Click for next page ( 39


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 38
2 Role of Safety and Environmental Management Systems in Establishing a Culture of Safety From the most literal (and simplistic) perspective, the Committee on the Effectiveness of Safety and Environmental Management Systems for Outer Continental Shelf Oil and Gas Operations (the committee) could have achieved its goal by first reviewing the documented requirements of a Safety and Environmental Management Systems (SEMS) program and then describing methods for determining whether those specified elements were being used. For example, the committee could have determined ways of assessing whether a hazards analysis was in place (e.g., by creating a checklist or defining a process) and then identified ways to document evidence that the results of the hazards analysis were being addressed. Such an approach would have resulted in recommendations for auditing compliance to a defined standard (e.g., the requirements of SEMS). That defined standard would, in practice, become the minimum standard. The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (2011) observed: The record shows that without effective government oversight, the off­ shore oil and gas industry will not adequately reduce the risk of accidents, nor prepare effectively to respond in emergencies. However, government oversight, alone, cannot reduce those risks to the full extent possible. Government oversight must be accompanied by the oil and gas industry’s internal reinvention: sweeping reforms that accomplish no less than a fundamental transformation of its safety culture. (p. 217, emphasis added) The committee agrees with the presidential commission that a transforma­ tion of the industry’s safety culture is necessary and believes that an approach based on compliance with a minimum standard will not achieve that goal. In fact, the committee believes that overemphasis on compliance with a minimum standard can actually work against that intended objective. 18

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 19 An effective SEMS program is a necessary and critical component of offshore safety. Without a well­reasoned, well­documented method of coordinating action, consistently safe operations are simply not possible. Nevertheless, as important as a SEMS program is, it alone cannot ensure that the people actually doing the work (whether planning or designing onshore or working offshore) make the choices and take the actions nec­ essary to ensure safety. Safe and effective operations are, in part, indica­ tive of an effective safety management system (SMS); however, safe and effective operations are not created solely by the management system, but by a set of diverse components. Factors such as a culture of blame and a lack of mindfulness of risk, organizational commitment, and trust have been shown time and again to be contributors to high­profile tragedies in the petroleum industry and elsewhere (DNV 2011; Hopkins 2004, 2006). Because a SEMS program cannot reliably control what people choose to do on the job, the mere existence of a documented SEMS plan is not suf­ ficient to ensure prevention of major accidents. The spirit of SEMS, whether as defined in American Petroleum Institute Recommended Practice 75 (API 2004) or in other similar approaches, is not intended to be strictly a paper exercise. The way that SEMS is actually implemented, even by different divisions in the same organization, can produce different results. By way of example, air­ lines use the very same equipment under similar conditions and have very similar written maintenance and operational processes and pro­ cedures, but differences in passenger risk of some 40 times have been documented (PSA Norway 2002; Reason 1997). Getting the people who actually do the work to make the right choice, every time, even when they are outdoors in the cold rain, under tight time constraints, and when no one is looking is different from having an auditable SEMS program in place; people have called these differences in terms of the way organizations operate “organizational culture.” Will SEMS ProMotE a CulturE of SafEty? Although a culture of safety is a goal of many organizations and attempts are made to measure it, people often find describing a safe culture in con­ crete terms difficult. According to James Reason, a definition of culture

OCR for page 38
20 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems captures most of its essentials: “Shared values (what is important) and beliefs (how things work) that interact with an organization’s structures and control systems to produce behavioural norms (the way we do things around here)” (Reason 1983, p. 294, and 1997, p. 192). According to Booth, the United Kingdom Health and Safety Commission defined safety culture in the following way: The safety culture of an organization is the product of individual and group values, attitudes, competencies, and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization’s health and safety programmes. Organizations with a positive safety culture are characterized by communications founded on mutual trust, by shared perceptions of the importance of safety, and by confidence in the efficacy of preventive measure. (Booth 1993, p. 5) Culture is critical in the choices people make and can promote or inhibit safe choices. Many people, according to Reason (1997, p. 192) believe that “a safety culture can only be achieved through some awe­ some transformation,” such as might occur as a result of a catastrophic organizational accident. He believes, however, that these changes are often short­lived because a safety culture is not something that springs up ready­made from the organizational equivalent of a near­death experience, but, in fact, “emerges gradually from the persistent and successful applica­ tion of practical and down­to­earth measures” (Reason 1997, p. 192). As major incident investigations have shown (e.g., Borthwick 2010; BP U.S. Refineries Independent Safety Review Panel 2007; CAIB 2003; CSB 2007; Cullen 1990; National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling 2011), the existence of an effective safety culture is fundamental to the creation of a safe work environment. In the incidents cited here, and many others, the lack of a positive safety culture has been cited as a major contributor. It is, therefore, a logical supposition that safe operation in a high­hazard industry requires an effective culture of safety. The term “safety culture” is often misconstrued as indicating a means of convincing individuals to comply with regulations and procedures; the term is more effective, however, when viewed as the intrinsic value of the importance of safety (HSE 2011). Several industries and regulatory bodies in the United States as well as other countries have policies and guidelines for creating a positive

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 21 culture of safety. The U.S. Nuclear Regulatory Commission (U.S. NRC) created a policy outlining its expectation that individuals and organiza­ tions performing regulated activities establish and maintain a positive safety culture commensurate with the safety and security significance of their activities and the nature and complexity of their organizations and functions. U.S. NRC outlined several traits that are common in an effective culture of safety. These are cited in the report Macondo Well— Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety (NAE­NRC 2011, pp. 92–93) and are adapted here with additional information from Reason (1997) and HSE (2011): • Leadership safety values and actions. Genuine values are consistently communicated by leadership through visible commitment to safety; values and actions are not tied to leadership’s personality or to com­ mercial concerns. Leadership’s commitment demonstrates a high level of concern for safety throughout the organization through resource allocation and priority support for safety versus production. Orga­ nizational leaders also visibly influence and lead by demonstrating their values through their decisions and actions, thereby ensuring that employees see that the commitment to safety is genuine. • Problem identification and resolution. Issues are identified, evaluated, addressed, and corrected promptly. • Personal accountability. Personal responsibility for safety is accepted by each individual. Workers take a proactive role and ownership in their own safety and that of colleagues. • Work processes. Planning and control of work processes is implemented to maintain safety. • Continuous learning. T he organization works as a learning organization—that is, an organization that pursues current knowledge and collects data and information to become and remain informed and that adapts as this new knowledge and information are gained. • Environment for raising concerns. The organization maintains a safety­ conscious work environment in which personnel feel free to raise safety concerns without fear of retaliation, intimidation, harassment, or discrimination. Reason (1997) describes this type of environment as a willing reporting culture, in which decisions and changes necessary for success are made following investigations.

OCR for page 38
22 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems • Effective safety communication. Communications within the organi­ zation maintain a focus on safety to ensure that mixed messages for competing priorities are not the norm. Knowledge and experience are shared across organizational boundaries. This sharing can be especially important when different companies are involved in various phases of the same project. Knowledge and experience are also shared vertically within the organization. • Respectful work environment. Trust and respect permeate the organiza­ tion. The workforce is treated with dignity and respect. • Questioning attitude. Individuals avoid complacency and continuously challenge existing conditions and activities to identify discrepancies that might result in unsafe conditions. No worker hesitates, at any time, to question work practices at any level, and this questioning is considered part of everyday work conversations. As noted by Meshkati (1999), a facility that emphasizes and fosters a culture of safety encourages employees to develop a questioning attitude and a rigorous and prudent approach to all aspects of their jobs and to establish open communica­ tion between line workers and middle and upper management. According to Reason (1997, p. 196), a safety culture has four critical subcomponents: • A reporting culture: People are willing to report their own errors and near misses. • A just culture: Individuals are encouraged when they provide essential safety­related information. • A flexible culture: Control changes according to the expertise needed in specific situations because there is respect for members of the workforce who have the skills, experience, and abilities to respond to the situation. • A learning culture: The organization and the workforce learn and make changes as needed. These four subcomponents interact to create an informed (i.e., safe) culture that will reduce the likelihood of organizational accidents. Another way of thinking about safety culture is that, in a safety culture, the subjective aspects of the organization (attitudes, perceptions, and values) are integrated with objective processes and systems. It is this integration and collaboration that support effective safety performance.

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 23 Able to Want to How: Process Why: Purpose Mechanism Culture What do people read Why do people . . . Organization or write . . .? if it wasn’t in their immediate interest? Competency Motivation Individual How are individuals Why would a totally capable of . . .? selfish person . . .? FIGURE 2-1 Interaction of culture and process. One useful way to explain the interaction between process and culture is with the matrix in Figure 2­1. This matrix illustrates the elements required for an action to occur reliably in a real organization. For something to occur reliably, the organization as a whole and each individual in the organization need to be able to accomplish the action and need to want to do so. The organization–able-to quadrant of the matrix describes the mechanism an organization would use to operate safely. The SEMS plan and supporting documentation correspond to the organization–able-to quadrant. Without an effective SEMS (or SEMS­like) plan and appropriate docu­ mentation, it is very unlikely that an organization could operate safely; however, great plans and supporting documentation do not mean the organization will be safe. The individual–able-to quadrant of the matrix is competency; it describes how people as individuals are capable of executing the requirements of safe operations. There may be great plans, but without competent individuals, they cannot be carried out. The individual–want-to quadrant is motivation; it describes those factors in the organization that would cause a totally self­interested person to want to work safely. For example, if people really are totally unmotivated to report incidents (e.g., because bonuses are lost or because the paper­ work is just too much of a hassle) then more training on how to spot incidents will not address the issue. The individual must be motivated and empowered to work safely. Finally, the organization–want-to quadrant is the culture or behavioral norms that cause people to act properly even when no one is looking and

OCR for page 38
24 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems when it is not in their immediate best interest. A healthy safety culture causes people to report events accurately, even when they are at fault, because truthfulness is the norm. If one of these elements is missing, there will be a bottleneck in the organization’s ability to work safely and with environmental respon­ sibility, and more emphasis on the other elements will not address the problem. If either motivation or culture is missing, lack of additional training or lack of more detailed processes will probably not be the root cause of an incident. The true root cause will probably be something missing in the organization’s culture or the individual’s motivation. To build a culture of safety from an organizational level there must be • Mechanisms that establish structure and control by specifying what is needed for safe operation and providing for checking to see that these specifications are being followed (SEMS’ organizational element), and • Actions that establish safety norms by encouraging people to act properly even when no one is looking or when it is not in their immediate best interest. To build a culture of safety from the individual’s level there must be • Mechanisms that build competency by developing individual knowledge and skill (SEMS’ requirements for training, operating procedures, and safe work practices), and • Actions that build the motivation of a totally self­interested person to act in accordance with behavioral norms. An organization’s culture is created by thousands of individual actions and by leadership at all levels; but the culture must be owned by the top leadership, in addition to the middle managers and the line workers, because “[n]o matter what regulatory system is used, safe operations ultimately depend on the commitment to systems safety by the people involved at all levels within the organization” (NAE­NRC 2011, p. 116). According to Peters and Waterman (1982), if there is a strong culture, all levels of the organization will have shared goals and values. The culture of safety cannot be built or sustained through publishing statements from the chief executive officer and human resources department, posting notices in company internal and external communications, punishing

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 25 individuals for incidents of noncompliance (INCs), rewarding individuals for a lack of INCs, or reading perfunctory safety minutes prior to meetings. It is something that the leadership must live. The management of safety within an organization is ultimately a reflection of its safety culture. A poorly designed and implemented SEMS program can work against creating the conditions needed for a healthy safety culture to develop. Conversely, effective implementation of a SEMS program is expected to have a positive impact on the safety culture of companies operating on the U.S. Outer Continental Shelf; however, whether it will do so will not be known until trend data are available and analyzed. To exist and grow, a culture of safety requires reciprocity between corporate management and individual employees’ values, beliefs, and per­ ceptions. A SEMS program can create the backbone of the safety culture upon which organizations build these internal reciprocal relationships. A culture of safety requires commitment, engagement, and execution from all levels of the organization. It is this ownership and engagement that reshapes safety culture into a continuing, long­term commitment to improve. The committee agrees with the NAE­NRC committee that SEMS will require companies to adopt both a top-down and a bottom-up safety culture. Safe . . . operations cannot be achieved solely through regulations, inspections, or mandates. They will only be realized when there is a full commitment to system safety, from the board room to the rig floor, and through recognition that a focus only on occupational safety will not ensure system safety. Compliance with either prescriptive regulations or standards related to achieving specific safety goals need[s] to be considered a minimum requirement and not necessarily a way to meet duty of care obligations.” (NAE­NRC 2011, pp. 119–120)1 A common problem for some companies is the tension between organizational mandates regarding safety and pressure for efficiency in terms of time and money. Companies continually make decisions that trade safety off against other objectives (e.g., time and cost). Without a framework that keeps safety concerns elevated to an appropriate level, The reader is referred to Chapter 5, “Industry Management of Offshore Drilling,” of the NAE­NRC 1 (2011) report for additional information about system safety, safety culture, and high­reliability organizations. This information is not strictly limited to offshore drilling operations, but is applicable to offshore oil and gas facilities in general.

OCR for page 38
26 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems inefficient, even disastrous, decisions will ultimately be made. This can happen when the conflict of responsibility and accountability with respect to many different organizational goals (e.g., safety, time, and production) ensures that the target with the most forceful message from top man­ agement will prevail. Building trust that top management will support safety decisions made by personnel throughout the organization, even when they are in conflict with other priorities, is the only way to achieve a culture of safety. SEMS alone cannot build this trust. To achieve reliably safe operations, more than a well­defined SEMS program is needed. People in the organization must actually use the SEMS program and improve its implementation on a continuing basis. Thus, auditing of SEMS programs should extend beyond verifying the existence of a SEMS program—and the existence of documentation that supports its use—to assuring that what is described in the SEMS plan is actually the way people in the organization think and work.2 Effective measurement of the efficacy of a SEMS program must extend beyond verifying the paper records of the program to examining how the SEMS plan is used to guide what individuals in the organization do to ensure safe and environmentally responsible operations. GuidinG QuEStionS for Evaluation or audit Any audit process offers multiple opportunities for checking the strength and effectiveness of each platform’s realization of SEMS. A sequence of guiding questions provides a preliminary structure for the audit: 1. Is a SEMS plan in place? Is the plan complete? Is there a document to read? Has the owner or operator structured a plan that covers all the necessary personnel, equipment, and situations? 2. Is the plan feasible and effective? Given that a plan is in place, how good is the plan at reducing risks? If the steps outlined in the plan Individual, organizational, and technical factors and their impact on the culture of safety are all 2 considered in the various philosophies, frameworks, and techniques espoused by leading researchers who study highly complex systems, high­reliability organizations, and the like. For more detailed discussions of this issue, the reader is referred to the following sources (to name but a few): ABS (2012), Bea (2002), Hopkins (2004, 2006), LaPorte and Consolini (1991), Reason (1997), Scarlett et al. (2011), Schein (1992, 2004), Weick (1987), and Weick and Sutcliffe (2001, 2007).

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 27 are followed, will they be successful in meeting program safety goals? Are sufficient resources available to comply with the plan? How does the plan compare with plans that have been developed for other similar platforms and have been shown to be effective? 3. Do personnel know about the plan? A well­written and carefully thought­ out program will not succeed if the personnel required to follow it are not aware of it. Is there a way to track components of SEMS with the necessary personnel? As personnel are replaced, is there a process by which new personnel are introduced to their responsibilities? Is the plan pervasive throughout the organization? 4. Can and do personnel effectively carry out the plan? That personnel are aware of the program does not mean that they can follow it effectively. Is a training program in place? Are there periodic tests and drills with which personnel can demonstrate their familiarity and expertise with details of the plan? 5. Is the plan affecting safety? The goals of SEMS programs are to improve both occupational and process safety. Are metrics that permit verification of the SEMS plan being recorded and tracked? Is the plan being used to instill and encourage a healthy safety culture? Long­term effective­ ness can only be assessed through the comparison of tracked measures with baseline data. Are near­miss events related to occupational and process safety being recorded and evaluated? A careful definition of performance metrics would allow for comparisons across platforms, rigs, operations, lessees and operators, and regions. It would also facilitate international comparisons. Each question requires a different audit approach; a different data collection requirement; a different audit schedule; and, potentially, a different type of trained auditor. Strengths and weaknesses of alternatives for these options are discussed in the following sections. aSSESSinG thE EffECtivEnESS of SEMS and itS EffECt on CulturE With its inspection and audit programs, the Bureau of Safety and Envi­ ronmental Enforcement (BSEE) is in a unique position to influence how SEMS is implemented and integrated into an organization. As discussed

OCR for page 38
28 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems above, more than a well­defined SEMS program is needed to achieve reliably safe operations; people in the organization must actually imple­ ment the program and improve it on a continuing basis. An effective audit program would extend assurance beyond verifying paper records to investigating how the program is used to guide what individuals in the organization do to ensure safe and environmentally responsible operations. For example, issuing INCs for failure to comply with prescriptive regulations leads to an attitude that compliance equals safety and does not influence behavior beyond the minimum standard. Because tacit knowledge exceeds explicit knowledge by several times, it is not possible to define a set of rules that, if followed exhaustively, will create safety. People need to understand the objectives and work toward those objectives, not blindly follow a minimum standard. Even worse, issuing INCs as punishment after the fact for inappropri­ ate behavior (the stick half of a carrot­and­stick approach) can create a culture of fear and blame. Practical experience in everything from child raising to conforming to a group norm has shown that fear of punishment can be used to provide a minimum level of expected behavior, but fear of punishment does not normally affect basic attitudes. More will be described later in this report, but briefly, BSEE has a critical role in • Auditing for the existence of a SEMS program and for its built­in improvement mechanisms and • Grading and counseling before the fact to help management establish norms and motivation (the carrot). Grading and counseling will help corporate leadership better understand how to strengthen the actual structure, controls, and competency that exist in its operations. BSEE can also help corporate leadership understand how to improve the actual state of behavioral norms and motivation in its operations. Such an evaluation system should not be strictly objective or quanti­ tative and cannot be a matter of pass or fail. The evaluation system will need elements such as interviews with a sample of workers and first­level supervisors, grading of each of the elements of SEMS, and reviews

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 29 of results with leadership. This process must be repeated periodically to find trends, and evaluation results should be publicly reported to provide both a carrot and a stick. Most importantly, it will require changing from an INC mentality (punishment) to a cooperative mentality (consultation and advice). a Word of hoPE Since 1968, the oil and gas industry has reduced lost­time incidents by some 97.5 percent (Figure 2­2), despite a large increase in hours worked. This change did not happen randomly. The industry has specifically focused on significantly improved occupational safety over the past few decades. Accomplishing this improvement required not only new processes (such as job safety analysis), but also cultural change. In the early 1970s, operations people actually quipped, “If you aren’t missing a finger, it means you haven’t worked very hard.” No one says this today, and if someone were to say it, he or she would be viewed by many of his or her peers with disdain. LTI Rate Rec. Rate DART Man-hours 16 450,000,000 400,000,000 Man-hours 14 350,000,000 12 97.5% decline in LTI Lost-Time Incidents 300,000,000 Incidence Rate 10 Man-hours 250,000,000 8 200,000,000 6 150,000,000 Recordable 4 100,000,000 Days Away & Restricted Time 2 50,000,000 0 0 1968 1970 1972 1974 1976 1978 1980 1982 1984 1986 1988 1990 1992 1994 1996 1998 2000 2002 2004 2006 FIGURE 2-2 Industry safety metrics. For 2007, man­hours are estimated and third­quarter incidence rates are used. (LTI = lost­time incidents; Rec. = recordable; DART = days away and restricted time. Source: IADC 2011.)

OCR for page 38
30 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems Many, Many Fatalities Process Safety Personal Safety Incident Blind Spot Fatality Near Miss Lost Time Injury Process/System Upset Restricted Duties Injury Component Design Flaw Near Miss Process/System Design Flaw Hazard Process/System Physical Sensitivity FIGURE 2-3 Personal versus process safety pyramids. (Source: Hopkins 2009.) The focus on occupational (personal) safety has led to dramatic reductions in lost­time incidents, recordable incidents, and the like. However, organizations with a good occupational safety record are not necessarily managing large­scale risks—that is, system safety or process safety—appropriately, as illustrated in the Macondo well–Deepwater Horizon catastrophe (see NAE­NRC 2011). Managing process safety means ensuring “that safety is built into a system with the objective of preventing or significantly reducing the likelihood of a potential accident” (NAE­NRC 2011, p. 91) in order to manage the very rare but very high­consequence incidents that can lead to multiple losses of life, substantial property loss, and extensive environmental damage.3 Figure 2­3 shows the difference between the occupational (personal) and process safety pyramids. In the past, regulators and the industry have not focused as much on total system safety (which includes process safety) as they should. The committee believes that, with a properly constructed SEMS program For additional discussions of system safety, see for example, Leveson (2011), Rasmussen (1997), 3 and Rasmussen and Svedung (2000).

OCR for page 38
Role of SEMS in Establishing a Culture of Safety 31 that encompasses a clear focus and intentional action, the industry can improve process safety without compromising occupational safety. In a widely circulated video, Brian Appleton, technical adviser to the Lord Cullen inquiry team into the Piper Alpha accident in the North Sea, makes the point that a safety audit that does not find defi­ ciencies in an SMS should be suspect: “In safety, no news is not good news” (Appleton 1995). The committee heard similar sentiments in meetings with the California State Lands Commission and Petroleum Safety Author­ ity Norway, two organizations that have extensive experience auditing SMS programs. That is, a pass–fail, INC­based audit of a SEMS program that does not find deficiencies is probably not a good audit. Such an audit will have a tendency to focus on written policies and procedures to determine whether they contain the exact wording required by 30 CFR 250, Subpart S, and operators will expend great effort to assure that the words are “correct” and the proper documentation is on file. If BSEE’s goal is, as it should be, to encourage a culture of safety so that individuals know the safety aspects of their actions and are motivated to think about safety, then the agency will need to evolve an evaluation system for SEMS that emphasizes the evaluation of attitudes and actions rather than documentation and paperwork. All of the elements of SEMS must be addressed, but it is more important that those who are actually doing the work understand and practice these elements than that these elements are documented. Lord Cullen said of the Piper Alpha “permit to work” system, “The operating staff had no commitment to working to the written proce­ dure; and . . . the procedure was knowingly and flagrantly disregarded” (Appleton 1995). An evaluation system that emphasized documentation may have missed the lack of a proper culture of safety on the Piper Alpha. The remainder of this report contains the committee’s justification and recommendations for how BSEE can assess the effectiveness of an operator’s SEMS program while simultaneously promoting development of a fundamental transformation of the industry’s safety culture. The report describes an approach that the committee believes will guide BSEE in playing a critical role in helping the industry transform its safety culture, with the goal of making the risk of working offshore as low as reasonably practicable (ALARP).