The 3 Strands of Safety: A Framework to Identify, Understand, and Act on Risk

 You don't know if your action is the correct action unless you truly understand the problem.

- Crystal Danbury

About this session

Frameworks are essential tools for health and safety leaders, but the most familiar one, the Hierarchy of Controls, doesn't always hold up against the complexity of real-world risk.

In this session of Safety Voices, we sat down with Crystal Danbury, Director of Group Safety, Insurance & Occupational Wellbeing at Sainsbury's, to unpack why. Drawing on 22 years of experience, from nuclear engineering to managing multimillion-pound safety budgets in FTSE 100 companies, Crystal introduced her own framework, the Three Strands of Safety: Identify, Understand, and then Accept, Mitigate, or Remove.

The conversation challenged the idea that “eliminate” can realistically sit at the top of every risk decision, made the case for risk acceptance as a legitimate and often overlooked strand, and explored how organisations can shift from a culture of blame to one focused on genuine causation.

The 3 Strands: identify, understand, act

Crystal points out that most safety problems are solved too fast, jumping straight from an identified issue to a fix without ever separating the immediate cause from the underlying and root causes. The “3 Strands” methodology allows people to see the issues and act on them with more clarity.

Strand 1: Identifying Risks Effectively

Explores how to systematically recognise hazards across your organisation, from operational processes to human factors, to ensure no risk goes unnoticed.

Strand 2: Understanding Risks and Their Impact

Methods to analyse and interpret identified risks, assessing consequences, and gaining deeper insight into organisational vulnerabilities.

Strand 3: Mitigating, Accepting, or Removing Risk

Practical approaches to managing risks, including mitigation strategies, informed risk acceptance, and the elimination of hazards.

Key takeaways from the session 

Why the Hierarchy of Controls Falls Short:
Crystal shares her core frustration with how very few risk assessments are really asking, first of all, “how do we eliminate this?”, arguing that the ERIC PD model has no explicit place for risk acceptance, even though it's embedded in the legal test of what's “reasonably practicable”. 

The Window Cleaner Analogy:  
Examine the limitations of the traditional HOC and explore how more dynamic frameworks can guide better decision-making and more effective risk management.

Taking Senior Stakeholders on the Journey:
Crystal tells her own story of using the framework to defuse a high-stake investment stand-off by being explicit about where her accountability ended and the stakeholder's decision began. 

What Actually Blocks Identification: why reporting mechanisms, culture, psychological safety, and trust (not a lack of process) are usually the real barriers to seeing risk in the first place. 

 Building the Business Case: practical guidance on quantifying the cost of harm, from telematics and claims data to using other organisations' publicly reported losses to build a case before an incident happens.