It's Done. It's Reported. Prove It.

Every safety system runs on two sentences. It's done. It's reported.

The control is in place. The action is closed. The audit is green. The report went up the line, and the person at the top read it and believed it — because what else were they meant to do?

A court in New Zealand has just answered that question, and the answer should be on the desk of every executive and HSE manager.

What happened at the Port of Auckland

In August 2020, stevedore Pala'amo Kalati was killed when a container fell on him during night-shift lashing work.

The former chief executive, Tony Gibson, was prosecuted personally under New Zealand's Health and Safety at Work Act. He was found guilty in 2024, fined $130,000 plus $60,000 in costs, and in April this year the High Court dismissed his appeal. It's the first time in New Zealand an officer of a large company has been convicted of breaching their due diligence duty.

Here's the part that matters. He wasn't convicted for not caring. The court described him as a good leader, dedicated to the port and its people. As forensic engineer Sean Brady put it in his analysis of the judgment: Gibson wasn't convicted because he didn't care about safety. He was convicted because he failed to ensure a fatal risk was being effectively managed.

What the courts found:

• He was personally aware of the critical risks in stevedoring and load handling.
• The exclusion zone guidance and training material were confusing and inconsistent.
• Performance monitoring couldn't detect non-compliance with the exclusion zone rule — particularly on night shifts.
• After a previous fatality in 2018, he was on notice that the port had difficulties monitoring work as done.
• The port's bow-tie work on its critical risks, as Brady's analysis describes it, ran out of steam.

Read that list again. None of it is a missing procedure. The procedure existed. The critical risk was known. The bow-ties had been started. The reports came up the line.

What was missing was any reliable way of knowing whether the control was actually working at 2am on the wharf.

"It's done" is not a control

The principle the courts drew out is blunt: officers cannot simply rely on subordinates, advisers or assurances that systems are working. They have to challenge the information and make sure verification exists.

There's also a line from the trial judge that every executive should sit with: a conscientious officer may still breach the duty despite the best of intentions.

That's the uncomfortable truth underneath this whole case. Good intent isn't a defence. Neither is a well-written system. Neither is a reporting line full of people telling you, honestly, that it's done.

"It's done" usually means the task was completed. It rarely means the barrier was proved to work, on the shift where it mattered, by someone who'd know the difference.

This applies here, too

Don't read this as a New Zealand story. Australia's model WHS laws put the same duty on officers, and they're specific about it: officers must take reasonable steps to verify the provision and use of the resources and processes that manage risk.

Verify. Not receive a report on. Not see a green dashboard. Verify.

The NZ courts essentially tested Gibson against that word — and the finding at trial was that he hadn't taken reasonable steps to verify that the exclusion zone processes were actually being used.

Why independent assurance is the answer

Here's the structural problem, and it's nobody's fault. The people who report that a control is in place are almost always the people responsible for putting it there. They're not lying. They're telling you what they believe — the same belief the system is built on.

That's not assurance. That's the system marking its own homework.

Independent assurance breaks that loop. Someone who didn't build the control, doesn't own the schedule, and isn't reporting their own performance goes to the workface and asks one question: is this barrier actually working, right now, on the shift where it matters?

It isn't about distrust. It's about giving the people at the top something they can genuinely rely on — because the courts have now made clear that relying on anything less isn't enough.

Good independent assurance looks like this:

• It goes where the risk is, when the risk is. Night shift, not day shift. During the lift, not after it. Gibson's monitoring couldn't see night shift — that's exactly where the gap lived.
• It tests the critical few, not everything. The handful of controls that stand between a person and a fatality, each with a clear standard for what "working" looks like.
• It produces evidence, not opinion. What was checked, how, when, and by whom — a named, competent person signing what they actually proved.
• It reports what it finds, unfiltered. Including the bit nobody wants to hear.

How leadership should respond

If you sit at the top of an organisation with fatal risks, here's what this case asks of you:

1. Know your fatal risks by name. Not as a register reference — as something you could explain to a worker. Maritime NZ's message from this case was exactly that: executives need to understand the critical risks in their business.
2. Stop accepting "done" as the answer. When an action is reported closed, ask how do we know it's working? If the answer is "it was reported," you've found the gap.
3. Treat repeat events as a notice, not a statistic. The court said the 2018 fatality should have put the CEO on notice. Every repeat incident, every second near miss of the same kind, is the system telling you the paper and the workface have come apart.
4. Finish what you start. A bow-tie programme that runs out of steam is arguably worse than none, because everyone believes the work was done.
5. Get an independent set of eyes on your critical controls. Not a document audit. A field verification, on the shifts that matter, by someone with no stake in the answer.
6. Act on what it tells you, visibly. Assurance that finds a gap and changes nothing is just a better-documented version of the same failure.

The most dangerous moment in a safety system isn't when something goes wrong. It's when someone says it's done, someone else says it's reported, and everyone believes it. A good leader with good intentions was convicted because he trusted that chain without testing it.

So the next time something comes across your desk as closed, ask the only question that holds up — in the field and in court: how do we know it's working?

Further reading

• Lessons from the Ports of Auckland CEO conviction, Sean Brady. A forensic engineer's comparison of the court's reasoning against what works in fatal risk management: understand your fatal risks, be clear on your critical controls, verify they're in place and effective.
• High Court dismisses Tony Gibson appeal, Maritime NZ, April 2026. The regulator's summary of the appeal outcome.
• Officer due diligence conviction upheld, HR Magazine. A plain-English read of what due diligence now means for a large organisation.

Independent field verification of HSE systems and critical controls — on the shifts and tasks where the risk actually sits, with a named, competent person signing what they proved — is part of ROC Advice's independent HSE audit work.

First published in The Field Note on LinkedIn.

Read and comment on LinkedIn