A critical control verification checklist is a short, control-specific set of field checks that tests whether a critical control is actually meeting its performance requirement at a named location, right now, and records who checked it, what they found and what happens if it fails. It is not a general workplace inspection. Every question traces back to one control, one performance standard and one owner.
This guide explains where critical control verification (CCV) in mining comes from, what Queensland and NSW law now say about critical controls, who should verify and how often, and gives worked checklists for three common open cut controls: windrows, energy isolation and exclusion zones. It finishes with the ways CCV programs quietly stop working.
Why verification is the part that matters
Most sites have the bowties, the material unwanted events (MUEs) and the named critical controls. The gap is in the field: nobody can say, on a given shift, whether those controls are in the condition the bowtie assumes.
The ICMM guide points to evidence from major incidents that, although the risks were known, the controls were not always effectively implemented. It also warns that the absence of incidents must not be taken as evidence that controls are working, because redundancy means one control can fail without anything happening. Verification is how you find the failed control before the second one goes.
We cover the wider pattern of controls that exist on paper but not on the ground in why critical controls fail and how real-time visibility fixes it.
What the law and the guidance say
Queensland
Critical controls are now written into the Queensland Acts. Under the Coal Mining Safety and Health Act 1999:
- Section 62(5) requires the safety and health management system to be adequate and effective by, among other things, identifying critical controls and containing a way of measuring, monitoring and evaluating the system’s performance.
- Section 63(1)(c) requires every principal hazard management plan to include critical controls.
- Schedule 3 defines a critical control as a risk control measure critical to preventing a material unwanted event, or mitigating its consequences, whose absence or failure would significantly increase risk despite the other controls. A material unwanted event is one whose potential or real consequence exceeds a threshold the operator defines as warranting the highest level of attention.
These definitions were inserted by the Resources Safety and Health Legislation Amendment Act 2024, and the Mining and Quarrying Safety and Health Act 1999 carries the same definition and a matching requirement for the safety and health management system to identify critical controls. The Acts say controls must be identified and system performance measured and monitored. They do not prescribe a verification checklist format, frequency or form, which is left to the site’s own system.
New South Wales
The NSW Resources Regulator’s planned assessment programs are built around critical controls: the regulator uses a bowtie framework and a standardised assessment checklist to assess how operators manage the critical controls that prevent MUEs. Its guide to preparing a principal hazard management plan (September 2022) is guidance rather than law, but it is direct. It says control checklists should be compiled so a site can validate that a control has been properly implemented and is functioning as designed, and that those checks must be carried out often enough to show the controls remain effective. It also points operators to the ICMM process.
The ICMM approach
The reference is the ICMM Health and Safety Critical Control Management Good Practice Guide (April 2015). Its nine steps run from planning the process and identifying MUEs through to responding to inadequate critical control performance. Step 5 defines each control’s objective, performance requirements and how performance is verified. Step 6 assigns owners. Step 8 carries out verification and reports it, using a traffic light view and acting when performance drops below a defined trigger. ICMM defines verification as checking the extent to which the performance requirements set for a critical control are being met in practice.
For how critical controls sit inside the plan itself, see our guide to the principal hazard management plan.
What every critical control verification checklist needs
A CCV checklist is short by design, and each question is anchored to something that can be observed or measured.
- The control and its MUE. Named exactly as in the bowtie, so the result rolls up to the right place.
- The performance requirement. A number or an observable state, not “adequate”. “Windrow at least half the tyre diameter of the largest truck” is verifiable. “Windrow in good condition” is not.
- The location. Which road section, which plant item, which exclusion zone. A control verified “somewhere on site” tells the owner nothing.
- Evidence. A photo, a measurement or a reading attached to the answer, so a reviewer can see what the verifier saw.
- The trigger and response. What result counts as a failure, and what the verifier must do immediately: stop the task, barricade, escalate to the control owner.
- Sign-off. Who verified it, when, and who reviewed it.
The common trap is checking paperwork instead of the control. “Is the isolation procedure current?” checks a document. “Was zero energy proven before work started?” checks the control.
Who verifies, and how often
ICMM describes three roles. The MUE owner is a senior line manager responsible for the operation. The critical control owner is a line manager who monitors the health of the control by reviewing verification reports. The verification activity owner carries out the check and reports the outcome. In ICMM’s worked example, activity owners report weekly to the control owner and control owners report monthly to the MUE owner, but the guide flags that timeline as an example only.
Frequency should follow how fast the control can degrade. A windrow on an active haul road can be cut down by a grader in one pass, so it warrants frequent checks; a fixed engineered barrier can be verified less often. Set the frequency in the control’s performance definition, then confirm the records show it being met.
Worked example 1: haul road windrows
MUE: vehicle leaves the road edge and falls or rolls. Control: roadside safety berm (windrow) along edges with a drop. In Queensland coal, Recognised Standard 19 (August 2019), a recognised standard under the Coal Mining Safety and Health Act, sets standard trapezoidal berms at a minimum height of 50 per cent of the tyre diameter of the largest vehicle regularly using the road, and triangular berms at 66 per cent. Use your own road design specification as the performance requirement, and see our guide to mine road safety berms for the detail.
| Check | What good looks like | Escalate if |
|---|---|---|
| Design basis | The largest vehicle now regularly using the road is the one the berm height was designed for | A larger truck class is now using the road |
| Berm height at the checked section | Measured and at or above the specified height for the largest vehicle using the road | Any point below the specified height |
| Continuity | No gaps except designed drainage breakthroughs | Gaps, washouts or a missing section along a drop |
| Profile and material | Designed profile held, compacted, not slumped | Slumping, erosion or loose material that would not stop a truck |
| Recent road work | Grading or widening has not cut the berm down | Berm reduced during maintenance and not reinstated |
| Evidence | Photo with measuring staff against the berm | No measurement taken |
Worked example 2: energy isolation
MUE: unplanned release of energy during maintenance. Control: positive isolation with proof of zero energy. In Queensland coal, section 78 of the Coal Mining Safety and Health Regulation 2017 requires a standard operating procedure for positively isolating the energy source, testing for zero potential where an electrical or mechanical source is isolated, and letting each person whose safety is directly affected personally control the plant’s return to operation by attaching a danger tag or lock. Our isolation verification checklist covers the full isolation walk; the CCV version below is the short test of whether the control held.
| Check | What good looks like | Escalate if |
|---|---|---|
| Isolation points | Every energy source on the isolation list is isolated at the marked isolation device | A source missed, or isolated at the wrong point |
| Stored energy | Hydraulic, pneumatic, gravity and spring energy released or restrained | Stored energy still present |
| Proof of zero energy | Test for dead or try start done and witnessed before work began | No test, or test done after work started |
| Personal locks and tags | Every person working on the plant has their own lock or danger tag applied | Anyone working without personal control |
| Out-of-service status | Plant tagged out of service and status clear to operators | Plant could be started by someone unaware |
Worked example 3: exclusion zones
MUE: person or vehicle struck by falling rock, a failing wall or blast effects. Control: an exclusion zone that keeps people out of the hazard area. The performance requirement is the zone defined in the site’s geotechnical or blast management plan, and the verification is simple: is the zone where the plan says it is, and is anyone inside it? For wall-specific checks, see the highwall inspection checklist.
| Check | What good looks like | Escalate if |
|---|---|---|
| Zone boundary | Physically delineated where the current plan shows it | Boundary moved, knocked down or in the wrong place |
| Access points | Every entry blocked or controlled, signs at each | An open road or track into the zone |
| Occupancy | No people or plant inside without authorisation | Anyone inside the zone |
| Currency | Zone matches the latest TARP level or blast plan | Conditions changed but the zone did not |
| Awareness | Crews working nearby can say where the zone is | A crew unaware of the zone |
When a geotechnical TARP level rises, the zone should change with it. Our guide to the digital TARP covers that link.
Tie verification to the control, the location and the owner
A verification result is only useful with three things attached. The control, so the result rolls up to the right MUE. The location, because “windrow compliant” without a place is not information. And the owner, because ICMM’s model depends on a named person reviewing results and acting.
Lose any one and the program becomes a count of completed forms, where nobody notices the same ramp failed three times.
Where CCV programs go wrong
- Tick boxes without a standard. “Windrow OK” with no measurement proves nothing. Every answer should be tested against the stated requirement.
- Too many critical controls. ICMM is explicit that procedures, rules, training, supervision, maintenance and other plans are not controls. Inflated lists produce verification nobody can keep up with.
- Failures that go nowhere. A failed check nobody reviews until month end.
- Generic checklists. One form for every control hides the specific failure. We cover this in why general checklists create a false sense of safety.
Managing verification day to day
The problem is rarely the checklist. It is that results live in forms, spreadsheets and inboxes, detached from the control, the place and the owner, so the control owner must reassemble the picture before acting.
In HazView, the site’s own verification checklist can be attached to the specific hazard it protects against on the mine map, or pinned to a location, so the windrow check sits on the ramp it verified and the next person can see its history. The control on that hazard carries an accountable owner, a due date and a status of Compliant, Non-Compliant or Ongoing, so the control owner reads the state of the control rather than a pile of forms. A failed answer can open an escalation section, photos sit against the question they prove, and the check can be done offline in the pit and sync when back in reception. See how HazView supports managers who own critical controls, or book a demo to see it on your own controls.
For where CCV fits among every other statutory and site inspection, read our guide to mine site inspections in Australia.
Critical control verification at a glance
| Element | What good looks like | Red flag |
|---|---|---|
| Control definition | Named control, linked to a named MUE | Controls that are really plans or training |
| Performance requirement | Measurable or observable standard | “Adequate”, “in good condition” |
| Location | Specific road section, plant item or zone | “Site wide” |
| Owners | MUE owner, control owner and verifier named | Owned by “the safety team” |
| Frequency | Set by how fast the control degrades, and met | Frequency undefined or running behind |
| Trigger and response | Failure threshold and immediate action defined | Failures recorded but not acted on |
Related guides
- Mine Site Inspections in Australia: What the Law Requires, What to Check and What a Defensible Record Looks Like
- Digital TARPs: From Laminated Card to Live Trigger
- Tyre and Rim Inspection Checklist for Mining Equipment
- Shotfirer Pre-Blast Area Inspection Checklist
- All Inspections & Checklists guides
Frequently asked questions
What is the difference between a critical control verification and an inspection?
An inspection looks broadly at an area for any hazard. A critical control verification tests one named control against its performance requirement and reports to that control’s owner. Both are needed.
Is critical control verification a legal requirement in Queensland?
The Queensland Acts require the safety and health management system to identify critical controls, require principal hazard management plans to include them, and require a way of measuring and monitoring system performance. They do not prescribe a CCV checklist format or frequency. How you verify is set by your own system, and it has to be adequate and effective.
Who should complete a critical control verification checklist?
A competent person assigned as the verification activity owner, often a supervisor, examiner or engineer close to the work, reporting to the critical control owner.
How many critical controls should a site verify?
Only the genuine critical controls for each MUE. If verification cannot keep pace, re-screen the list against the definition: crucial to preventing or mitigating the event, with risk rising significantly if it is absent.
What should happen when a verification fails?
The immediate response defined for that control, such as stopping the task, barricading or withdrawing people, then notifying the control owner. Under ICMM Step 9, an underperforming control is investigated and action taken to improve it, and repeat failures should prompt a review of the control’s design.