For officers, boards and safety leaders
Due diligence and the ledger.
The pages on this site show the record working. This page sets out the argument behind it: why health and safety due diligence has never had books to be read, what a ledger for operational risk would look like, and why a risk score cannot stand in for one.
The argument, in brief
- Every other officer duty, from solvency to tax to emissions, is discharged from records kept in the course of the work. Health and safety is the only one without them.
- Courts and guidance now ask officers how they know, not what they believe.
- A sample can test a ledger. It cannot be one.
- The answer is a record written as the work is done, booked against the standard it was performed to, owned by operations and read by safety: an operational ledger.
Kept to run the work. Read by many. Due diligence falls out of it.
The argument, in full.
Published 21 October 2026 · New Zealand Journal of Health and Safety Practice · Peer reviewed
Due diligence – health and safety: a performance review, and what next?
Michael Boyle, Risk Mentor
Health and safety is the only officer duty not discharged from records kept during the work. The paper reviews how due diligence has performed since it arrived in health and safety, tests it against case law and regulator guidance, and benchmarks it against finance, where directors have signed accounts on top of a ledger for a century.
Its answer is operational, not safety-specific: capture task planning and execution as the work happens, book each task against the specification it was performed to, and let discrepancies surface from the record itself. The officer’s duty can then be shown from the same record. The NZ electricity distribution page shows that record working on a network.
Four findings
- Officers are expected to show how they know controls work, not just believe they do.
- Health and safety borrowed finance’s intent and vocabulary, but not its foundations: the ledger.
- The fix sits with operations, not the safety function. The missing piece is operational records built from field data.
- Verification alone is not enough. The work has to leave a record of itself as it is done.
What an operational ledger must deliver
Ten minimum characteristics. Each is an exclusion test: it identifies what is not a ledger, however good. Three of them are about the people writing it.
What an entry must be
- Produced while doing the work: contemporaneity and authorship together
- Carries its own derivation: who, when, where, under what conditions, against which version of the standard
- Cannot be re-authored on the way up
What the record must do
- Links to operational standards: every entry traces to a requirement
- Absence is itself a signal: the record shows what should have been done and was not
- Reconcilable against independent records
- Carries energy and conditions status in the workflow as the task proceeds
Who it must serve
- Designed to support the field: if it does not help the person doing the work, it competes with the transaction and loses
- Serves many functions and inquiries beyond the immediate management outcome
- The reading returns to the author: a record that pays nothing back results in malicious compliance
Every other duty an officer holds is discharged from the books. Where are the books for this one?
A risk score tells you how a workshop felt. It doesn’t tell you what the crew did.
Most risk registers rank each hazard on a five-by-five matrix, add controls, then rank it again. The scores feel precise, but they aren’t measurements. Three reasons, then what we do instead.
The question is not how high the risk scored. It is which controls must hold, and whether they did.
See the record working: NZ electricity distribution · Mining & resources · Talk to us