In upstream drilling and well servicing, the citation isn't for the hazard — it's for the missing verification record.
Here is the thing nobody tells you until you are standing next to an OSHA compliance officer on a drilling location: the citation almost never says "you had a hazardous condition." It says "you failed to verify, document, or demonstrate that your control was functioning as intended." The hazard is just the backdrop. The paperwork — or the absence of it — is what gets you fined.
In upstream oil and gas, that distinction costs companies real money. An OSHA serious violation runs up to $16,131 per instance. A repeat or willful citation — where the agency decides you knew about the gap and didn't fix it — goes up to $161,323. And those numbers don't include the EMR spike that follows, the Avetta or ISNetworld grade that quietly tanks before your next bid cycle, or the operator who decides it's easier to find a different contractor than to keep defending your qualification file.
A critical control is the specific barrier standing between a high-energy hazard and a person. On a well servicing job, that might be the pressure-relief valve that keeps the wellhead from going over its rated working pressure. On a pipeline integrity crew, it might be the atmospheric monitor that confirms a confined space is safe to enter. The control exists. Everyone knows it exists. The question a leading indicator program actually asks is: did someone verify it was working, and did they write it down before work began?
Most safety coordinators and field supervisors in this industry track lagging indicators — TRIR, DART rate, recordable count. Those numbers tell you where you were six months ago. Critical control verification tracking tells you whether your Swiss Cheese layers have holes in them right now, before the holes align into an incident.
Most well services companies assume X — that if the equipment is physically present and functional, they are covered. The real problem is Y: OSHA doesn't just want the control in place. OSHA wants dated, signed evidence that a competent person confirmed it was in place and operational before each shift or each task.
Walk through a real scenario. A completion crew is rigging up on location in the Permian Basin. The company man is on the phone with the operator's engineer. The driller runs his pre-tour checklist in his head — he's done this exact job four hundred times. The crown safety device has been on that rig for two years and has never failed. What he doesn't do is fill out the pre-job inspection form that demonstrates the crown safety device was tested and verified functional at the start of that specific tower. Six weeks later, during an OSHA inspection triggered by an unrelated incident at a different location, the compliance officer pulls the inspection records for that rig. There is no pre-job crown safety verification log for seventeen of the last thirty shifts. That is a serious citation. Not because the device failed. Because no one documented that anyone checked it.
This is the admin failure OSHA cites. Not the hazard. The missing record of control verification.
The mechanism is straightforward, but the execution is where most contractors fall apart. You need three things:
When you track critical control verification as a leading indicator — not just whether it was done, but the percentage of required verifications that were completed and documented on time — you get a number that predicts incident risk. A verification completion rate dropping from 94% to 78% over eight weeks is a signal. Something changed: a supervisor left, the crew is short-handed, the form is too cumbersome, or nobody is holding the field accountable. Any of those root causes is fixable before an incident. None of them are visible in your TRIR until after someone gets hurt.
A completion rate that is flat at 100% but where every form has the same handwriting is a different problem. It means one person is filling out records for the whole crew, probably in the doghouse at the end of shift. That is also a leading indicator — it tells you the culture treats this as paperwork, not as a real check.
Beyond the OSHA citation, a documented failure to verify critical controls is the kind of finding that shows up in a prequalification audit and does not go away quietly. Operators using Avetta or ISNetworld score contractors on safety management system elements, including documented inspection and verification programs. A gap in your critical control verification records is not just a compliance issue — it is a direct argument for why an operator should move their contract to a competitor whose paperwork is tighter. In a relationship-driven industry, that conversation rarely happens out loud. The bid just stops coming.
A critical control is the specific barrier that prevents a high-consequence event from reaching a worker. Examples in upstream oil and gas include crown safety devices on drilling rigs, pressure-relief valves on wellheads, atmospheric monitors for confined space entry, and lockout/tagout procedures on pumping equipment. Not every control is critical — a critical control is one where failure could result in a fatality or catastrophic incident.
A standard inspection checks whether equipment exists and is generally in good condition. Critical control verification specifically confirms that the control mechanism designed to prevent a high-energy event is functional and was tested before a specific task or shift started. The distinction matters to OSHA and to incident investigators: you can pass a general inspection and still have an undocumented critical control failure waiting to happen.
Because the documentation is the only evidence that the control was actually verified — not just assumed to be working. OSHA standards for oil and gas operations, including 29 CFR 1910.147 for energy control and API RP 54 for drilling operations, require documented pre-job and pre-task inspection records. Without the record, the agency has no way to confirm the control was ever checked. The citation follows the missing paper trail, not the physical condition of the equipment at the time of the inspection.
When tracked over time, the percentage of required verifications completed on schedule and signed by a competent person tells you whether your controls are actually being maintained or just assumed to be working. A declining verification rate is a measurable signal that your control layer is degrading — before any incident occurs. That is the definition of a leading indicator: it measures the health of your defenses in real time.
In this industry, the gap between a functional safety program and a citable one is often a single missing signature on a verification form. That is not a harsh judgment — it is the reality every field safety coordinator and drilling superintendent lives with. The controls exist. The training happened. The hazards are understood. What kills the program is the paperwork system nobody had time to build properly because the safety coordinator is already running three other sites.
If the documentation is eating your program's bandwidth, that is exactly what EHS, Inc. handles. Talk to EHS — the admin comes off your plate so you can spend your time on what the paperwork is supposed to be tracking.
External reference: OSHA's energy control standard, 29 CFR 1910.147 — Control of Hazardous Energy, outlines the documentation requirements for lockout/tagout procedures that apply directly to well servicing and pipeline maintenance operations.
Aaron West
Founder, EHS, Inc. — 18+ years in EHS compliance and contractor safety
Aaron West has spent over 18 years helping contractors and businesses navigate OSHA compliance, ISNetworld® certification, and workplace safety management. He founded EHS, Inc. to make enterprise-level EHS accessible to companies of all sizes — serving contractors and businesses nationwide — without long-term contracts or enterprise overhead.
Our team handles the complexity so you can focus on running your business. No long-term contracts, no learning curve.
Talk to EHSYour EMR tells you what already went wrong. Here's what data-driven safety pros in manufacturing track before the next incident.
The paperwork gap—not the hazard itself—is what gets upstream oil and gas contractors cited and what lets SIF events slip through undetected.
When one subsidiary's bad year tanks the parent company's EMR, you need risk transfer architecture—not more training reminders.
Framework to achieve zero incidents
Stop hitting paywalls
54 topics in English & Spanish