What this is
What is a What If Study?
What is a What If Study?
It is a structured brainstorming technique for process hazard analysis: a facilitator leads a team through a process stage by stage, posing 'what if' questions about deviations, and the team records the cause, consequence, existing safeguards and a risk band for each answer. It is one of the recognised methodologies under process hazard analysis practice.
How is a What If Study different from HAZOP?
HAZOP applies formal guidewords (no, more, less, reverse) systematically to every node of a process design. A What If Study is looser and faster: it relies on the team's experience to generate scenarios rather than a fixed guideword set, which makes it quicker to run but more dependent on who is in the room.
Who needs to be in the room for a What If Study?
At minimum, someone who operates the process and someone who designed or engineers it, led by a facilitator who is not defending either position. Without both perspectives the study finds only the failures each discipline already expects.
Scope
When is a what if study required?
This is a hazard-identification study, not a task-level risk assessment and not the register the findings roll into. Using it for either produces records that report on nothing.
Use this template when
- A new process or system is being introduced and has not yet had a structured hazard review
- A significant change to an existing process is planned and the change itself needs a fresh look, not a re-read of the old study
- A customer requirement or capability concern raises a question the team cannot answer from memory
- A periodic revalidation of a process is due under the site's process safety programme
- The Critical Control and Fatal Risk programme calls for this step ahead of Risk Assessment or MOC
Do not use it for
- Job Safety Analysis, which breaks a single job into steps and sets controls task by task, not a whole process into stages.
- Hazard Identification Study, which is the broader identification pass this template sits alongside rather than replaces.
- Bowtie Analysis, which maps one already-known top event's causes and barriers in detail, rather than searching a process for scenarios.
- Task Risk Assessment, which uses the shared risk method on a defined task with known hazards, not an open exploratory question set.
- Anything outside process hazard review, which belongs to the workspace that owns that process
Compliance mapping
Which CCPS process hazard analysis requirements does this satisfy?
OSHA's process safety management standard names What-If as an acceptable PHA methodology and sets what any chosen methodology has to produce; the clauses below map those requirements onto this template's sections.
| Clause | Requirement | Where it lands |
|---|---|---|
| OSHA PSM 1910.119(e)(1) | The methodology used is appropriate to the process and is recorded, along with when it was applied | Header |
| OSHA PSM 1910.119(e)(3)(i) | The study is performed by a team with expertise in engineering and process operations | Header |
| OSHA PSM 1910.119(e)(2)(i) | The hazards of the process are identified stage by stage | Scenarios |
| OSHA PSM 1910.119(e)(2)(vii) | A qualitative evaluation of a range of possible safety and health effects is made for each scenario | Scenarios |
| OSHA PSM 1910.119(e)(2)(iii) | Engineering and administrative controls applicable to each hazard are identified and judged | Scenarios |
| OSHA PSM 1910.119(e)(5) | Findings and recommendations are resolved, and the resolution is documented | Scenarios |
| OSHA PSM 1910.119(e)(6) | The study is revalidated on a set cycle rather than left to stand indefinitely | Result |
What it does not cover
- Safeguards Adequate, which was marked Yes for every scenario without a single Recommendation being raised, suggesting the field was completed by habit rather than judgement.
- Process Stage, which lists only the stages the team already considered troublesome, leaving gaps in the process map that were never asked about at all.
- Risk Band, which reads Acceptable for a scenario whose Consequence field describes a credible serious injury, with no Likelihood or Severity rationale recorded to support the downgrade.
- Recommendations Raised in the Result section, which does not match the count of Scenarios where Safeguards Adequate is No or Partly, meaning findings were dropped between the scenario table and the summary.
- Next Review Due, which was left as a default date rather than set against the process's actual change frequency or the site's revalidation cycle.
Global
What If Study requirements by country
The What-If method sits inside process safety regimes that differ mainly in how prescriptive they are about when a study is mandatory and how long it can stand before revalidation.
OSHA Process Safety Management, 29 CFR 1910.119(e)
PHA is mandatory for covered highly hazardous chemical processes, with What-If named as one of the acceptable methodologies
A site with a covered process cannot treat this as optional good practice; the study, its team composition and its five-year revalidation cycle are enforceable requirements.
Control of Major Accident Hazards (COMAH) Regulations 2015
Major accident hazard sites must demonstrate systematic identification of hazards and assessment of their likelihood and consequences
A What If Study is one accepted way to evidence the systematic hazard identification a COMAH safety report has to show; the regulator will look for the same rigour, not the same template.
CCPS Guidelines for Hazard Evaluation Procedures
Describes What-If, and What-If/Checklist, as recognised hazard evaluation techniques alongside HAZOP and FMEA
Outside jurisdictions with a statutory PHA requirement, CCPS guidance is the practical benchmark auditors and insurers use to judge whether a study was rigorous or perfunctory.
How to complete it
How to complete a what if study, step by step
The fields are simple to fill in; the judgement calls decide whether the finished study would survive an auditor asking why a stage was missed or a scenario was scored low.
A team will generate the first few what-if questions from memory of past incidents. The harder, more valuable questions come from deliberately working through low-probability, high-consequence deviations the team has never seen happen. Deciding when the study has gone far enough is a judgement call, not a fixed question count.
Marking Safeguards Adequate as Yes should mean someone checked the safeguard exists and functions, not that it appears in a procedure somewhere. Treating a documented control as a working one is the single most common way a study understates its own findings.
Where Food Safety Consequence is anything above None, the study is no longer purely a safety document; it has a quality and HACCP dimension. Deciding whether that requires a quality reviewer alongside the facilitator, rather than a downstream HACCP reference field, is a call the site has to make deliberately.
A CAPA ID entered against a scenario is not the same as the safeguard being fixed. The study record should be treated as open until the linked CAPA is verified closed, not closed the moment a reference number is typed in.
What auditors find
Most common what if study findings
These are the failure patterns that show up most often when a What If Study record is checked against the process it claims to cover.
| Finding | Clause | What fixes it |
|---|---|---|
| Process stages with no what-if question at all | OSHA PSM 1910.119(e)(2)(i) | Require the process map's stage list to be pasted into the study before any Scenario rows are opened, so silence is visible. |
| Risk Band scored Acceptable against a Consequence describing serious harm | OSHA PSM 1910.119(e)(2)(vii) | Add a validation that blocks Acceptable when the Consequence text contains injury or fatality language, forcing a facilitator override with a reason. |
| Safeguards Adequate marked Yes with no safeguard described in Existing Safeguards | OSHA PSM 1910.119(e)(2)(iii) | Make Existing Safeguards required whenever Safeguards Adequate is answered, in either direction. |
| Recommendations written in the free-text field but never given a CAPA ID | OSHA PSM 1910.119(e)(5) | Require a CAPA ID or an explicit 'accepted risk, no action' reason before the record can move to Complete. |
| Design Documents Reviewed marked Partly with no note on what was missing | OSHA PSM 1910.119(e)(3)(i) | Add a conditional text field that opens whenever Design Documents Reviewed is not Yes. |
| Next Review Due set to a standard interval regardless of process criticality | OSHA PSM 1910.119(e)(6) | Default the review interval from the Highest Risk Band Found rather than a flat calendar rule. |
Case in point
Case in point: the stage nobody asked about
A site ran a What If Study ahead of a packaging line speed increase. The team worked through infeed, forming and sealing stages in detail, generating a dozen scenarios each with sensible safeguards, then closed the study with Highest Risk Band Found recorded as Medium.
The outfeed stage, where an operator manually cleared jams at the faster line speed, was never given a Process Stage row. It surfaced three months later as a Serious Potential Incident when a guard interlock, rated for the old cycle time, failed to stop the conveyor fast enough. The study had not found the risk wrong; it had simply never asked the question.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- SAF-063
- Archetype
- Assessment
- Record ID
- WHATIF-2026-000
- Scoring
- Risk band per scenario
- Direction
- High is bad
- Singleton
- No
- Basis
- CCPS process hazard analysis
- Links
- Feeds Risk Assessment, MOC
- Tags
- Risk, Process safety
- Sections
- 4
- Fields
- 34
- Follow up fields
- 3
- Repeating sections
- 1
- Links out
- 5
Header
12 fieldsStudy ID*
Auto sequence. Format WHATIF-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Study Date*
Facilitator*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Asset
Asset ID
Format AST-0000.
Links to FDN-002 Asset ID
Process Or System Studied*
Study Trigger*
Team Members*
Design Documents Reviewed*
- Yes3 pts
- Partly1 pt
- No0 pts
Scenarios
Repeats14 fieldsProcess Stage*
What If Question*
What if the pump stops. What if the valve is left open. What if the operator is called away.
Possible Cause*
Consequence*
Likelihood*
- Rare3 pts
- Possible1 pt
- Likely0 pts
Severity*
- Minor3 pts
- Moderate1 pt
- Serious0 pts
Risk Band*
- Acceptable4 pts
- Investigate2 pts
- Change soon1 pt
- Change now0 pts
Existing Safeguards*
Safeguards Adequate*
- Yes3 pts
- Partly1 pt
- No0 pts
Recommendation
CAPA ID
Links to FDN-014 CAPA ID
Food Safety Consequence
Process deviations in food plants often have a product consequence as well as a safety one.
- None4 pts
- Minor3 pts
- Product hold1 pt
- Recall potential0 pts
HACCP Plan Affected
HACCP Plan ID
Links to QUA-046 HACCP ID
Related records
1 fieldRisk ID
The register entry the scenarios roll into.
Links to FDN-012 Risk ID
Result
7 fieldsScenarios Considered*
Recommendations Raised*
Highest Risk Band Found*
- Low5 pts
- Medium4 pts
- High2 pts
- Very high1 pt
- Extreme0 pts
Added To Risk Register*
- Yes3 pts
- No0 pts
Next Review Due*
Facilitator*
Signature*
SAF-063 · record IDs look like WHATIF-2026-000 · Feeds Risk Assessment, MOC
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The study itself is a conversation; what slips is making sure every stage got asked about and every finding actually closes out somewhere.
Holds the What If Study library against the site's process map, flags stages with no recorded scenario, and tracks every recommendation through to its linked CAPA.
Surfaces which safeguards named in Existing Safeguards are actually maintained assets, so 'adequate' can be checked against maintenance history rather than assumed.
Matches Training Or Briefing outcomes from linked change and risk records against the crew rostered on the studied process, so a finding that needs a briefing doesn't go quiet.
Coordinates the facilitator and reviewers, rolls open recommendations into one view across every study, and holds every write for approval before it touches a record.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Glossary
What If Study definitions and key terms
- What-If method
- A hazard evaluation technique where a facilitator poses open questions about deviations at each process stage and the team answers from experience, rather than following fixed guidewords.
- Process hazard analysis (PHA)
- A systematic review of a process to identify, evaluate and control hazards, required under process safety management regimes for covered processes.
- Risk band
- A categorical rating, derived from likelihood and severity, that groups a scenario into a tier such as Acceptable, Investigate, Change soon or Change now.
- Safeguard
- An existing engineering or administrative control that reduces the likelihood or consequence of a scenario, distinct from a new recommendation raised by the study.
- Revalidation
- The scheduled re-examination of a PHA to confirm it still reflects the process as actually operated, typically on a fixed cycle rather than only after an incident.
FAQ
Frequently asked questions about what if study
What is a What If Study based on?+
It follows the What-If methodology described in CCPS hazard evaluation guidance, one of the techniques accepted under process hazard analysis practice and, where applicable, OSHA's process safety management standard.
What sections does the What If Study template contain?+
Four sections: Header, Scenarios, Related records and Result. Scenarios repeats once for each what-if question raised, so a study can hold as many rows as the process needs.
When should a new What If Study be raised?+
When a process is new, before a significant change, in response to a customer requirement or capability concern, or on a periodic cycle. Each record gets its own ID in the form WHATIF-2026-000.
Which programme does the What If Study belong to?+
It sits in the Critical Control and Fatal Risk programme, and its findings feed into Risk Assessment and management of change records.
How is a What If Study scored?+
Each scenario gets a risk band from its likelihood and severity; the study as a whole reports its Highest Risk Band Found, which drives whether the finding is added to the risk register.
Can the What If Study template be changed?+
Yes. The stages, scoring and conditional fields are all editable. Most sites run it as delivered for one cycle before adjusting the risk band thresholds to match their own tolerance.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Critical Control and Fatal Risk
Bow Tie Analysis Record
Maps threats, the top event, consequences and the barriers on each side for a major hazard
Barrier Health Review
Reviews whether the barriers relied on in a bow tie are actually in place and working
Critical Control Register
Lists the controls that stand between your people and a fatal or catastrophic event, with an owner and a required check frequency for each
Risk Assessment
The single risk assessment used across the whole business
Serious Potential Incident Report
Used when an event could have killed or seriously injured someone, whatever the actual outcome
Job Safety Analysis
Breaks a job into steps, finds the hazards in each and sets the controls
More in Risk Studies
Job Safety Analysis
Breaks a job into steps, finds the hazards in each and sets the controls
Pre-Task Risk Assessment
A short check done by the crew right before work starts, covering what has changed today
Task Risk Assessment
A fuller assessment of a task, its hazards and its controls, using the shared risk method
Hazard Identification Study
A structured search for hazards across an area, process or new installation
Bowtie Analysis
Maps a major hazard from its causes through to its consequences, and shows which barriers sit in between
Change Risk Review
Assesses the risk created by a proposed change before it goes ahead
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- OSHA Process Safety Management — 29 CFR 1910.119(e)
- CCPS — Guidelines for Hazard Evaluation Procedures
- Control of Major Accident Hazards (COMAH) Regulations 2015
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.