HID Inspection Guide Offshore Inspection of Operational Risk Assessments Contents

 Summary  Introduction  Action  Background  Appendix 1: Inspection Guidance  Appendix 2: Performance assessment

Summary This guidance outlines an approach to the inspection of dutyholder’s Operational Risk Assessment (ORA) or analogous systems. Similar systems to ORAs include Safety Critical Risk Assessment (SCRA), Safety Critical Element Impairment Risk Assessment (SCEIRA), Safety Critical Element Failure (SCEF) and Deviation Control Risk Assessment (DCRA). Temporary management of change procedures may also be used in such situations. Some dutyholders may operate separate systems for impaired safety critical elements and other defects. For simplicity the term ORA is used in this document to encompass all of these systems. ORA systems may also be used for matters that are not safety related e.g. for business or environmental risks: however, HSE inspections should target safety risk issues. It should also be noted that dutyholders may also seek to assess the impact on overall risk either as part of the primary ORA system or by separate means e.g. through some other cumulative risk process.

Introduction Dutyholder risk management procedures should include arrangements for identifying and assessing the implications of any impairment of safety critical elements and other abnormal situations which affect major accident hazard control systems.

The effectiveness of such systems is a key component of risk control in that the system will be used as part of the process in deciding whether affected plant or equipment may remain in use and, at the extreme level, whether an installation, or parts thereof, may continue in operation. An ineffective system may allow significant shortcomings to be allowed to persist, erroneous conclusions to be reached or reinforce the results of non evidence based decision making.

This guidance is aimed at promoting an effective approach to the inspection of such systems.

Action The aim of this Inspection Guide (IG) is to provide information and guidance to offshore inspectors to support the delivery of consistent and effective offshore ORA management interventions. It does this by highlighting key areas essential to an effective ORA process, so that these can be covered during inspections, providing a framework for inspectors to judge compliance, assign performance ratings, and decide what enforcement action to take should they find legislative breaches. In doing so, it complements HSE’s Enforcement Policy Statement (EPS) and Enforcement Management Model (EMM).

Each dutyholder will have their own ORA procedures. For Integrated Safe System of Work (ISSOW), users’ ORAs may be dealt with fully or partly within the ISSOW system and the procedure may form part of the overall ISSOW procedure.

The inspection of the ORA system should include inspection of the following elements;

a) Does the dutyholder have a system, if so are relevant matters covered by the system(s)? b) Does it include the necessary elements that make it potentially effective? c) Is the system being followed? d) Are the outputs of the system credible? (realistic?) e) How does the dutyholder ensure this? f) What monitoring and audit systems are in place and how effective are these?

Success criteria (fundamental requirements) are listed under the inspection topics (see appendix 2); these cover the key issues that inspectors should consider when carrying-out inspections against each core intervention issue. In some instances, not all of the success criteria will apply so inspectors should make a judgement regarding which of these are relevant in each case. If the relevant success criteria cannot be met, inspectors should assess how serious the consequences of failure to comply could be. This will inform their decision making in terms of the performance ratings that they assign and the enforcement action they take (if any) based on the findings of the inspection.

Inspection of this topic should include both inspection of the system itself and inspection of the outputs from the system. In inspecting outputs it may be necessary to have input from the relevant specialist inspectors where there are technical issues beyond the competence of the IMT inspector.

Appendix 1 includes a more detailed framework for inspection.

Background Relevant legislation

 The Management of Health and Safety at Work Regulations 1999, Regulation 3(1)

Organisation Targeting Inspections should be carried-out in accordance with ED duty holder intervention plans.

Timing Inspectors should undertake ORA inspections as part of the agreed ED Offshore Intervention Plan; when intelligence indicates intervention is necessary, or as part of an investigation following an incident.

Resources Resource for the undertaking of ORA interventions will be agreed as part of the ED Offshore Work Plan or by agreement between discipline specialist team-leaders and inspection management team-leaders, as appropriate.

Recording & Reporting The duty holder performance ratings should be entered on the Inspection Rating Form (IRF) tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the normal post inspection report and letter.

Further References

 Oil&Gas UK - Guidance on the Conduct and Management of Operational Risk Assessment for UKCS Offshore Oil and Gas Operations.  A framework for monitoring the management of ageing effects on safety critical elements, Energy Institute Research Report, 1st Edition, 2009, The Energy Institute

Contacts ED Offshore: ED1.2

Appendices Appendix 1: Inspection guidance

Appendix 2: Performance assessment

Appendix 1: Inspection Guidance

Inspectors should be familiar with the industry guidance in the Oil and Gas UK publication prior to carrying out the inspection. The inspection of ORAs should include consideration of the following;

Inspection procedure

The inspector should become familiar with the dutyholder’s procedure and their specific terminology before inspection offshore. It is expected that the dutyholder’s procedure will contain the following basic components:

 Details of when the procedure is to be used;

 A clear definition of what systems or equipment the ORA applies to (including all SCEs), and what degree of shortcoming/ impairment triggers the assessment;

 Clarity as to how shortcomings or impairments in SCEs should be identified and notified;

 An Identified rule based systems for foreseeable events (e.g. firepump strategy or action in the event of a TEMPSC being unavailable);

 A clear methodology to be followed when assessing the risks;

 A specification of the personnel to be involved including roles and responsibilities;

 Arrangements for the provision of technical support and the role of this;

 The level within the organisation at which the assessment can be approved (this may vary depending on the potential consequence or risk);

 The means by which the ORA status and any associated remedial actions are tracked, monitored and reviewed/ closed out. This may include some priority allocation or risk/ impact categorisation to assist in effective management;

 There should be a means of determining how individual ORAs may impact on each other to affect the hazard management process and overall risk level. There should also be consideration of other matters that will affect the risk, for example safety critical maintenance backlog, operational restrictions, weather conditions, etc. This aspect of ORA is challenging so may still be being refined and developed. Nevertheless there should at least be some system, which considers the overall impact of multiple assessments. Some duty holders have developed overarching systems which aim to give a picture of the overall risk profile of the installation.

If the system does not contain all of these components it is likely to require improvement, however, this should not in itself preclude continuing with the inspection to determine its overall adequacy.

Application of Procedure

The application of the procedure should be inspected offshore. This should include discussion with some of those defined as having roles by the procedure. The discussions should seek to compare the individuals understanding of the role compared to that outlined in the procedure and to identify any gaps that may affect the outcome. Discussions may also be required onshore, for example with TA’s, to clarify their role in the process.

Current ORAs should be inspected to determine whether there is evidence that the procedure has been followed. The information available will depend on the dutyholder’s system but all should include at least a record of the decision made and the assessment produced.

Inspection of Outputs

A sample (or all depending on numbers) of current ORAs should be inspected. The aim of this part of the inspection is to determine whether or not the conclusions reached are justified based on application of appropriate risk assessment techniques (which should be required by the procedure). In doing this it will be necessary to consider the following aspects of the assessments;

 Description of purpose This should make clear the reason for carrying out the assessment (i.e. what is the degraded or failed SCE or other event) and what is being considered.

 Consequence The assessment should be clear about the potential consequence of the defect being considered, including any knock-on consequences due to SCE interdependencies. If this is not correct the level of additional controls or mitigations may be inappropriate.

 Likelihood This should be determined using descriptors from the dutyholder’s procedure in a way that is easily understood.

 Mitigations/Controls It should be clear what these are and how their application will affect the matter under consideration. There should be reference to hierarchy of control measures in the procedure and evidence that this has been followed. Check that the controls listed are actually in place.

 Duration

Does the assessment make clear any time limits on adopting temporary remedial measures and when the fault or failure must be rectified including its priority.

Inspection of the assessments produced will, in some circumstances, require additional specialist knowledge and the appropriate topic specialist should be asked to provide assistance where there are questions regarding the technical adequacy of the assessment. However, personnel offshore who have been involved in the process should be able to explain the outcome to the inspector and this in itself will allow some conclusions to be reached.

Audit and Monitoring Systems

The dutyholder should have systems in place to monitor the implementation of the controls or mitigations put in place following the assessment process. There should also be effective monitoring of the application of the process. Inspectors should review available evidence, such as records, to determine that monitoring is being carried out. The inspection should also identify whether the monitoring systems are identifying any problems with the implementation of the system and controls and, if this is the case, what has been done to rectify matters.

In addition to monitoring there should be arrangements for periodic audit. Any available audits should be reviewed to determine whether they meet the necessary objectives of assessing compliance with the procedure and providing assurance that the system is effective in controlling the risks associated with degraded SCE’s or similar matters.

Appendix 2: Performance assessment When inspecting ORAs there are two areas of to be considered as follows;

a) When inspecting the outputs from the system a decision will have to be reached on whether the risk control measures implemented lead to compliance with the relevant legislation. This decision will be made in the same way as for other inspection topics by comparing the standard of control achieved against the relevant benchmarks and applying the principles of EMM. b) The inspection will reach conclusions on overall effectiveness of the dutyholder ORA system. These should be recorded using the assessment criteria listed below. Those dutyholders who either do not have a system, or have a system that is substantially ineffective will fall in the very poor or unacceptable categories. Where there is a system in place and there is evidence of a number of examples where it results in controls that are ineffective or inappropriate it will fall in the poor category.

The following descriptors may be used to assist in determining the appropriate score for the dutyholder.

a) Unnaceptable- There is no system in place for managing the impact of degraded Safety critical elements.

b) Very Poor- There is a system for managing degraded safety critical elements but either this has not been implemented or the outputs are such that the system is largely ineffective in identifying appropriate control measures.

c) Poor- There is a system in place for managing degraded safety critical elements and this is being followed however, there are numerous examples where the system has not resulted in the implementation of effective control measures.

d) Broadly Compliant- There is a system in place, it has been fully implemented and used when most issues considered have resulted in appropriate precautions being implemented.

e) Fully Compliant- There is a system that has been fully implemented and is effective in identifying appropriate control measures for all issues.

f) Exemplary- Meets the fully compliant standard but with evidence of class leading systems in complex areas such as cumulative risk.

EMM RISK GAP EXTREME SUBSTANTIAL MODERATE NOMINAL NONE NONE TOPIC PERFORMANCE SCORE 60 50 40 30 20 10 Broadly Fully Unacceptable Very Poor Poor Exemplary Compliant Compliant Significantly Meets most of Meets the Unacceptably below the the relevant relevant far below relevant minimum legal Exceeds the minimum legal relevant minimum legal requirements. relevant Substantially requirements. minimum legal requirements. minimal legal below the requirements. Most success requirements. relevant All success Several criteria are fully minimum legal criteria are fully Most success success criteria met. All success requirements. met. criteria are not are not fully criteria are fully met. met. Degree of non- met. Many success Management compliance criteria are not competent and Degree of non- Degree of non- minor and Management fully met. able to compliance compliance easily competent, demonstrate extreme and significant. remedied. enthusiastic, Degree of non- adequate widespread. and proactive in compliance identification of Limited Management devising and substantial. the principal Failure to recognition of recognise implementing Failures not risks, recognise the essential essential effective safety recognised, with implementation issues, their relevant relevant management limited of the necessary significance, components of components of system to ‘good commitment to control and to effective health effective health practice’ or take remedial measures, demonstrate and safety and safety above standard. action. confirmation that adequate management, management, Actively seek to these are used commitment to but demonstrate and further improve effectively; and take remedial commitment to commitment to standards. subject to action. take remedial improve review. action standards. EMM INITIAL ENFORCEMENT EXPECTATION Prosecution / Enforcement Enforcement Letter / Verbal None. None. Enforcement Notice / Letter. Notice / Letter. warning. Notice.