EHS & Risk Glossary

Bowtie analysis is a qualitative risk method that places a single hazardous 'top event' at the center, maps its potential causes on the left and its consequences on the right, and shows the barriers that prevent or mitigate each pathway. The result is a diagram, shaped like a bowtie, that makes clear how preventive and mitigating controls reduce risk. It is widely used in high-hazard industries to communicate major-accident risk and demonstrate that credible barriers are in place.

A Process Hazard Analysis is a systematic, team-based assessment of the hazards of a process, examining equipment, instrumentation, procedures, and human factors that could lead to an uncontrolled release of hazardous material or energy. Common methodologies include HAZOP, What-If, Checklist, and Failure Modes and Effects Analysis. PHAs are a core element of OSHA Process Safety Management (29 CFR 1910.119) and must be revalidated on a defined cycle.

A Job Hazard Analysis, also called a Job Safety Analysis, breaks a task into its individual steps, identifies the hazards associated with each step, and defines the controls needed to perform the work safely. It is typically completed before non-routine or higher-risk work and used to brief the crew. JHAs embed hazard recognition into everyday task planning rather than relying on after-the-fact incident review.

Lockout/Tagout is a set of procedures for isolating and de-energizing machinery and equipment so it cannot be started while servicing or maintenance is performed. Energy-isolating devices are physically locked in a safe position and tagged to warn others, protecting workers from the unexpected release of hazardous energy. In the United States it is governed by OSHA's Control of Hazardous Energy standard, 29 CFR 1910.147.

A Permit to Work is a formal, documented authorization that specifies the controls, precautions, and time limits required before high-risk work such as hot work, confined-space entry, or work at height may begin. Control of Work is the broader management system that coordinates permits, energy isolations, risk assessments, and simultaneous operations so that conflicting activities do not create new hazards. Together they provide an auditable record that hazards were assessed and controlled before work started.

Enterprise Risk Management is a structured, organization-wide approach to identifying, assessing, prioritizing, and treating the risks that could affect an organization's objectives, spanning strategic, operational, financial, compliance, and hazard risks. It aggregates risk information so leadership and the board can make decisions against a consistent view of exposure and risk appetite. Widely referenced frameworks include COSO ERM and ISO 31000.

Barrier management is the practice of identifying the technical, operational, and organizational barriers that prevent or mitigate major accidents, and ensuring they remain effective throughout an asset's life. It sets a performance standard for each barrier, monitors barrier status, and manages impairments so residual risk stays within acceptable limits. It is closely tied to bowtie analysis, which visualizes the barriers protecting against a top event.

Incident management is the end-to-end process of reporting, recording, investigating, and learning from incidents, near misses, and unsafe conditions. A mature process captures the event, triages severity, drives investigation and root cause analysis, and tracks corrective and preventive actions (CAPAs) to closure. Its purpose is not only regulatory recordkeeping but organizational learning that prevents recurrence.

Root Cause Analysis is a structured investigation method for identifying the underlying causes of an incident rather than its immediate symptoms, so corrective actions address why the event was able to occur. Techniques range from the iterative '5 Whys' to systemic models such as ICAM (Incident Cause Analysis Method), which separates absent or failed defenses, individual actions, task and environmental conditions, and organizational factors. Effective RCA produces controls that prevent recurrence across similar work, not just the single event investigated.

Under the GHG Protocol, an organization's greenhouse gas emissions are grouped into three scopes: Scope 1 covers direct emissions from owned or controlled sources; Scope 2 covers indirect emissions from purchased electricity, steam, heating, and cooling; and Scope 3 covers all other indirect emissions across the value chain, both upstream and downstream. Scope 3 is usually the largest and hardest to measure because it depends on suppliers, customers, and product use. The scopes provide a consistent basis for carbon accounting and disclosure.

ESG reporting is the disclosure of an organization's performance on environmental, social, and governance factors, such as emissions, resource use, workforce safety, diversity, and board oversight, to investors, regulators, and other stakeholders. It may be voluntary or, increasingly, mandated by regulations such as the EU's Corporate Sustainability Reporting Directive. Reports typically follow one or more standards, for example GRI, SASB/ISSB, or the TCFD recommendations, to make the information comparable and decision-useful.

The SASB Standards identify the subset of sustainability topics most likely to be financially material for companies in each of 77 industries, along with standardized metrics to report them. Designed primarily for investors, they emphasize decision-useful, industry-specific disclosure. SASB is now maintained by the IFRS Foundation's International Sustainability Standards Board (ISSB), which has built on it in developing global sustainability disclosure standards.

The TCFD issued recommendations for disclosing climate-related risks and opportunities across four pillars: governance, strategy, risk management, and metrics and targets. Its framework emphasizes forward-looking, scenario-based analysis of how climate change could affect an organization's financial position. The TCFD was disbanded in 2023 after its recommendations were absorbed into the ISSB's IFRS S2 climate disclosure standard, which now carries them forward.

The Global Reporting Initiative provides the most widely used standards for sustainability reporting, oriented toward an organization's impacts on the economy, the environment, and people. Its 'impact materiality' lens serves a broad set of stakeholders and complements investor-focused frameworks such as SASB and IFRS. GRI Standards are modular, comprising universal, sector, and topic standards.

CDP operates a global environmental disclosure system through which companies, cities, and governments report on climate change, water security, and deforestation. Organizations respond to standardized questionnaires and receive a graded score, from A to D- (with an F for non-disclosure), that investors and buyers use to benchmark environmental performance and transparency. CDP disclosure aligns closely with the GHG Protocol and TCFD recommendations.

A Safety Data Sheet is a standardized document that communicates the hazards of a chemical product and the precautions for its safe handling, storage, transport, and emergency response. Under the UN Globally Harmonized System (GHS), it follows a fixed 16-section format covering identification, hazards, composition, first aid, firefighting, and more. Employers must keep SDSs readily accessible to workers who may be exposed, as required by OSHA's Hazard Communication Standard.

A HAZOP is a structured PHA technique in which a multidisciplinary team examines a process design node by node, applying guide words such as No, More, Less, and Reverse to process parameters to identify deviations, their causes, and their consequences. It systematically surfaces both safety hazards and operability problems that less rigorous methods can miss. HAZOP is one of the most common methodologies used to satisfy Process Hazard Analysis requirements.

Management of Change is a formal process for reviewing, approving, and documenting changes to processes, equipment, procedures, or organization before they are implemented, so that new hazards are not introduced unintentionally. It ensures that technical review, hazard assessment, and updates to documentation and training accompany any change that is not a replacement in kind. MOC is a required element of OSHA Process Safety Management and a frequent contributing factor when incidents are traced to unmanaged change.

Lagging indicators measure safety outcomes that have already occurred, such as recordable injuries or spills, while leading indicators measure proactive activities believed to prevent them, such as inspections completed, near misses reported, or overdue actions closed. A balanced program uses leading indicators to predict and drive improvement rather than relying solely on after-the-fact outcome data. The two are complementary: leading indicators signal where to act before lagging indicators register harm.

The Total Recordable Incident Rate expresses the number of OSHA-recordable injuries and illnesses per 200,000 hours worked, roughly equivalent to 100 full-time employees for a year, so organizations of different sizes can be compared. It is calculated as recordable cases multiplied by 200,000 and divided by total hours worked. As a lagging indicator it reflects past outcomes and is best interpreted alongside leading measures.

Process Safety Management is a regulatory and management framework for preventing catastrophic releases of highly hazardous chemicals from processes. OSHA's PSM standard (29 CFR 1910.119) comprises 14 interrelated elements, including process hazard analysis, mechanical integrity, management of change, operating procedures, and incident investigation. It targets low-frequency, high-consequence events, distinct from everyday occupational safety.

The Corporate Sustainability Reporting Directive is an EU law that expands the scope and rigor of mandatory sustainability disclosure, requiring in-scope companies to report against the European Sustainability Reporting Standards (ESRS). It applies the principle of 'double materiality,' requiring companies to report both how sustainability issues affect the business and how the business affects people and the environment. Reported information is subject to third-party assurance and digital tagging.