C4.4 Design gate

NIOSH PtD [10]; BCBS PSMOR principle 7 [17]

The fourth component requires that no new product, process, system or material change go live before a review has asked whether the hazard it introduces can be eliminated or substituted rather than administered, and has recorded the answer. The idea comes from prevention through design [10], the safety profession's observation that the moment a process is drawn is the only moment at which elimination is cheap; the regulatory expectation comes from principle 7 of the operational-risk principles [17], which requires that change be risk-assessed before implementation. Together they make a gate that both an engineer and a supervisor recognize.

What the gate reconciles is a sequence that almost every organization runs backward. A new product is designed by the business, approved by a committee that reads a risk assessment written after the design was fixed, and controlled afterward by whatever can still be bolted on, which is always administrative. The gate moves the hierarchy question to the front. Its record is a short document: the hazards the change introduces, the level at which each is controlled, the reason elimination or substitution was not chosen where it was not, and the signature of the person who accepted the design. That document is the control object's design-gate record, and it is what the auditor reads two years later when asking why the process relies on a callback.