U.S. C H E M I C AL S A F E T Y A N D H A Z A R D I N V E S T I G A T I O N B O A R D

INVESTIGATION REPORT VOLUME 4 DRILLING RIG EXPLOSION AND FIRE AT THE MACONDO WELL (11 Fatalities, 17 Injured, and Serious Environmental Damage)

DEEPWATER HORIZON RIG MISSISSIPPI CANYON 252, GULF OF MEXICO

KEY ISSUES: APRIL 20, 2010

• US OFFSHORE SAFETY REGULATION DURING AND AFTER MACONDO • ATTRIBUTES OF AN EFFECTIVE REGULATOR AND REGULATORY SYSTEM

REPORT NO. 2010-10-I-OS 4/17/2016

[This page left intentionally blank.]

Contents ACRONYMS AND ABBREVIATIONS ..................................................................................................... 7

REGULATORY OVERSIGHT OF U.S. OFFSHORE OIL AND GAS OPERATIONS: A CALL FOR MORE ROBUST AND PROACTIVE REQUIREMENTS ....................................................................... 10

VOLUME 4 – INTRODUCTION .............................................................................................................. 11 1.1 Approach to Analysis..................................................................................................................... 12 1.2 Attributes of an Effective Regulatory Model ................................................................................. 13

2.0 REVIEWING INTERNATIONAL REGULATORY MODELS .................................................. 18 2.1 History of Safety and Environmental Management Systems Offshore in the US ......................... 18 2.1.1 The Outdated API Offshore Safety Management System Approach................................ 20 2.2 Purpose of the Regulations and Role of the Regulator .................................................................. 22 2.3 An Alternative Regulatory Model: The Safety Case ..................................................................... 23 2.4 Managing Major Accident Hazards in the US ............................................................................... 26

3.0 INADEQUATE POST-MACONDO SAFETY MANAGEMENT REGULATIONS .................. 28 3.1 SEMS: No Goal-Setting Risk-Reduction Standard ....................................................................... 29 3.1.1 The Use of Standards and Guidance in ALARP-based Regulatory Regimes ................... 33 3.1.2 Insufficient US Alternative Legal Mechanisms to Drive Continual Safety Improvements 35 3.1.3 Ineffective Regulatory “Workarounds” ............................................................................ 37 3.1.4 Recent BSEE-proposed Regulatory ALARP-type Language ........................................... 38 3.2 SEMS Activity-Based Requirements: A Compliance-Based Mentality ........................................ 39 3.3 Safety Responsibility Offshore ...................................................................................................... 43 3.3.1 Offshore Regulatory Ambiguity and Industry/Stakeholder Response .............................. 45 3.3.1.1 Post-Macondo BSEE Efforts to Hold Contractors Responsible for Safety ... 48 3.3.1.2 Stakeholders Attempt to Fill Responsibility Gap with Voluntary Guidance 50 3.3.2 Other Regimes’ Focus on Safety Responsibilities of Operator/Lessee and Drilling Contractor 51 3.3.3 Conclusion ........................................................................................................................ 54 3.4 Insufficient SEMS Worker Participation Provisions ..................................................................... 54 3.4.1 Post-Macondo/SEMS Worker Participation Provisions ................................................... 56 3.4.2 Insufficient and Limited SEMS Worker Participation Provisions .................................... 57 3.4.3 No SEMS Provisions for Worker-Elected Safety Representatives ................................... 59

3.4.4 No SEMS Requirement for Contractor Participation ....................................................... 62 3.4.5 SEMS Stop-Work Authority Impact on Worker Liability ................................................ 63 3.4.6 Inadequate SEMS Requirements to Protect Workers from Retaliation ............................ 64 3.4.7 No SWA Worker-Requested Regulatory Provision in Regulation ................................... 67 3.4.8 No SEMS Safety Committees or Tripartite Safety Forums Provision.............................. 68 3.4.9 Conclusion ........................................................................................................................ 70

4.0 US OFFSHORE REGULATOR CHALLENGE IN EFFECTIVE OVERSIGHT ........................ 71 4.1 No Required Review of Major Accident Hazard Documentation Before Hazardous Work Begins 72 4.2 Regulatory Safety Oversight Audits and Initiatives ...................................................................... 77 4.2.1 Challenges of Relying on Third-Party Audits in the GoM ............................................... 79 4.3 Regulatory Use of Safety Performance Indicator Data .................................................................. 80 4.3.1 Roadblocks to Regulatory Improvements in Data Collection and Analysis ..................... 81 4.3.2 Inadequate Use of Safety Performance Indicators ............................................................ 85 4.4 Transparency of Offshore Safety ................................................................................................... 89 4.4.1 Regulatory Approaches to Transparency .......................................................................... 90

5.0 INSUFFICIENT AND INADEQUATE STAFF FOR APPROPRIATE OVERSIGHT ............... 95 5.1 Models for Building a Competent Regulator ................................................................................. 95 5.1.1 UK Offshore Safety Directive Regulator .......................................................................... 95 5.1.2 US Government Incentives to Build Competent Staff ...................................................... 97 5.2 Disproportionate Regulator Resources for Gulf of Mexico Offshore Activity.............................. 98 5.3 The Deficit in Regulator Technical Competency and Credibility ............................................... 101 5.4 Post-Macondo Efforts to Improve Competency .......................................................................... 102 5.5 Insufficient Regulatory Funding Mechanism for Securing Staff ................................................. 103 5.5.1 Ineffectual Funding Appropriations for Offshore Activity ............................................. 104 5.5.2 Industry Funding of International Offshore Regulators.................................................. 107 5.6 The Importance of an Independent Regulator.............................................................................. 109 5.6.1 The Minerals Management: The Safety Versus Revenue Conflict................................. 109 5.6.2 BSEE Organizational Structure ...................................................................................... 111 5.6.3 Critical BSEE Drilling Permit Concerns ........................................................................ 114 5.6.4 Historical Recognition for Separating Safety Oversight from Resource Development.. 115 5.6.4.1 Creation of the Mine Safety and Health Administration ............................. 115

5.6.4.2 Creation of the Nuclear Regulatory Commission ....................................... 115 5.6.4.3 Creation of the UK HSE Offshore Division ................................................ 116

6.0 CONCLUSION ............................................................................................................................ 117

7.0 RECOMMENDATIONS ............................................................................................................. 118

APPENDIX A: INTERNATIONAL OFFSHORE INCIDENTS AND THE US RESPONSE................ 122 Alexander Kielland and Regulatory Change in Norway........................................................................... 122 Ocean Ranger and Regulatory Change in Canada .................................................................................... 123 Piper Alpha and Regulatory Change in the United Kingdom ................................................................... 124 Montara and Regulatory Change in Australia........................................................................................... 125 History of Regulatory Change in the US .................................................................................................. 126

Figures and Tables

Figures Figure 3-1. Transocean’s Well Delivery Process as defined by Transocean corporate polices.................. 44 Figure 4-1. Department of Interior organization chart: at the time of the April 20, 2010, Macondo incident and currently. .................................................................................................................................... 113

Tables Table 3-1. Current and BSEE proposed language for § 250.107, What must I do to protect health, safety, property, and the environment? .......................................................................................................... 39 Table 4-1. Abridged list of reportable incidents to BSEE from § 250.188. ................................................ 82

Acronyms and Abbreviations

AB Accreditation Body ACOP Approved Code of Practice AEC Atomic Energy Commission ALARA As Low As Reasonably Achievable ALARP As Low As Reasonably Practicable ANSI American National Standards Institute AOC Acknowledgement of Compliance API American Petroleum Institute ASME American Society of Mechanical Engineers ASP Audit Service Provider ASTM American Society for Testing and Materials BAST Best Available and Safest Technology BOEM Bureau of Ocean Energy Management BOEMRE Bureau of Ocean Energy Management, Regulation, and Enforcement BOP Blowout Preventer BSEE Bureau of Safety and Environmental Enforcement CCPS Center for Chemical Process Safety C.F.R. Code of Federal Regulations COMAH Control of Major Accident Hazards COS Center for Offshore Safety CSB U.S. Chemical Safety Board CUPA Certified Unified Program Agency DAFW Days Away From Work DNFSB Defense Nuclear Facilities Safety Board DNV Det Norske Veritas DOI Department of Interior DWH Deepwater Horizon EPA Environmental Protection Agency EPP Employee Participation Plan

FRC Financial Reporting Council GAO US Government Accountability Office GASCET Guidance for the Topic Assessment of Major Accident Hazard Aspects of Safety Cases GoM Gulf of Mexico HSE Health Safety Executive (of the United Kingdom) IADC International Association of Drilling Contractors INC Incident of Noncompliance INPO Institute of Nuclear Power Operations IPD Interim Policy Document IRF International Regulators’ Forum ITL Information to Lessee JSA Job Safety Analysis LCM Loss Circulation Material LTI Lost Time Incident MBI Marine Board of Investigation MDL Multi-District Litigation MESA Mining Enforcement and Safety Administration MMS Minerals Management Service MOA Memorandum of Agreements MOC Management of Change MODU Mobile Offshore Drilling Unit MSHA Mine Safety and Health Authority NAE National Academy of Engineering NOPSA National Offshore Petroleum Safety Authority; formally NOPSEMA (of Australia) NOPSEMA National Offshore Petroleum Safety and Environmental Management Authority NRC Nuclear Regulatory Commission NTL Notice to Lessee OCS Outer Continental Shelf OCSLA Outer Continental Shelf Lands Act OECD Organization for Economic Co-operation and Development OESAC Ocean Energy Safety Advisory Committee

OIAC Offshore Industry Advisory Committee OIM Offshore Installation Manager ONRR Office of Natural Resources Revenue OOC Offshore Operators Committee OSDR Offshore Safety Directive Regulator OSHA Occupational Safety and Health Administration OTC Offshore Technology Conference PHMSA Pipeline and Hazardous Materials Safety Administration PINC Potential Incident of Noncompliance PSA Petroleum Safety Authority PSM Process Safety Management RIF Recordable Injury Frequency ROP Reactor Oversight Process SEC Securities and Exchange Commission SEMP Safety and Environmental Management Program SEMS Safety and Environmental Management System SHE Safety, Health and Environment SMS Safety Management System SOP Standard Operating Procedure SWA Stop Work Authority TRB Transportation Research Board TPSR Total Potential Severity Rate TRIR Total Recordable Injury Rate UK United Kingdom US United States USCG United States Coast Guard UWA Ultimate Work Authority WCS Well Construction Standards WEST Workforce Engagement Support Team WOMP Well Operations Management Plan

Volume 4 Regulatory Oversight of U.S. Offshore Oil and Gas Operations: A Call for More Robust and Proactive Requirements

Volume 4 – Introduction In the aftermath of the Macondo incident, the US offshore safety regulations for drilling and completions activities on the outer continental shelf have been reviewed, debated, and revised. 1 Amid several reorganizational efforts, the Department of Interior established the Bureau of Safety and Environmental Enforcement (BSEE) in October 2011 to oversee safety of the US offshore oil and gas operations. 2 BSEE’s immediate predecessor, the Bureau of Ocean Energy Management, Regulation & Enforcement, (BOEMRE), 3 promulgated the Safety and Environmental Management Systems (SEMS) rule in October 2010, 4 requiring the previously voluntary practices in the American Petroleum Institute's (API) Recommended Practice 75 (API 75). 5 After BSEE’s creation, the agency amended SEMS in 2013 to further its initiative for performance-based 6 regulations to “reduce the occurrence of accidents, injuries, and spills during oil and gas activities on the Outer Continental Shelf (OCS).” 7 In April 2015, BSEE proposed well control regulations that it identified as the “most substantial rulemakings in the history” of offshore safety in the United States. 8 Most recently, on December 7, 2015, BSEE announced the launch of a pilot Risk-Based Inspection Program to complement its existing inspections and audits with the goal of more efficiently and effectively managing the limited inspection and auditing resources of the agency. 9 In support of these endeavors, BSEE has made efforts over the last five years to educate its staff and

1 See Appendix A for a history of offshore US oil and gas safety regulation. Including pre-Macondo events. 2 http://www.bsee.gov/About-BSEE/BSEE-History/index/ (accessed January 19, 2016). 3 BOEMRE replaced the Minerals Management Service (MMS) shortly following the Macondo incident in 2010. 4 Oil and Gas and Sulphur Operations in the Outer Continental Shelf, 75 Fed. Reg. 63609 (Final Rule, October 15, 2010) (to be codified at 30 C.F.R. Part 250). 5 API Recommended Practice 75, 3rd ed., Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities, May 2004 (Reaffirmed May 2008). 6 The US Nuclear regulatory commission defines performance-based regulation as “a regulatory approach that focuses on desired, measurable outcomes, rather than prescriptive processes, techniques, or procedures. Performance-based regulation leads to defined results without specific direction regarding how those results are to be obtained;” http://www.nrc.gov/reading-rm/basic-ref/glossary/performance-based-regulation.html (accessed January 19, 2016). 7 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Revisions to Safety and Environmental Management Systems, 78 Fed. Reg. 20423 (Final Rule, April 5, 2013) (to be codified at 30 C.F.R. Part 250); While the original SEMS rule became effective on November 15, 2010, this subsequent enhancement effective June 4, 2013 is referred to as SEMS II. SEMS II incorporated additional safety requirements that addressed stop work authority, ultimate work authority, employee participation plans, guidelines for reporting unsafe work conditions, job safety analyses, and independence of accredited audit service providers. Unless otherwise stated, when the CSB refers to SEMS, it is addressing both the original SEMS rule and the subsequent SEMS II revisions; see also, BSEE. Safety and Environmental Management Systems (SEMS) Fact Sheet; http://www.bsee.gov/BSEE- Newsroom/BSEE-Fact-Sheet/SEMS-II-Fact-Sheet/ (accessed March 21, 2016). 8 Oil and Gas and Sulphur Operations in the Outer Continental Shelf—Blowout Preventer Systems and Well Control, 80 Fed. Reg. 21504 (Proposed Rule, April 17, 2015) (to be codified at 30 C.F.R. Part 250). 9 Bureau of Safety and Environmental Enforcement to Launch Pilot Risk-Based Inspection Program for Offshore Facilities. December 7, 2015. http://www.bsee.gov/BSEE-Newsroom/Press-Releases/2015/Bureau-of-Safety-and- Environmental-Enforcement-to-Launch-Pilot-Risk-Based-Inspection-Program-for-Offshore-Facilities / (accessed December 21, 2015).

engage in dialogue with industry, regulatory bodies, and safety experts worldwide to improve its function as the regulator of offshore safety. While the acknowledging these positive efforts, the CSB concludes that the SEMS regulations do not provide BSEE with an adequate framework for major accident prevention, and an improved approach is needed to reduce the risk of another Macondo-like event. SEMS does not utilize goal-setting, meaning the reduction of risks to a goal such as “as low as reasonably practicable” (ALARP). In addition, notwithstanding the implementation of SEMS, BSEE audit findings suggest that a culture of minimal regulatory compliance continues to exist in the Gulf of Mexico and risk reduction continues to prove elusive. 10 Ultimately, the offshore regulatory changes made thus far do not sufficiently place the onus on industry to reduce risk or empower the regulator to ensure proactive and effective industry management and control of major hazards.

1.1 Approach to Analysis The CSB’s preventive mission as a federal agency is to reduce chemical hazards as broadly as possible (e.g., through recommendations that will effect national preventive changes). The CSB, therefore, focuses its recommendation efforts on changing national legislation, regulation, voluntary consensus standards, and industry recommended practices. As a result of an investigation or study, the CSB may issue “proposed rules or orders” to regulators such as the EPA Administrator and the Secretary of Labor “to prevent or minimize the consequences of any release of substances that may cause death, injury or other serious adverse effects on human health or substantial property damage as the result of an accidental release.”11 The CSB’s investigative analytical approach, therefore, must look beyond technical and management system causes. The CSB approach to regulatory analysis and recommendations starts with an examination of key investigative findings and an analysis of whether the applicable regulatory and enforcement regime manifests weaknesses or gaps that were causally related to the incident. The CSB formulates recommendations that, if effectively implemented, work to prevent or reduce the similar incidents or hazards to as great an extent as possible. For example, key findings in Volumes 3 and 4 of the Macondo Report show that the US offshore regulator lacks effective use of key process safety indicators and guidance addressing corporate boards of directors and human factors focused on major accident prevention. The CSB report analysis shows that addressing these significant gaps could help reduce the risk of similar incidents.

10 See Section 4.2 and Bureau of Safety and Environmental Enforcement. BSEE Priorities Regarding SEMS, Offshore Technology Conference, Houston, TX, 2015; http://www.bsee.gov/uploadedFiles/BSEE/BSEE_Newsroom/Speeches/2015/OTC%202015%20Mtg%20SEMS% 20Presentation.pdf (accessed December 19, 2015). 42 USC sec. 7412(r)(6)(c)(ii).

Throughout Volume 4, the CSB refers to “the regulator” or “offshore regulations” to indicate either MMS or BSEE and their respective safety regulations for drilling and completions activities on the outer continental shelf. As indicated in the figure below, MMS evolved into BSEE after the Macondo incident occurred. In reality, several regulatory bodies oversee the offshore oil and gas industry, including the US Coast Guard (USCG), the Bureau of Ocean Energy Management (BOEM), and the Environmental Protection Agency (EPA), but the CSB generally limits its discussion to MMS and BSEE due to its specific authority over the safe conduct of offshore drilling and completion operations.

1.2 Attributes of an Effective Regulatory Model Various international models for offshore safety regulation can be used to compare and contrast what the US regulator has adopted since Macondo. No one approach is an undisputed panacea for all accidents, partly because prevention requires active and sustained participation in risk reduction from industry, the workforce, and the regulator. Ultimate responsibility for preventing incidents and protecting workers and the public always remains with the employers and parties who create or control major accident risk. Yet regulatory systems have an important role to play in establishing sufficient requirements, guidance, and

oversight to establish a floor of practice that if covered employers implement effectively works to reduce major incidents. As part of the agency’s investigative approach, the CSB frequently compares international regulatory regimes from what existed at the worksite under investigation to examine the strengths and weaknesses of different models and methodologies. 12 It would be incorrect, however, to assume that an effective model found in some other international jurisdiction could necessarily be imported to the US with no allowance for important variances that may exist among cultures, existing legal and regulatory structures, political systems, as well as numerous and varied industry stakeholder interests and levels of involvement. To that end, the CSB reviews international regulatory models to identify various attributes that could strengthen the current US offshore regulatory environment. This helps clarify key attributes that could provide more effective safety regulation for addressing identified gaps and weaknesses. Recent CSB reports used this approach, such as those analyzing the 2010 Tesoro Anacortes and 2012 Chevron Richmond refinery incidents, and have identified attributes from other regulatory regimes to address causal regulatory gaps related to the incidents. 13 Those attributes related to the Macondo incident causal factors include:

Continual Risk Reduction to Levels As Low As Reasonably Practicable (ALARP) The intention of a goal-based, risk-reduction regulatory framework is to eliminate or sufficiently minimize the risks in an operation. Although risk can never be completely eliminated, any such framework must continually strive toward this goal. With major accident hazards, the key question becomes: Is there anything more that can be done to reduce the risk? ALARP is a standard familiar to industry in other global offshore regimes, and even in other high-hazard industries in the US. In such regimes, the government sets the goal, and the duty holder demonstrates how it will meet that goal through submitted documentation. The regulator then holds the duty holder accountable to execute that

12 In the investigation of a 1999 fire that killed four workers at the Tosco Avon refinery in Martinez, California, the CSB report identified features and attributes from the UK HSE’s regulatory guidance related to safe piping and equipment opening in process plants that supported the analysis and recommendations in the report. See USCSB, 2001, Refinery Fire Incident, Martinez, CA, February 23, 1999, Report No. 99-014-I-CA, Section 3, pp 31-44, March 2001, http://www.csb.gov/assets/1/19/Tosco_Final_Report.pdf (accessed March 25, 2016). In the 2002 CSB Hazard Investigation Report, Improving Reactive Hazard Management, the CSB concluded that the UK HSE and European Union utilize a comprehensive “all hazards” approach to reactive hazard management with regulatory requirements based upon a facilities’ written analysis of specific hazards and needed controls rather than limited to an approach that only reviews listed chemicals based upon their inherent instability. Those regulatory attributes buttressed CSB’s recommendations that called upon EPA and OSHA to base reactive hazard coverage upon classifications beyond a list that would include combinations of chemicals and process specific conditions. See USCSB, 2002, Improving Reactive Hazard Management, Section 8.1.3, pp 83-84, October 2002, http://www.csb.gov/file.aspx?DocumentId=355 (accessed March 25, 2016). 13 USCSB,