Is Preventive Maintenance a Critical Control?
.png)
Recently, I posed a question on LinkedIn (and even to a few colleagues at school):
Is preventive maintenance a critical control?
I did two things deliberately when I asked this question:
- I didn’t share my own view upfront.
- I knew it might stir a bit of debate not necessarily controversy, but healthy discussion.
It’s one of those topics where perspectives differ, and I was genuinely curious to see how people think about it. After reading the responses and reflecting on my own view, I wanted to share my take.
For me, the answer comes in two parts:
- No, preventive maintenance is not a critical control.
- However, it still plays a vital supporting role in effective risk management.
Let me unpack that.
What Defines a Control?
If we go back to basics, a control is often defined as an act, object, or system that prevents or mitigates an unwanted event. In that sense, preventive maintenance could be seen as a system, perhaps fitting into the technological category.
But here’s where it doesn’t pass the test — a true control should be specific, measurable, and auditable.
“Preventive maintenance” is too broad and general to meet those criteria. Because of that, I don’t consider it a control and certainly not a critical control.
Understanding Support Activities vs. Controls
A useful way to visualize this is through a model that separates:
- True controls – the things that directly prevent or mitigate an unwanted event.
- Support activities – actions that maintain or enhance the effectiveness of those controls.
- Verification activities – checks that confirm controls are in place and functioning.
From this perspective, maintenance sits firmly in the “support activity” space.
It’s not specific, measurable, and auditable in the same way a control should be but it does maximize the health of a control.
For example, take brakes on a vehicle:
- The brakes themselves are the control.
- Maintenance ensures the brakes continue to work effectively.
That distinction matters. While there may be exceptions at a detailed level where specific maintenance actions could act as controls at a system level, maintenance is generally a support activity, much like training or education.
The Broader Role of Maintenance in Risk Management
That said, maintenance is still foundational.
It underpins effective critical risk management and contributes to cost control, asset integrity, and the prevention of damage or loss.
If we think about traditional Critical Risk Management (CRM) models where we identify critical risks, map them through bow tie analyses, define controls, performance standards, and verification processes we tend to look at these vertically.
But there’s also a horizontal layer of what I call principal control systems or foundation systems.
These systems like asset management, training, and yes, preventive maintenance support multiple critical risks across the organization.
A robust maintenance system strengthens our ability to manage critical risks effectively. Conversely, a poor or ineffective maintenance system can enable failures that lead to unwanted events like a truck fire or brake failure due to neglected maintenance.
Bringing It All Together
So, to summarize:
- Preventive maintenance isn’t a critical control because it doesn’t meet the specific, measurable, and auditable test.
- However, it’s a vital foundation system that supports the performance and reliability of true controls across the business.
In practice, effective governance means we should focus on both:
- The vertical dimension — managing critical risks and their controls, and
- The horizontal dimension — ensuring our foundational systems (like maintenance) are robust and integrated.
And perhaps most importantly, we should look at the intersections between these layers where systems and controls interact because that’s often where strengths or weaknesses emerge.
Final Thoughts
That’s my perspective on whether preventive maintenance qualifies as a critical control. I’m always interested to learn from others especially those who see it differently.
Thanks to everyone who joined the conversation and shared their thoughts. These discussions are how we all continue to learn and evolve our approaches to risk management.
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.webp)
.webp)
.png)
Ready to Save Lives at Work?
With Impress Solutions, you’re not just getting a service, you’re securing peace of mind with a partner you can trust. Book a free consultation today, and let’s map out how we can help you save lives at work.
.png){kind=small}