HID Inspection Guide Offshore Inspection of Control of Work arrangements Contents  Summary  Introduction  Action  Background  Organisation  Targeting  Timing  Recording and Reporting  Appendix 1: Inspection guidance  Appendix 2: Performance assessment  Appendix 3: Offshore Case studies  Appendix 4: High-level questions for inspecting CoW systems  Appendix 5: Detailed questions to support intervention on CoW  Appendix 6: Primer on Integrated Safe System of Work (ISSOW)

Summary This inspection guide is for use by Inspection Management Team and other inspectors who are inspecting duty holder arrangements for the Control of Work (CoW). CoW includes three primary elements: Hazard Identification and Risk Assessment (HIRA), PTW and Isolation Management. By far the most important element is HIRA which covers Task Risk Assessment, Permit to Work and the Safe Isolation & Reinstatement of Plant. It does not cover operational risk assessments, which are the subject of a separate inspection guide.

Introduction This Inspection Guide (IG) describes how you may inspect control of work procedures used at offshore installations. Control of work in this context includes hazard identification and risk assessment, permit to work systems and the arrangements for the safe isolation and reinstatement of plant. This guidance also describes some of the common deficiencies identified with duty holders’ use of the Integrated Safe System of Work (“ISSOW”) CoW procedure because of the high proportion of production installations at which ISSOW is used.

The generic requirements for all CoW systems are not described here though as this is comprehensively outlined in HSE’s key guidance publications: HSG 250, “Guidance on permit-to-work systems” and HSG 253, “The safe isolation of plant and

equipment”. Duty holders may use any form of CoW procedure, as long as in so doing they comply with the key relevant statutory provisions.

This guide is not exhaustive, but covers a range of issues and circumstances. It is not envisaged that you will explore every aspect covered, but rather, will exercise your judgment to direct the intervention and gather sufficient information to determine adequacy of the relevant SMS aspect.

Action The aim of this Inspection Guide (IG) is to provide information and guidance to offshore inspectors to support the delivery of consistent and effective offshore CoW interventions. It does this by highlighting key areas essential to an effective CoW process, so that these can be covered during inspections, providing a framework for inspectors to judge compliance, assign performance ratings, and decide what enforcement action to take should they find legislative breaches. In doing so, it complements HSE’s Enforcement Policy Statement (EPS) and Enforcement Management Model (EMM).

Success criteria (fundamental requirements) are listed under the inspection topics (see appendix 2); these cover the key issues that inspectors should consider when carrying-out inspections against each core intervention issue. In some instances, not all of the success criteria will apply so inspectors should make a judgement regarding which of these are relevant in each case. If the relevant success criteria cannot be met, inspectors should assess how serious the consequences of failure to comply could be. This will inform their decision making in terms of the performance ratings that they assign and the enforcement action they take (if any) based on the findings of the inspection.

Inspection of this topic contributes to HSE’s Offshore Strategy for avoiding catastrophe, which requires duty holder CoW procedures to be sufficiently effective to manage the risk of hydrocarbon releases. This guidance indicates how you should assess the effectiveness of duty holder CoW arrangements for managing the risk of HCRs and other hazardous activities, such as confined space entry, work at height, pressure testing.

HSG 250, “Guidance on permit-to-work systems” and HSG 253, “The safe isolation of plant and equipment” provide detailed descriptions of the elements of suitable & sufficient PTW/SIRP systems, how they should be operated and how duty holders should monitor, audit and review their systems/procedures.

You should use these as the basis for inspecting the effectiveness of duty holders’ PTW and SIRP systems. Most established duty holders have systems that are compatible with those described in these two publications. Inspectors will have to inspect how duty holders operate their systems so that they can form an opinion as to whether they are actually followed, and if the hazards identified and the risk controls provided are suitable and sufficient.

Effective inspection of CoW systems requires a systematic check on whether duty holders are actually following their own procedures. This involves inspecting the whole CoW system, from how the duty holder decides which work has to be undertaken under a permit, through to the suitability of the risk control measures identified. To do this you should develop an understanding of the duty holders’ CoW systems and check that they are compatible with HSG 250 & HSG 253, or an equivalent standard.

You should then check how the systems are used in practice. This should include a check of whether the system is followed and of how effective this is in identifying and implementing the relevant risk control measures. As most PTW and SIRP procedures tend to be broadly compatible with HSGs 250 & 253, the key regulatory objective is to identify whether there are systematic failings in following the procedures, or in identifying and implementing risk control measures and to take appropriate action to ensure that any failings are rectified.

IMT inspectors should undertake such interventions themselves, but sometimes they may need to seek assistance from topic specialists where an additional opinion on the suitability of technical the risk controls is required.

Background Instructions or procedures are adequate for most work activities, but some require extra care. A ‘permit to work’ is a more formal system stating exactly what work is to be done, where, and when. A responsible person should assess the work and check safety at each stage. The people doing the job sign the permit to show that they understand the risks and precautions necessary.

Permits are effectively a means of communication between site management, plant supervisors and operators, and those who carry out the work. Examples of high-risk jobs where a written permit to work procedure may need to be used include hot work such as welding, vessel entry, cutting into pipe-work carrying hazardous substances, and work that requires electrical or mechanical isolation. It is also a means of coordinating different work activities to avoid conflicts.

It should be emphasised that a permit to work is not a replacement for robust risk assessment, but can help bring the risk assessment 'to life', at the sharp end, where it matters.

A formal definition of a PTW system is:

“A method which ensures that all foreseeable hazards of high hazard operational and maintenance activities are identified and appropriate precautions specified to eliminate the hazards or control the risks. Details of the hazards and precautions are effectively communicated to all involved in the work, thereby safeguarding their health and safety”.

HSE studies showed that a third of all accidents in the UK chemical industry were maintenance related and that the single largest cause was a lack of, or deficiency in, PTW systems.

CoW systems are an essential element of an offshore duty holder’s safety management system. The duty holder must have a system of hazard identification and risk assessment as well as written permits for any work in circumstances where the nature and scale of the risk arising from the work to be carried out demands a stringent system of control. Risk assessments undertaken under regulation 3 of MHSWR should enable the duty holder to identify when the system should be used and what the suitable and sufficient risk control measures should be. Once identified, the duty holder must ensure that no such work is carried out unless a competent person has issued a permit, and that the work is carried out in accordance with the terms of the permit and the risk assessment supporting it.

Many duty holders have integrated their Safe Isolation and Reinstatement of Plant (SIRP) procedures into their CoW system to produce an overarching “Control of Work” procedure.

Common failures in CoW systems are a failure to follow the PTW or SIRPs procedures, risk assessments that are not suitable and sufficient to identify the risks, and/or the control measures and a combination of the two.

Effective CoW procedures have well understood characteristics and methods of operation. The inspection checklists in HSGs 250 & 253 (appendices 5 & 6) can be used to benchmark duty holders. This guide outlines some approaches to inspecting the efficacy of arrangements that are in place and are based on those that have been used for enforcement and other regulatory work. SIRP procedures are a key aspect of PFEER regulation 9 compliance due to the importance of CoW in the preparation and undertaking of breaking containment of plant and equipment of hydrocarbon duty. Any failure of the SIRP procedures to identify the correct isolation & reinstatement requirements for a given task may also represent non-compliance with PFEER regulation 9.

The purpose of this guidance is to assist you in checking the suitability of duty holders’ CoW procedures and particularly that these procedures are actually being followed.

Key principles in PTW systems 1. The issue of a permit itself does not make a job safe. 2. PTW systems are about communicating all relevant information (including hazards, controls, roles and responsibilities) to all personnel involved. 3. There are pros and cons of paper versus electronic systems; do not assume that an electronic system is more effective than a paper-based system. 4. If there are a number of permits, they should be displayed at an appropriate location, in a systematic arrangement that enables staff to check which equipment is e.g. isolated or undergoing maintenance. 5. All users in the PTW system should be trained to a level appropriate to their role in the system.

6. Links between related permits should be clear, consider simultaneous tasks and interdependent activities. 7. The system must be able to maintain safety if work continues over a shift change.

Organisation Targeting Inspections should be carried-out in accordance with ED duty holder intervention plans.

Timing Inspectors should undertake CoW inspections as part of the agreed ED Offshore Intervention Plan; when intelligence indicates intervention is necessary, or as part of an investigation following an incident.

Resources Resource for the undertaking of CoW interventions will be agreed as part of the ED Offshore Work Plan or by agreement between discipline specialist team-leaders and inspection management team-leaders, as appropriate.

Recording & Reporting The duty holder performance ratings should be entered on the Inspection Rating Form (IRF) tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the normal post inspection report and letter.

Further References

1. http://www.hse.gov.uk/pubns/books/hsg250.htm Key guidance in this area, applicable to all industries where permit-to-work systems are used. This includes a checklist for the assessment of systems.

2. http://www.stepchangeinsafety.net/knowledgecentre/publications/publication.c fm/publicationid/31 Step Change’s PTW pocket-card.

3. http://www.ogp.org.uk/publications/safety-committee/guidelines-on-permit-to- work-systems/ This guide gives a basic understanding of the Permit to Work (PTW) system in the E&P industry. The guide provides a full definition, discusses when the systems are applicable and where the principal responsibilities lie, suggests an appropriate form for the certificate and outlines the training and competence required for key personnel. It stresses the need for effective communication within the PTW system and for regular verification and monitoring of the system. Extensive guidelines on the preparation of a PTW system, the process of using the system and the completion of a permit are provided, as well as an inspection check-list, a

check-list for the review of PTW systems and a sample check-list of potential hazards.

4. http://www.hse.gov.uk/humanfactors/topics/ptw.htm - HSE’s microsite for human factors; page on PTW systems.

Contacts ED Offshore: ED1.2 specialist inspectors

Appendices

 Appendix 1: Inspection Guidance  Appendix 2: Performance Assessment  Appendix 3: Offshore Case Studies  Appendix 4: High-level questions for inspecting CoW systems  Appendix 5: Detailed questions to support and intervention on CoW  Appendix 6: Primer on Integrated Safe System of Work (“ISSOW”)

Appendix 1: Inspection Guidance

You should have an effective working knowledge of HSG 250 and HSG 253 before planning CoW inspections.

Suitability of the Procedures

The key reason for you to consider the suitability of the procedures is to enable you to gain an understanding of how the CoW should be used to control risks. You should request copies of the duty holder’s CoW system, including hazard identification and risk assessment, PTW and SIRPs procedures, prior to the offshore phase of the inspection and develop an understanding of the procedures including the specific terminology.

Both HSG 250 & 253 describe the essential components and operational principles of PTW and SIRPS procedures respectively. If a duty holder’s PTW or SIRP procedure does not substantially cover the essential elements as described in this guidance then it is unlikely to enable compliance with MAR regulation10 or MHSW regulations 3 & 5.

Inspection in Practice

PTW systems may be described in the safety case; or you may have obtained a detailed PTW Procedure from the duty holder. A PTW system cannot be inspected on the basis of these paper documents – the key is to inspect how the system is implemented in practice. A suggested inspection plan is provided below, although you may modify this according to your experience or duty holder specifics. Further questions and inspection points are provided later in this guidance.

1. Briefly review the PTW written procedure in order to understand the format of the system; key roles and responsibilities etc. a. Are roles and responsibilities listed? You can test these later. 2. Meet the PTW Co-ordinator (or PTW Controller) in their office in order to talk through the system; how they manage it (their training?), and talk you through a sample of recent or live permits; 3. If you have time, you may wish to undertake a short Permit users course offshore – this will help you to understand their system, and may give you authorisation and access to search an electronic PTW system; enabling you to browse recent Permits; a. How many are live? b. Did the same person sign-off many permits, and could they have visited the workplace? c. Are they completed consistently? d. Are there suitable controls for all hazards identified? e. Are related documents (such as isolations) attached? 4. If you have time, follow a Permit through the complete system, from start to finish.

5. Take a live permit and associated documents (risk assessment, isolation certificates, Toolbox Talk etc.) to the workplace and talk to those undertaking the work: a. Are all of the hazards present at the workplace identified on the Permit (or on associated risk assessments)? b. Are the controls listed on the Permit in use? c. Do the hazards listed include precursors to major hazards? d. How could the work impact on the performance of an asset integrity barrier or SCE - and is this considered on the Permit/risk assessment? e. Are personnel familiar with the hazards and controls? f. Has anything changed since the Permit was issued? g. Is anyone present that isn’t listed on the Permit and vice versa? h. Have any isolations been undertaken as planned? i. If there are interactions with other ongoing work – and is the team aware? 6. If possible, attend a Toolbox Talk, when the Permit and the work is discussed by the work team; 7. Attend a Permit meeting where relevant parties (usually OIM and Heads of Departments) discuss several Permits in the process of being authorised; 8. Attend a shift handover meeting where the Permits are discussed.

Links to other SMS topics Interventions on the PTW system may be linked to other SMS topics, including: communications (especially handovers); competence; procedures; supervision; control of contractors; KPIs; and audit/review.

Links to topic specialists If reviewing particular Permits in detail, you should consider involving the relevant topic specialist (mechanical, electrical, process safety etc). Relevant Human & Organisational (HOF) topics include usability, safety culture, human failures (particularly maintenance failures), identification of plant and equipment, workload, and risk perception – seek HOF topic specialists for further advice and support, if appropriate.

Having understood the duty holder’s Risk Assessment/PTW/SIRP procedure you need to be able to decide if it is being complied with. Compliance relates to all aspects of the procedures, including arrangements for demonstrating the competence of those workers with roles in using the procedure.

A manageable number of HIRAs, PTWs or isolations should be chosen for inspection - probably no more than three. Ideally, you should attend the daily “work planning meeting”, at which members of the offshore management discuss the day’s work activities. The quality of the discussion, in terms of identifying suitable risk controls, and possible adverse interactions of different work activities in the context of other planned operations is often a good indicator of effective CoW.

Effective work planning meetings should involve meaningful discussion of risk controls, ideally with query or challenge if the controls identified are vague or insufficient. It is likely that you might be expected to comment on permits under

discussion and this would be an ideal time for you to question what might appear to be inadequate risk controls.

Once you have chosen HIRAs, PTWs or isolations for inspection you should spend time with one of the CoW authorities (eg relevant area authority) to discuss the hazard that the HIRA / permit / isolation is intended to control. The duty holder’s personnel should be able to explain this and how the each CoW element provides the risk control.

On visiting the worksite where the PTW is being used, you should ask a member of the crew using the permit, eg performing authority or another member of the party, to explain their understanding of what could go wrong with the work being undertaken and how the PTW is being used to control the risk. Those undertaking the work should be able to describe the worst thing that could go wrong with the work, who would be affected and