1

Recommendations and Findings of the NIST Safety Commission

April 7, 2023

The following recommendations and findings represent the opinions of the NIST Safety Commission 

based upon presentations and discussions with NIST leadership, review of detailed written information 

provided by NIST, and frank live interviews with numerous NIST employees. The Commission will 

provide a report that places these recommendations and findings in context, but wishes to share this 

information with NIST at this time as these recommendations can be immediately actionable by NIST as 

it begins the process of reinventing its safety posture. 

1. Organization and Leadership

a. RECOMMENDATION 1: Office of Safety, Health, and Environment (OSHE) and all related 

EH&S functions should report directly to the NIST Director. Further, the Chief Safety 

Officer (CSO) should be a voting member of the Enterprise Risk Management (ERM)

Council. Moreover, the NIST Director should make any other organizational changes 

needed to ensure the success of these specific recommendations. 

i. FINDING: Placement of OSHE under the Management Resources directorate 

does not adequately prioritize research safety or inform the NIST Director of 

safety risks. 

ii. FINDING: It is not clear that NIST leadership has demanded the highest level of 

professional and technical expertise from all personnel involved in safety. 

iii. FINDING: Research safety is not adequately considered or prioritized in the ERM 

Risk Inventory by the ERM Council despite significant risks to human life or 

institutional mission as demonstrated by known incidents involving injuries, 

physical damages, and a fatality. 

iv. FINDING: The Occupational and Environmental Medicine (OEM) physician and 

medical team of competent and qualified/licensed professionals are 

underutilized or missing resources in the risk management process, discounting 

their value as an existing quality assurance asset. The current placement of the 

OEM physician does not adequately prioritize occupational health and safety 

within NIST nor inform the NIST Director of operational program status or 

employee health and safety concerns. 

v. FINDING: While issues resulting from the COVID pandemic presented NIST with 

additional safety challenges, they are not thought to be material to the 

foundational safety vulnerabilities this Commission identified and described in 

detail below along with many documented in the 2008 and 2010 Blue Ribbon 

Commission reports. 

2. Safety Management Systems and Safety Processes

a. RECOMMENDATION 2: Establish and implement a safety audit system into the Safety 

Management System (SMS) that proactively identifies hazards and their associated risks, 

provides quality assurance-based feedback on performance of corrective actions and 

activities, and is compatible and consistent with the intention of a high quality SMS as 

exemplified by the standards set by ISO 45001 or ANSI Z10. 
2

i. FINDING: The lack of an audit process in NIST’s Safety Management System 

(SMS) has not been appropriately prioritized, causing a material weakness and 

elevated risk to the organization’s safety posture.

1. FINDING: This recommendation was made by the 2008 NIST Blue 

Ribbon Commission: “Currently NIST has no independent, systematic, 

and comprehensive internal audit procedures to ensure compliance with 

safety standards and regulations.”

2. FINDING: This recommendation was also made by the 2010 NIST Blue 

Ribbon Commission: “NIST’s safety program will indicate metrics that 

would be appropriate to monitor safety requirements that are 

applicable throughout NIST. Once these requirements have been 

established, safety performance will be monitored, measured, assessed, 

and audited.” 

b. RECOMMENDATION 3: Improve the Hazard Review and Approval System (HR) and Risk 

Hazard Index process (RHI), to include quantifiable definitions, validation/verification of 

user proficiency, and requirement for a reviewing role by OSHE. 

i. FINDING: The Hazard Review and Approval System (HR) is a capable tool for 

hazard identification, but requires improvements for quality hazard 

management.

ii. FINDING: Risk Hazard Index (RHI) assessments are somewhat arbitrary, 

contributing to a false sense of safety risk acceptance.

iii. FINDING: The current risk matrix used by OSHE is deficient and lacks defined 

time references to determine likelihood. 

iv. FINDING: ANSI Z10 is being incorrectly interpreted and used as a risk 

assessment aid.

v. FINDING: The Emergency Response Plans that are part of the hazard review 

package in the Hazard Review and Approval System are not well understood and 

practiced and thus not consistently/reliably actionable by staff. 

c. RECOMMENDATION 4: Develop more relevant safety training and more effective 

methods of delivery, addressing specific safety concerns of researchers and staff that is 

generated to provide targeted and actionable information.

i. FINDING: Some safety information is treated as if it were “spam”, due to 

irrelevance, or too generic and basic, feeling more like a “check the box” 

exercise focused on compliance, which results in missed opportunities for safety 

education and reinforcement. 

ii. FINDING: Many NIST researchers take their safety responsibilities seriously, but 

all personnel require/desire access to better tools, training, and expertise, to 

fulfill their safety responsibilities. 

d. RECOMMENDATION 5: Revise the Workplace Inspection Program such that inspection 

teams include both subject matter experts and OSHE staff, inspection teams have 

authority to mandate changes, inspections look beyond compliance issues to work 

practices and research hazards, and inspection findings are corrected and verified in a 

timely manner. 
3

i. FINDING: Laboratory inspections do not always include OSHE staff and 

sometimes were led by people lacking sufficient expertise or who were not 

unbiased, for example by inspecting a laboratory under their authority. 

ii. FINDING: The laboratory inspection checklist was detailed with appropriate 

topic areas to be examined; however, it focused on compliance rather than on 

actual work practices or research hazards and risks specific to that laboratory. 

iii. FINDING: Inspection findings are not prioritized consistently for correction, have 

no timeframe mandated for completion, and are not verified to have been 

completed or been effective in achieving their goals to mitigate identified 

vulnerabilities and eliminate or control risk at an acceptable level. 

iv. FINDING: OSHE staff reported that while they are periodically invited by OUs to 

visit certain specific research spaces, they also reported that their requests to 

access research spaces were sometimes denied. 

e. RECOMMENDATION 6: Improve the Incident Reporting and Investigation Program to

enable effective incident reporting functionality, usage, prioritization, response, and 

communication. Improve the Incident Reporting and Investigation Program to enable 

effective incident Investigations with regard to explicit risk-based prioritization of what 

is investigated, who leads the investigation, how incidents are investigated, 

identification of true root causes (not just identification of superficial proximate causes), 

formulation of recommendations and actions that clearly address root causes (not just 

proximate causes), and contributing factors to mitigate risks, timeliness of 

investigations, and follow through on completion and effectiveness of recommended

corrective actions.

i. FINDING: Significant number of researchers interviewed did not know how to 

submit IRIS reports, were not authorized to submit IRIS reports, found the 

reporting system too cumbersome, were not encouraged to report close calls,

and did not know how reports were utilized in improving their work 

environment. 

ii. FINDING: Placing responsibility and authority for initiating investigations, 

determining actions, and following-up on actions at each Organizational Unit 

level creates an actual or perceived conflict of interest, limits generalized 

learning, and may result in unrecognized and increased organizational risk. 

iii. FINDING: The tools for determining hazard induced risk use definitions of

likelihood that have no specified period of time over which the likelihood is 

defined. This leads to inconsistent prioritization, inefficient allocation of 

resources, and detracts from the establishment and maintenance of a robust 

and sustainable culture of safety. 

iv. FINDING: The investigation process is not sufficiently standardized and the 

metrics for quality and success of the investigations are not adequate, for 

example, by not correctly identifying root causes. 

v. FINDING: Investigation reports performed by OUs or OSHE seldom properly 

identified and determined contributing factors and root causes. 

vi. FINDING: Investigations and their subsequent actions are not accomplished in a 

timely manner. 

vii. FINDING: No systematic method exists to audit what is accomplished and to 

provide independent Quality Assurance for the investigation process or the 

success of interventions.
4

viii. FINDING: Incident reporting information is being emailed to employees without 

categorization or prioritization as to individual relevance resulting in staff stating 

they view it as spam and thus has a detrimental impact on safety.

f. RECOMMENDATION 7: Conduct a comprehensive review and audit of all safety related 

information technology (IT) systems, and based upon that review, make the necessary 

changes/fixes to ensure seamless integration and interoperability of safety information 

across all safety system IT tools. In addition, establish an advisory panel of safety 

stakeholders to periodically review effectiveness of these systems and empowered to 

make recommendations for continual improvement. 

i. FINDING: NIST created a number of IT safety systems, but they do not work 

together nor share data that is common.

ii. FINDING: Explicit usability testing was not employed for the tools, such as IRIS, 

and this resulted in less than desired use, efficiency, and benefit from their 

employment.

g. RECOMMENDATION 8: Improve the Enterprise Risk Management program (ERM), and 

its current standard of processes and practices, to better address critical research safety 

matters such as by conducting enterprise-wide audits/scans of safety issues, and 

improving the timeliness and efficiency of addition of items to the Risk Inventory to 

inform strategic decisions by NIST leadership. 

i. FINDING: The ERM system is being used as a financially-oriented business tool 

and safety risks are not adequately considered. 

ii. FINDING: The ERM process and ERM Council do not adequately address and 

manage risks, thus appearing ineffective, addressing only high level safety risks. 

The ERM Council is failing to inform executive leadership’s safety awareness for 

timely risk setting deliberations and prioritizations.

iii. FINDING: The ERM process has technical shortcomings, for example the 

likelihood criteria of the Risk Scoring Matrix, objective uses of Risk Appetite and 

Risk Tolerance, and reporting of corrective action plans and their status as 

required by OMB Circular A-123 V.B. The Matrix does not employ likelihood 

definitions that have a grounding in an actual time reference without which 

reliable determination of risk is virtually impossible.

iv. FINDING: ERM personnel do not personally brief upper management or are they 

present when senior management is briefed. This increases the likelihood that 

senior managers are deprived of an accurate picture of the systems level 

implications of the hazards and risks that exist.

v. FINDING: ERM personnel do not proactively explore and identify organization 

risks that have enterprise implications. ERM personnel reported that they only 

take input from NIST organizational elements and do not systematically verify 

the veracity of the reports.

vi. FINDING: Deficiencies in safety issues even being considered by the ERM 

Council were also noted by Thomas Mason (Director, Los Alamos National 

Laboratory) in his 2022 NIST NCNR Reactor Incident Review 

(https://www.nist.gov/system/files/documents/2022/08/02/T.%20Mason%20R

eport%20on%20NCNR_2022.pdf ): “the NCNR had only been added to the NIST 

Risk Matrix shortly before the incident and only then in the context of an ageing 

reactor that might not meet beam delivery needs of the scientific community. 
5

The fact it represents the highest hazard operation across all of NIST seems not 

to have been formally recognized.” 

3. Safety Culture

a. RECOMMENDATION 9: Make appropriate administrative, policy, and organizational 

changes to establish and promote an enterprise-wide sense of responsibility and 

ownership for safety, by 1) increasing the role of OSHE in Organizational Units (OU) 

safety operations, 2) holding all employees accountable for their safety roles, 

awareness, and performance, 3) eliminating differences between federal employees and 

Associates regarding their safety roles and responsibilities. 

i. FINDING: NIST’s philosophy of OU ownership of safety has the (unintended) 

consequence of relegating OSHE to an advisory role with little to no authority 

and lessened safety impact. This siloed approach results in a failure to take 

advantage of learning from one OU and sharing across the NIST enterprise to 

proactively mitigate risks. 

ii. FINDING: Federal employees and Associates perform many similar research 

activities and thus have similar exposures to risks and propensity for being 

involved in safety incidents yet have distinctly different safety authority. This 

inequity results in exposure to unmitigated safety risks. 

iii. FINDING: There is a lack of consistent understanding of safety principles at their 

most fundamental level throughout the organization, which adversely affects a 

positive safety culture.

iv. FINDING: NIST's approach to safety is primarily reactive and utilizes a 

compliance-based approach compared to a preferred proactive and sustained 

approach. The compliance approach results in a safety culture that is 

fragmented and inconsistent where the organization's value for safety is merely 

cosmetic. 

b. RECOMMENDATION 10: NIST leadership should take visible and proactive measures to 

inculcate essential elements of a robust safety culture, by promoting an engaged and

informed learning culture involving all NIST personnel. 

i. FINDING: Instantiations of a compliance mindset instead of a proactive safety 

attitude, particularly in training, field inspection, and policy have been observed 

and reported, which promotes minimal safety for standard procedures, and 

increases safety risk in unique, complex, or non-standard/non-routine

procedures. 

ii. FINDING: Transparency, awareness, and follow-up of safety-related activities 

and actions are lacking, leading to mistrust and pessimism of some staff towards

management’s and leadership’s safety commitment. Further, an absence of 

explicit risk-based prioritization and acceptance of residual risks in the

determination of what safety actions are taken erodes staff confidence in the 

value of safety. 

iii. FINDING: The Management Observation Process (MOP) is not having its 

intended effect of visibility, engagement, and effectiveness promoting safety

due to inconsistent participation by leadership and deficiencies in execution 
6

(e.g., not conducted during active laboratory operations and focused on 

compliance issues rather than hazards and risks). 

iv. FINDING: NIST staff spoke of a lack of prioritization of safety by NIST leadership. 

This finding was also reported by Thomas Mason (Director, Los Alamos National 

Laboratory) in his 2022 NIST NCNR Reactor Incident Review 

(https://www.nist.gov/system/files/documents/2022/08/02/T.%20Mason%20R

eport%20on%20NCNR_2022.pdf ): “...staff observation of the difficulty in 

resolving long standing safety concerns of a non-nuclear nature (examples cited 

include ladders and stairwells). This reflects a NIST challenge of deferred 

maintenance and insufficient funding to address infrastructure deficiencies that 

is not limited to NCNR, however the inadvertent message sent to staff that 

impacts the nuclear safety culture is that safety is not as important as the 

marquee scientific investments that do attract funding.” 

c. RECOMMENDATION 11: Analyze results from the 2023 National Safety Council’s “Safety 

Culture Survey”, along with previous safety culture surveys, to develop a robust safety 

culture improvement plan. 

i. FINDING: Key actions identified from the 2017 safety culture survey do not 

include metrics to demonstrate implementation or sustained organizational and 

safety culture improvement. Both leading and lagging indicators should be 

considered to measure safety improvement.

ii. FINDING: The safety culture perception is inconsistent throughout NIST. A 

positive view of the current safety culture is possibly overrated by upper 

management and indicates an undesirable hierarchical difference in perception 

as to the confidence of staff. This is particularly concerning with respect to some 

staff views of upper management’s attitude and support of safety.

4. Facilities and Infrastructure

a. RECOMMENDATION 12: NIST should implement an overall capital investment and 

infrastructure improvement plan as many buildings and facilities need significant 

renovations or replacement to addresss both research and safety issues. Safety issues 

alone should justify funding and guide all designs and implementations. 

i. FINDING: The 2023 National Academies of Sciences, Engineering, and Medicine 

report “Technical Assessment of the Capital Facility Needs of the National 

Institute of Standards and Technology” highlights the significant infrastructure 

deficiencies at NIST by stating “Most of the older laboratories that have not 

been renovated fail to provide the functionality needed by world-class scientists 

on vital assignments of national consequence.” 

ii. FINDING: While mentioning safety in context, “A substantial number of 

facilities, in particular the general purpose laboratories, have functional 

deficiencies in meeting their environmental requirements for temperature and 

humidity, and of electrical systems for stability, interruptability, and for life 

safety”, the report fails to cite significant actual injuries, property damages, and 

close calls that resulted from substandard infrastructure. 

iii. FINDING: There are many instances in decades old facilities where safety 

considerations were not incorporated in the design process (e.g., prevention 
7

through design: https://www.cdc.gov/niosh/topics/ptd/default.html) making 

issues difficult to address in later stages of development and operation. 

iv. FINDING: Aging infrastructure, deferred maintenance, deferred repairs, and 

numerous work-arounds have a negative impact on staff morale. The low staff 

morale in several areas contributes to a less favorable view of safety culture. 

The poor infrastructure and required workarounds symbolically convey a 

diminished concern by management about employee safety and well-being.

v. FINDING: These facility issues have not been systematically addressed with 

respect to their safety context for prioritization by NIST management thus 

inhibiting a robust organizational culture of safety.

5. Engagement and Implementation

a. RECOMMENDATION 13: NIST should meet with the NIST Safety Commission 

approximately 90 days after delivery of the final NIST Safety Commission report to allow 

discussions ensuring that the plans, actions, and associated schedules for 

implementation by NIST are consistent with the Commission’s intent as set by these 

recommendations. This timeframe is before the termination of the Commission on 

November 30, 2023 as set forth by the Charter. 

i. FINDING: There has been a consistent pattern of incomplete responses and 

mixed success of corrective actions in relation to recommendations of NISTcreated commissions and surveys, such as the 2008 and 2010 NIST Blue Ribbon 

Commissions and the 2017 Employee Engagement Survey. 

b. RECOMMENDATION 14: NIST should obtain outside advice/expertise/oversight with 

external experts on its Safety Management Systems and plans, actions, and associated 

schedules for implementation as those are generated in response to the 

recommendations in the final NIST Safety Commission report.

i. FINDING: Missing actions addressing recommendations from previous of NISTcreated commissions and surveys and technical errors in the current NIST Safety 

Management Systems suggest that NIST could benefit from continuing outside 

advice and expertise. 

c. RECOMMENDATION 15: As the world leader in metrics and standards, NIST should 

design and implement changes to their Safety Management Systems with a long-term 

vision to be a world class model for research safety.

i. FINDING: NIST has not incorporated a robust audit system into its Safety 

Management System to provide metrics on the efficacy of safety programs. 

ii. FINDING: NIST has not effectively partnered with other federal agencies that 

use similar hazardous equipment, materials, and processes to establish and 

share successful practices for safe research.

iii. FINDING: NIST has not effectively partnered with other federal agencies that 

have expertise in worker protection (such as the OSHA Voluntary Protection 

Program) to proactively design, implement, study, and analyze safety systems 

designed to prevent fatalities, injuries, and illnesses. 

iv. FINDING: NIST has not utilized resources available from, or even considered 

becoming, one of the NIOSH Centers of Excellence for Total Worker Health. 
8

These Centers build the scientific evidence to develop innovative solutions to 

complex problems in keeping employees safe and productive. 

v. FINDING: NIST has not benchmarked their safety management systems or 

safety leadership actions to other federal agencies working with high hazards 

such as NASA or DOE.