AI and the Hierarchy of Controls: ML to Prioritize High-Risk Hazards

The Spreadsheet That's Lying to You

Every EHS manager has one. It's the risk register — maybe 200 rows, color-coded by someone's best guess, last updated six months ago by a safety coordinator who has since left the company. Red means urgent. Yellow means "we'll get to it." Green means nobody looked hard enough.

The problem isn't effort. Most safety professionals I've worked alongside are genuinely trying to prioritize correctly. The problem is the sheer volume of inputs required to do it well: incident history, near-miss logs, inspection findings, OSHA recordables, equipment maintenance records, job hazard analyses, and regulatory citations — all living in different systems, updated at different cadences, owned by different departments. Synthesizing all of that into a defensible, prioritized hazard list is a multi-day exercise that most teams run quarterly at best.

Meanwhile, hazards don't wait for your quarterly review cycle.

What the Hierarchy of Controls Actually Demands

The hierarchy of controls — elimination, substitution, engineering controls, administrative controls, PPE — is not a compliance checkbox. It's a decision framework. And making good decisions inside that framework requires knowing which hazards deserve your most aggressive controls first.

OSHA's process safety management standard at 29 CFR 1910.119 requires documented process hazard analyses for facilities handling highly hazardous chemicals. The general industry walking-working surfaces standard at 29 CFR 1910.22 requires employers to identify and correct hazardous conditions. The recordkeeping standard at 29 CFR 1904 requires accurate logging of work-related injuries and illnesses. None of these standards tell you how to prioritize across all your open hazards simultaneously — that analytical burden falls entirely on your team.

For a safety director managing a 500-person manufacturing facility with 14 open inspection findings, 3 unresolved near-miss reports, and a pending audit, manual triage is not a process problem. It's a math problem. There are too many variables for a human being to hold in working memory and rank consistently.

What Most Safety Managers Get Wrong About Risk Scoring

Most safety managers assume that their current risk matrix — severity times probability — is an objective tool. The reality is that it encodes whoever filled it out last, and that person was probably working under deadline pressure with incomplete information.

A 5x5 risk matrix feels rigorous. But when a maintenance supervisor rates a hydraulic press hazard as a "3 severity / 2 probability" and a different supervisor at a sister facility rates an identical hazard as "4 severity / 3 probability," you don't have a scoring system. You have two opinions. Aggregated across dozens of assessors and hundreds of hazards, that inconsistency quietly destroys your ability to prioritize accurately.

How Gerty Uses Machine Learning to Prioritize Hazards

Gerty connects to the data sources your EHS program already generates — inspection records, incident reports, JHAs, corrective action logs, equipment service histories — and applies machine learning to surface the hazards that deserve elimination or engineering controls first.

Here's what that looks like in practice:

• Cross-source pattern recognition: Gerty correlates findings across systems that don't talk to each other. A near-miss logged in your incident system, combined with an overdue inspection finding and a corrective action that was closed without verification — Gerty flags that cluster as high-priority because the pattern matches precursor sequences associated with recordable incidents in your industry.
• Consistent severity modeling: Rather than relying on individual assessors to apply a matrix consistently, Gerty uses your own historical incident data to calibrate severity predictions. If hydraulic press injuries at your facility have historically resulted in lost-time incidents, that outcome data informs how the model scores similar open hazards going forward.
• Control gap identification: Gerty maps each open hazard against the hierarchy of controls and flags where your current control is lower on the hierarchy than the hazard severity warrants. A high-severity chemical exposure hazard managed only by PPE — with no engineering or administrative controls documented — surfaces immediately.
• Prioritized action queues: Safety coordinators, EHS managers, and operations supervisors each see a role-specific queue of hazards ranked by urgency, with suggested control levels and regulatory citations attached.

A Real Scenario: Lockout/Tagout Gaps Across Multiple Lines

Consider a food processing facility with 11 production lines. Their safety coordinator has documented LOTO procedures for each line under 29 CFR 1910.147, but annual audits have been inconsistent — some lines audited last March, others not since the previous year. Three corrective actions from the most recent audit are technically "closed" but were resolved with updated signage rather than procedure rewrites.

Manually, a safety manager reviewing this situation might not connect those three closed-but-inadequate CAs to the lines with the longest audit gaps. Gerty does. It identifies that lines 4, 7, and 9 have a combination of overdue audits, inadequate prior corrective actions, and higher-frequency maintenance activity — and ranks them as the highest LOTO-related priority for re-inspection before any other line. The safety coordinator doesn't have to reconstruct that analysis from three separate spreadsheets. It's already in the queue.

What Gerty Doesn't Replace

This matters, so let's be direct about it.

• Gerty does not conduct physical hazard assessments. A machine learning model cannot walk a production floor, smell a chemical vapor, or notice that a guard has been zip-tied open. Your safety professionals still need to be present and observant.
• Gerty does not make control decisions. Whether to install a machine guard, redesign a workflow, or eliminate a process entirely requires engineering judgment, operational knowledge, and human accountability. Gerty surfaces what needs attention and at what priority level — your team decides what to do about it.
• Gerty does not replace the JHA process. Job hazard analyses under 29 CFR 1910 require worker involvement and task-level observation. Gerty can help you prioritize which JHAs to update first, but it cannot generate a valid JHA from a database query.
• Gerty does not provide legal advice. Citations, enforcement risk assessments, and legal strategy require qualified counsel and credentialed safety professionals. Gerty is a compliance automation tool, not a compliance guarantee.

The Actual Value Proposition

The hierarchy of controls is only as useful as your ability to apply it to the right hazards at the right time. When your prioritization process runs quarterly on incomplete data, you are systematically under-resourcing your highest-risk exposures — not because you don't care, but because the manual version of this analysis doesn't scale.

Gerty doesn't replace the judgment of a qualified EHS professional. It gives that professional accurate, current, cross-referenced information so their judgment lands on the right target. That's the difference between a risk register that reflects reality and one that reflects the last person who had time to update it.

Frequently Asked Questions

Does Gerty work with our existing incident management system?

Gerty is built to connect with common EHS platforms and accepts data imports from standard formats including CSV, Excel, and API integrations with major incident and inspection management tools. Your implementation contact will map your existing data sources during onboarding.

How does Gerty's hazard prioritization handle facilities with very different risk profiles?

Gerty's models are calibrated to your facility's own historical data, not just industry averages. A chemical plant and a warehouse will generate very different priority outputs because the underlying incident history, regulatory exposure, and hazard types are different. The model adapts to your data over time.

Can Gerty help us prepare for an OSHA inspection?

Gerty surfaces open findings, overdue corrective actions, and documentation gaps that are commonly cited in OSHA inspections — including areas relevant to 29 CFR 1910.119, 1910.147, and 1910.22. It does not predict inspector behavior or provide legal preparation strategy, but it significantly reduces the likelihood that a known gap goes unaddressed before an inspection occurs.

What if our historical incident data is incomplete or inconsistently recorded?

Gerty can work with incomplete data sets — it will flag where data gaps exist and weight its outputs accordingly. Incomplete data does reduce model confidence, which is surfaced transparently in the interface. Improving data quality over time increases the accuracy of prioritization outputs.

Is Gerty appropriate for small EHS teams without dedicated data staff?

Yes. Gerty is specifically designed for EHS professionals, not data scientists. The interface requires no coding, no model configuration, and no analytics background. If you can navigate a spreadsheet, you can use Gerty's prioritization dashboard from day one.

If your hazard prioritization process depends on a spreadsheet that's already out of date, your highest-risk exposures may not be at the top of your list. Start a free Gerty trial and find out what your data is actually telling you.