Safety Norms: Business and Management Consulting

1Purpose, Scope, and Safety Principles

This document sets out practical safety norms for business and management consulting work. It covers diagnostic reviews, process redesign, change programs, workforce planning studies, training delivery, and advisory work carried out at client sites, consultant offices, or remote locations. It applies to employees, contractors, and associates who plan, deliver, or support engagements. The aim is to protect people, prevent harm to client operations, safeguard confidential information, and keep the firm within its legal and contractual obligations.

The norms rest on four principles: plan for risk before work starts, follow the client's site rules, share only the information each person needs, and report problems early. The norms are written for consultants at every level, including associates and subcontractors who work under the same contract. Laws, standards, contract clauses, and client policies are jurisdiction-dependent and change over time. Verify current versions with qualified counsel, the client compliance function, or the relevant authorities. This is educational guidance, not legal advice, and it does not replace formal training, supervision, or approved local procedures.

2Roles, Competence, and Accountability

Accountability is assigned by role so that every hazard has an owner. The engagement partner approves scope, the risk plan, and any use of sensitive data. The project manager runs daily safety checks, confirms site inductions, and tracks open actions. The information security lead or data protection contact approves data handling methods. Each consultant is responsible for following these norms, completing required training, and reporting incidents. The client sponsor arranges site access, induction, and local emergency information.

Competence limits are mandatory. Consultants MUST NOT give opinions outside their training, such as legal conclusions, tax positions, engineering or safety-critical judgments, or clinical or employment decisions. Refer those to licensed or qualified professionals and the client's own specialists. Consultants MUST NOT claim certifications or regulatory approvals they do not hold. Subcontractors and specialist partners MUST be briefed on these norms, and their qualifications MUST be verified before they begin work.

• The engagement partner MUST sign off the engagement risk assessment before field work begins.
• The project manager MUST keep a current contact list for every team member, including emergency contacts and travel details.
• Every consultant MUST complete the firm induction and any client site induction before entering a facility.

3Course-Specific Hazards and Risk Assessment

Business and management consulting has fewer physical hazards than field trades, but the risks are real. Physical hazards arise on client premises, including plant floors with forklift traffic, machinery, stairs, loading bays, construction zones during operational reviews, and poorly lit storage areas. Travel hazards include road journeys, airport transfers, and fatigue after long schedules. Ergonomic hazards come from long hours at poorly arranged workstations and laptops used on kitchen tables or in moving vehicles.

Psychological and conduct hazards are common during restructuring, cost reduction, and change programs. Staff may show distress, hostility, or intimidation, and interviews can surface grievances, harassment, or whistleblowing concerns. Information hazards include payroll, customer, pricing, and strategic data, some of which may be personal data or inside information if the client is publicly traded. Interview notes about a single employee's performance are a common example of personal data that needs restricted handling. Legal hazards include competitor information exchange, conflicts of interest, improper gifts, and advice given outside the agreed scope.

Rate each hazard using a simple three-level scale. Likelihood is low, medium, or high, severity is minor, serious, or major, and the combined rating drives the control level. Any high rating MUST have a named owner and a written control before work starts. Example: a plant walk-through with active forklift traffic is rated high until the client provides induction, escorts, and required high-visibility clothing. Reassess the risk when scope, location, or stakeholders change.

4Preventive Controls and Safe Work Practices

Controls should be applied in order of effectiveness: remove the hazard where possible, change the method, use an escort or approved equipment, and only then rely on personal behavior and protective items. Most consulting controls are procedural, so they must be written into the engagement plan and checked. Where a control cannot be applied, the engagement partner MUST decide whether to proceed, change the method, or stop.

• Site visits: consultants MUST complete the client induction, sign the visitor log, wear any required protective equipment, stay with the assigned escort, and stay out of restricted areas.
• Consultants MUST NOT operate plant equipment, vehicles, or client systems unless specifically authorized in writing and trained for that task.
• Travel: the traveler MUST share an itinerary and emergency contact with the project manager. Drivers MUST NOT use a phone while driving and SHOULD stop to rest after prolonged driving or when tired.
• Fatigue: teams SHOULD limit consecutive long workdays and schedule rest after overnight travel. Anyone who is unfit to drive or work safely MUST say so and must not be pressured to continue.
• Workstations: SHOULD set screens at eye level, use a separate keyboard and mouse when working for long periods, and take short breaks away from the screen at regular intervals.
• Interviews and workshops: MUST use a second person for sensitive or hostile sessions where feasible, MUST provide a clear exit route, and MUST pause a session if a participant becomes distressed or threatened.
• Restructuring advice: MUST involve HR and employment counsel before recommending workforce reductions, and SHOULD provide information on employee assistance resources to the client.
• Competitor information: MUST NOT exchange pricing, wage, bidding, or strategic plans with competitors. Benchmarking MUST follow a protocol reviewed by counsel and MUST use aggregated or public data.
• Conflicts and gifts: MUST disclose any personal financial interest, prior relationship, or gift above the firm limit, and MUST NOT accept gifts that could influence advice.

5Equipment, Environment, Information, and Protective Safeguards

Only firm-managed laptops and phones with encryption, screen locking, and current security updates may be used for client work. Personal USB drives MUST NOT hold client data. Consultants MUST NOT install unapproved software or browser extensions on client devices, and SHOULD check that screen sharing does not expose confidential notifications. Projectors, extension leads, and client equipment MUST be inspected for damage before use, and no one should bypass a client's electrical or equipment rules. Portable equipment SHOULD be carried in a way that avoids trip hazards and strain.

Classify all material as public, internal, confidential, or restricted. Restricted and personal data MUST be stored only on approved platforms, MUST NOT be emailed to personal accounts, and MUST be minimized and redacted in slides and appendices. Use multi-factor authentication for client systems. Do not use public Wi-Fi for sensitive work unless the approved secure connection is active. Data retention and secure destruction MUST follow the engagement contract and applicable privacy law, which varies by jurisdiction.

Confirm emergency exits, first aid equipment, ventilation, and temperature in meeting rooms before long sessions. Printed client material SHOULD be minimized and shredded or collected by secure disposal services. Old devices, batteries, and storage media MUST be handed to approved e-waste or recycling channels under local rules, with data wiped or destroyed first. Badges, access cards, and lanyards MUST be worn as required and returned at engagement close.

6Incident Reporting, Emergency Response, and Escalation

Report all incidents, including near misses. An incident is any event that caused or could have caused injury, illness, loss or exposure of data, damage to property, legal exposure, or harm to a client or colleague. Report to the project manager the same working day. Report suspected information incidents to the security lead immediately, because some breach notification obligations are time-bound and jurisdiction-dependent. The project manager MUST record the incident, notify the engagement partner, and inform the client contact as the contract requires. Keep a current incident log, and do not delay reporting until a root cause is known, since early reports are more valuable than complete ones.

In an emergency, call local emergency services first, then the client's emergency contact and the firm's safety contact. Follow the client's evacuation route and move to the assembly point. Only people with current first aid training may give first aid, and an injured person MUST NOT be moved unless they are in immediate danger. If there is a threat of violence, leave the area, get to safety, and call emergency services. Do not confront the person. For data incidents, the only immediate actions are containment steps such as disconnecting a device from the network and preserving evidence. Do not attempt to investigate or delete material alone.

Escalate to the engagement partner and legal counsel when there is possible regulatory reporting, litigation, or a concern about inside information. Every traveler SHOULD carry emergency contacts, local emergency numbers, and insurance details. Hold a short blameless review after each significant incident to identify system causes and update controls.

7Records, Training, Inspection, and Review

Records make safety verifiable. The engagement file MUST include the risk assessment, site induction records, travel itineraries, data handling approvals, conflict disclosures, gift registers, incident log, and close-out notes. Retain records for the period required by firm policy, contract, and applicable law, and verify those periods with counsel.

• All staff MUST complete the firm induction covering this document, data handling, and incident reporting before client work begins.
• Role-based training MUST cover data protection, antitrust awareness, and interview conduct for staff who handle those activities.
• Mental health awareness and first aid training SHOULD be offered to project leads, and only qualified staff may provide first aid.
• Project managers MUST inspect workspaces, travel arrangements, and data handling at the start of each engagement and at periodic intervals during long engagements.

8Monitoring, Review, and Continuous Improvement

Review these norms when laws change, when a serious incident occurs, when the firm enters a new service line, or when client feedback shows a gap. Track leading indicators such as overdue actions, late incident reports, and training completion, alongside lagging indicators such as incidents and near misses. Use the results to improve controls, not to blame individuals. Each review SHOULD name the owner of each change, the deadline for it, and the method for confirming that the change worked. Local safety procedures should be approved by the firm's responsible leaders.

9Conclusion

Safe consulting depends on disciplined planning, clear competence limits, strong information handling, and prompt reporting. These norms are a foundation for locally approved procedures and should be adapted with qualified legal, security, and safety advice. Every team member shares responsibility for speaking up when a control is missing or an activity has moved beyond the agreed scope.

Implementation checklist

• Confirm the engagement risk assessment is approved before field work starts.
• Complete client site induction and wear all required protective items.
• Share itinerary and emergency contacts with the project manager before travel.
• Use only firm-managed, encrypted devices and approved platforms for client data.
• Classify materials and minimize personal data in slides and appendices.
• Disclose conflicts of interest and log all gifts before accepting them.
• Avoid any exchange of competitor pricing, wage, or strategic information.
• Refer legal, tax, engineering, or safety-critical questions to qualified professionals.
• Report incidents and near misses the same working day, and suspected data incidents immediately.
• Record decisions, assumptions, and open actions in the engagement file.