Safety Norms: Project and Program Management

1Purpose, Scope, and Safety Principles

These norms apply to anyone who sponsors, plans, directs, or controls projects or programs, including sponsors, project managers, program managers, team leads, schedulers, and coordinators. They apply whether work takes place in offices, client sites, plants, data centers, field locations, or remotely. Safety in this context means preventing harm to people, damage to property and the environment, exposure of protected information, and legal breaches caused by project decisions.

Where a project involves construction, engineering, hazardous materials, healthcare, transport, finance, or cybersecurity, this is educational guidance. It does not replace professional authorization, formal training, approved procedures, supervision, or emergency services.

• Mandatory: every project records a named safety owner in the project charter before work starts.
• Mandatory: safety requirements from contracts, site rules, and applicable law are written into the project plan.
• Recommended: treat schedule pressure as a documented risk that is reviewed, not absorbed silently.
• Principle: stop work and escalate when a hazard cannot be controlled with the competence and authority available.

2Roles, Competence, and Accountability

Accountability sits with the sponsor and the program or project manager, but every team member has a duty to report hazards they see. Specialist tasks such as electrical, structural, medical, chemical, or hazardous waste work must be performed by people holding the qualifications required by the employer, site owner, or competent authority. Project staff must not be assigned to such tasks simply because they are available.

Competence is confirmed, not assumed. Records should show what each person is authorized to do and when that authorization was last verified.

• Sponsor: approves the safety owner, funds required controls, and resolves conflicts between schedule and safety.
• Project or program manager: maintains the hazard register, confirms contractor competence, and holds safety reviews at each phase gate.
• Team leads and specialists: perform tasks within their documented authorization and report unsafe conditions immediately.
• Procurement and contract staff: verify that suppliers hold required insurance, licenses, and safety records before mobilization.
• Mandatory: no one directs a person to perform work outside their documented competence.

3Course-Specific Hazards and Risk Assessment

Project hazards are often indirect. Realistic examples include site visits to active construction or industrial areas, travel to unfamiliar locations, long hours that cause fatigue, poor workstation ergonomics, chronic stress from overload, and exposure of personal or commercial data. Program-level decisions such as deferring maintenance, approving a design change, or accelerating a commissioning date can create physical hazards far from the project office.

Risk is assessed by combining likelihood and severity and rating the result as low, medium, high, or critical. Each hazard has a named owner. Assessments are reviewed at every phase gate and whenever scope, location, or personnel change.

• Site visit to a live work area: high. Requires site induction, escort, and compliance with permits.
• Overnight travel to an unfamiliar region: medium. Requires a travel plan, check-in schedule, and local emergency contacts.
• Prolonged screen work: medium. Requires a workstation assessment and scheduled breaks.
• Deadline pressure that skips reviews: high. Requires independent gate review and written sign-off.
• Handling confidential client, employee, or financial data: high. Requires access controls and classification labels.
• Shared site work with vendors: high. Requires a written interface agreement and a joint hazard briefing.
• Change requests affecting safety-critical or regulated systems: critical. Requires specialist review before approval.

4Preventive Controls and Safe Work Practices

Controls should follow a clear order: eliminate the hazard where possible, substitute a safer method, apply engineering or administrative controls, and rely on personal protective equipment last. Project managers mainly control risk through scheduling, approval gates, briefings, and contract terms. These controls must be specific, written, and enforced.

Stop conditions must be stated in writing before work begins. Examples include a missing isolation, an unqualified person assigned to a task, an unresolved test failure, or a weather limit named in the site plan. Anyone may call a stop, and the project manager must review the stop before work resumes. Schedule recovery is never a valid reason to bypass a stop.

• Mandatory: before any site visit, confirm the site induction, PPE list, and emergency assembly point with the site host.
• Mandatory: do not enter an active construction, plant, or laboratory area unless accompanied by a person authorized for that area.
• Mandatory: permits to work, lockout and tagging, and isolations required by site rules must be obtained by the authorized person. Project staff must never bypass them to meet a milestone.
• Mandatory: project plans for physical work name the qualified contractor and define inspection points before handover.
• Mandatory: changes affecting safety-critical systems go through documented change control with specialist sign-off.
• Mandatory: no staff member is asked to perform safety-critical tasks while fatigued. Any exception to approved working hours requires a documented risk review.
• Mandatory: no one uses a handheld phone while driving on project business. Drivers follow employer policy and local road rules.
• Recommended: hold a five-minute pre-task briefing covering hazards, roles, and stop conditions.
• Recommended: schedule breaks from screen work at intervals set by local occupational health guidance.
• Recommended: build schedule buffers around critical activities that have safety dependencies.

5Equipment, Environment, Information, and Protective Safeguards

Project managers rarely operate heavy equipment, but they depend on tools, test environments, and information systems. Keep an inventory of equipment issued to the team, such as ladders, test devices, and portable power units, with inspection tags and dates of last check recorded. Confirm that contractor equipment carries current inspection evidence as required by site rules and the manufacturer instructions.

Information safeguards are equally important. Project records often contain personal data, commercial terms, and security-sensitive plans for facilities. Classification and access control must be applied from the first document created.

• Classify project documents as public, internal, confidential, or restricted. Store restricted files only in approved repositories.
• Limit personal data access by role and remove access when a person changes assignment or leaves.
• Verify privacy and records obligations under applicable data protection and records laws, which vary by jurisdiction.
• Require multi-factor authentication on project tools. Never share credentials, and report phishing that targets schedules or payment changes.
• Include waste, spill, and hazardous material handling in site plans. Use licensed carriers for disposal as required by local law.
• Provide adjustable seating, monitor height adjustment, and adequate lighting at workstations, and record the assessment.
• Site-specific PPE, such as hard hats, high-visibility clothing, safety footwear, and hearing protection, is selected by the site safety authority. The project office must not substitute its own choices.

6Incident Reporting, Emergency Response, and Escalation

Every injury, illness, near miss, property damage event, environmental release, data breach, and security incident must be reported within the timeframe set by the employer and applicable rules. Reporting must not depend on whether harm occurred. Near misses are early warnings and should be treated with the same seriousness as actual losses. Never delay an emergency call to complete paperwork.

Each project location and travel destination needs a current emergency contact list, nearest medical facility information, and an assembly point. These are confirmed before work or travel begins and reviewed after any change in site conditions.

• Immediate life threat: call the local emergency number first. Do not move an injured person unless there is immediate danger and trained responders advise it.
• Report all incidents to the site supervisor and the project safety owner within the same shift.
• Data breach or suspected intrusion: notify the information security team immediately. Do not delete or alter logs. Follow legal notification duties with counsel.
• Spill or release: stop the source only if trained and safe to do so, evacuate the area, and contact the hazardous materials responder named in the site plan.
• Escalate to the sponsor when a safety control has failed and the schedule, budget, or legal exposure is significant.
• Post-incident reviews focus on system causes rather than individual blame. Corrective actions are assigned, dated, and tracked to closure.

7Records, Training, Inspection, and Review

Records show that controls were planned and followed. Keep the hazard register, risk assessments, induction records, competence confirmations, permit references, incident logs, and inspection results in the project repository with version control. Retention periods are set by contract and law, and must be verified locally.

Training and review are continuous. A norm that is not practiced by the team is not an effective control, so inspection and feedback are part of routine project governance.

• All team members complete site safety induction, information security awareness, and role-specific training before assignment.
• Confirm contractor licenses and certificates with issuing bodies where the law or contract requires it.
• Carry out periodic safety walk-throughs of field locations and track findings to closure.
• Hold a safety review at every phase gate and after any major change in scope, location, or personnel.
• Track incidents, near misses, overdue actions, and training completion. Do not use these figures to punish reporting.
• Feed lessons learned into organizational templates and planning checklists.

8Conclusion and Local Adoption

These norms are a starting point. Each organization must adapt them to its own sites, contracts, risk tolerance, and legal obligations. Where a local rule is stricter than this guidance, the stricter rule governs. Where this guidance conflicts with an approved procedure, the approved procedure governs.

Safe project and program management depends on leaders who treat safety as part of scope, schedule, and budget decisions. Document decisions, verify competence, and stop when controls are missing.

Implementation checklist

• Confirm the named safety owner and record the role in the project charter.
• Complete a risk assessment for each phase and record a named owner for every hazard.
• Verify contractor competence, licenses, and insurance before site access is granted.
• Brief every person before site visits on hazards, PPE, permits, and stop conditions.
• Confirm travel check-in times and local emergency contacts before departure.
• Classify project information and restrict access to users with a documented need.
• Route all safety-critical changes through specialist review before approval.
• Report incidents, near misses, and data breaches within the required timeframes.
• Hold a safety review at each phase gate and track every action to closure.
• Verify current laws, standards, and manufacturer instructions with competent authorities.