Stop Work Authority: Building a No-Blame Program

Every high-risk operator talks about Stop Work Authority. Far fewer can show you the trend line of SWA events, the median time from stop to resolution, or the leading-indicator value the program generates each quarter. SWA is easy to announce and hard to run well.

This guide is the 2026 playbook for building (or rebuilding) a Stop Work Authority program that workers actually use, supervisors don't punish, and management can defend in front of regulators and boards.

In plain terms: Stop Work Authority (SWA), also called a stop work policy, is the right and expectation that anyone on a site can stop unsafe work, at once, without asking permission and without being penalised for it. The rest of this guide covers where that is law, how to build it, and what to record.

What Stop Work Authority actually is

Stop Work Authority is a formal, employer-granted right for any worker — employee or contractor, at any level — to halt a task they believe is unsafe, without needing permission first and without fear of reprisal. It is not a suggestion channel and it is not an escalation path. The authority to stop is the whole point: the work stops when the worker says stop, and the conversation about whether they were right happens afterwards.

Many people meet the term as a poster. It is better understood as three commitments the organisation makes in advance:

• Anyone can stop. Not just supervisors, not just the permit holder, not just employees. The newest contractor on their first shift has the same authority as the site manager.
• No permission is needed. A stop that has to be cleared by someone senior before it takes effect is not Stop Work Authority. It is a request.
• No reprisal, including for being wrong. A worker who stops in good faith and turns out to be mistaken must be thanked, visibly. The moment a mistaken stop costs someone anything, every future stop is a calculation rather than a reflex.

Stop Work Authority is not the legal right to refuse unsafe work

These are routinely conflated, and the difference is the reason SWA exists at all.

In the United States, the protection for refusing dangerous work sits in 29 CFR 1977.12 under the OSH Act, and it is deliberately narrow. OSHA's position is that the Act gives employees no general right to walk off a job over potentially unsafe conditions. The protection applies where the worker refuses in good faith, where a reasonable person in the worker's position would conclude there is a real danger of death or serious injury, where there is not enough time to resolve it through normal enforcement channels, where the worker has no reasonable alternative, and where, if possible, they have already asked the employer to fix the condition and been refused.

Read those conditions as a worker standing at a live task. They describe an emergency, judged after the fact, with a burden of proof. They do not describe the ordinary case that SWA is designed for: something looks wrong, nobody is certain yet, and the cheapest moment to find out is now.

For most employers, Stop Work Authority is a voluntary programme built on top of that legal floor. It lowers the threshold from imminent danger to reasonable doubt, removes the burden of being right, and makes stopping the default rather than the exception. That is why it is a programme and not a policy line: the legal minimum applies anyway, and everything of value in SWA is what the organisation adds above it.

Where stop work authority is itself a legal requirement

A few rules go further and require stop work authority, or something close to it, in their own right. In the United States:

• Offshore oil, gas and sulphur operations. The Bureau of Safety and Environmental Enforcement's safety and environmental management systems (SEMS) rule, 30 CFR 250.1930, requires SWA procedures that grant all personnel the responsibility and authority, without fear of reprisal, to stop work or decline an assigned task when an imminent risk or danger exists. Work may resume when the person on the facility with ultimate work authority determines that the danger does not exist or no longer exists, and that decision must be documented in writing as soon as practicable.
• Department of Energy contractor workplaces. 10 CFR 851.20 requires procedures that permit workers to stop work or decline a task they reasonably believe poses an imminent risk of death, serious physical harm or other serious hazard, where they believe there is not enough time to use normal hazard reporting and abatement procedures, and gives workers the right, without reprisal, to stop work when they discover exposures to imminently dangerous conditions or other serious hazards.
• Program 3 chemical processes under the EPA Risk Management Program. 40 CFR 68.83(d), added in 2024, requires owners or operators to give employees knowledgeable in the process the authority to recommend a shutdown to the operator in charge, and a qualified operator in charge the authority to shut down, based on the potential for a catastrophic release. Compliance is due by 10 May 2027. The EPA proposed on 24 February 2026 to rescind the provision, with the stated aim of realigning it with the OSHA PSM standard. The comment period was extended to 11 May 2026, and the Federal Register listed no final rule as of 4 October 2026, so the requirement and the 2027 date stand until a final rule says otherwise.

In Great Britain, regulation 8 of the Management of Health and Safety at Work Regulations 1999 requires procedures that enable people exposed to serious, imminent and unavoidable danger to stop work and go immediately to a place of safety, and that prevent them resuming work while serious and imminent danger remains, save in exceptional cases. Article 8 of the EU Framework Directive 89/391/EEC sets a closely similar duty for employers across the EU, applied through national law. Both are narrower than a site-wide stop work programme, which remains a practice built above them. Our stop work authority software guide sets out each provision, its threshold and what it says about restarting.

The adjacent terms

• Right to refuse unsafe work — the statutory floor described above. Narrow, jurisdiction-specific, and judged after the fact.
• Stop work obligation — used by some operators, notably in oil and gas, to make stopping a duty rather than a right. Offshore, the SEMS rule itself speaks of responsibility as well as authority. Stronger on paper; only as strong as the reporting culture underneath it in practice.
• STOP (Safety Training Observation Program) — a workplace safety training programme that builds observation and communication skills, so supervisors can discuss safe and unsafe work practices. It is about observing and talking. SWA is the authority to halt work. An observation can end in a stop, but a stop does not need an observation.
• Time out for safety, Take 5, SLAM — short pause-and-check routines at the task level. Useful, and often confused with SWA, but they pause a task rather than grant authority to halt work.

If your programme document does not distinguish these, expect the confusion to surface at the worst moment: a worker who thinks they are protected by law, a supervisor who thinks a stop needs approving, and an investigation that discovers the difference afterwards.

Source: 29 CFR 1977.12, OSHA, Workers' Right to Refuse Dangerous Work and the provisions linked above. Paraphrased, not quoted. Outside the United States, Great Britain and the EU the statutory floor differs, so check your own jurisdiction before reusing this wording.

Why SWA programs fail

Common failure modes include:

• Soft stop. Workers raise concerns informally instead of triggering the program, because they have seen colleagues penalised for "halting production".
• Manager push-back. Front-line supervisors interpret SWA as a challenge to their authority and create friction.
• Logging gap. Stops happen but are never recorded, so the data needed to redesign the work is invisible.
• Blame culture. Investigations focus on whether the stop was "justified" instead of on the hazard that triggered it; the glossary entry on just culture describes the alternative.
• No closure. Crews are told "thanks, get back to work" without any documented control change.

A defensible program closes every one of these gaps deliberately.

The 4 pillars of Stop Work Authority

A working SWA program rests on four pillars. If any of them is missing, the program degrades.

1. Authority

Every worker — employee, contractor, visitor — has unconditional authority to stop any work they believe is unsafe. No prior approval required. No tier limit. No "qualified person only" carve-out.

2. Training

Every worker is trained on how to trigger a stop (verbal, radio, mobile app), what happens next, and what is expected of them during the investigation. We suggest a refresher every 12 months and on any change of role or site. Offshore, the SEMS rule requires training on SWA procedures in the orientation of all new personnel and a review of those procedures at all meetings focusing on safety (30 CFR 250.1930(e)). The same section requires SWA procedures and expectations to appear as a standard statement in every job safety analysis (paragraph (d)), which is a cheap way to put the authority in front of the crew at the moment the task is planned; see the job safety analysis software page and the JSA glossary entry.

3. No retaliation

Documented, named consequence framework for any supervisor or manager who pressures, punishes or penalises a worker for triggering SWA, including informal pressure. Our article on building safety culture with technology covers the wider culture questions, and the safety culture assessment page covers ways to measure it.

4. Documentation

Every stop is recorded — trigger, work activity, hazard, investigation, control change, follow-up training, sharing. No paper, no SWA. If it's not in the system, it didn't happen.

A one-page SWA policy template

A policy is only useful if it can be read at a toolbox talk. A one-pager, printed at every site entry and included in induction, is short enough for that. The time limits in this template are our suggestions; set your own.

Stop Work Authority — [Company name]

Every person working on any [Company] site has the unconditional authority and the personal responsibility to stop any task, equipment or operation they believe to be unsafe, environmentally damaging, or non-compliant.

How to trigger a stop. Verbally say "Stop Work", call it on the radio, or trigger it in the [App name] app. Use plain language.

What happens next.

1. Work stops immediately. Equipment is made safe.
2. The person triggering, the work-party supervisor and the area HSE rep gather at the location.
3. The hazard is assessed. The work is modified, controls are added, or the work is abandoned.
4. The stop is logged in [System name] within 24 hours including hazard, decision and follow-up actions.
5. The learning is shared with all affected crews within 7 days.

No retaliation. No person will be disciplined or disadvantaged for triggering Stop Work Authority. Pressuring, mocking or penalising a worker for using SWA is a Cardinal Rule violation and will be treated as such.

Signed: [CEO name] Date: [yyyy-mm-dd]

A worked example: one stop, from trigger to closure

The scenario is invented to show what a complete record looks like. A contractor rigger on a night shift sees that a lifting sling has been moved from the tagged-out store to a live lift and calls "Stop Work". The table shows the entries a reviewer should be able to find afterwards.

Notice that the rigger is not asked to justify the call. The hazard is the subject of the record, and the first line of the investigation is the control that failed, in line with the hierarchy of controls rather than the worker's judgement. A stop of this kind is also worth reading alongside near-miss data: if it would have been a near miss, the question is whether the near-miss route was ever used.

Stop work authority examples by sector

The four examples below are invented to show what a stop looks like in different workplaces. None describes a real event.

• Warehouse. A forklift operator sees a pedestrian walkway blocked by stacked pallets in a live aisle and stops the aisle. Traffic is held, the pallets are cleared, and the walkway marking is added to the daily check.
• Construction. A labourer notices that a scaffold lift has no handrail on one side before a pour. The crew stops, the scaffold contractor is called, and work resumes only after the scaffold is signed off again.
• Oil and gas facility. A technician finds that a permit shows a different isolation point from the one on the tag at the valve. The job is stopped until the permit issuer and the technician agree which one is correct, and the mismatch is recorded.
• Food manufacturing. A line operator sees a guard that has been taken off a packaging machine for cleaning and not replaced. The line is stopped and locked, the guard is restored, and the cleaning procedure is changed so the guard step is explicit.

In each case the person who stops is not asked to prove they were right, and the record asks what the hazard was, not who raised it.

Trigger and resolution workflow

The execution workflow has five steps. Software should drive every one of them.

1. Stop. Work halts. Equipment is made safe (isolation, depressurisation, lay down).
2. Notify. Mobile app or radio notification to supervisor, HSE rep and (for high-consequence stops) site manager.
3. Investigate. Joint walk-down by triggering worker, supervisor, HSE rep. Hazard identified. Photo and short narrative captured on mobile.
4. Resume, modify or abandon. Documented decision. If resumed, a control change is required.
5. Share. Lesson packaged and distributed to all crews on similar work within 7 days (our suggested limit). Closed with a documented action.

Leading KPIs for SWA

Lagging indicators (TRIR, LTIR, fatalities) tell you about the past. SWA generates leading indicators that tell you about the next month.

We know of no regulator or standards body that publishes benchmarks for these measures, so the targets in the table are our own examples, not industry figures. Set yours from your own baseline.

Software automation — what to wire up

A digital SWA workflow turns the program from a poster into a measurable control.

• Mobile trigger form. One-tap stop with photo, location auto-capture, work-party tag.
• Escalation tree. Auto-notify the supervisor and, for high-consequence stops, the site manager, within limits you set (for example, 5 minutes and 30 minutes).
• CAPA loop. Required corrective action linked to the stop, with owner and due date, blocking closure until done.
• Sharing engine. Lesson published to a crew-facing feed with multilingual support.
• Scorecards. Site-level SWA dashboard updated daily — events, resolution time, sharing closure, retaliation reports.
• Audit trail. Immutable history of every stop for regulator, client or board scrutiny.

Questions to ask a software vendor about SWA

The pages on this site describe what each product record documents; they do not rank products, and a stop work workflow can be built from the generic forms and actions of many systems. Ask each vendor the same questions and keep the answers dated:

1. Does a stop have its own record type, or is it logged as an incident, an observation or a generic form? What fields are mandatory?
2. Can a person without a full licence (a contractor, a visitor, a guest) trigger a stop, and what do they see afterwards?
3. Can a stop be raised without a network connection and synchronised later? The offline support article explains how this site classifies offline claims.
4. Does an open stop block the linked permit or task, or is that done by hand?
5. Can a corrective action be required before a stop is closed, and who can override that?
6. Can reports be filtered by contractor, site, shift and hazard type without exporting?
7. Is there a way to flag and review a report of retaliation separately from the stop it relates to?

The capability map shows which capabilities the researched profiles document and which they do not; the demo checklist turns questions like these into a script for a live session.

Integration with adjacent systems

SWA does not live alone. It earns its keep when it connects to the rest of the safety stack.

• Permit-to-work — a stop on permitted work auto-suspends the permit and routes back to the issuing authority. See our permit-to-work software guide.
• Contractor management — contractor SWA events feed the contractor scorecard and renewal decision. See our contractor management software 2026 guide.
• Incident management — stops that uncover a recordable hazard auto-spawn an incident with the SWA event as the source. See our incident management software.
• Behavior-based safety — SWA triggers are a primary input to the BBS program observation database.
• ISO 45001 — for an organisation certified to this voluntary standard, SWA records can support the evidence it presents under clause 5.4 (Consultation and participation of workers) and clause 8.1 (Operational planning and control). The standard's text is sold rather than published, so we cite only its clause headings, as the contents of ISO's own handbook list them; check what your certification body expects.

Failure modes to design against

• The "soft stop" trap. Workers raise concerns informally because formal stops feel risky. Counter by celebrating named stops monthly with leadership.
• Manager push-back. Counter with named consequence and visible enforcement of the no-retaliation pillar.
• Logging gap. Counter by making the trigger easier than not triggering — one-tap mobile, voice-to-text narrative.
• Closure theatre. Counter by requiring a documented control change before any high-consequence stop can be closed.
• Quarterly KPI starvation. Counter by reporting SWA KPIs on the same dashboard as TRIR, weekly, to the same executives.

30-60-90 day rollout

Days 1–30 — Foundation.

• Executive sign-off on the one-page policy and the no-retaliation pillar.
• Software workflow configured, including escalation tree and KPI dashboard.
• Site list, languages, supervisor cohort identified.

Days 31–60 — Train and pilot.

• All workers trained in their language, including contractors.
• Pilot at two sites with daily executive review of every stop.
• Tune the escalation tree and the sharing template.

Days 61–90 — Scale and audit.

• Full multi-site rollout.
• Monthly leadership review of SWA KPIs alongside lagging indicators.
• Independent audit of the no-retaliation pillar (anonymous worker survey).

FAQ

How is SWA different from a Last Minute Risk Assessment (LMRA)? LMRA happens before work starts; SWA happens any time during work. They are complementary, not substitutes.

Can a contractor trigger SWA on the asset owner's equipment? Yes. The authority is unconditional and not bounded by employer. This must be explicit in the contractor induction.

What if the stop turns out to be unfounded? Still recorded, still treated as a positive event. An unfounded stop costs some time; a real hazard not stopped can cost far more. Investigations focus on the hazard perception, not on penalising the worker. The offshore SEMS rule allows for this case: work resumes when the person with ultimate work authority determines that the danger does not exist or no longer exists.

How do we prevent abuse of the program? We have found no published data on how often stop work authority is misused, so we make no claim either way. The failure modes described above are all forms of under-use, and they are what to design against first. Where the law addresses misuse, it asks for responsible use rather than limiting who may stop: the Department of Energy rule, 10 CFR 851.20(b)(9), requires stop work authority to be exercised in a justifiable and responsible manner in accordance with the approved worker safety and health programme.

Should SWA tie to bonus or incentive systems? Treat this with care. If leadership pay is linked to SWA measures at all, link it to the quality of the response (resolution time, sharing closure, retaliation reports investigated) rather than to the number of stops, and never to an individual worker's count in either direction. We found no published evidence on which design works best.

What is a stop work policy? It is the written statement of the programme: who may stop work, that no permission is needed, that no one is penalised for a good-faith stop, who decides when work can restart, and how stops are recorded. The one-page template above is a starting point.

Is SWA the same as the STOP observation programme? No. STOP (Safety Training Observation Program) trains supervisors to observe and discuss work practices. Stop Work Authority is the right to halt a task. They can run together, but one does not replace the other.

Is a stop the same as a near miss? No. A stop interrupts work before the hazard has produced an event; a near miss records an event that did not cause harm. Both feed the same learning loop, and the near-miss reporting guide covers the second. For events with serious injury potential, see SIF prevention software and the SIF glossary entry.

How does SWA show up in ISO 45001? ISO 45001:2018 is a voluntary standard. For an organisation certified to it, SWA event volume, resolution time and lesson-sharing closure can support the evidence it presents under clauses 5.4 (Consultation and participation of workers) and 8.1 (Operational planning and control). The requirement text is not published free, so confirm with your certification body what it expects to see.

Where to go next

• Best Safety Management Software
• Permit-to-Work Software
• Contractor Management Software 2026
• Behavior-Based Safety Program Guide
• Incident Investigation & RCA Techniques
• ISO 45001 Software
• Stop Work Authority Software
• Incident investigation glossary entry

The companies that operate Stop Work Authority well in 2026 will not be the ones with the prettiest posters. They will be the ones with the cleanest data, the shortest resolution times and the loudest celebration of every worker who used the word "stop".

Sources

• US OSHA: 29 CFR 1977.12, exercise of any right afforded by the OSH Act
• US OSHA: Workers' right to refuse dangerous work
• eCFR: 30 CFR 250.1930, SEMS stop work authority
• eCFR: 10 CFR 851.20, DOE worker safety and health: management responsibilities and worker rights
• eCFR: 40 CFR 68.83, Risk Management Program employee participation and 40 CFR 68.10, compliance dates
• Federal Register: EPA proposed rule, Common Sense Approach to Chemical Accident Prevention, 91 FR 8970 (24 February 2026)
• legislation.gov.uk: Management of Health and Safety at Work Regulations 1999, regulation 8
• EUR-Lex: Council Directive 89/391/EEC (the Framework Directive)
• dss+: STOP for Supervision program overview (Safety Training Observation Program)
• ISO: ISO 45001:2018, a practical guide for small organizations, preview with contents

Revised 4 October 2026: every regulation cited was re-read against its current text (29 CFR 1977.12, 30 CFR 250.1930, 10 CFR 851.20, 40 CFR 68.83 and 68.10, regulation 8 of the 1999 Regulations). The EPA rescission status was updated (comment period extended to 11 May 2026, no final rule listed on 4 October 2026), the incentive answer was softened because the earlier advice was unsupported, and a worked example, vendor questions and extra FAQ were added.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the regulations cited now link to their official texts. The section on the law now also sets out where stop work authority is itself a legal requirement, in line with our stop work authority software guide.