Developing process safety indicators A step-by-step guide for chemical and major hazard industries This is a free-to-download, web-friendly version of HSG254 (First edition, published 2006). This version has been adapted for online use from HSE’s current printed version.

You can buy the book at www.hsebooks.co.uk and most good bookshops.

ISBN 978 0 7176 6180 0 Price £11.95

This guidance is aimed at senior managers and safety professionals within major hazard organisations that wish to develop performance indicators to give improved assurance that major hazard risks are under control.

It is presumed that companies using this guide already have appropriate safety management systems, so the emphasis is on checking whether their risk controls are effective and operating as intended. The guide draws on good practice in the UK chemical sector.

Too many organisations rely heavily on failure data to monitor performance, so improvements or changes are only determined after something has gone wrong. Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions.

While aimed mainly at major hazard organisations, the generic model for establishing a performance measurement system described in this guide will also apply to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended.

HSE Books

© Crown copyright 2006

First published 2006

ISBN 978 0 7176 6180 0

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner.

Applications for reproduction should be made in writing to: The Office of Public Sector Information, Information Policy Team, Kew, Richmond, Surrey TW9 4DU or e-mail: licensing@opsi.gov.uk

This guidance is issued by the Health and Safety Executive. Following the guidance is not compulsory and you are free to take other action. But if you do follow the guidance you will normally be doing enough to comply with the law. Health and safety inspectors seek to secure compliance with the law and may refer to this guidance as illustrating good practice.

Contents Foreword 4

Part 1: Introduction 5 Structure and content 6 Measuring performance – early warning before catastrophic failure 6 What’s different about this guide? 6

Part 2: Six steps to performance measurement 10

Step 1: Establish the organisational arrangements to implement indicators 11

Step 2: Decide on the scope of the indicators 13

Step 3: Identify the risk control systems and decide on the outcomes 18

Step 4: Identify critical elements of each risk control system 22

Step 5: Establish data collection and reporting system 25

Step 6: Review 26

Part 3: Worked example 28 Risk control systems 37

References 58

Further information 59

Foreword There is a collective need for the chemical and major hazard sectors to demonstrate that risks are being adequately controlled, as the industry is often judged by the worst performer or against the last major incident to gain public attention. Since the publication of the BP Grangemouth Major incident investigation report,1 the Health and Safety Executive (HSE) and industry have been working closely to develop the means by which companies can develop key performance indicators for major hazards and ensure process safety performance is monitored and reported against these parameters.

This guide has been produced jointly by HSE and the Chemical Industries Association (CIA), based on information and ideas from industry. The six-stage process outlined should help companies through the main steps towards implementing process safety performance indicators.

Investigation of major incidents chemical and major hazard installations have shown that it is vital that chemical companies know that systems designed to control risks operate as intended. This work, built from close collaboration between HSE and industry, helps provide this assurance. It is important that we continue to share understanding of best practice in this developing area. Reviewing performance will increasingly feature in our inspection programme.

Kevin Allars Head of Chemical Industries Division HSE Measurement leads to confidence.

Our Responsibe Care®2 commitment is to continuous improvement in all aspects of health, safety and environmental management. This important new initiative will help us all gain a better understanding of potentially serious incident precursors, and will enable us to make further improvements to our overall health, safety and environmental management systems.

Steve Elliot Director General Chemical Industries Association

Part 1: Introduction Measurement leads to confidence

1 This guide is intended for senior managers and safety professionals within organisations that wish to develop performance indicators to provide assurance that major hazard risks are under control. A small number of carefully chosen indicators can monitor the status of key systems and provide an early warning should controls deteriorate dangerously.

2 Although primarily aimed at major hazard organisations, the generic model for establishing a performance measurement system described in this guide can equally be applied to other enterprises requiring a high level of assurance that systems and procedures continue to operate as intended.

3 It is presumed that companies using this guide already have appropriate safety management systems in place; the emphasis of this guide is therefore to check whether the controls in place are effective and operating as intended.

4 Too many organisations rely heavily on failure data to monitor performance. The consequence of this approach is that improvements or changes are only determined after something has gone wrong. Often the difference between whether a system failure results in a minor or a catastrophic outcome is purely down to chance. Effective management of major hazards requires a proactive approach to risk management, so information to confirm critical systems are operating as intended is essential. Switching the emphasis in favour of leading indicators to confirm that risk controls continue to operate is an important step forward in the management of major hazard risks.

5 The main reason for measuring process safety performance is to provide ongoing assurance that risks are being adequately controlled. Directors and senior managers need to monitor the effectiveness of internal controls against business risks. For major hazard installations and chemical manufacturers, process safety risks will be a significant aspect of business risk, asset integrity and reputation. Many organisations do not have good information to show how well they are managing major hazard risks. This is because the information gathered tends to be limited to measuring failures, such as incidents or near misses. Discovering weaknesses in control systems by having a major incident is too late and too costly. Early warning of dangerous deterioration within critical systems provides an opportunity to avoid major incidents. Knowing that process risks are effectively controlled has a clear link with business efficiency, as several indicators can be used to show plant availability and optimised operating conditions.

6 The method of setting indicators outlined in this guide requires those involved in managing process safety risks to ask some fundamental questions about their systems, such as:

n What can go wrong? n What controls are in place to prevent major incidents? n What does each control deliver in terms of a ‘safety outcome’? n How do we know they continue to operate as intended?

7 Companies who have adopted process safety performance indicators have reported that they have:

n an increased assurance on risk management and protected reputation;

n demonstrated the suitability of their risk control systems; n avoided discovering weaknesses through costly incidents; n stopped collecting and reporting performance information which was no longer relevant – thereby saving costs; and n made better use of information already collected for other purposes, eg quality management.

Structure and content

8 Part 2, the main part of this guide, describes a six-step process that can be adopted by organisations wishing to implement a programme of performance measurement for process safety risks. Each stage is explained in detail within a separate chapter. To help put the process into context, a full worked example for a top-tier COMAH3 site is included in Part 3.

9 Although this model can be followed step-by-step, many organisations already have a performance measurement system in place and may not wish to embark on radical change. In such circumstances, this guide may be used as a framework against which to compare existing programmes to decide if improvements are needed, as it draws on good practice within the UK chemical sector.

10 Throughout this guide, the term ‘process safety management system’ is used to describe those parts of an organisation’s management system intended to prevent major incidents arising out of the production, storage and handling of dangerous substances. ‘Risk control system’ (RCS) is used to describe a constituent part of a process safety management system that focuses on a specific risk or activity, eg plant and process change, permit to work, inspection and maintenance etc.

Measuring performance – early warning before catastrophic failure

11 Most systems and procedures deteriorate over time, and system failures discovered following a major incident frequently surprise senior managers, who sincerely believed that the controls were functioning as designed. Used effectively, process safety indicators can provide an early warning, before catastrophic failure, that critical controls have deteriorated to an unacceptable level.

12 Measuring performance to assess how effectively risks are being controlled is an essential part of a health and safety management system, as explained in Successful health and safety management,4 and, for example, the CIA’s Responsible Care Management Systems:5

n active monitoring provides feedback on performance before an accident or incident; whereas n reactive monitoring involves identifying and reporting on incidents to check the controls in place are adequate, to identify weaknesses or gaps in control systems and to learn from mistakes.

What’s different about this guide?

Dual assurance – a leading and lagging indicator for each risk control system 13 The main difference between the approach outlined in this guide and existing guidance on performance measurement is the introduction of the concept of ‘dual assurance’ that key risk control systems are operating as intended. Leading and lagging indicators are set in a structured and systematic way for each critical risk

control system within the whole process safety management system. In tandem they act as system guardians providing dual assurance to confirm that the risk control system is operating as intended or providing a warning that problems are starting to develop.

Leading indicators 14 Leading indicators are a form of active monitoring focused on a few critical risk control systems to ensure their continued effectiveness. Leading indicators require a routine systematic check that key actions or activities are undertaken as intended. They can be considered as measures of process or inputs essential to deliver the desired safety outcome.

Lagging indicators 15 Lagging indicators are a form of reactive monitoring requiring the reporting and investigation of specific incidents and events to discover weaknesses in that system. These incidents or events do not have to result in major damage or injury or even a loss of containment, providing that they represent a failure of a significant control system which guards against or limits the consequences of a major incident. Lagging indicators show when a desired safety outcome has failed, or has not been achieved.

Figure 1 Dual assurance - leading and lagging indicators measuring performance of each critical risk control system

16 According to James Reason in Managing the Risks of Organizational Accidents,6 (major) accidents result when a series of failings within several critical risk control systems materialise concurrently. Figure 2 illustrates an ‘accident trajectory’ model where an accident trajectory passes through corresponding holes in the layers of defence, barriers and safeguards. Each risk control system represents an important barrier or safeguard within the process safety management system. It should also be recognised that a significant failing in just one critical barrier may be sufficient in itself to give rise to a major accident.

17 For each risk control system:

n the leading indicator identifies failings or ‘holes’ in vital aspects of the risk control system discovered during routine checks on the operation of a

critical activity within the risk control system; and n the lagging indicator reveals failings or ‘holes’ in that barrier discovered following an incident or adverse event. The incident does not necessarily have to result in injury or environmental damage and can be a near miss, precursor event or undesired outcome attributable to a failing in that risk control system.

Figure 2 Leading and lagging indicators set to detect defects in important risk control systems

(Reproduced with permission of Ashgate Publishing Limited, from Managing the Risks of Organizational Accidents James Reason 1997 Ashgate Publishing Limited)6

18 If unchecked, all systems will deteriorate over time and major incidents occur when defects across a number of risk control systems materialise concurrently. Setting leading and lagging indicators for each risk critical control system should reveal failings in these barriers as they arise and before all the important barriers are defeated.

Frequency of checks 19 Many organisations rely on auditing to highlight system deterioration. However, audit intervals can be too infrequent to detect rapid change, or the audit may focus on compliance (verifying the right systems are in place), rather than ensuring systems are delivering the desired safety outcome. The use of process safety performance indicators fits between these formal, infrequent audits and more frequent workplace inspection and safety observation programmes. It is important

to bear in mind that an audit programme may be designed to address different issues when compared to the information gained from performance indicators. Ideally, each will inform the other. Deficiencies uncovered by an audit may highlight the need for a new performance indicator and vice versa. Therefore, performance indicators are not a substitute for an audit programme but a complimentary activity to give more frequent or different information on system performance.

Figure 3 How performance indicators fit within normal health and safety monitoring activities

Part 2: Six steps to performance measurement 20 This section outlines the six main stages needed to implement a process safety measurement system. Organisations that do not have a process safety performance measurement system would benefit from considering each stage in turn. Organisations with performance measurement systems in place can use this guide as a benchmark of good practice and consider improvements as appropriate.

Table 1 Overview of the six steps to setting performance indicators

Step 1 Establish the organisational arrangements to Appoint a steward or champion implement the indicators Set up an implementation team Senior management should be involved Step 2 Decide on the scope of the measurement system. Select the organisational level Consider what can go wrong and where. Identify the scope of the measurement system: n Identify incident scenarios - wnat can go wrong? n Identify the immediate causes of hazard scenarios n Review performance and non-conformances Step 3 Identify the risk control systems in place to prevent What risk control systems are in place? major accidents. Decide on the outcomes for each Describe the outcome and set a lagging indicator Set a lagging indicator Follow up deviations from the outcome Step 4 Identify the critical elements of each risk control What are the most important parts of the risk control system, (ie those actions or processes which must system? function correctly to deliver the outcomes) and set Set leading indicators leading indicators Set tolerances Follow up deviations from tolerances Step 5 Establish the data collection and reporting system Collect information - ensure information/unit of measurement is available or can be established Decide on presentation format Step 6 Review Review performance of process management system Review the scope of the indicators Review the tolerances

Step 1: Establish the organisational arrangements to implement indicators ■■ Appoint a steward or champion to take the initiative forward.

■■ In larger organisations, consider using a process safety steering committee.

■■ Senior management should be actively involved in the development of indicators.

21 New organisational arrangements may be needed to implement a performance measurement system. Someone will have to make the case for process safety measurement within the company and then drive it forward to implementation. The benefits and the costs will need to be carefully considered and the details of the exact indicators determined.

Step 1.1: Appoint a steward or champion

22 A steward or champion is needed to:

n promote, drive forward and co-ordinate the introduction of the new concept and system; n make the business case and link with company health, safety, environment, quality and business improvement systems; n communicate ideas and progress; n keep in touch with others working in this area and gather information on best practice; and n identify and evaluate the benefits achieved.

Make the business case 23 Developing and implementing process safety indicators is often a new area of work within many organisations, and the need for such a system will not be immediately obvious to many people. To be successful, this sort of initiative requires someone within the organisation to promote the idea, gauge support and then to drive forward the initiative. This may include making the business case for adopting performance indicators and securing suitable resources.

24 Monitoring and measuring performance has always been part of health and safety management systems. However, such systems frequently overlook process safety issues because it is difficult to know what to measure and how to set leading indicators. Where performance indicators already feature in a company health and safety management system, it is important for someone to check the suitability of those indicators for providing ongoing assurance on the control of process safety risks. It could be that existing performance indicators may only show half the story and that dual assurance derived from selecting a leading and lagging indicator for each critical RCS can add significantly to such a system. Clarifying gaps and weaknesses in existing measurement systems and identifying the associated business risks will be a key part of any