and post them on the trailer wall with the reporting number, because the day you need them is a day nobody is thinking straight. Owner and insurer notice obligations are in your contract and your policy; late notice can void coverage.
5. Interview early and separately. Memory degrades within hours and, more importantly, it converges: people who talk to each other before you talk to them produce one shared story, and that story is not more accurate, only more consistent. Interview each person alone, as soon as it is humane, and open with a sentence you mean: "I am not trying to find out who to blame. I am trying to find out what happened so it doesn't happen to somebody else." Then ask open questions and stop talking. The single best interview question in construction is "walk me through your morning."
6. Build a timeline before you build a theory. Every fact on one line, with a time and a source. Do not interpret yet. The timeline routinely reveals that the incident began days before the injury.
7. Then, and only then, analyze.

F.8.2 Root cause, not blame

The common tool is the five whys: ask why, take the answer, ask again, until you reach something structural. It is useful. It is also taught as if it were a law of nature, and it is not.

Three honest limits. It is linear — real incidents have several interacting chains, and one "why" ladder finds one of them and makes it look like the answer. It is vulnerable to hindsight — once you know the outcome, every prior decision looks obviously wrong; it was not obvious on Tuesday. And most importantly, it stops where the investigator's authority stops. A safety coordinator with no standing to question an executive scheduling decision will terminate the chain at the third why and write "improve after-hours procedures." That is not analytical rigor; it is organizational gravity. The chain always terminates at the investigator's pay grade unless somebody protects it.

Use it as a prompt, not a proof, then apply the test that matters:

The substitution test: if a different, competent, well-intentioned person had been standing in that spot, would this still have happened?

If yes — you have a system problem, and a corrective action aimed at the individual will do nothing. If no — ask why this person was placed where their particular limitation mattered, and you will usually find a system problem behind that too.

And the discipline that separates an investigation from a report: do not stop at "the worker made a mistake." That is a description of the event, not a cause. So is "the installer set the anchors wrong" and "the worker stepped on an unsecured plank." Both describe. Neither explains. Both leave the producing system untouched, which is why the same finding shows up again in nine weeks with a different name on the form.

Classify every finding, because the classification determines whether the corrective action does anything:

The test of whether your investigation was any good: count how many corrective actions are aimed at the person, the tool, or the condition, and how many are aimed at the decision that produced them. If the answer is all of the first and none of the second, you did not investigate. You documented.

F.9 Measuring safety

F.9.1 Lagging indicators, and what they cannot tell you

They measure the past. They are standardized, comparable, required — and every one counts injuries that already happened.

Total recordable incident rate (TRIR) — recordable cases per 100 full-time-equivalent workers per year. The 200,000 is a normalizing constant (100 workers × 40 hours × 50 weeks), nothing more.

TRIR = (recordable cases × 200,000) ÷ total hours worked

Northgate, at completion: 412,000 craft man-hours, 5 recordable cases.

(5 × 200,000) ÷ 412,000 = 1,000,000 ÷ 412,000 = 2.43

DART — cases involving Days Away, Restricted, or Transferred — uses the same formula. Northgate had 1: (1 × 200,000) ÷ 412,000 = 0.49. DART is the more useful of the two, because it filters out minor recordables and tracks the injuries that actually took somebody off their job.

Now the statistical problem, which is the most important thing in this section.

Read the last row. The same job, with a single incident, is either a perfect safety record or roughly double the industry's typical construction rate. Nothing about the safety program changed. One person slipped. A small project's TRIR is close to meaningless, and no owner should prequalify on a project-level rate over a short period.

Experience modification rate (EMR). A workers' compensation rating factor. A rating bureau compares a company's actual losses over a three-year experience period — typically lagging one year, so this year's mod reflects claims from roughly four to two years ago — against the expected losses for a company of its size and job classifications, and produces a multiplier applied to manual premium.

• EMR = 1.00 — performed as expected for your size and trade mix.
• Below 1.00 — better than expected; premium goes down.
• Above 1.00 — worse; premium goes up, and every owner who asks can see it.

Three things about EMR that get misread. It weights frequency more heavily than severity — the formulas split each claim into a primary and an excess portion at a defined split point, and the primary portion counts far more. Ten small claims hurt a mod more than one catastrophic one. That is deliberate, because frequency is more controllable and more predictive — and it is why a company can have a fatality and a mod under 1.00, which is worth knowing before anyone uses EMR as a moral scoreboard. It is a company number, not a project number — a loss on one job raises the insurance cost embedded in the bid on every other job for three years. And it varies by jurisdiction: most U.S. states use a common bureau formula, several run their own, a few have monopolistic state funds.

How owners use it. Many healthcare owners, public agencies, and large private clients set a hard EMR cutoff in prequalification — commonly 1.00, sometimes 0.90 — often paired with a requirement of no willful or repeat citations in three years. Cross it and you do not bid at a lower margin. You do not bid. That is the real consequence, and it is larger than the premium.

And the last weakness, which is the serious one: lagging indicators can be gamed. Every one can be improved by managing the reporting rather than the work — characterizing a recordable as first aid, putting an injured worker on nominal "light duty" recorded as no restriction, or building a culture in which reporting costs you something. A safety incentive program that pays for zero recordable injuries does exactly this: it does not pay for safe behavior, because safe behavior is not what it measures. It pays for the absence of a recorded injury, and a worker has far more control over whether an injury is recorded than over whether it occurs — with the worst version being peer enforcement, because a report costs the whole crew their bonus. Pay for the leading indicators instead. The test of a well-designed incentive is simple: does it get better or worse when somebody tells the truth?

F.9.2 Leading indicators — the ones that actually predict

🔍 A rising near-miss count is usually good news, and this is worth understanding mechanically rather than accepting on faith. The number of near-misses that occur is a property of the work: it is large, roughly stable, and unobservable. The number reported is that occurrence rate multiplied by people's willingness to tell you. When your reported number is low, either the site is genuinely safe or people are not talking — and those two states produce identical data. Near-misses are common on every construction site in the world, so a near-zero count is far more likely to be a reporting failure than a hazard-free site. Fix the culture and occurrence is unchanged, willingness climbs, and reports go up. The target is never zero and never a ceiling. The honest management sentence is: "We got 14 near-miss reports this week. Good. What did we learn, and how fast did we close them?"

F.9.3 Schedule pressure as a measurable leading indicator

This is the book's own contribution, and it is the reason §F.11 exists.

Acceleration is a hazard-generating decision. On Northgate, Kestrel spent $168,000 to buy back 17 of 23 lost calendar days. It was probably the right call. Here is what the money actually bought, expressed as production changes rather than line items: a second erection crew sharing one crane and one hoist; six-day weeks for nine weeks; enclosure resequenced by area so trades planned in series now overlapped in one zone; follow-on trades pulled forward into areas not fully ready; and — the row with no dollar figure — an unwritten understanding that stopping was expensive.

Here is the leading-indicator dashboard across that window. Milo Serrano stepped on an unsecured scaffold plank on the Tuesday of week 34.

Weeks 31 → 34: every pressure indicator climbs and every reporting indicator falls. And the near-miss count fell, from four a week to one. That falling line is the alarm, and it reads exactly backwards. A superintendent glancing at week 34 sees "one near-miss — quiet week." It was the loudest week of the job. Near-misses did not decrease; the willingness to spend ten minutes reporting one, in a week when everybody was being asked to make up time, collapsed.

Weeks 35–37 are the stand-down: reports went from 1 to 11 to 14, not because the site got more dangerous but because people started talking. Note that overtime stayed high through week 36 — the pressure barely dropped, but the reporting recovered, because what reporting cost had changed.

The data to predict that near-miss existed inside the project controls system nine days before it happened, held in the schedule and in the payroll, and nobody had ever thought to put it on a safety report.

F.9.4 The safety impact review

So here is the management practice to take out of this appendix and put into your company's procedures. When an acceleration or resequencing directive above a defined threshold is issued — Kestrel's is $25,000 or 3 calendar days — it does not issue until a safety impact review is attached and signed by the safety director.

One page, eight questions:

1. What changes about who is working where, and when? A zone-by-zone, week-by-week before/after — not "we'll add manpower."
2. How many trades will occupy the same zone at the same time, before and after? A number. The stacking index is the single best predictor on this form.
3. What work will now happen above other work? Named. The highest-value line on the page.
4. What hours will people work, for how many consecutive weeks? Fatigue is cumulative and non-linear; a 60-hour week is not the same thing in week 1 and week 7.
5. What temporary protections were planned to be removed and are now needed longer — or removed sooner? Guardrails, covers, lighting, egress, shoring.
6. Which activities go out of sequence, and what protective condition does each assume was already complete? This is where the hidden hazards live.
7. What controls are required, what do they cost, and who buys them? A priced list. This is what turns the review from an opinion into a decision.
8. What will we watch, weekly, to know if this is going wrong? Named leading indicators with a threshold that triggers a stop-and-rebalance.

Two things make it work. The cost of the controls goes into the acceleration price — decide to accelerate for $168,000 and discover $40,000 of required controls afterward, and one of two things happens, and it is never that you find $40,000. Price the controls with the option, or you have not priced the option. And the safety director signs before the directive issues, because a review that arrives after the decision is a review of a decision that has already been made, and everyone in the room knows it.

⚖️ One contractual note. An acceleration directed by the owner is a change, and the cost of the required safety controls belongs in that change order, line-itemed: "additional safety controls required by directed acceleration — overhead protection at zones 3–5, task lighting for second-shift operations, additional supervision, extended temporary guardrail." Contractors routinely price the labor premium and the equipment and silently absorb the controls, then argue about it eight months later with no contemporaneous record that the controls were required by the acceleration rather than by the base scope.

F.10 Emergency action planning

"Call 911" is not a plan. A plan names who calls, who meets the ambulance and at which gate, who clears the haul road, who runs the headcount, who calls the family, who calls the office, who preserves the scene, and who talks to anybody who arrives with a camera.

Contents:

1. Muster points — primary and secondary — located away from the building, out of the way of emergency access, and reachable from every work area.
2. Evacuation routes from every level and every area, updated as the building changes.
3. A headcount procedure with named responsibility by crew, and a way to report a missing person to one place.
4. The alarm — how it sounds, who can activate it, and how it reaches people wearing hearing protection or working in a stairwell.
5. The medical gate: the gate an ambulance uses, a person assigned to stand in it, and a cleared route. On a project adjacent to an operating clinic, name a different gate from the one the public uses — that detail takes ten minutes to work out and one day saves four minutes, which in a cardiac event or an arterial bleed is the whole ballgame.
6. The site address exactly as a dispatcher needs to hear it, plus cross streets and the gate name, posted at every phone and printed on every badge.
7. First aid and AED locations, and trained responders by name and by shift.
8. The nearest occupational clinic and the nearest emergency department, with addresses, drive times, and the rule for which one you use.
9. Scenario-specific procedures: fire, severe weather and tornado or lightning, medical, spill, utility strike, structural collapse, confined-space rescue, high-angle rescue, and active threat.
10. Contact list — internal, owner, emergency services, utilities, and the regulator's reporting number — one page, on the wall, current.
11. Who talks to the public and the press, and who does not.

⚠️ Practice it. An unrehearsed emergency action plan is a document, not a capability. Run one unannounced evacuation drill per quarter, time the headcount, and publish the time. On Northgate the first drill took nineteen minutes to account for 174 people. The fourth took six. Nothing about the plan changed; the foremen had simply done it before.

F.11 The argument, restated — in case you arrived here first

If you have come to this appendix for a checklist and nothing else, read this section before you leave, because it is what the checklists are for.

🚪 Safety is a property of the production system, not a rulebook.

Hazards are produced by decisions — about schedule, sequence, staffing, procurement, and pressure — made weeks earlier by people who were not thinking about safety at all. Fix the system that produced the hazard, not just the hazard, or you have merely reset the clock on the next one.

Look back at the worked JHA in §F.6. Its highest-value control was not a harness or a barricade. It was relocating an entrance, negotiated between a project manager and an owner's representative, days before anybody went up on the roof. That is the shape of nearly every elimination-level control in construction: it lives in a schedule, a contract, a sequence, or a procurement decision, and it is available only to people who are thinking about safety early.

Then look at the checklists in §F.4 again. Every one of them is a verification that a decision made earlier is still holding. None of them can substitute for the decision. A perfect inspection record on a job running 21% overtime with five trades stacked in one zone is not evidence of safety. It is evidence that somebody is looking at the wrong thing very carefully.

And the last word, which is not a metric. The business case for safety is real and large — the experience modification rate, the premium, the prequalification list, the schedule impact, the citation history — and you should use it without embarrassment when you need to win an argument in a budget meeting. But it is not the reason. A job that hurts people has failed, whatever the cost report and the schedule report say. You can bring in a project on time, under budget, with a delighted owner, and if somebody's spine is different than it was, you lost. There is no column on the cost report where that goes, and that is not an accounting problem. That is the point.

Related reading: Chapter 24 (the full argument, the multi-employer worksite, toolbox talks, orientation, and safety culture) · Chapter 22 (formwork, shoring, scaffolds, excavation support, dewatering) · Chapter 18 (site logistics and the traffic plan) · Chapter 19 (why the interfaces between trades are yours) · Chapter 20 (fatigue, overtime, and the new worker) · Chapter 21 (cranes and lift planning) · Chapter 27 (the production system that makes most of this easier) · Chapter 29 (acceleration and recovery) · Appendix D (the JHA, toolbox talk, and incident report forms) · Appendix E (what an owner should look for, and what an EMR means to them) · Appendix I (terms defined plainly).