Subchapter 1.1 · Trieste, Italy

Setting: Trieste, Italy

A woman sits cross-legged on the parquet floor of a half-cleared office. Open cardboard boxes stand to her left, string-tied bundles of yellowed paper lie on the dark shelving behind her, and discarded sheets fan out across the floor beside her knee. To her right a heavy walnut desk has one drawer pulled fully out, its hanging folders still upright. She holds a buff folder open on her lap, a few old pages drawn halfway out, her eyes on the top sheet and her face still and grave. It is an afternoon of sorting, and she has stopped.

She is Giulia Depangher, clearing the office of her father, who ran the family hotel on the Rive in Trieste for thirty-four years, and the folder is the one marked 1974. It concerns Bruno Petaros, a night porter of forty-seven, who reached into the shaft to lift the jammed gate of the goods lift and the car moved. He survived and never worked again; the folder holds medical reports, letters with a lawyer in Udine and a settlement. Of that year’s rate sheets, bank letters and refurbishment drawings nothing remains. One document survived because somebody decided it must.

The four plaques read that discovery as a ledger. Three are sentences a long-lived hotel can say about itself with equanimity: rebuilt after fire, refinanced after loss, reopened after closure. Each names a catastrophe that money and time reversed. The fourth refuses the pattern, and the refusal is an accounting point rather than a moral one. A property can be reconstructed in every part except the people harmed inside it, which is why the volume treats human integrity as an asset: it can be damaged, maintained, improved, and it is transferred with the building.

ISO 45001:2018 frames the same thing as responsibility. Its opening makes the organisation responsible for the health and safety of workers and of others who can be affected by its activities, including the promotion and protection of physical and mental health. Clause 5.1 then requires top management to take overall responsibility and accountability for the prevention of work-related injury and ill health and for the provision of safe and healthy workplaces and activities. The object is prevention, and the obligation sits where the money is rather than where the safety file is.

In practice the useful test is where the subject appears. An owner can open the capital plan, the due diligence file and the insurance schedule and ask whether safety work competes in any of them or merely waits for what is left. An auditor reading clause 5.1 learns less from the policy on the wall than from whether a safety project has ever won money against a bathroom refurbishment.

The framing has a limit: it claims no return on prevention. The invoice for the replacement gate is dated eleven weeks after the accident. The gate cost what a gate costs; the man on the other side of it was the asset that could not be rebuilt.

Subchapter 1.2 · Ljubljana, Slovenia

Setting: Ljubljana, Slovenia

A woman in a navy blazer leans over a long wooden table on which an architect’s floor plan has been unrolled, nothing on it but thin grey lines of walls, rooms and a staircase. In her right hand a red pen is pressed to the paper, adding one more dot to a small cluster; two further clusters sit lower on the sheet and to the right, and the rest of the plan is empty. Her left hand rests on a thick ring binder lying open beside it. Behind her stand a grey filing cabinet and a basket of rolled drawings; a coffee cup waits at the table’s edge.

She is Nika Zupan, on her first Monday as manager of the Miklošičeva in Ljubljana, the house her family has owned since 1991: two adjoining buildings from 1904, joined in 1998, with an annexe added in 2015. The binder is three years of the accident register and the plan was drawn for the annexe and never consulted since. A register is a list, and a list has no shape. By lunchtime the sixty-one entries had one: forty-four of them inside roughly nine per cent of the floor area, while the level, wide-corridored annexe had produced two.

The plaques follow the morning in order. Sixty-one entries plotted; three dense knots on the sheet, at the narrow service stair, the linen room and the kitchen pass, with the fourth zone, the cobbled delivery route, running mostly beyond the walls the plan draws. Harm follows the building: a stair cut narrow in 1904 so that staff would be invisible was never widened. The fourth plaque limits the finding. Every entry concerned an employee; the window cleaners on ropes, the laundry drivers on the cobbles and the concessionaire’s spa staff appear nowhere.

ISO 45001:2018 makes this more than a good idea. Clause 4.1 asks the organisation to determine the internal and external issues that affect its intended outcomes, and since Amendment 1:2024 whether climate change is relevant among them. Clause 6.1.2.1 then lists what hazard identification must take into account: how work is organised and performed, the infrastructure and physical conditions of the workplace, past relevant incidents and their causes, and the people with access to the workplace, contractors and visitors included. A register filed unread leaves that requirement undischarged.

For an owner the practical value is that the map turns safety spending from a request for more into a question of where. An auditor would ask to see the map with its date, how it was checked against the payroll, and whether it was drawn twice, at the ordinary hour and at the hour the house is under load; the same stair is an arterial road in December.

The map has its own limit. Concentration describes the ordinary operation, not the extraordinary event, and a hotel regularly does extraordinary things in rooms built for something else. It tells a manager where to look first, never where the hazard is permitted to be.

Subchapter 1.3 · Da Nang, Vietnam

Setting: Da Nang, Vietnam

Four people stand on the lawn of a beach resort in bright morning light, palms and clipped hedges behind them and a pale building just visible beyond. In the middle a woman in a white blouse and dark trousers holds a clipboard and has lifted its last sheet with her left hand, pen ready in her right, her brow drawn into a puzzled frown. Around her wait three people in three different uniforms: a young housekeeper in a pale-green tunic with her hands folded, a spa therapist in a white wrap tunic looking down at the clipboard, and a security guard in a dark-grey shirt standing square. Nobody is alarmed; they are waiting to be found on a page.

The woman is Lê Thu Hà, human resources manager of a two hundred and forty room resort on Non Nước beach, south of Da Nang, running the roll call of the annual evacuation drill on a Tuesday morning in March. Her list held two hundred and fourteen names; the assembly point held three hundred and one people. She counted three times. The eighty-seven were agency housekeepers, concession therapists, contracted guards, gardeners, a refurbishment crew, performers, interns, laundry drivers and lift engineers, every arrangement proper and none on the payroll.

The plaques set the two figures side by side. The duty follows the work: in ISO 45001:2018 a worker is a person performing work or work-related activities under the control of the organisation, a definition in clause 3.3 that turns on control and says nothing about employment. From there the obligations run outward: consultation under clause 5.4, with its emphasis on non-managerial workers; hazard identification under 6.1.2.1, which must consider everyone with access to the workplace; and clause 8.1.4, where contractors are coordinated and outsourced processes controlled, the organisation remaining responsible for conformity.

The subchapter’s sharper point is that the missing population is not a random sample. Housekeeping at peak, night security, grounds and refurbishment are the work hotels outsource, and they are also the work in which people get hurt. The housekeeper on the left, working the resort’s shifts in the resort’s tunic under its supervisor, is the resort’s worker whatever her contract says; the lift engineers belong to a second relation, where coordination rather than direction is owed. An owner should be able to say how many people performed work on the premises yesterday, and an auditor asking for that number, then for who inducted each group, learns more than any procedure shows.

The counter-argument is real. A neighbouring resort answered the same discovery by absorbing everyone, issuing method statements to engineers better qualified than its own staff; over-inclusion is a different error, not a safer one.

The last plaque, count from the real figure, is the drill’s own lesson. An evacuation succeeds by subtraction, and a subtraction is only as good as the number it starts from. The only people at Non Nước with a complete induction were the three students, because their college demanded proof.

Subchapter 1.4 · Antwerp, Belgium

Setting: Antwerp, Belgium

It is the end of the day in a general manager’s office, lit by a brass desk lamp; box files line the shelves behind. A man in a grey suit, tie loosened, sits with his chin in one hand and the other hand resting on a thick tender pack lying open in front of him. He has turned in his chair to look up at a woman in a dark-blue housekeeping tunic with white piping, who stands beside the desk and points firmly past the door, towards somewhere else in the building.

The man is Wouter Claes, for six years general manager of the Zuiderdok, a hundred and seventy-eight rooms near the old docks in Antwerp. The pack is a tender for a framework he had won twice, and this time it carried a supplier health and safety pre-qualification: nineteen questions, to be answered with evidence. The hotel could answer four. The woman is Fatima Ouahbi, housekeeping supervisor and the person the staff elected to speak for them, and she is pointing at the loading dock ramp she had raised three times in two years. A distant client changed the hotel’s thinking in nine days; she, from inside the building, had not managed it in two years.

The four plaques name the parties that actually move a hotel: a corporate client, an insurer at renewal, a brand over the door, and a single incident. None can inspect, and all change behaviour faster than inspection. The figure in the picture who belongs to none of the four is the most important one: the party who brings knowledge, standing in the place where people get hurt and without a channel that carries.

ISO 45001:2018 treats this in clause 4.2, and its operative step is the third. After determining the relevant interested parties, and their needs and expectations, the organisation must decide which of those needs and expectations are, or could become, legal requirements and other requirements. That is the valve through which a signed client annexe, an insurer’s condition or a brand standard enters the system, to become a compliance obligation under 6.1.3 and, later, something whose compliance is evaluated under 9.1.2. The words “could become” reach the draft annexe before it is signed.

In practice the instrument is a single table, with a column that hurts: party, expectation, what they bring, and whether it binds, by which route and where the document is. An auditor would ask a simpler question first: who has changed how this hotel works in the last three years, and does the list on file say so? The useful rule sits in front of the signature, so that nobody adds requirements unread.

The counter-case is the hotel that adopted an industrial client’s annexe wholesale and found itself with permits to change a light fitting. Reading before signing guards against both failures, the unanswerable tender and the imported theatre; listening to the woman pointing at the ramp guards against the one that ends in an injury.

Subchapter 1.5 · Muscat, Oman

Setting: Muscat, Oman

A service yard behind a large hotel at first light: a sand-coloured perimeter wall, a few lamps still burning. A plain white minibus stands with its sliding door open and its rows of seats empty. In front of it two men look at a single sheet of paper. One, bearded, in a white dishdasha and embroidered kumma, holds the sheet and runs his forefinger along a line drawn across its grid. The other, older and grey-haired, in a dark suit with an open white collar, holds a folded paper at his side and studies the schedule, frowning. A walkie-talkie stands on a concrete ledge.

The first man is Salim Al Harthy, security manager of a three hundred and ten room hotel on the Muscat shore, who also runs the transport schedule. The night shift’s bus home had collided on the expressway fourteen kilometres inland; two people were hurt. By half past nine the general manager had asked the four words of the title, and nobody in the building could answer them. The scope statement named one address in twenty-three words. Al Harthy’s list of places where the hotel’s people must be for work ran to seven: buses, staff accommodation, a beach club, an airport desk, a stores annexe, other people’s venues and a shared rooftop plant.

The plaques hold the case in four stages. Fourteen kilometres out is the address the work has left behind. Our schedule is control. Our driver needs reading carefully, because the driver belongs to a transport company; what is the hotel’s is the choice of operator, the contract and the hour at which it puts somebody on the road. Still for work is where all three point.

ISO 45001:2018 decides the question through clause 4.3, which requires the scope to include the activities, products and services within the organisation’s control or influence that can affect its occupational health and safety performance, and to be determined in the light of the work-related activities performed. Influence is the harder word: its lever is contractual rather than managerial. The definition of workplace, a place under the organisation’s control where a person needs to be or to go for work purposes, settles the staff accommodation, where a room attendant had slept four nights in forty-one degrees before being treated for heat exhaustion after a double shift.

For an owner, the test is whether a duty manager can read the scope statement and say whether the bus is inside it. An auditor would ask for the list of places, and for each one who controls it, who influences it and what the system actually does there. Influence is cheapest at the contract’s renewal.

Widening the scope is not itself a virtue. A resort nearby declared everything in a single revision and was audited against promises it had not staffed. The order is decide, resource, declare. The two people hurt that morning were in none of the seven places; they were on the road between two of them.

Subchapter 1.6 · Montevideo, Uruguay

Setting: Montevideo, Uruguay

A general manager’s office in cool afternoon light. Behind the desk a cork board is crowded with pinned slips of paper. A man in a dark-blue suit sits back in a leather chair, hands resting on the desk, listening with a courteous expression that commits him to nothing. A woman in a charcoal trouser suit stands at the side of the desk holding a large ruled ledger open towards him, her forefinger on its columns, which are empty. On the desk lie a sheet in a clear sleeve and a pen. Two chairs in front wait for nobody.

The woman is Andrea Sosa, health and safety manager of a hundred and forty-eight room hotel in Pocitos, on the Montevideo waterfront; the man is Ruben Ferrer, the general manager. The board is her work: a reporting system that brought in thirty-one reports a month from a house of two hundred and ten people. In March a room attendant, Claudia, refused to keep using a service lift that was closing on the trolleys; Sosa closed it the same afternoon. In April Claudia was moved to the split shift everybody avoids. Ferrer had a word. By July the reports were running at four a month.

The ledger is the subchapter’s own test made visible. Name one decision in the last twelve months that went the expensive way for safety reasons, and name who took it: two columns, and both empty. The plaques complete it. Thirty-one reports a month shows a system that works. Responsibility travels down to a competent specialist. Accountability stays on top, and the signed policy in its sleeve was accurate throughout and changed nothing.

ISO 45001:2018 puts this in clause 5.1, which requires top management to take overall responsibility and accountability for the prevention of work-related injury and ill health. Beside the integration of the system’s requirements into business processes, the list carries items with no counterpart in the quality or environmental standards: developing a supporting culture, protecting workers from reprisals when they report incidents, hazards, risks and opportunities, and ensuring processes for consultation and participation. Clause 5.3 completes the arrangement: responsibilities and authorities are assigned, and workers at each level take responsibility for what they control. The work is distributed; the accountability is not.

In a hotel the business processes are the roster, the budget, the capital plan and the banquet event order. An owner can open the last twelve rotas and look for a single safety consideration. An auditor would watch the reporting rate as a measure of trust, and ask what visibly happened after a reporter’s conditions changed.

The correction has its own failure. An owner in the same city took everything personally, and when he bought a second property reporting at the first fell to almost nothing within a season. Leadership means building authority outward as well as holding accountability at the top. The rota that switched off the best instrument in the building cost nothing to issue, and an afternoon to reverse.

Subchapter 1.7 · Cartagena de Indias, Colombia

Setting: Cartagena de Indias, Colombia

A long meeting room in a restored colonial house: high white walls, dark ceiling beams, an iron chandelier, tall wooden shutters half closed so that the morning sun falls across the floor in slats. Four people sit at the near end of a polished table, each with a ruled pad and a glass. A grey-haired man in a white guayabera speaks, one hand open. A woman in a grey supervisor’s tunic listens and nods; opposite her a man in a navy work shirt sits with his arms folded. At the corner a younger woman in a cream blouse writes minutes by hand, eyes on the speaker. At the far end of the table four cane-backed chairs stand pushed in.

The minute-taker is Yuranis Padilla, executive office coordinator of a hundred and sixty-two room hotel inside the walls of Cartagena, who had minuted the committee for fourteen months. The committee was no sham: it met on the second Wednesday at ten, kept an agenda and had pleased an auditor. But thirty-eight of its forty-one attendees were managers or supervisors, and the two worker representatives were supervisors themselves. Of the seventeen items they raised, three received any recorded response. Against the roster, eighty-six of the hundred and ninety people on the operation could never attend at that hour: the night team asleep, the split shift off the property, the agency housekeepers never invited.

The plaques read the room. No matters from the floor, because the floor was not in it. Same four functions again. A meeting is not consultation: it is one mechanism, built at the hour that suits managers. Remove the obstacles is the instruction, an active duty aimed at the arrangement rather than the intention.

Clause 5.4 of ISO 45001:2018 distinguishes consultation, seeking views before a decision, from participation, involvement in taking it, and lists different matters under each. Participation covers identifying hazards, determining control measures, assessing training needs and investigating incidents, and both lists place the emphasis on non-managerial workers. The organisation must provide the mechanisms, time, training and resources, and must determine and remove obstacles or barriers to participation, minimising those it cannot remove. The note to the clause names failure to respond to worker inputs among them, beside language barriers and reprisal.

In practice the correction is not a better committee but consultation taken to the work: five minutes at a shift handover, a standing item in the morning housekeeping briefing, a walk through the dish area during service. The record worth defending is an answer column showing what was raised, by whom, what was said back and when. An auditor learns more from that column than from fourteen months of minutes.

The clause can be over-read. A hotel on the same coast put a loose handrail through three rounds of comment and left it loose for five months; participation is involvement, not consensus, and somebody still decides. But the empty chairs remain the sharper finding: nobody had excluded anyone, and a time had excluded eighty-six.

Subchapter 1.8 · Chiang Mai, Thailand

Setting: Chiang Mai, Thailand

A timber garden store with its wide doorway open: coiled green hoses, rakes and spades on the wall, folded tarpaulins on a shelf. Three cardboard boxes stand in a row, the middle one open and filled with white disposable masks. A man in a faded olive work shirt, greying at the temples, holds one up by its elastic strap and looks at it with weary disbelief. Beside him a younger gardener in the same olive shirt and a wide cloth hat holds a single form and looks from the mask to his chief. Outside, the garden and the roofs of the pavilions are dimmed by a grey-yellow haze.

The older man is Nattapong Srisawat, for eleven years head gardener of an eighty-four room resort of teak pavilions in the Mae Rim valley north of Chiang Mai. Between mid-February and the end of April his team of nine works eight hours a day outdoors while the valley fills with smoke from the burning season. Three times in three years he asked for masks, and three times the request travelled from gardener to supervisor to purchasing clerk as the single word masks, and was answered from the housekeeping store with dust masks, the wrong instrument. Nobody in that chain did anything wrong; nobody was asked what the masks were for.

The plaques make the argument. The third box of wrong masks and the eight hours in the haze are the facts. The grounds team had never had an accident, so the January risk assessment, built from what had gone wrong and signed by the general manager four years running, had nothing to say about them. The clean record concealed the exposure. Look before harm happens, the third plaque says, and the fourth names the standard’s two words for it.

ISO 45001:2018, in clause 6.1.2.1, requires a hazard identification process that is ongoing and proactive, and lists what it must take into account: how work is organised, routine and non-routine situations, past incidents internal or external, potential emergencies, actual or proposed changes, and changes in knowledge of and information about hazards. That last trigger obliges a property to notice the world moving even when nothing on its premises has. The standard’s subject is injury and ill health, and ill health is where smoke, noise, heat and repetitive lifting belong: exposure that produces no event, no date and no form.

The practical diagnostic is the one in the subchapter’s guiding question. An owner should find the team with the cleanest record and see what it breathes, lifts and hears. An auditor would ask for the triggers that start the process, and for the route by which a sentence spoken in the garden becomes an entry in the hazard record rather than a purchase request.

Proactive does not mean exhaustive; a register of four hundred undifferentiated lines protects nobody. The correction is narrow: nine people, ten weeks, respiratory protection suited to fine particulate. The resort had already been paying most of it, incorrectly.

Subchapter 1.9 · Rovaniemi, Finland

Setting: Rovaniemi, Finland

A pine-panelled linen store, shelves of folded white towels, two loaded trolleys. Through a small frosted window the snow-laden pines are already deep blue, though it is afternoon. Three people stand in front of a laminated map pinned to the wall: winding paths, dozens of small cabin shapes. A young attendant with a long blonde plait traces one path with her forefinger and turns to ask something. Beside her a colleague in a fleece vest looks at the map, uncertain. A bearded man in a dark softshell jacket holds a pair of studded overshoes in one hand, the other at his chin, frowning.

The resort lies twenty minutes outside Rovaniemi, with sixty-two glass cabins among the pines and two hundred and ten staff at the peak. Anni Väisänen, on her fourth season, was walking the new intake through the cabin circuit when one of them asked why it ran that way round. She did not know; the person who had shown her had left. Joonas Lehtinen, the safety coordinator, did not know either, because he too was in his first season. An attendant covers the three hundred metres of outdoor path fourteen times a shift, pushing a trolley at minus twenty or worse.

The overshoes in Lehtinen’s hand are the honest answer of a good risk assessment: gritting twice daily, studded soles, insulated gloves, a rule about the steep section, a shortened shift below a stated temperature. All of it real, none of it able to ask the newcomer’s question. Why this way round, after eleven years unchanged, is not a hazard report and would not be accepted as one. Opportunities need a column, because a split circuit served from a second store in the maintenance building had been tried two seasons earlier, had worked, and had vanished in April with the person who set it up. Remove the hazard itself names its purpose.

ISO 45001:2018 separates the two questions. Clause 6.1.2.2 requires risks to be assessed taking into account the effectiveness of existing controls, and requires the other risks to the management system itself to be determined and assessed: in a seasonal resort, competence that leaves every April. Clause 6.1.2.3 is a distinct, required process for opportunities, naming the adaptation of work, its organisation and the working environment to workers, and the elimination of hazards. Elimination stands at the top of the hierarchy of controls in 8.1.2, and a risk assessment that takes the hazard as given can never reach it.

In practice the clause asks for one column beside each significant risk: what would have to change for this exposure not to exist. An auditor would look for that column, for the documented methodology and criteria, and for the risks to the system laid before the owner.

The counter-case is a resort nearby that moved its circuit indoors and lost the only daylight its attendants had in December; the elimination was resented and abandoned. Adapting the work to the workers cannot be done to them.

Subchapter 1.10 · Tbilisi, Georgia

Setting: Tbilisi, Georgia

A lift motor room: whitewashed walls, a louvred vent, the grey traction machine with its broad sheave behind a steel guard rail, a tall control cabinet with its doors shut. At a steel workbench a technician in a navy overall leans in and taps a single ruled service sheet with his forefinger, explaining as though it were common knowledge. His tool case lies open beside him. Next to him a bearded man in a grey sweater holds a ring binder open on the same bench, his other hand pressed to his mouth, staring at its ruled pages. The two documents lie side by side, and only one of them is current.

The bearded man is Levan Beridze, technical manager of a ninety-six room hotel in a restored nineteenth-century house in the old quarter of Tbilisi. The technician had mentioned, in passing, that the hotel would presumably be applying the new inspection regime to the passenger lift as well. The requirement had been in force for fourteen months. It was neither obscure nor disputed, yet the hotel had not complied, because nothing in the building could tell it. What the hotel held was a fourteen-page register compiled by a consultant in 2019, opened since only by auditors checking that it existed.

The plaques work in pairs. In force for fourteen months, register never reviewed: the gap between a document and the world it describes. Kept up to date, a way to find out: the two things the register could never supply for itself. A register is a photograph taken on the day it was compiled, and the requirement asks for something closer to a relationship with a source.

ISO 45001:2018, clause 6.1.3, requires a process to determine and have access to up-to-date legal requirements and other requirements, to determine how they apply to the organisation and what needs to be communicated, and to take them into account in running and improving the system, with documented information updated to reflect any changes. The definition reaches requirements the organisation has to comply with and those it chooses to, which is why the six documents Beridze and the general manager, Tamar, found outside the register (a brand standard, two client annexes, an agreement with a sulphur bath house, an employment agreement and a promise on the hotel’s own website) belong inside it.

In practice the register that works has columns the consultant’s never had: where the obligation came from, what somebody must now do differently, and who has been told. An auditor would ask a duty manager to name the hotel’s source of updates and the date it was last consulted, then pick one line and ask whose work it changes. Permits and authorisations deserve their own look; they expire silently.

Buying access is no cure. A hotel in the same market subscribed to forty bulletins a year that nobody filtered, and became demonstrably informed and no better protected. The only person who knew in Tbilisi did not work for the hotel.

Subchapter 1.11 · Windhoek, Namibia

Setting: Windhoek, Namibia

The scene is a duty manager’s office. Petrus Haufiku, the storeman, stands at the desk in his khaki store coat beside an open carton of blue detectable dressings, one strip raised in his hand, puzzled by stock that moves too fast. Across from him the safety officer sits before a thick hardback register, a finger running down a ruled column, her expression settling into concern. A green first aid cabinet hangs closed behind them. Nothing here is dramatic, and that is the point: the truth about the hotel’s safety lies on a desk between a box of plasters and a book nobody reads.

“Sixty-three treatments” is what the register holds for the period: cuts, mostly, burns, a finger crushed on a laundry cage, two eye irrigations after a chemical splash in the plate wash. “None cost a shift” is why none of them travelled further. The figure sent to the owner counted only lost-time injuries; it stood at two, and the target of a twenty per cent reduction had been met three years running, with every head of department carrying it in a scorecard. Nobody ordered anything hidden: two days of light duties at the end of a hard week did it without a decision being taken.

Clause 6.2.1 of ISO 45001:2018 requires objectives to be consistent with the policy, measurable where practicable or capable of performance evaluation, monitored, communicated and updated, and to take into account applicable requirements, the results of the assessment of risks and opportunities, and the results of consultation with workers. Last year’s figure is none of these. Clause 6.2.2 requires each plan to state how results will be evaluated, including the indicators, and how the actions will be integrated into business processes. Windhoek integrated faithfully; what it integrated was a measure that improves fastest when less is written down.

Hence the plaque “Measure what predicts harm”. The distinction between leading and lagging indicators is the profession’s rather than the standard’s. An owner or auditor can put one question to each objective: how could somebody reach this target without making anything safer? If the answer is a judgement about paperwork, the indicator measures the record. Hazards reported by non-managerial workers, time to close a reported hazard, inductions completed before the first shift: these improve only when the work is done.

The remedy has its own traps. Activity counts such as walks completed reach a hundred per cent and stay there unless they are paired with what the activity found. And once the register is read, the reported figure will rise from two towards sixty; an owner who has not been warned in advance will read that as deterioration and teach the property never to try again.

That is the force of the last plaque, “Better numbers, same danger”. Sixty-three treatments were never the failure; reporting two of them upward was, and the storeman signing for his third box of the quarter had been the only instrument in the hotel sensitive enough to notice.

Subchapter 1.12 · Riga, Latvia

Setting: Riga, Latvia

Two ruled grid sheets lie side by side on the executive housekeeper’s desk, a pen between them. Ilze Ozola sits behind the left-hand one, her palm flat upon it, her other hand raised in a refusal that is firm without being hostile. The safety coordinator leans in from the right and points into the second sheet, a weekly schedule, with the earnestness of a man who has built something he believes in. Shelves of folded linen, a rail of tunics and a lit desk lamp complete the room. The two sheets look alike, and the card turns on how they differ.

Ozola’s sheet is the standard her department is judged by, minutes per room. The coordinator’s is the consultation mechanism of 1.7: “Twenty minutes per person” at the start of a shift. With thirty-four people in the season that is a little over eleven hours, and those hours exist nowhere in her arithmetic. So she refuses, and the mechanism goes in for the permanent staff only, the half least likely to be hurt. The safety budget, four thousand eight hundred euro and never cut, paid for none of the six hundred and forty hours the system turned out to consume each year.

Clause 7.1 of ISO 45001:2018 contains two verbs: the organisation shall determine and provide the resources needed for the management system. Hotels provide; they rarely determine, because determining means knowing what the system consumes. Three clauses carry this one: top management must ensure that resources are available, under 5.1; each plan for an objective must state its resources, under 6.2.2; and the management review in 9.3 must consider the adequacy of resources, once a year, with minutes.

Hence the plaque “Budget the hours too”. The clause requires no safety budget and no documented information; its evidence lives in ordinary business records. An auditor will look past the safety line, asking whether housekeeping carries a named allowance for induction and consultation hours or must find them inside a productivity target, and whether the review minute records an answer to the adequacy question, even if the answer is no. A recorded refusal is a stronger position for everybody than an unrecorded silence.

The obvious objection is that the cure is more money. A property in the same city had its safety budget tripled, bought equipment and a training licence, and changed nothing, because money comes out of a line that already exists while hours must come out of a target that somebody is measured on.

Hence the last plaque, “Unbudgeted hours aren’t free”. Ozola’s raised hand is not resistance to safety. It is the only measurement of the shortfall the hotel possesses, offered by the one person who had noticed what the system really cost, and who was quietly paying for it.

Subchapter 1.13 · Hobart, Australia

Setting: Hobart, Australia

At the back of a function room in a converted sandstone warehouse, an aluminium ladder leans against the stone below a high window, and nobody is on it. A white hard hat lies by its feet. Meredith Wong, the duty manager, in a black suit with a radio in one hand, points up towards the window with the hurry of someone running a wedding. Dylan Reece, a seasonal bar attendant in waistcoat and rolled sleeves, has a hand on a rung and turns to look at her. Through the open doors behind them a wedding dinner waits under warm lamps.

“Asked, and he went up”: on a January evening, with a storm coming in off the Derwent and the maintenance man off, Wong asked him to clear a backed-up gutter; he did, came down, and nothing happened. “His eleventh shift”: Reece worked fourteen shifts before the four-hour induction reached him, and the roof came on his eleventh. He had gone up assuming the hotel had what his previous employer, a mine site in Western Australia, had drummed into him: that he could have stopped and been backed rather than remembered. Wong learned this three weeks later, in passing.

ISO 45001:2018 places the missing sentence in clause 7.3. Workers are to be made aware of their ability to remove themselves from work situations they consider present an imminent and serious danger to their life or health, and of the arrangements protecting them from undue consequences for doing so. Both halves are in the requirement. Clause 7.2 adds that competence includes the ability to identify hazards, that the effectiveness of actions to acquire competence be evaluated, and that evidence of competence be retained. The Hobart folder of attendance signatures, which had passed four audits, evidenced presence in a room and evaluated nothing.

Hence “The right to stop” and “Told before it is needed”. The seasonal intake arrives in waves: of sixty-two starters, the median worked seven shifts before induction and twenty-one worked more than ten. An auditor testing clause 7.3 does better on the floor than in the file, asking three people whether they may refuse dangerous work and what would follow if they did. The volume’s answer is a twenty-minute essential before the first shift, with the right to stop among its four items, and the full session within a fortnight.

Four hours compulsory before anyone works fails the other way: a property on the mainland tried it, and by the second season department heads were signing people into sessions they would attend later. The clause asks for competence and awareness, not a duration. For the duty manager the discipline is smaller: asking not whether he can clear the gutter, but whether he is happy to, in this wind.

Nothing in the gestures is unusual. What makes the scene a risk is a sentence nobody in the building had ever said, and the empty ladder records that, by chance, the man at its foot had heard it somewhere else.

Subchapter 1.14 · Kigali, Rwanda

Setting: Kigali, Rwanda

The chemical store is plain and orderly: metal shelving of sealed containers, white ceiling light, and against the back wall two blue drums of floor cleaner, so alike that nothing tells them apart. On the steel bench a clear measuring jug is already filled with pale liquid; at the far end lies a pair of blue nitrile gloves. Immaculée Mukamana, the laundry supervisor, in white, holds a data sheet and points at the gloves, explaining. The housekeeping supervisor beside the jug, in grey with a dark-red headscarf, keeps her hands at her sides and listens in surprise. This is the last step of a communication chain, made visible.

The upper plaques give both sides, and both are true. “Email sent, sheet attached”: in March a two hundred and ten room conference hotel in Kigali changed its floor cleaner; the purchasing manager read the safety data sheet, noted the new dilution, contact time and gloves, and emailed it all to the heads of department on delivery day. “Nobody told me anything”: three weeks later a supervisor was mixing at the old dilution. The chain had five steps. Two of four heads opened the attachment, one mentioned it at a briefing in English, and the last step, carrying meaning into the supervisors’ own language, had only ever been Immaculée, unappointed and unpaid, who was on leave.

Clause 7.4.1 of ISO 45001:2018 requires the organisation to determine what it will communicate, when, with whom and how, naming internal levels and functions, contractors and visitors, and other interested parties. It requires diversity aspects, language and literacy among them, to be taken into account, and the information communicated to be consistent with what the system generates and reliable. Clause 7.4.2 adds that internal communication must cover changes and must enable workers to contribute to continual improvement, which no broadcast channel can do on its own.

Hence “Sending is not communicating” and “Reach the hand that acts”. The diagnostic is to take one recent change and walk it from the person who knew to the person who had to act differently, counting which steps are channels and which are people. At Kigali it was four channels and one person. An owner should ask who the informal translator in the building is, and whether she has been named, paid and given a deputy.

Technology is not automatically the answer. A group in the same region moved its safety communication into an app and found that roughly a third of the operational workforce, in stewarding, grounds and the laundry, could not or would not use it. The records improved; the reach did not.

Nobody in this story did anything wrong. The failure sits in the space between correct actions, and the gloves lying at the far end of the bench measure how wide that space was.

Subchapter 1.15 · Trieste, Italy

Setting: Trieste, Italy

Giulia Depangher sits at a heavy walnut desk in the private office of her family’s hotel, now cleared and in order, archive boxes squared on the shelving behind her. Three documents lie in a row. Under her right hand, flat and still, is an old buff folder, closed. In the middle is a bound tender pack; on the right, beneath her poised pen, a quotation whose top sheet carries a floor plan. Her expression is calm and resolved. The row runs from what the building has carried for five decades to what it must now decide.

The folder is the file from 1974: a porter, a lift shaft and a settlement, kept by her father in a language nobody in the building now speaks, the only document from that year anyone still reads. The tender is “Nineteen questions to answer”: a shipping group with offices along the Rive has put its Trieste accommodation out to competition and asks how the hotel looks after its people. The quotation is “Service stair excluded again”: the fourth-floor refurbishment, with the service stair outside the scope as it has been since 1961, never refused, simply never in a document that competed for money.

“No percentage, no promise” is where the standard itself stands. ISO 45001:2018 opens with responsibility rather than benefit: an organisation is responsible for the health and safety of workers and others affected by its activities, including promoting and protecting their physical and mental health. Its intended outcomes are continual improvement of performance, fulfilment of legal and other requirements, and achievement of objectives, and its introduction states that adoption will not guarantee the prevention of injury and ill health, safe workplaces or improved performance. Its listed success factors map closely onto the chapter this card concludes.

What Depangher can honestly be offered has four parts, three of them countable from existing records. Access: revenue arriving through doors where somebody asks this question and checks the answer. Labour: of forty-one seasonal staff last summer, nineteen came back, and every one who did not is a recruitment and training cost repeated. Continuity: the weeks in which a department ran short because of injury. On one page, those numbers changed the conversation about the stair. The fourth is capability: knowing where harm concentrates, who works here and under what arrangement, what happened and what was done. The certificate is the receipt, not the asset.

A hotel that has done all this can still have a serious injury in its first year. If it promised prevention, the injury discredits the system and reporting falls silent; if it promised only what the standard promises, the injury is what the system exists for: found, answered, its cause removed, in front of a watching workforce.

So “Take the deferred decision” names the gain: not a multiplier and not a guarantee, but an owner with one hand on the past and her pen above the plan where the stair has always been left out.

Subchapter 2.1 · Naples, Italy

Setting: Naples, Italy

A basement service corridor in an old palazzo: cold ceiling tubes, pipes overhead, no window. Down the left wall a queue recedes: crates of greens and oranges, steel kegs, bulging sacks, a cage of folded linen. At the far end stands the single goods lift, its scissor gate closed. Ciro Esposito, the night porter, tie loosened, stretches out an arm along the line of waiting goods. The new general manager, in navy, a notebook held against her, has turned to listen. Behind them a breakfast waiter at a loaded trolley checks his watch. Everything about to go wrong is already in the corridor, waiting for one gate.

“One goods lift”: the hotel is ninety-six rooms off Via Toledo, and the lift serves the cellar, the ground floor and four bedroom floors. “Everything before eight”: the street closes to lorries at eight, so the laundry van, the dry store run, the housekeeping cages, the public-area cleaners and, fortnightly, the lift engineer converge between five past seven and twenty to eight. “Cut in nineteen eighty-seven” explains why there is no second lift: there is nowhere to put one. Esposito described four breaches, the same every morning: a linen cage on a half-landing, the service-stair fire door wedged with a rubber chock, trays carried up the main staircase past guests, the lift gate propped at the cellar. The audits started at nine.

Clause 8.1.1 of ISO 45001:2018 requires processes to be controlled by establishing criteria, implementing control in accordance with them, keeping documented information to the extent necessary, and adapting work to workers. The operative word is criteria. A procedure is a sequence that assumes its performer controls the next ten minutes; a criterion is a condition, such as no cage ever left on a landing, that anyone can check at a glance. The clause also requires coordination with other organisations in multi-employer workplaces, and at ten past seven that corridor holds four employers.

The system was not being ignored; it was being outrun. An owner who wants to know whether operational control works should have someone senior stand at the foot of the service stair from a quarter to seven until half past eight and write down what happens, with times. The Naples remedies were adaptations of work, not supervision: the laundry collection moved to a quarter past six, the dry store run to the previous evening, and housekeeping given the lift alone from half past seven.

The tempting alternative is a tighter procedure. A hotel in the same city tried a countersigned lift booking sheet on a clipboard, and it lasted nine days. Under load, controls that depend on writing fail first and those that depend on sequence fail next; what survives is built into the arrangement of the work.

Hence “Ask the night porter”. For eleven years the only person who had watched the controls fail was the one going home, and the picture records the morning somebody finally turned to listen to him.

Subchapter 2.2 · Tallinn, Estonia

Setting: Tallinn, Estonia

A narrow stair descends into a vaulted cellar lit by warm lamps. The limestone treads are worn into hollows at the centre, a wooden handrail runs along the left wall, and at the bottom two steel kegs stand on the cellar floor. Kadri Tamm, the new bar manager, sits sideways on a step, a thick ring binder open across her knees, her face serious. A few steps above, a young bar worker in a dark apron keeps a hand on the rail and leans to see what she is reading. Both pages are ruled and blank, and the blankness is the part of the record that matters.

The binder is the folder labelled cellar stair: four years of a seventy-four room hotel in a fifteenth-century merchant house in the old town of Tallinn. “Nineteen worn steps” is the stair, down which the kegs go, six a week in winter and nearer twenty in summer. “Five fixes in four years” is the contents: a toolbox talk after a near slip; boots for three regular users; a sign telling people to use a handrail that did not exist; after a fall and eleven days off, the handrail; and a quotation for a keg hoist, declined on cost in a single line. Not one line asked why thirty-litre kegs went down that stair at all.

Clause 8.1.2 of ISO 45001:2018 requires hazards to be eliminated and risks reduced using a hierarchy in fixed order: eliminate; substitute with less hazardous processes, operations, materials or equipment; use engineering controls and reorganisation of work; use administrative controls including training; use adequate personal protective equipment. The guidance adds that each control is considered less effective than the one before it. The third rung is the one hospitality overlooks: reorganisation of work sits above all training and all equipment, so a change of rota, route or delivery time outranks any instruction.

Hence “An order, not a menu” and “Elimination comes first”. The folder shows a hotel starting at the bottom because the bottom is procurable, and climbing only when an injury forced it. The practical test for an owner or auditor is to label the property’s last twenty controls by rung; the distribution, usually crowded at four and five, is the finding. At Tallinn the third rung cost almost nothing: moving summer deliveries so that kegs went down before service rather than during it needed only a conversation with a supplier.

The hierarchy can be misread the other way. A property in the region refused interim measures while a capital solution was prepared, and its people worked for two years with less protection than before. Controls are usually combined; the order says where to aim, not what to leave undone this afternoon.

Tamm saw the pattern only because she was new and laid the four years end to end. The empty page on her knees is where the first question belonged, years ago: does this work have to be done here at all?

Subchapter 2.3 · Turin, Italy

Setting: Turin, Italy

In the lobby of a nineteenth-century hotel in central Turin, under warm wall lamps, two men point in opposite directions. Sergio Fassone, the chief concierge, in a dark-grey uniform, lays a finger on the green arrow of the framed evacuation plan beside the entrance, the arrow that leads to the front doors; behind rimless glasses his face is troubled. A white-haired guest in a beige raincoat, one hand on a small wheeled suitcase, points through those glass doors. Beyond them there is no street, only scaffolding tubes and plywood hoarding pressed against the façade. Arrow and hoarding share a frame, and they disagree.

“The route leads to scaffolding”: the façade of this hundred and thirty-two room hotel was in the third week of an eleven-week restoration, and the route on the notice in every room still ran down the main stair, across the lobby and out through doors now inside the hoarding. “Wrong for three weeks”: a gate in the hoarding and a side exit meant nobody would have died. But the staff entrance now passed beneath the loading zone, two extinguisher points had moved for the site cabin, eleven front rooms had lost their daylight, and a two-hundred-page works contract assessed the works and not the hotel.

Clause 8.1.3 of ISO 45001:2018 requires a process for implementing and controlling planned temporary and permanent changes that impact health and safety performance. Temporary is in the requirement, which brings eleven weeks of scaffolding inside it. Changes include workplace locations and surroundings, work organisation, working conditions, equipment and the work force, together with changes in legal requirements, in knowledge about hazards and in technology. The organisation must also review the consequences of unintended changes, and when Fassone raised the matter two more surfaced: evening security moved to an agency, and a supplier had substituted a heavier sheet under the same code and price.

“Assess the change itself” marks the boundary error: the contractor assessed the contractor’s work, and the hotel, believing it was simply carrying on, assessed nothing. “Ask what is now untrue” is the question that would have caught the room notices. The volume proposes four questions asked in the meetings where changes are actually decided: what will be different, for how long, who works in it, and what now says something no longer true. An auditor might begin with the subchapter’s own exercise: list what differs from last month, cross off what somebody decided, and examine the residue.

A formal procedure would not have rescued it. A group in the same region built one, with a form, an approval and a threshold, and in its first year it caught four large projects that already had managers and none of the forty-odd temporary reconfigurations or the three supplier substitutions. The guest’s outstretched arm was the only control that operated. The door cards were reprinted in an afternoon once somebody asked; in two hundred pages, asking had been nobody’s job.

Subchapter 2.4 · Ghent, Belgium

Setting: Ghent, Belgium

Four in the morning in the pastry section, under hard white light. Above the long steel bench a run of ceiling tiles has come down, exposing a grey extraction duct; the tiles are stacked on a trolley, and two stepladders stand nearby, empty. On the floured bench, trays of dough prove under cloths beside a steel scraper. Femke De Clercq, the pastry chef, just arrived in whites and cap, turns an open hand up towards the hole above her section, asking. Two men in grey overalls, safety glasses pushed up and gloves in hand, follow her gesture upwards. None of the three knows the others.

“Ceiling open over her bench”: the annual duct cleaning had been scheduled, as every year, between the close of the kitchen at eleven and the start of the bakery, and the men were three hours in. “The bakery starts at four”: nobody had told them, so they had planned to finish at half past five. Wouter Vandenberghe, in purchasing, later traced four organisations counting the hotel: a facilities company chosen on price, availability and an unread certificate; a specialist subcontractor; and two self-employed operatives engaged by the job. He also found that the extraction fans start automatically on a timer at five.

Clause 8.1.4 of ISO 45001:2018 covers procurement, contractors and outsourcing. Procurement is controlled so that what is bought conforms to the management system. Contractor coordination must address three directions: the contractors’ activities affecting the organisation, the organisation’s activities affecting the contractors’ workers, and the contractors’ activities affecting other interested parties in the workplace. The organisation must ensure that its requirements are met by contractors and their workers, and must define and apply health and safety criteria for selecting contractors. For outsourced functions, the type and degree of control is defined within the management system.

Ghent was caught by the second direction, and “Tell them what your house does” names the remedy. The timer, the gas isolation behind the pass and the four o’clock start were invisible to the visitors and had become invisible to the host. What closes the gap is a fifteen-minute exchange before the work starts, in both directions, backed by one page on what in this building is dangerous to someone who could not know it. An auditor might ask, of the last high-risk job, who actually came, who employed them, and what they were told on arrival.

“Control beyond the signature” marks the limit. A group in the same market built a rigorous prequalification, and the same two self-employed men still arrived at eleven at night, because prequalification qualifies the organisation that bids, not the people who turn up. Everything assessed belonged to the first organisation. The men under the open ceiling worked for the fourth, and the only person who asked who they were was the one about to start the dough.

Subchapter 2.5 · Arequipa, Peru

Setting: Arequipa, Peru

Night on a flat roof of white volcanic stone, lit by a single work lamp. Three round cisterns stand in a row; the nearest has its hatch open beneath a steel tripod. The older contractor, in a white hard hat and high-visibility vest, bends over a clipboard on the cistern rim, reading the form by hand torch. The younger, in a harness and headlamp, stands at the hatch with a gloved hand on the valve wheel of the feed pipe, looking across at the page. Two careful, properly equipped men are the only people on the roof, and that is the difficulty.

“Signature line still empty” and “Nobody present at the start” belong to a seventy-eight room hotel in a colonial house in Arequipa, whose three twelve-thousand-litre cisterns are cleaned yearly, at night. The permit had been completed at ten past eight that morning, in the maintenance office, by the maintenance chief and the contractor’s supervisor, who then left for another site. It named Édgar Quispe, the hotel’s technician, as having verified the isolation and the venting. He was in Cusco, four hundred kilometres away, and was asked on his return to sign the file copy. Work began at nine. Four years of permits showed the same pattern, eleven of them confirming isolations hours before they were physically possible.

ISO 45001:2018 does not require a permit to work; permits appear once, in the guidance, as one method among several. What it requires is the frame: criteria and control against them under 8.1.1; the hierarchy under 8.1.2, where a permit, as an administrative control, sits at the fourth rung of five; hazard identification under 6.1.2 that covers non-routine activities; and contractor coordination under 8.1.4, including the hotel’s own effect on the contractor’s workers. In that frame a permit makes nothing safe. It is a gate forcing somebody to verify, just before work begins, that the controls above it are in place.

Hence “Evidence of fact, not intent” and “Sign at the job, not after”. A permit is issued at the job, immediately before the work, by somebody present, because a signature says that a person looked. The simplest test is to read the last ten permits for the time and place of signature; a stack issued at eight in the morning tells its story in minutes. A good form holds nothing that can be completed without looking, and records what the hotel will not start while men are inside, which only the hotel can know.

A hotel in the region introduced permits for a dozen tasks and recorded more incidents on permitted work, because the paper carried an authority the controls lacked. At Arequipa the honest options were to attend, to reschedule, or to admit that nobody was verifying anything.

The torch on the clipboard is the only verification on that roof, performed by the men the permit was meant to protect, reading a page finished thirteen hours earlier by people who are not there.

Subchapter 2.6 · Kaohsiung, Taiwan

Setting: Kaohsiung, Taiwan

In a windowless engineering office the afternoon duty engineer holds a shift log sheet in each hand, while a colleague in a dark suit jacket leans in and presses a finger to the left-hand sheet. Behind them the fire panel stands open, one amber lamp lit, a red magnetic tag beside it; a closed ledger lies on the desk. The plaques above give the sheets their voices, “Zone seven isolated” and “Nothing to report”; those below explain how both were written in good faith.

Nothing in the Kaohsiung case is an error. At twenty to three in the morning Huang Wen-teng, night duty engineer of a two hundred and sixty-eight room tower near the harbour, isolated zone seven after a kitchen extract detector had alarmed three times in ninety minutes, with the kitchen closed and a full house asleep. He logged it, tagged the panel and, at five past seven, told the morning engineer in a corridor. Ten minutes later a burst hose on the eleventh floor took that engineer away. Lin Chih-hao found the zone still isolated at three in the afternoon, twelve hours and forty minutes on.

The closed ledger is the quiet witness. Of thirty-one handover entries that week, twenty-nine concerned guests and none the panel. Front office had designed the book to carry guests, and it did; the state of a building, a short list of things currently not normal, is a different kind of information.

ISO 45001:2018 has no clause on handovers; their shape comes from several read together. Clause 8.1.1 asks for criteria for processes, and “anything relevant” is not a criterion. Clause 7.4.2 requires relevant information, including changes, to be communicated among functions. Clause 8.1.3 supplies the decisive point: an isolation is a planned temporary change, and one that outlives the shift that made it becomes an unintended change whose consequences must be reviewed.

An owner needs not a thicker handover book but a second, short one: five closed questions asked every time, in the negative, about what is isolated, open or closed off, what hurt somebody and what a contractor left. An auditor would ask for the isolation log and check each entry for a marker at the point of isolation, the signature of each incoming shift, and a named time for restoration. Huang supplied the first two. The third is what “Restoring needs an owner” means, the only element that survives an interruption because it depends on nobody remembering.

The obvious remedy fails the other way. A hotel in the same city adopted a forty-item checklist taking twenty-five minutes neither shift had, and within a month one person was signing it from memory. A handover longer than its paid overlap is recorded rather than performed. Both sheets are honest, which is the difficulty: the fact that mattered belonged to neither, and memory goes home at seven.

Subchapter 2.7 · Varna, Bulgaria

Setting: Varna, Bulgaria

A pool plant room under a single cold light: grey pipework, three dosing pumps beneath a pale control box, white chemical tanks. On the box a red fault lamp burns beside a dark display. The seasonal technician, in navy overalls, safety glasses and a long teal chemical glove, rests that hand on an orange valve handle and looks back over his shoulder, stuck. A yellowed laminated sheet is fixed to the wall at his right. Across the room a grey steel door is shut, a small keypad beside its handle.

In the case the barrier was a login, and the keypad stands for it. At ten past nine on a Sunday evening Ivan Petrov, in his second season at a three hundred and forty room resort north of Varna, faced a dosing fault he had never seen, with the water going out of range. The procedure was one of two hundred and fourteen controlled documents on a shared drive whose logins went to the sixty permanent staff; Petrov was one of two hundred and ninety seasonal workers. Within reach was only the wall sheet, dated 2011, describing a system replaced in 2019. He telephoned the maintenance chief at home.

“Controlled is not available” names a distinction clause 7.5.3 of ISO 45001:2018 makes in one sentence: documented information is controlled so that it is available and suitable for use, where and when it is needed. The resort met the first two conditions in the office and the last two nowhere. Clause 7.5.2 places language inside format, and a note to the control clause states that access includes access by workers. Control of changes is also listed, which condemns the sheet from 2011: not an incomplete control but a wrong instruction fixed to a wall.

The test costs an afternoon. Go where dangerous work is done, at the hour it is done, with the access a seasonal worker holds, and count the doors, logins and telephone calls between worker and instruction. An auditor would say: show me, from here, the procedure for this equipment. “Reachable where work is done” rarely means the full procedure; it means a card with the two or three things that must be right under pressure, in the languages spoken there, versioned and dated. A resort replacing four fifths of its people each May must hold more knowledge in documents, not less.

The obvious correction has its own failure. A resort on the same coast laminated around four hundred sheets, and within two seasons roughly a third described things that had changed. Distribution without version control multiplies the places where an obsolete instruction can be read under pressure. Whoever owns a document owns every copy, including the one beside the panel.

Between the dark display and the shut door the technician stands exactly where the system was never designed to reach, which is the one place it has to arrive.

Subchapter 2.8 · Wellington, New Zealand

Setting: Wellington, New Zealand

Behind a hotel reception desk before dawn, under two brass desk lamps, a woman in a dark-grey blazer points at one of two sheets pinned side by side on a pale wall: the left divided into boxes, the right ruled and almost empty. Beside her a broad man in a dark jacket holds a lit torch in one hand and a red first aid bag in the other, following her finger. Two people, two sheets, and plaques that open with “Five roles, two people” and close with “Count who is there”.

The scene belongs to Aroha Waititi, night auditor of a hundred and fifty-four room hotel in Wellington where, at nineteen minutes to five on a Thursday morning, the building moved. Guests were accounted for in eleven minutes and the debrief recorded a success. Three days later Waititi wrote the other account. Two people in the basement laundry were on no warden plan and came up on their own. Three contract cleaners never reached the assembly point. And the plan required the two people on duty to be at the panel, at the assembly point and wherever somebody was hurt, all at once.

The porter’s hands hold that arithmetic. The plan named him fire warden and the only first aider on the premises overnight; he can carry torch and bag together, but cannot stand in two places. Nobody was hurt, so the subtraction went untested, as in every drill, all held at ten in the morning. Hence the danger in “Eleven minutes, called success”: a good result endorsing an arrangement that would not have held.

Clause 8.2 of ISO 45001:2018 reads almost as an inventory of what was missed. The planned response includes first aid, named inside it. The response capability, not the document, is to be periodically tested and exercised. Performance is to be evaluated and the response revised, in particular after an emergency has occurred. Information on duties goes to all workers, laundry staff and cleaners included, while visitors, where guests appear, are listed with contractors, emergency services and authorities.

For a duty manager the last plaque is a five-minute exercise: count the roles the plan requires at four in the morning, count the people on duty. Where the first exceeds the second, the plan is fictional. An auditor would ask when the last exercise ran, at what hour, with which crew, and whether the review of the real event covered workers as well as guests. Good evidence is a one-page night version saying what the people present do, in what order, and what they do not attempt.

The correction can breed its own fiction. Another hotel in the country extended its plan to every worker location and needed fourteen people for a night team of three; within a year the night version was quietly abandoned. Designing for the smallest crew is the only way to have a plan at the hour the building chooses.

Subchapter 2.9 · Trondheim, Norway

Setting: Trondheim, Norway

A back service stair in the thin light of a winter afternoon. A young woman in a grey fleece and dark-green work trousers, her fair hair in a long plait, leans on the steel handrail with a notebook open on it, pencil in hand, and looks up towards the corridor at her shoulder. Partway along that clean corridor a grey door stands open, held by a small block of wood; beyond it stacked banquet chairs and a wire trolley narrow the passage. Nothing in the frame is dramatic, and that is its subject.

Ingrid Solheim, a second-year maintenance apprentice at a hundred and eighty-seven room hotel on the river in Trondheim, was given the February safety walk because nobody senior wanted it. In seventy minutes she wrote down thirty-one items. The fourteen indicators had been green for nine months, and none was false. Nineteen items were conditions no indicator would show: tables stacked before a riser cupboard, a stair fire door held open as every morning, a corridor narrowed to about seventy centimetres. Four were controls that did not work, among them expired pool test reagents and an eyewash whose flow stopped after four seconds.

“A dashboard sees only events” describes what measurement is. Clause 9.1.1 of ISO 45001:2018 names monitoring, measurement, analysis and performance evaluation, and the guidance separates the first two: monitoring can involve checking, supervision, critical observation or determining status, while measurement attributes numbers to objects or events. The walk is monitoring in the standard’s own vocabulary. What must be monitored includes the effectiveness of operational controls, and the clause requires monitoring equipment, here test kits, probes and detectors, to be calibrated or verified.

“Walk it with fresh eyes” explains why the apprentice saw what others did not: for everybody else the propped door had become part of the corridor. An owner should give the walk the standing of the requirement it discharges, owned by somebody senior enough to act, carried out against criteria checkable at a glance, and conducted by testing rather than confirming. An auditor would ask for the list of instruments relied on for a number, each with its last calibration, and for the last walk’s findings with what was done about each.

The limit runs the other way. A hotel in the same region held a monthly walk announced a week ahead, and found corridors cleared the afternoon before that filled again within two days. An announced walk observes the announcement.

None of this argues for dismantling the dashboard, which is accurate. The card sets its blind spot beside a block of wood on a corridor floor: an indicator reports only what it was built to see, and the present condition of a building is visible only to somebody standing in it.

Subchapter 2.10 · Puebla, Mexico

Setting: Puebla, Mexico

A small meeting room, afternoon sun striped by a slatted blind. The client’s auditor, a woman in a grey suit and reading glasses, leans forward with a finger on a bound report open at its final pages, an empty box on the right-hand page. Across the desk the general manager, in a dark-blue suit, looks down with one hand beside a small desk calendar showing a plain grid of days. Report and calendar are a hand’s width apart; the card measures that distance in months.

The setting is a supplier assessment at a hundred and twenty room business hotel in Puebla, for a manufacturing client with a substantial accommodation programme. Three questions were asked in about ninety seconds and none was answered. The first was the current compliance status: there was a consultant’s report from January ending in ninety-four per cent, and it was August. The second was how the hotel evaluated a commitment in its own tender response. The third asked for the corrective actions on January’s three gaps, none of which had been through the corrective action process.

“True only of its day” accuses the report of nothing; it was accurate when measured. The failure is reading it in August as the present, and clause 9.1.2 of ISO 45001:2018 is written against that habit. Beside determining frequency and methods, evaluating and acting, and retaining results, it requires the organisation to maintain knowledge and understanding of its compliance status, a continuing state rather than a periodic result. The scope is legal and other requirements, determined under 6.1.3, including what a hotel promises on its own account.

“Evaluate at set intervals” points to the remedy, and the guidance lets the interval vary with the importance of the requirement, operating conditions, changes and past performance. In Puebla a live answer existed: Fernanda Olmos, the maintenance planner, held eighty-seven recurring items with due dates and owners, and nobody had ever asked her. An owner should look for a register showing, against each obligation, how it is evaluated, when it last was, and with what result.

The clause routes every gap to 10.2: cause, action, review of effectiveness, and whether the same gap exists elsewhere, which would have caught the one found in two consecutive January reports. The counter-argument deserves an answer. Another hotel in the country recorded eleven gaps and closed four in two years, creating a dated record of known non-compliance. The lesson is not to look less but to fund both halves of the sentence, and where a gap must stay open, to record a decision and a date.

The calendar shows no month and needs none. A compliance figure speaks of the day it was written and of no day since.

Subchapter 2.11 · Hanoi, Vietnam

Setting: Hanoi, Vietnam

A tiled courtyard patterned in grey and white, round folding tables stacked on their edges along both walls. In the middle lies a long section of carved dark timber cornice, broken plaster still clinging to it and scattered round it. At the doorway from the service corridor a woman in a dark-red tunic rests one hand on the stacked tables; beside her a maintenance man in a white hard hat holds a broom upright. Both are looking up.

That upward gaze is the right instinct. At twenty past six in the morning, in a hundred and four room hotel in Hanoi built around internal lightwells, about a metre and a half of cornice fell from the second-floor level into the courtyard where the buffet is set up at half past six. Phạm Thị Hồng, breakfast supervisor for nine years, would have been putting out the first table. The courtyard was swept, a contractor looked at the other panels from ground level, and the engineering log closed the event: no further action.

The two upper plaques set the times side by side, and the gap between them is the card. The physical event at twenty past and at half past would have been identical; the only variable was who stood there. “A near miss is an incident” corrects the definition most hotels use. In ISO 45001:2018 an incident is an occurrence arising out of or in the course of work that could or does result in injury and ill health, and near miss is a name for one kind of incident, not a lesser class.

Clause 10.2 gives incidents and nonconformities one machine. The organisation reacts in a timely manner, then evaluates, with the participation of workers, the need for corrective action to eliminate root causes, including whether similar incidents could occur elsewhere. The other two lightwells had the same cornice detail from the same refurbishment, and nobody asked. Action follows the hierarchy of controls and management of change, and the governing sentence answers the lower left plaque: corrective actions are to be appropriate to the effects or potential effects encountered.

An owner should look for one added question at the point of reporting, the worst credible outcome and how close it came; for a single entrance to the registers, since at Hanoi the event sat only in an engineering log; and for a worker in the investigation. Hồng knew the tables stand under the well because the sockets are there, a fact neither investigating manager had reason to know. An auditor would also ask how the reporter learned the outcome. She had to ask, three weeks later.

Proportionality runs both ways. A hotel elsewhere in the region applied full root-cause investigation to every event and within a year reporting had collapsed. The courtyard asked for more than a sweep and less than a tribunal: a response sized to timber falling into a space occupied every morning, ten minutes before it was.

Subchapter 2.12 · Galway, Ireland

Setting: Galway, Ireland

A hotel pot wash on an April morning, clean and idle before the season: a deep steel sink, an empty draining rack, a black apron on a hook. Above the sink a cork board holds a single sheet with a column of boxes, a green magnet in each but the last. The head chef, her auburn hair cut short, rests her finger on that empty box. Beside her a bearded supervisor in a black chef’s jacket holds a ruled rota sheet against his side and watches the board.

The empty box belongs to Marek Sobczak, in his third summer the best kitchen porter Deirdre Quinn had had in six years as head chef of a hundred and eighteen room hotel in Galway. In race week he reported on the form that the walk-in freezer latch did not release from the inside, and it was fixed within three days. The rota published eleven days later moved him from evenings to weekday mornings, around thirty per cent of his earnings. Nobody said anything, nothing was written down, and by April he was working elsewhere.

The supervisor’s sheet is the instrument, which is why “Reprisal hides in the rota” sits beneath it. The hotel’s sincere policy against detriment was aimed at dismissal and discipline, formal acts that need a reason and leave a record. A hotel penalises in other currencies, shifts, sections, stations, cover and next season. A prohibition governs acts that can be identified as acts; it has nothing to say about a rota that is simply different.

ISO 45001:2018 treats reprisal in four places. Clause 5.1 makes protecting workers from reprisals when they report part of top management’s leadership. The note to 5.4 lists reprisals and threats of reprisal among obstacles to participation to be removed or minimised. Clause 6.1.2.1 names victimisation among the social factors hazard identification must consider. The guidance on the hierarchy places instructions on reporting without fear of retaliation among administrative controls. And clause 7.3 speaks of protection from undue consequences, a phrase wide enough to reach a rota.

“Make the question answerable” is the practical demand. A workforce cannot verify a promise about what will not happen; it can only observe. An owner can build a look-back: eight weeks after a report, somebody who does not build rotas checks what happened to the reporter’s hours and shifts. For seasonal workers, whose whole exposure is the list drawn up in March, the instrument is published criteria for being asked back, and evidence that reporters appear on it at the same rate as everybody else.

A hotel on the same coast required approval for any adverse change to a recent reporter’s conditions, and supervisors began avoiding such people altogether, a reprisal nobody has to decide on. At Galway the hazard was fixed in three days and the reporter left; the second fact is the one the kitchen remembered.

Subchapter 2.13 · Luang Prabang, Laos

Setting: Luang Prabang, Laos

A meeting room in a converted villa, wooden shutters half drawn, a long dark table. The resident manager, in a pale-blue silk blouse and a dark woven skirt, leans over three sets of minutes laid edge to edge, each open at its last page. Her right forefinger rests on the first; her left hand lies flat beside a closed laptop and a glass of water. The pages carry ruled lines and a signature line at the foot, and nothing more. What she is reading is the sameness.

Souphaphone Vongsa was preparing the fourth January review at a thirty-four room hotel in Luang Prabang when she read the previous three. Each closed with the same sentence: the occupational health and safety management system remains suitable, adequate and effective. Three authors had each copied the previous year’s wording because it was correct. Reading the clause against the minutes took half an hour. The inputs were reasonably covered; of the seven kinds of decision the clause requires as outputs, three years had produced two, and the rest were recorded as noted.

“Same sentence, three years” and “Three authors, one verdict” accuse nobody of dishonesty; the words are the standard’s own. Clause 9.3 of ISO 45001:2018 requires top management to review the system at planned intervals to ensure its continuing suitability, adequacy and effectiveness, and the guidance defines three separate verdicts: whether the system fits the organisation, whether it is implemented appropriately, whether it achieves its intended results. One sentence reciting all three names the questions without answering any.

“A review must decide” points to the outputs, where the clause is unusually specific: decisions on suitability, adequacy and effectiveness, improvement opportunities, changes to the system, resources, actions, integration with other business processes, and implications for strategic direction. At Luang Prabang a resource request had reached each review and gone to a budget template with no safety line. The owner had never attended, and the general manager’s authority stopped below the two most consequential decisions. Noted was the honest record of a room that could not decide.

For an owner the test is the last plaque: read three conclusions side by side and look for one sentence that could only belong to that year. Then map the seven outputs against who can decide them, and route those above the room’s authority to the owner in writing, with a recommendation. An auditor would ask for trends rather than one year’s figures, for worker consultation and participation as a performance input, and for evidence that the outputs reached the workforce.

The tempting correction, a full day and sixty slides, worked once in a group elsewhere in the region and was hollow the next year. The guidance lets topics be addressed at different times, and four short sessions are easier to sustain. What the clause asks for is not a longer meeting but a verdict that could not have been written before it.

Subchapter 2.14 · Panama City, Panama

Setting: Panama City, Panama

A windowless back office behind a restaurant: a grey filing cabinet, a coat stand with a dark jacket. Two large sheets lie side by side. On the left an absence grid in which small red dots gather in one narrow vertical band while the rest stays clear; on the right a timesheet of ruled rows. A woman in a black blouse, dark curls pulled back, has her finger on the dots and her mouth half open in recognition. A grey-haired man in a light-blue shirt traces a row of the timesheet.

Yariela Castillo, assistant restaurant manager at a two hundred and forty room business hotel in Panama City, was asked to explain two quarters of short-notice absence above the rest of the property. She found that the absences clustered on mornings after a closing shift. The restaurant closes at half past one, the last person leaves nearer two, and breakfast needs somebody in the building at half past five; she had rostered that pairing on the same people, with four supervisors and a labour cost per cover she was measured on.

The second sheet makes the card a safety card. Payroll ran the query: two hundred and fourteen occasions in a quarter on which somebody clocked back in less than nine hours after clocking out, involving thirty-one people, and nineteen people past twelve consecutive days. “The roster is safety data” says only that nobody had read it as such. Fatigue presents as absence, turnover, errors and short tempers, each handled by someone other than whoever owns hazards.

“Fatigue is a hazard” is the standard’s position. ISO 45001:2018 defines injury and ill health as an adverse effect on the physical, mental or cognitive condition of a person, and clause 6.1.2.1 requires hazard identification to consider how work is organised and social factors including workload and work hours. Clause 8.1.1 includes adapting work to workers in operational control. The guidance places reorganising work to avoid unhealthy hours and workload at the third rung of the hierarchy; training sits at the fourth, and the scope merely permits integrating wellbeing.

For an owner the evidence is three queries and two lines. Short turnarounds, runs of consecutive days and split shifts by individual sit in the time and attendance system. A minimum turnaround and a maximum run of days, written down and enforced by the rostering system, are third-rung controls costing flexibility rather than money. An auditor would ask whether the hazard identification mentions hours at all; if not, it has omitted a named item.

The limit lies in measuring the wrong thing. A group elsewhere in the region introduced individual stress questionnaires, which located the hazard in people and left the rosters unexamined. The Panama City hotel had a good wellbeing programme, its support line well used; every call was somebody coping with an arrangement that was lying, all along, on the desk.

Subchapter 2.15 · Trieste, Italy

Setting: Trieste, Italy

A landing on a narrow service stair: worn stone steps, a wrought-iron banister, soft daylight from a tall window. Beside it a new linen store stands open, white shelves stacked with sheets and towels, a loaded housekeeping trolley at the door. A woman in a dark-grey cardigan slides a closed grey ring folder onto an upper shelf, tab facing out, with quiet satisfaction. A room attendant in a pale-grey tunic holds a stack of towels and smiles towards the shelf.

A year after Giulia Depangher found the file in the second drawer, the stair in her Trieste hotel has not been widened. It is a Habsburg staircase, widening it would cost two rooms on each of four floors, and that arithmetic has defeated every owner since 1961. What she did instead was move the linen: a second store on the third floor, where the weight was being carried to, so the run on the stair is one floor rather than four. It cost shelving and a decision. The stair has also entered a capital plan for the first time.

“Second best, taken this year” is the plaque on which the volume closes. Moving the store is a reorganisation of work, two rungs below elimination in the hierarchy of clause 8.1.2.1.2 of ISO 45001:2018, and it removed most of an exposure that decades of owners had protected people from rather than taken away. Clause 10.3 asks the organisation to continually improve the suitability, adequacy and effectiveness of the system by five means: enhancing performance, promoting a supportive culture, promoting worker participation in improvement, communicating results to workers, and keeping evidence.

The guidance adds two points. Continual means recurring, with intervals, and improvement need not happen everywhere at once. And among its examples is achieving better performance with fewer resources: simplification. One store instead of a rebuilt stair is that kind of improvement. The card does not pretend the upper rungs were reached; it records that they were climbed towards before the property settled.

“Measure report to remedy” offers the only figure the volume proposes. Take the last twenty reports, measure the days from report to remedy. It cannot be improved by concealment, because a shorter interval requires the report to arrive and the action to follow. In March a night porter reported that emergency lighting on a second-floor corridor had failed during a power interruption; an electrician came that afternoon and the fitting was replaced the same day. Nine hours. The gate that ended Bruno Petaros’s working life had been replaced eleven weeks after it was needed.

The counter-argument is counting: a group on the same coast set each hotel a target number of improvements and got easy ones at the expense of the difficult few. The folder is filed, not put away. Same building, same stair, and a gap between knowing and acting that now stays open for hours rather than weeks.