Diagnostic Tool

Interface Risk Diagnostic

21 observable signals across 7 failure mechanisms. Work through the checklist against your current EHS platform. No data upload required.

21 signals 7 mechanisms No data shared Print-ready

How to use this. For each signal, ask: does this describe what I can observe in my platform right now? Check it if yes. You do not need system access or a report from IT — these are observable from normal day-to-day use. A mechanism with two or more signals checked is active in your platform and should be treated as an unregistered hazard. The evidence and field examples behind each mechanism are in: The Digital Error Trap.

/ 21 signals

No signals detected

Clear

Habit Override

Muscle memory replaces risk assessment

0 / 3

The interface assigns the same gesture or interaction to tasks with fundamentally different risk levels. A worker swipes left on a critical safety alert because that gesture is identical to dismissing a routine notification. The interface trained the response — it is not a failure of attention.

Observable signals

Critical alerts and routine notifications are dismissed with the same gesture — swipe, tap, or click. Nothing in the interface distinguishes them. The platform gives no visual difference between a high-priority safety action and a low-priority administrative task at the moment of interaction. A worker has dismissed or skipped a critical alert unintentionally in the last 90 days — and only realised after the fact.

Feedback Holes

No confirmation = duplicate or lost records

0 / 3

When the system does not confirm that an action was received, workers repeat the action. On platforms that do not detect duplicate submissions, one near-miss becomes five incident records. On platforms that do nothing, the submission is lost. Both outcomes corrupt your data.

Observable signals

The platform does not display a clear confirmation screen after a report is submitted — workers cannot tell whether the record went through without reopening the system. Your incident log contains duplicate records that workers did not knowingly create — the same event with identical timestamps filed multiple times. Workers regularly ask supervisors or safety managers "did my report come through?" after submitting.

Signal Fragmentation

Category structure splits the same hazard

0 / 3

Unclear or overlapping category structure causes workers to file the same hazard under different labels. The system sees ten unrelated problems; the site has one systemic failure. Your data cannot show you the pattern that is about to produce an incident.

Observable signals

Two or more categories exist that could legitimately describe the same type of incident — for example, "Slip Hazard," "Housekeeping," and "Spill" are all valid choices for a floor oil leak. Running the same trend analysis using different category filters gives different results for the same underlying hazard type. Frontline supervisors describe recurring hazard patterns in toolbox talks or shift handovers that do not appear in the official incident data.

Smart Guess Error

The interface made the wrong choice first

0 / 3

Modern platforms pre-fill hazard categories to speed up entry. When the pre-fill is wrong and correcting it costs more effort than accepting it, the worker accepts the wrong answer. The error entered the record before the worker touched the keyboard. Your data reflects what the system guessed, not what was observed.

Observable signals

The platform pre-fills or suggests hazard categories, incident types, or locations before the worker has entered any descriptive information. Correcting a suggested category requires more steps than accepting it — for example, accepting is one tap; correcting requires opening a dropdown, scrolling, and selecting. Your incident data shows uniform categorization across a workforce for incident types that field supervisors describe differently when asked directly.

Alert Saturation

Volume eliminates the ability to distinguish critical from routine

0 / 3

When every notification looks the same and arrives through the same channel, workers stop reading any of them. Over hundreds of shifts, the habit becomes automatic. A critical alert — a permit about to expire, an isolation not yet cleared — arrives. It looks identical to the forty routine notifications before it. It is dismissed in the same second.

Observable signals

Critical safety alerts (isolation conflicts, permit violations, atmospheric threshold breaches) arrive in the same notification feed, with the same visual format, as routine administrative reminders (training overdue, shift handover, permit expiry). A typical worker receives more than 10 platform notifications per shift through the same channel. Workers have reported turning off platform notifications, or supervisors have observed workers dismissing notifications without reading them.

Physical Decoupling

The record and the physical act separate

0 / 3

The platform allows a worker to record the completion of a physical safety action — a Lockout/Tagout verification, an atmospheric check, a hot work clearance — without performing it. The record is not inaccurate: it is fabricated. The machine may be live. The permit says it's isolated.

Observable signals

A worker can sign off a physical safety check — Lockout/Tagout verification, atmospheric test, hot work clearance, confined space entry check — from any location. The platform has no GPS or proximity requirement at the time of sign-off. A completed permit record does not require any physical verification at the isolation point — a digital signature from a desk or site office satisfies the system requirement. Audits or spot checks have found completed digital records for physical safety actions that were not performed or were performed incorrectly.

Form Abandonment

The form is not completed — no record exists

0 / 3

When a reporting form is too long, too slow, or too cumbersome at the point of observation, workers walk away. No record is filed. Form Abandonment produces a zero — not a wrong record, not a duplicate. An absence. Declining near-miss volumes on a platform with known usability problems are not a sign of improving safety.

Observable signals

You do not know what percentage of started reports are submitted vs. abandoned. The platform does not track or report this figure. A standard near-miss report takes more than 3 minutes to complete on a mobile device in normal field conditions — gloves on, outdoor light, standard site connectivity. When workers are asked why they don't report more near-misses, the form or the app is mentioned — not culture, fear of blame, or lack of time.

Mechanism Summary

What to do next Work through the checklist. Come back to this section when you have completed at least one mechanism.

The Digital Error Trap — full article and evidence base