Subcommittee Session
Charge to the NIST Safety Commission

Charge to the Commission:

Assess the state of NIST’s safety culture and how effectively the existing safety 

protocols and policies have been implemented across NIST.

The Commission will evaluate:

• the quality and completeness of NIST safety directives and programs,

• the performance of safety protocols and the responses to recent incidents and near misses, and

• the impacts of the pandemic and hybrid work environment on safety.

The Commission should consider:

• perspectives of NIST staff and management, 

• NIST’s responses to significant safety-related incidents and near-misses, 

• findings from investigations and reviews of incidents, and

• implementation of corrective actions to prevent future incidents and improve safety 

performance, as well as actions taken to strengthen safety culture at NIST facilities. 
Subcommittees Overview

Incident Investigations and Corrective Actions Safety and Culture

Created to assess (1) Safety Management Systems and Processes, and (2) Safety Culture

Joseph Kolly

(Chair)

Allison Jones

James Bagian

(Chair)

Craig Merlic Darryl Hill

(Chair)

David Hofmann

Shyam Sunder

Hazard Analysis and Risk Assessment

NIST Designated Federal Official
Themes to Pursue

These are some of the areas the Commission is examining and the basis for 

some of the subcommittee topics.

• Safety Management Systems and Processes

➢ Safety Management Systems and Processes 

➢ Hazard Analysis and Risk Assessment - Subcommittee 1 Topic

➢ Incident Reporting, Investigations, and Corrective Action Planning and Follow Up -

Subcommittee 2 Topic

➢ Line Management Presence at Bench/Point of Work

➢ IT Systems and Training

➢ Role of OSHE
Themes to Pursue

These are some of the areas the Commission is examining and the basis for 

some of the subcommittee topics.

• Culture and Safety 

➢ Senior Management Commitment to Safety

➢ Line Management Ownership of Safety 

➢ Culture - Subcommittee 3 Topic

➢ Alignment of Mission OU’s and Functions 

• Facilities and Infrastructure

➢ Current State of Facilities and Infrastructure

➢ Space Ownership 
March 10, 2023

Subcommittee on Hazard Analysis and 

Risk Assessment

NIST Safety Commission

Dr. Joseph Kolly and Dr. Allison Jones

NIST Safety Commission Members
Approach and Progress

• Review of NIST Hazard Analysis and Risk Assessment—as well as Occupation Medicine—

related documents and materials.

• Discussions with NIST managers

• One-on-one discussions with a representative sample of NIST researchers experienced in 

the actual conduct of hazard analysis and risk assessments.

➢ Elizabeth Mackey, NIST Chief Safety Officer & Director, Office of Safety, Health, and Environment (OSHE)

➢ Wing Wong, Manager of Hazard Review Program, OSHE

➢ Nahla Ivy, Enterprise Risk Management Officer, Office of Financial Resources Management (OFRM)
Findings and Observations - 1

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 1: Hazard Review and Approval System is a capable tool for hazard 

identification, but requires improvements for quality hazard management.

➢ Employees can be “tagged” at any time in the Hazard Review and Approval system as accepting 

and understanding risk without their knowledge or consent.

➢ Reviews of uncommon, unique, or seldomly executed projects that individual scientists may have can 

be subject to unintentional omission of hazards due to lack of experience and familiarity with the task, 

and may not be detected during review (2-party review).

• FINDING 2: Risk Hazard Index (RHI) assessments are somewhat arbitrary, contributing 

to a false sense of safety risk acceptance.

➢ RHI elements of severity and likelihood have imprecise descriptions that have been open to multiple 

interpretations causing confusion, excessive variability, resulting in poor quality and usability of RHI for 

safety.

➢ The RHI levels can and have been downgraded (in multiple instances) for desired outcomes, and are 

not truly independent nor free of conflict-of-interest.
Findings and Observations - 2

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 3: OSHE and the Occupational and Environmental Medicine physician and 

medical team of competent and qualified/licensed professionals are underutilized 

resources in the risk management process, discounting their value as an existing 

quality assurance asset.

➢ OSHE has no required role in the hazard review approval process. 

➢ Of the ~2000 reviews in the Hazard Review system, OSHE is estimated to have been involved in 

detailed review of ~20%, and “lite review” of ~35%. 
Findings and Observations - 3

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 4: The ERM/ERM Council does not adequately manage, thus appears 

highly ineffective, addressing high level safety risks. ERM/ERM Council is failing to 

inform executive leadership’s safety awareness for timely risk setting deliberations 

and prioritizations.

➢ There is no formal role of a safety official (e.g., CSO) on the ERM Executive Council.

➢ ERM’s Risk Assessment Matrix and guidance on safety is inconsistent with that used in NIST’s Hazard 

Review process.

➢ The process used to select ERM priorities can take months to prepare, is overly burdensome, and 

highly subjective.

➢ Significant attention to CHIPS Act is taxing ERM resources. 
Findings and Observations - 4

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 5: The lack of an audit process in NIST’s Safety Management System (SMS) 

has not been appropriately prioritized, causing a material weakness and high risk to 

their organization’s safety posture. 

➢ The need for a safety management audit systems was recognized as early as 2010 by the Blue 

Ribbon Commission (BRC), has not been prioritized, and is still not instituted across the NIST enterprise.

➢ Lack of a certified and maintenance audit process results in an incomplete SMS system, and this 

omission has not been addressed by NIST’s entire safety organization (CSO, ERM, OU’s DRSs, and NIST 

senior leadership).

• FINDING 6: NIST’s philosophy of OU ownership of safety has the (unintended) 

consequence of relegating OSHE to an advisory role with little to no authority and 

lessened safety impact.

➢ Safety practice, approval, oversight, and audit functions are the responsibility of the same 

organizational unit, and are not inherently independent processes with check and balance. 
Findings and Observations - 5

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 7: NIST researchers take their safety responsibilities seriously, but require/desire 

access to better tools, training, and expertise, to fulfill their safety responsibilities. 

➢ On-line safety training and hazard reporting systems are cumbersome to use.

➢ Employees are not encouraged, and in some cases not authorized to report safety concerns, and do 

not receive adequate feedback on those concerns.

➢ Standardized treatment of routine safety matters is not common, and can be highly variable depending 

upon experience.

➢ Researchers feel safety training and reporting is more of a “check the box” exercise for compliance 

rather than a thorough treatment of the safety matter.
March 10, 2023

Subcommittee on Incident Investigations, 

Corrective Actions, and Follow Up

NIST Safety Commission

Dr. James Bagian and Dr. Craig Merlic

NIST Safety Commission Members
Approach and Progress

• Review of Incident Reporting, Investigations, Corrective Action Formulation, Planning, and 

Follow Up—as well as Enterprise Risk Management—related documents and materials.

• Discussions with NIST managers

• One-on-one discussions with a representative sample of NIST bench level researchers 

involved in higher-hazard laboratory-based experimental work.

➢ Elizabeth Mackey, NIST Chief Safety Officer and Director, Office of Safety, Health, and Environment (OSHE)

➢ Kevin Bald, Manager of the Incident Reporting and Investigation Program, and Manager of the Corrective 

and Preventive Action Program, OSHE

➢ Del Brockett, Associate Director for Management Resources

➢ Nahla Ivy, Enterprise Risk Management Officer, Office of Financial Resources Management (OFRM)

➢ Manny Mejias, Radiation Safety Officer and Chief, Radiation Safety Division, OSHE
Findings and Observations - 1

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• Incident Reporting

➢ Large percentage of NIST employees interviewed had no idea how to submit reports for inclusion in IRIS, 

how reports were utilized, or if anything of value resulted from reports. 

➢ Reporting system in current form restricts who may submit reports which can result in inaccurate, 

incomplete, or suppressed reporting.

➢ IRIS reporting system is cumbersome to use and is not organized in a manner that insures that efforts of 

reporters are value-added rather than being perceived as an obstacle to participation. OSHE reported that 

they wish there was more reporting but had not considered investigating if reporters abandoned submission 

of reports once initiated due to the current structure of the IRIS report submission input interfaces.

➢ OSHE Director stated that Near Miss reporting is important and that she thinks Near Misses are vastly underreported. This puts the organization at avoidable additional risk.

➢ NIST S 7101–02 Employee Reporting of Unsafe or Unhealthful Working Conditions creates a structure 

(Appendix A) that can lead to siloed responses and failure to share/address/mitigate hazards that may 

have broad impact across NIST and exacerbate risk of mishap.

➢ Incident reporting information is being emailed to employees without any categorization or prioritization as 

to individual relevance resulting in staff stating they view it as spam and has a detrimental impact on safety.
Findings and Observations - 2

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• Incident Investigations

➢ OUs decide how to investigate, mitigate, and follow-up corrective actions which creates an actual or 

perceived inherent Conflict of Interest. 

➢ Placing responsibility and authority for initiating investigations, actions and follow-up at the individual 

OU level limits generalized learning and may result in unrecognized and increased organizational risk 

on a local and NIST system-wide basis.

➢ The investigation process is not standardized and the quality of the investigations is generally poor. For 

example, root causes are not correctly identified and this includes even the detailed investigations led 

by senior OSHE personnel. Proximate cause is usually as far as any investigation goes which means that 

systems-based improvement is virtually impossible and increases safety risk.

➢ Investigations and their subsequent actions are not accomplished in a timely manner. 

➢ OSHE has no systematic method to audit what is accomplished and provide independent Quality 

Assurance for the investigation process or the success of interventions. OSHE’s plan to wait until 2024 to 

implement this audit capability is ill advised and is in direct violation of the recommendation made in 

2010 in the Final Report of the Blue Ribbon Panel on Management and Safety II November 18, 2010. 
Findings and Observations - 3

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• Laboratory Inspections

➢ Laboratory inspections did not always include OSHE staff and sometimes were led by people lacking 

sufficient expertise or who were not unbiased, for example were inspecting a lab under their authority.

➢ The laboratory inspection checklist was detailed with appropriate areas to be examined covering 

major areas of concern (biological, chemical, electrical, laser, etc.). However, the focus was on 

compliance of static items. There were not checklist questions on actual work practices or observation 

of work being performed, nor on actual research hazards specific to that lab.

➢ There is insufficient prioritization of deficiencies required to be corrected.

➢ Not all corrections for deficiencies have a timeframe mandated for completion such as 48 h, 30 days, 

etc.

➢ No evidence was presented that there was any follow-up on whether required corrections for 

deficiencies were actually completed or were effective.
Findings and Observations - 4

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• Enterprise Risk Management (ERM)

➢ Overall, the Enterprise Risk Management system is being used as a financially oriented business tool 

and safety is a minor afterthought. (Despite the words “Risk Management” in the title.)

➢ ERM Officer stated during interview/presentation that ERM only considers what is submitted to them 

and stated that they don’t proactively go out and do assessments to identify risk to organizational 

goals nor do they audit to verify that what is reported to them is accurate. This passive role is not 

consistent with the recommended practices for ERM as described in or what is stated to be 

achieved in the briefing materials that they presented and provided to our Subcommittee. 

➢ The ERM Officer told us that she had never briefed the NIST Director on ERM issues. We are unsure 

what information the ERM Council communicates to the NIST Director and were not permitted to 

read the Minutes of the ERM Council. 
Findings and Observations - 5

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• Enterprise Risk Management (cont.)

➢ The ERM process has apparent functional shortcomings. For example, the ERM Reference Card v2 

contains a Risk Scoring Matrix which has no time period defined in any of the likelihood criteria. The 

absence of a time-based likelihood metric is common among many prioritization matrices used at 

NIST and is a fundamental shortcoming making clear communication and consistent prioritization 

difficult if not impossible. This results in an incomplete picture of organizational risk that interferes with 

top management making well-informed risk-based decisions. An example is the failure of ERM to 

highlight the failure of NIST to implement or accept the residual risk of not implementing the 

recommendations in the Final Report of the Blue Ribbon Panel on Management and Safety II 

November 18, 2010 such as to “Establish an Audit mechanism”. 

➢ OMB Circular A-123 V.B. requires the reporting of corrective action plans and their status. This is not 

currently done and cannot be done successfully because OSHE has officially indicated that they 

don’t do this audit and don’t plan to do it until 2024 and ERM told us that they don’t do 

independent audits or verification of what is reported to them although the briefing materials they 

furnished us indicates that is within their scope of responsibility.
March 10, 2023

Subcommittee on Safety and Culture

NIST Safety Commission

Dr. Darryl Hill and Dr. David Hofmann

NIST Safety Commission Members
Approach and Progress

• Review documents and materials related to 2017 NIST Safety Climate 

Assessment results, lessons learned, and actions taken and completed.

• Discussion with NIST manager

• Review results of 2022/23 NIST Safety Culture Survey conducted by the National 

Safety Council (Presented at NIST Safety Commission meeting on March 9, 2023.

➢ Elizabeth Mackey, NIST Chief Safety Officer & Director, Office of Safety, Health, and Environment
Findings and Observations - 1

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 1: General View of NIST Safety Culture is not consistent throughout NIST.

➢ While the 2017 safety culture survey findings led to seven (7) key actions, sustained safety culture 

improvement is not evident.

➢ Multiple incidents since 2017 have resulted in the formation of the current Commission.

➢ Initial findings of this Commission are that the safety culture is not consistent across different working 

groups/divisions and, overall, not strong.

➢ OSHE focus group strongly agreed that safety culture is not strong.

➢ Senior Management’s overall support is sometimes overridden by their actions (e.g., confusing 

accidents and incidents, overriding recommendations of the safety experts via email – building 

entry after construction started was one example).

➢ Upper management seems to treat safety like other policy/compliance issues – they create/send 

out policy statements expecting folks to follow them. There does not seem to be significant personal

involvement of senior management in creating a strong safety culture. 
Findings and Observations - 2

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 2: There does not seem to be an ongoing measurement of safety culture 

and other related metrics to create a continuous improvement framework. 

➢ 2017 survey resulting actions did not include ongoing continuing improvement assessment.

➢ There were seven (7) safety culture survey actions identified. However, it is difficult to measure 

quantifiable improvement to date for several actions. 

• FINDING 3: Safety Culture momentum has suffered due to the COVID pandemic. 

➢ During the pandemic, the safety culture of NIST seemed to take a big step backward. Given social 

distancing and other Covid restrictions, lab work seemingly was often done in an unsafe manner 

(e.g., working alone, etc.). This tension point – balancing Covid safety with work safety does not 

seem to have been managed well. 

➢ The pandemic resulted in a dispersed workforce. This may have impacted the safety culture in an 

adverse manner by diminishing team connections, trust, and psychological safety. 
Findings and Observations - 3

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

• FINDING 4: Gaps identified across various levels of management

➢ Related to there not being a strong and consistent safety culture across various work groups/divisions, 

there seem to be gaps in safety culture across different layers of management.

➢ Senior Management tends to create policies and send them out – there does not seem to be much 

personal involvement in creating a strong safety culture.

➢ OSHE managers do not feel they have the power to influence safety and reported that sometimes their 

advice is overruled by senior management and/or they only have “advice” authority over line managers.

➢ Many lab managers are charged with conducting risk analysis likely without adequate training. Given the 

slow response in the work approval/hazard analysis process, there exists an incentive to under-estimate 

the risk to get faster approvals and “get back to work.”

➢ We suspect there is substantial variability across front-line and middle-managers regarding the degree to 

which they make safety a priority.

➢ Observed a big disconnect between the way Senior Management and frontline workers described the 

Management Observation Program. Senior management described it as a key part of the safety 

program, whereas frontline workers and supervisors said it rarely happens, it is announced in advance, 

and it is more of a work context tour vs. observation of real work happening. 
Findings and Observations - 4

Note, these reflect the views of the subcommittee and are not yet consensus views of the NIST Safety Commission

Finding 5: Facilities, Safety Training, and Safety Infrastructure

➢ Facilities are in need of significant updating/renovation (see NASEM report) resulting in significant 

lost productivity and many “workarounds” which can introduce safety issues.

➢ Importantly and additionally, the quality of facilities are an important symbolic marker for safety. 

Poor facilities resulting in workarounds and lost productivity influence safety culture directly (due to 

workarounds increasing risk) but also indirectly as a symbolic marker for how much the organization 

cares about how the work is completed.

➢ Safety training seems to be largely a perfunctory exercise (a “check the box” exercise).

➢ Safety infrastructure – processes and procedures for Hazard Review, reporting issues, and the like 

seems to be very cumbersome with multiple systems in place that are not inter-connected. This 

makes compliance effortful resulting in a disincentive to proactively attempt to create a strong 

safety culture.