Why does an equipment malfunction need a written policy?
A malfunction that is fixed and forgotten is the most common way a near miss repeats. The operator resets the sensor, the machine runs, and the next shift meets the same fault with no record of what was done. A written policy makes the response the same on every shift and every site, and it creates the record that shows the control was actually changed.
What are the four steps?
| Step | What happens | Owner | Record |
|---|---|---|---|
| 1. Report | The person who saw the malfunction or near miss reports it the same shift, with the equipment, time, location and what could have happened. | Person who saw it | Report reference and time |
| 2. Stop | The affected equipment or task is made safe and stays out of use until a competent person has assessed it. | Supervisor or team leader | Isolation or stop time, who authorised restart |
| 3. Update the control | The cause is found and the control that failed is changed. The change is chosen from the hierarchy of control, not from the quickest fix. | Process or maintenance owner | Cause, control changed, new control, risk rating |
| 4. Verify | The new control is tested under normal running conditions and a check date is set. The event closes only when the check passes. | Area supervisor, checked by a second person | Test method, result, date, sign-off |
What should the control update record say?
Write the cause as a fact the team has confirmed, not a guess. "Guard interlock failed because the sensor was dirty" is a cause; "operator error" is not, because it does not tell anyone what to change. Then name the control in place before the event, the control after the change, and the level of the hierarchy it sits at. A new warning sign is the weakest level. Removing the hazard, guarding it or redesigning the task are stronger, and the policy should ask for the strongest one that is reasonably practicable.
How do you verify the updated control works?
Verification is a check in use. Run the equipment through the task it was used for, under the conditions where the event happened, such as a changeover, a cold start or a full shift. Record what was tested and the result. If the check fails, the event stays open and goes back to step 3. Set a follow-up date for a second check, and review the event again if the same malfunction recurs.
What makes this kind of policy fail?
- Reports made days later, or not at all, because reporting feels like blame.
- Equipment restarted by the person who caused the event, with no assessment.
- A control change written up but never tested.
- Events closed on the date of the repair rather than the date the control was verified.
- No link between the near miss and the risk assessment or the task procedure that needs updating.
How do you adapt this template?
Put the site's own names for the roles, the reporting window your business sets, the equipment register reference and the risk assessment it links to. Check the wording against your state or territory work health and safety law and your own risk assessment process. This template is a starting point for a policy, not a legal opinion.
Step by step
- Report the event. Record the equipment, time, location and what could have happened on the same shift the malfunction or near miss is seen.
- Stop the affected work. Isolate or stop the equipment and keep it out of use until a competent person has assessed it and authorised restart.
- Update the control. Confirm the cause, change the control that failed, and choose the change from the hierarchy of control with the new risk rating recorded.
- Verify the control in use. Test the updated control under normal running conditions, record the result and close the event only when the check passes.
A worked example
A packing line stopped twice in one week when a photo-eye on the carton infeed failed to see cartons, and an operator reached in to clear a jam while the belt was still moving. The report was made on the same shift. The supervisor isolated the infeed and the maintenance lead confirmed the cause: the sensor lens was coated in adhesive dust from the sealing step. The control changed from a cleaning task on the checklist to a fixed guard that stops the belt when the access door opens, with the sensor cleaned on a set frequency. The check ran through two full shifts before the event was closed.