No surprises is a process,
not a promise.

A safety culture is set on day one, or it is set by an incident. Everything that arrives after the first recordable injury is repair work. The crew can tell that a program appearing the week after the numbers move is protecting a statistic, not a person.

The posters go up. The toolbox talk gets longer. The paperwork thickens.

Nothing about how the job actually runs changes.

They treat it accordingly, and you do not get that credibility back on the same project.

Safety is the one thing I have never delegated. I track and defend it personally, and it sits at the same governance level as cost and schedule: same reporting line, same rigor, and a place in every conversation about the job rather than a slot on an agenda.

Every project says safety comes first. If that were true, nobody would need to say it.

Every project says it.

Owner-led safety does not mean that the owner replaces the contractor’s safety system, supervises every task, or takes over the contractor’s legal responsibilities. It means the owner sets the behavioral standard across the project, reinforces it visibly, and remains accountable for the conditions in which every contractor operates.

The contractor’s program remains essential. The owner-led culture makes those individual programs work as one project-wide system.

Owner-led safety programs are no longer the norm. As scope moved to full-scope turnkey EPC, owners handed over the keys to safety along with everything else and relied on the contractor’s program. That is a defensible contractual position and a poor safety one.

Most contractors run good safety programs. The problem is not the quality of what they run; it is the boundary of it. They cover the training the work legally requires — safety induction, working at heights, confined space — and they cover it well. That training is built around the task and the individual: how to perform this job without hurting yourself.

That is necessary. It is not sufficient.

We ran an owner-led culture program alongside the contractors’ own training on one project and asked the people who sat through both what the difference was. The answer was consistent. Every other course had been about keeping yourself safe. This one was about looking out for everyone else.

That is not a moral appeal, it is arithmetic. Watch only yourself and you have one person looking out for you. Get a whole site watching each other and you have thousands.

That is not a training course. It’s a change of culture.

Procedures govern the work as designed. Culture governs what people do when the work changes, the schedule tightens, or nobody is watching.

A program built to teach confined space entry is not designed to deliver that, and it should not have to. That program teaches a task. An owner-led culture changes what an entire site believes is normal.

That is the gap, and it is the behavioral half of the job — the moment someone speaks up to a person they have never met about work that is not theirs.

Where several contractors share a site, there is a second gap stacked on top of it: several programs running side by side, thousands of people moving between them, and nobody responsible for the space in between.

When the owner leads, both gaps get covered. The owner sets the standard that outranks every company policy on site, sees across every contractor at once, and answers for whatever happens on it.

A contract can require training, competencies, reporting and audits. It cannot oblige anyone to look out for a stranger.

That is a norm rather than an obligation, and a norm follows whatever a site believes the project actually values. That belief is not set by whoever holds the scope. It is shaped most powerfully by the party that owns the outcome.

Recognition is only one part of the program, and the easiest to see. It is also the part that surprises people. Being thanked by your own employer is your employer doing its job. Being thanked by the company that owns the project, in front of your crew, is the kind of thing that gets told at the dinner table that night — and what gets told at home comes back to the job.

The behavior that earned it gets repeated, by the person who was recognized and by everyone who watched it happen. I have watched that land harder than any recognition a contractor’s own program could offer.

The owner cannot subcontract the visible leadership that tells an entire project what matters.

Huang and Hinze studied 59 major projects covering 143 million work hours. They scored the owners against twenty-five practices: how the project was set up, how contractors were selected, what the contract required, and what the owner actually did once work began.

Owners in the bottom band recorded injury rates roughly nine times higher than owners in the top band. Six of the 59 projects finished with no recordable injuries at all.

None of those results came from one thing done well. The paper’s own conclusion is that safety cannot be achieved through a singular effort: the owner’s practices, what the contract required and how the project was set up all had to pull the same way.

Of the three, what the owner actually did carried the most weight — more than the requirements written into the contract.

What separates the two bands is not complicated. The owner’s safety representative reviews the near-miss rate. Injury statistics are kept for each contractor rather than pooled.

None of that is a program in its own right. All of it is the owner being in the room.

One finding in that work should stop any owner who believes pre-qualification is the answer. Of the four things measured, how carefully the owner selected safe contractors was the only one that fell out of the model. Not because it does not matter, but because by then everyone was already doing it.

What distinguishes projects is what the owner does after contract award.

That paper was published in 2006, and the industry has moved the other way since.

Owner involvement changes the outcome, and you cannot be involved through somebody else’s program.

I have set this program up twice and run it through execution, both times on projects where the safety culture was still maturing.

Twenty-four million work hours. No lost-time injury.

That was not luck.

It was a decision made before there was anything to measure, before there was evidence it would work, and before there was an incident forcing action. And it was defended every day afterward.

Cost can be recovered. Schedule can be recovered. A person cannot.

There is plenty on a project worth handing over, just not the part where failure is measured in people.

What that decision actually consists of: the five parts of a safety culture, what it costs to run, and the ways it fails.

In the last edition, I said that a safety culture is the one thing an owner cannot subcontract.

This is how I build the culture that makes that responsibility real.

Building a safety culture means changing how thousands of people behave. On one of my projects, about five thousand came through the gate, and the program had to reach every one of them.

Compliance is essential. But I also want to change what people do when nobody is watching. Following a rule and forming a habit are not the same thing.

So I give that change the same structure I would give any other change on a project.

I use a five-part version of the Managing Complex Change framework, commonly associated with Lippitt and Knoster. It gives me a practical checklist: vision, skills, incentives, resources and an action plan.

I use it alongside safety frameworks, not instead of them. A maturity model helps me assess where we are. A management system sets out what must be in place. The change framework helps me think about how those expectations become everyday behavior.

Habits are hard to change. On a megaproject, it is harder still.

A megaproject brings together thousands of people from different companies, industries, countries, trades, safety cultures and first languages, and asks most of them to work differently from the way they always have.

The five parts give me a way to organize that work, and somewhere to start looking when it is not working. They are a diagnostic lens, not a guarantee.

Vision. A one-page project safety mission statement: what we believe, what we are committed to, and how we will get there. The wording is the project’s own; the commitments are not negotiable: no project objective takes priority over the safety of our people, and we work to prevent every injury and learn from every incident.

The owner’s and every contractor’s project directors write it together, rather than inheriting one from head office. They sign it first, then every worker does. Signing creates collective ownership, but a signature is not understanding.

I want leaders defending a commitment they helped write, not simply complying with one they were given.

The statement brings the companies’ commitments into one shared direction for the project. Any contradictions have to be resolved explicitly, not left for a supervisor or worker to interpret at the workfront. It does not replace the detailed requirements that keep the work safe.

Skills. Training beyond compliance. I engage HRE Consulting International to run Are You Safe 360™, the safety culture uplift program they design and deliver in-house, built on human-centered design thinking, evidence-based change theory and the neuroscience of habit. It teaches people to think about how a message lands on somebody not wired like them; to carry four questions through the day until they become habitual — am I safe, are you safe, are we safe, are they safe; and to act, moving from awareness, through acceptance, to action.

It is deliberately simple enough to cross languages. On a site where a dozen languages are spoken, that matters. But simplicity does not remove the need to check understanding.

That final step, action, is the test. Not just whether someone recognizes a hazard, but whether they will walk across a site and say something to a stranger.

The program runs alongside the contractors’ own programs rather than replacing them, and gives the project a common language. The research is explicit: safety cannot be achieved through a singular effort. Enough of the workforce is trained as ambassadors that every crew has one: a headcount, deliberately, not a percentage. That is what makes it travel without me in the room.

HRE Consulting asked about seven thousand workers what their biggest safety challenge on the job was. The workers were on three projects in three countries on two continents, two of them mine. The top three answers were team engagement and training (35 percent), communication (25 percent) and supporting people new to the industry or the project (20 percent).

None of the top three was about the work being dangerous. I do not read that as evidence that the work was not dangerous. I read it as a warning about what people needed to manage that danger together: engaged teams, clear communication and better support for newcomers.

Three workforces with nothing in common raised the same concerns.

Incentives. Recognition, intrinsic and extrinsic. Anyone on site can nominate anyone else for a safety recognition card: for safe work, a well-timed intervention, or an action that protects others. A pipefitter can recognize a scaffolder from another contractor they have never met. That simple rule reinforces a project-wide commitment: protecting one another does not stop at your employer, your trade or your crew.

The safety committee reviews each card and awards a gold, silver or bronze coin that converts to a prize, and the owner hands them out alongside the contractor: recognition from the project owner can carry a different weight from recognition by the employer.

The committee rewards useful hazard identification and constructive intervention, not low incident counts or fewer reports.

Choose the prizes for the culture you are in, not the one you came from.

Resources. Give ambassadors material to teach with and support to use it. Keep the message visible and current: banners carrying the vision, a changing message of the moment, and family photos reminding people what is at stake on the way out of the office.

Stand behind Stop Work Authority with a clear commitment that raising a concern in good faith will be supported. A poster is a reminder, not the resource itself. Management’s response is what makes the authority usable.

Start every key meeting with a safety moment relevant to the work in front of the room, not a generic reminder everyone has heard before.

Action plan. A jointly developed engagement plan with a timeline, clear responsibilities and a way to train new workers as the workfronts evolve. A project workforce turns over constantly as the scopes change: civil leaves, mechanical arrives, and commissioning changes the mix again.

A culture launched once and never renewed will not reach the workforce that arrives later.

The parts matter. The reason matters more.

Leave one of the five short and the framework gives me a pattern to look for.

No vision, and you get confusion. There is nothing common to point at, so everybody falls back on what they arrived with: their own company’s policy, or whatever they learned on the last job. Ask three crews what is expected of them and you get three different answers.

No skills, and you get anxiety. You have made people responsible for each other and not trained them to do it. They notice what is wrong and have not been given what to do next, or how to say it to somebody they have never met who thinks nothing like them. Being held responsible for something nobody equipped you for is what anxiety is.

No incentives, and you get gradual change, which on a construction program is the same as none. People may understand the message, but the behavior you want receives little recognition while production gets attention every day. Nobody refuses. It simply never reaches the tools.

No resources, and you get frustration. You have asked ambassadors to lead something and given them nothing to lead it with. The willing ones stop volunteering.

No action plan, and you get false starts. The launch goes well. Then the workforce turns over, and nobody scheduled the next round, so the crews who arrive in month six are never trained at all. A program that launched so well becomes something half the site has only heard about.

That is what a change model buys you. When it is not working you are not guessing at morale or blaming a contractor; the symptom gives you somewhere specific to start looking.

The framework travels. The way it is expressed does not.

On one project, family was central to the local culture. We built the program around that, including a safety video featuring the site workers’ own children.

It did not tell anyone what the rules were. It asked a question: what is your why?

The children were the answer. Their messages built the story in four parts.

Why they loved the person they were waiting for. “If we were in danger, my mom would do anything for us, even if it’s impossible.”

How it felt to watch them leave for work. “When mom goes to work I miss her a lot, because I’m very attached to my mom and I don’t want to miss out on the time I have with her.”

What they wished for them while they were away. “I would like to tell my sister that I want her to come home safe and that nothing bad happens to her.”

How it felt when they came home. “When my mom comes home, I hug her a lot and she makes me spaghetti because I like it a lot.”

The video ended by changing one word. So, who is your why?

The point was personal, but also shared: the person working next to you had someone waiting for them too.

Nothing else we issued on that project came close.

If you can pull at the heart, the message is through. Nothing procedural ever gets that far.

Culture can work against you too.

Where deference to seniority is strong, a junior worker may hesitate to stop a job a senior person is running. Stop Work Authority can exist on paper without existing in practice.

Management can do the same damage. Make the person who stopped the job feel they are on trial, rather than thank them for raising the concern, and the authority becomes decoration on a poster.

I do not want an incident to be the first evidence that people did not feel able to speak. That is why I watch how concerns are raised, and how leaders respond, rather than assume the authority works.

Nobody was hired to run it.

The owner’s safety organization was six people on a project where about five thousand workers came through the gate. Those six were additional to every contractor’s own safety organization, not the entire site safety team. Their existing role was contractor oversight; promoting the program became part of that work.

That is not the same as saying it took no resources. It used the time of people already there.

The coins, banners and videos were modest costs relative to the project. The harder commitment was time.

Writing a check for a safety initiative is easy.

Standing in the room for one, while the schedule is asking you for something else, is the part that gets quietly deferred.

The training is where that bites. Four hours of initial training for everyone, away from their normal work. Sessions are staggered around the workfronts so a whole piping crew is not taken off the tools at once.

But four hours for every worker is still the one cost that scales, and a contractor measured on progress feels every one of them. The contractor has to make room for it in the work plan. The owner’s job is to make sure it stays there when the schedule comes under pressure.

Cut it short to protect progress and you keep the program on paper and lose it on site.

Afterward, the ambassadors carry much of the program inside the working day. But it is not maintenance-free: new arrivals need training, ambassadors need support, and materials need renewing.

Leadership time remains a substantial commitment, and not all of it appears in a diary.

The visible part is what goes in the diary. The walkdown is an hour a week. A safety moment at the top of every key meeting. Reviewing the safety statistics every week. Reading the incident reports.

And then the part that shows up nowhere as a commitment: reading the near-miss reports rather than the summary of them, taking part in the incident investigations rather than being briefed on the outcome, sitting in on the design of the safety videos, walking the site often enough that the workers expect you and talk to you, knowing which contractor is drifting before the statistics say so, knowing the ambassadors by name.

Being across all of it, not across the hour.

That is the program.

You do not have to attend everything personally. But if you routinely send somebody else to the safety walkdown, let somebody else open the meetings, let somebody else thank the worker for stopping unsafe work, you have told five thousand people exactly how much it matters.

Running safety this way has done more for the way I lead a project than any other part of the job. You cannot ask people to believe safety matters to you if your own behavior says otherwise.

Once you have led this way, you read the rest of the project differently. You notice the contractor whose people have gone quiet. You notice the engineer who is out of their depth and will not say so. You notice the recovery plan that quietly takes weekends from other people’s families.

You stop looking only at activities and milestones. You start seeing people.

That is empathy. It gets called a soft skill, but it is where leadership starts. Without it, you will never win the hearts and minds of the whole workforce.

What safety does is sharpen it and show you how to use it — and a project is where five thousand people find out whether you have it.

Every part of the program rests on one belief.

Nobody should be hurt trying to put food on their family’s table.

Cost trending — early warning, pointed at money rather than people. How a trend register actually works, how it joins the risk process, and why bad news early is just news.

In the last edition, I said I do not want an incident to be the first evidence that people did not feel able to speak. Cost works the same way. You do not want a commitment to be the first evidence that the budget has moved.

A project that reports only actuals and commitments is reporting history: what has already happened or already been promised. It is more common than it should be on major projects, and it is one of the quietest ways an owner loses control.

Most owners run risk management and cost management as two separate disciplines.

I do not.

Cost trending makes the forecast arrive before the commitment does, and in my experience, it is the most underused discipline available to a project team.

It also shows you whether your team is speaking up early, or only once the cost is committed.

Most report actuals and commitments against the control estimate, call the difference variance, and run the risk register as a separate exercise on its own cycle.

Both are competent.

Neither tells you what the project will cost while there is still time to react.

Some trends begin as risks. While the event is uncertain, its exposure is captured in the risk process. When there is enough evidence that the cost will occur, it is raised as a trend. Other trends come directly from discovered omissions, scope changes, or costs that exceed an allowance; they may never have been risks.

When a risk becomes a trend, reconcile the two records. Remove the transferred exposure from the risk model completely; anything left behind is counted twice.

A trend can be a change order, a new services contract, a purchase order, an internal overrun, additional staff or a contract claim, to name a few. The test is simpler than any list: if it can draw on contingency, it belongs in the trend register, whether or not it began life as a risk.

On one project, the owner’s team drove an hour each way between home and site. That sat on the risk register as a safety risk: more of our people on the road, fatigue after a long day, and security on the way home. Once we decided to run a bus with a professional driver, the bus became a trend.

Others were never risks at all, just things the budget had missed: language and cultural competence training for the team, scope a government agency required as a new condition of its permits, a provisional sum that came in above its allowance, and a scope change taken from a lesson learned on a similar project.

Language and cultural competence training is the one I would budget first next time. The team was working in its second language, and deference to seniority was strong. Raising anything with a supervisor, let alone someone two levels up, created real anxiety. So, people held back: challenging assumptions, raising concerns, calling out problems, and I was not getting the early warnings this whole process depends on.

A trend register cannot record what nobody says.

Once raised, a trend moves through three states.

Unconfirmed. A potential impact has been identified. You are confident it will happen, but not yet certain: it could still fall away. There is not enough information to value it, so it is not yet in the forecast. It is early warning, and the team can be steered before anything is allocated.

Uncommitted. The cost is estimated to reasonable accuracy, or the contract, change order or purchase order is being negotiated and will be executed. Contingency is allocated and forecast as a drawdown, but nothing can be spent against it until the trend is committed.

Committed. The contract, change order, claim or purchase order is executed, or the internal approval is granted, and the estimate from the uncommitted trend is reconciled. The drawdown is confirmed, and the money can be spent.

What moves a trend from unconfirmed to uncommitted is approval, and the test at approval is certainty, not the number.

If you are not sure it will happen, do not approve it, even if you can price it.

Approving a trend and then withdrawing it when the event never occurs teaches the team that the register is negotiable. Be sure it will be committed; you need not know the value yet.

Only approved trends, uncommitted and committed, go into the “Forecast to Complete” within the cost report.

Approved trends are then tested against the quantitative risk models, cost and schedule, to see whether the contingency still covers what is left.

The quantitative cost risk analysis, a Monte Carlo model run monthly, gives the value of the remaining risks at the company’s chosen confidence level.

Where key milestones on the critical path could slip, the quantitative schedule risk analysis is rerun and gives the likely delay. Price it at the owner’s monthly burn rate from the forecasted spend curve: the team kept on longer, extra financing costs, more third-party support.

Add the approved trends to both and compare the total with the approved contingency budget. It will sometimes exceed it.

The reconciliation is a decision point, not a report. What you act on is not a single month above the line, because the modeled value moves month to month; it is a sustained overrun.

The first response is to spend time re-ranking the top risks (initial rankings are usually conservative) and driving the mitigation actions to closure so consequence and likelihood come down. If the forecasted overrun survives that, re-evaluate the remaining budget for savings.

Cost and risk are not two conversations. They are one conversation at different points in time.

The trend register is where the risk process turns into money, and the reconciliation tells you whether the approved budget still holds.

The trap is double counting.

And it runs both ways.

If the same exposure remains in the risk model after it is raised as a trend, the cost is counted twice and the forecast looks worse than the project really is. The team may then cut scope or pursue savings unnecessarily.

The opposite error is quieter: a risk is closed because it has become a trend, but the trend is never raised. The cost disappears from both views. The same happens when contingency is drawn down against something that was never trended.

Both have the same cause: two registers and no reconciliation between them.

One predicts a problem. The other records its arrival.

If the handover between the two is not managed, neither number can be trusted.

Every project finds out what it costs in the end.

The only variable is whether it finds out while it can still change the answer.

Found early, bad news is just news.

Found late, it is history.

Setting up an owner’s team — why most project teams are built backwards, and the four stages, in order, that put the responsibilities on the chart before the names.