Click for next page ( 64


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 63
4 Existing Approaches for Assessing Safety Management Systems It is impossible for a regulator to inspect quality into the petroleum industry. The industry itself must ensure quality. —Magne Ognedal, Director General, Petroleum Safety Authority Norway This chapter presents a description of the safety management programs of various U.S. and international regulatory agencies whose safety mandate is similar to that of the Bureau of Safety and Environmental Enforcement (BSEE). Each of these agencies has developed a program and established regulations to assure the compliance of the specific activities and cultures of the industries under its purview. In addition, the newly established Center for Offshore Safety (COS) is described, and its potential value to the U.S. offshore oil and gas industry is discussed. The Committee on the Effectiveness of Safety and Environmental Management Systems for Outer Continental Shelf Oil and Gas Operations (the committee) received presentations from and conducted follow-up inquires with the Occupational Safety and Health Administration (OSHA) and Mine Safety and Health Administration (MSHA) of the U.S. Depart- ment of Labor, the U.S. Coast Guard (USCG), and the California State Lands Commission (CSLC), as well as with the United Kingdom (UK) Health and Safety Executive (HSE) and Petroleum Safety Authority (PSA) Norway. On the basis of the information gathered, the committee attempted to address the following questions for each agency, as applicable: • What has been done to ensure there is a safety management system (SMS) in place? • How does the regulatory authority know that the SMS is working? • How does the regulatory agency enforce it? 43

OCR for page 63
44 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems • Now that the agency has had some experience with a safety manage- ment program, what does it believe is effective in the program? What would the agency change in the program if it could? U.S. RegUlatoRy agencieS U.S. coast guard The USCG policy for enforcing the International Safety Management (ISM) Code is divided into two major areas. The first area of responsibility is for U.S. flag vessels mandated to comply with the ISM Code. USCG is the flag administration agency for the implementation and enforcement of the ISM Code on U.S. flag vessels and administers this responsibility through a delegation of recognized and authorized organizations according to 46 CFR 8, “Vessel Inspection Alternatives.” The second area of responsi- bility is verification of compliance with the ISM Code on foreign-flag ves- sels entering U.S. ports. Detailed guidelines for enforcement of the ISM Code on foreign-flag vessels subject to the U.S. Port State Control program are contained in Navigation and Vessel Inspection Circular (NVIC) 4-98. This NVIC contains all of the applicable International Maritime Organiza- tion guideline documents for the ISM Code. Compliance with the ISM Code is unique because the code is integral to nearly every other aspect of overall regulatory compliance. A basic tenant of any SMS is that the system must be in constant compliance with requirements for safety and environmental protection. Because of this, USCG marine inspectors will, in the course of routine material and human element inspections, provide a means of measuring compliance with the ISM Code. Confirmation of compliance can take several forms, the most basic of which is simply to verify that the vessel has a valid ISM Code Safety Management Certificate and a copy of the company’s Docu- ment of Compliance Certificate. The next, and more complex, level is to identify links between any deficiencies noted during the course of rou- tine inspections and the vessel’s SMS. The latter task requires that marine inspectors have a working knowledge of the elements of the ISM Code as well as knowledge of the duties and training of shipboard personnel. To assist marine inspectors in making these judgments, a training course has been established at the Marine Inspection and Investigation School at the USCG Training Center in Yorktown, Virginia. All USCG marine

OCR for page 63
45 Existing Approaches for Assessing Safety Management Systems inspectors and vessel-boarding officers are required to read and become familiar with the ISM Code and NVIC 04-98. USCG oversight of ISM Code auditing or ISM Code certification pro- cesses for the SMS of a U.S. company or vessel is coordinated through the authorized organization. Any examination of a vessel for any purpose is also an opportunity to judge the effectiveness of the SMS. Although ISM oversight is not the primary purpose of the visit, inspectors are alert to whether the deficiencies they find while performing other inspections should have been managed with the SMS. Oversight may also occasion- ally arise from investigations into vessel casualties, reports by vessel crew members, or at the direction of the USCG commandant. Any time an authorized organization’s surveyor notes significant material deficiencies, serious lack of maintenance of a vessel or its equip- ment, or failure of the crew to follow safety procedures, the potential or actual failure of the SMS procedures is analyzed. This analysis may include instances of a lack of routine maintenance of critical systems or of equipment or material failures that have not been submitted as a corrective action request and that indicate a clear failure of the crew to follow maintenance or safety procedures. Information to make this type of determination may be collected by • Observing or interviewing the crew members responsible for the area of the SMS where the deficient item was noted. Crew members should be knowledgeable about the responsibilities required of them by SMS procedures. • Verifying that SMS procedures are being carried out with regard to the area of deficiency. • Asking the master or responsible crew member to give an account of what corrective action has been initiated under the SMS and to cite evidence of this action. Failure to submit corrective action reports is noted and, depending on the severity and number of instances, is reported to the organization that issued the Safety Management Cer- tificate. When these failures are found, the representative of the autho- rized organization acting on behalf of the United States must provide a report, orally or in writing, to the cognizant local officer in charge, marine inspection. These reports are required to be submitted as soon as possible; in addition, oral or written reports (the latter of which can be delivered via e-mail) are supposed to be made within 48 hours.

OCR for page 63
46 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems If it appears that any portion of the SMS is not being followed, USCG personnel may issue a vessel deficiency citation (Form CG-835, Notice of Merchant Marine Inspection Requirements) to the vessel’s master requesting verification of compliance from the authorized organization that issued the vessel’s Safety Management Certificate. If the noncon- formity is linked to shoreside operations, then compliance from the authorized organization that issued the company’s Document of Com- pliance Certificate is also required. It is the vessel master’s responsibility to notify the organization that issued the Safety Management Certificate or Document of Compliance Certificate. Depending on the severity of the deficiency, USCG may allow a reasonable period of time to satisfy the requirements of the CG-835. In cases in which the deficient item would restrict the vessel from sailing, the time allowed by the CG-835 for veri- fication of the SMS should be proportionally short. U.S. occupational Safety and Health administration Process safety management (PSM) is an OSHA regulation intended to prevent or minimize the consequences of a catastrophic release of hazardous materials from specific onshore processing operations, nota- bly chemical and hydrocarbon facilities. PSM is similar to Safety and Environmental Management Systems (SEMS) in that it involves com- prehensive procedures and management practices to ensure safe opera- tions that protect workers and, by extension, minimize environmental consequences. The PSM rule is contained in 29 CFR 1910.119, “Process safety management of highly hazardous chemicals.” PSM was initiated in 1992 after several large-scale chemical incidents, including the explosion in Flixborough, England, in 1974; the toxic release in Bhopal, India, in 1984; the toxic release at the Union Carbide facility in Institute, West Virginia, in 1985; and others. Investigations and studies of these events indicated that a performance standard was needed that would provide a comprehensive management program— a holistic approach that would integrate technologies, procedures, and management practices. The details of such a program are contained in 29 CFR 1919.119. PSM covers 225 different industry subsectors with an estimated 10,000 to 15,000 processes. The PSM regulation (29 CFR 1910.119) was first pub-

OCR for page 63
47 Existing Approaches for Assessing Safety Management Systems lished in February 1992. Covered facilities were required to comply with the standard by May 26, 1992. The standard provided a period of approxi- mately 5 years for employers to conduct their initial process hazard analyses (PHAs), with 25 percent of the PHAs to be conducted in each year, starting in 1994, and all PHAs to be completed by May 1997. The PHA element of PSM must be updated and revalidated at least every 5 years [29 CFR 1919.119 (c)(6)], and audits to ensure compliance with all provisions of PSM must be conducted at least every 3 years [29 CFR 1919.119 (o)]. In contrast, the SEMS regulation was published in October 2010, with full implementation required by November 15, 2011 [30 CFR 250.1900 (a)]. Although November 2011 was the deadline for implementation of a SEMS plan, operators were not required to submit a written plan. Instead, they have been subject to audit at any time thereafter and must be able to dem- onstrate they have a SEMS plan in place if there is an incident. Several American Petroleum Institute (API) publications that address PSM with regard to oil and gas operations are available, including API Recommended Practice (RP) 750, Management of Process Hazards (API 1990); API RP 752, Management of Hazards Associated with Location of Process Plant Buildings (API 2003); API RP 754, Process Safety Per- formance Indicators for the Refining and Petrochemical Industries (API 2010b); and API RP 755, Fatigue Risk Management Systems for Personnel in the Refining and Petrochemical Industries (API 2010a). The latter two incorporate recommendations from the study of the 2005 Texas City explosion (ABSG Consulting Inc. 2006; BP U.S. Refineries Independent Safety Review Panel 2007). PSM also references several publications related to chemical plants and other types of industrial facilities that handle hazardous materials. Because PSM is a performance manage - ment standard, it requires employers to identify the codes and stan- dards they use with respect to equipment and to document that they have complied with recognized and generally accepted good engineer- ing practices for the design, inspection, and testing of their equipment. For offshore oil and gas operations, SEMS likewise references API RP 75, Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities (API 2004). BSEE used the Safety and Environmental Management Program (SEMP)

OCR for page 63
48 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems as the underlying philosophy for SEMS. BSEE informed the committee that they conferred with the OSHA PSM group while developing SEMS in order to incorporate lessons learned and other findings from OSHA’s approximately 20 years of experience with PSM. The initial PSM rule had 12 elements; two more elements (employee participation and trade secret protection) were added later. The PSM elements are similar to the SEMS elements (see Table 4-1). There are TABLE 4-1 Comparison of SEMS Elements with OSHA PSM Elements Similar OSHA PSM Element SEMS Element (CFR reference) (PSM element number) General Description 1. General (30 CFR 250.1909) Implementation, planning, and management approval of program 2. Safety and environmental Process safety information (2) Compilation of written process safety information (30 CFR 250.190) and environmental information, including hazard information 3. Hazards analysis Process hazards analysis (3) Conduct of PHA for each covered (30 CFR 250.1911) process 4. Management of change Management of change (10) Establishment and implementation (30 CFR 250.1912) of written procedures to manage change 5. Operating procedures Operating procedures (4) Development of written operating (30 CFR 250.1913) procedures that provide clear instructions for safely conducting activities 6. Safe work practices Hot work (9) Development and implementation (30 CFR 250.1914) Line breaking (4) of practices for hazardous Lockout–tagout (4) operations Confined space entry (4) 7. Training (30 CFR 250.1915) Training (5) Conduct of training of employees Contractors (6) and contractors alike; training must emphasize safety and environmental hazards 8. Mechanical integrity Mechanical integrity (8) Development of written procedures (30 CFR 250.1916) for the ongoing integrity of process equipment 9. Pre-start-up review Pre-start-up safety review (7) Confirmation that the construction (30 CFR 250.1917) and equipment of a process are in accordance with design specifications 10. Emergency response and Emergency planning and Development and implementation control (30 CFR 250.1918) response (12) of an emergency action plan (continued)

OCR for page 63
49 Existing Approaches for Assessing Safety Management Systems TABLE 4-1 (continued) Comparison of SEMS Elements with OSHA PSM Elements Similar OSHA PSM Element SEMS Element (CFR reference) (PSM element number) General Description 11. Investigation of incidents Incident investigations (11) Investigation of each incident that (30 CFR 250.1919) resulted in, or could reasonably have resulted in, an incident 12. Auditing (30 CFR 250.1920) Compliance audits (13) Evaluation of the program of compliance 13. Record keeping Maintenance of documentation (30 CFR 250.1928) that describes the elements of the program 14. Stop work authoritya Stipulation that any and all personnel (30 CFR 250.1930) (employees or contractors) can stop unsafe or hazardous work 15. Ultimate work authoritya Identification of the person with (30 CFR 250.1931) ultimate authority for the facility 16. Employee participationa Employee participation (1) Development of a written plan of (30 CFR 250.1932) action regarding the implementa- tion of employee participation 17. Guidelines for reporting Provision of procedures to report unsafe work conditionsa unsafe work conditions (30 CFR 250.1933) 18. None Trade secrets (14) Information required by the PSM standard is to be made available as needed (confiden- tially if necessary) Additional element issued under SEMS II in September 2011 (BOEMRE 2011a). a 13 original SEMS elements, and several more were proposed in the notice of proposed rulemaking published in September 2011 (SEMS II) (BOEMRE 2011a). Early PSM compliance used a program quality verification scheme in which compliance safety and health officers audited an operation for PSM compliance and OSHA issued citations for noncompliance. Program quality verification was resource intensive, although relatively few cita- tions were issued, and was too broadly focused. It did not focus the compliance safety and health officers on specific issues for the many types of facilities and processes covered by PSM (in contrast, SEMS is generally limited to offshore oil, gas, and sulfur operations). Program quality veri- fication was subsequently replaced with the current National Emphasis

OCR for page 63
50 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems Program for PSM enforcement. This system uses a list-based approach for determining compliance via a publicly available “static list” of compli- ance items to be inspected and a “dynamic list” that is not publicly avail- able and is ever changing. Because the National Emphasis Program is able to conduct more inspections with the same number of resources, there is more incentive for better compliance with the standard. The National Emphasis Program has uncovered many more significant findings than the previous program quality verification approach. This is partly because of the large-scale refining and chemical facilities and operations to which PSM applies, as it is easier to identify deficiencies when there is a focus on specific items to evaluate. OSHA has also increased PSM training for compliance safety and health officers in order to provide a more effec- tive workforce. Discussion between the committee and OSHA identified the follow- ing actions that could be taken to improve PSM:1 • Revise the wording of the PSM regulations to make them more defen- sible against legal arguments that try to work around the phrasing in the Code of Federal Regulations. OSHA believes that the PSM requirements are not fundamentally flawed; rather, some modifica- tions in the wording of the requirements would improve the ability to enforce them. • Look at specific performance requirements to determine whether they can be made more prescriptive without burdening the employer. • Use dedicated staff with experience and background in the industry that is being inspected. • Emphasize the need for comprehensive training for enforcement staff and managers. Additional information about PSM can be found on the OSHA PSM website.2 This website provides the PSM regulations and references for equipment design and in-service practices (including inspection, testing, preventative and predictive maintenance, repair, alteration, rerating, and M. Marshall. OSHA’s PSM Regulation. Presentation to the committee, Washington, D.C., 1 August 31, 2011. See http://www.osha.gov/SLTC/processsafetymanagement/index.html. 2

OCR for page 63
51 Existing Approaches for Assessing Safety Management Systems fitness-for-service evaluations). The website also covers other important aspects of PSM, including PHA, human factors, facility siting (blast), fire protection, mechanical integrity, procedures, management of change, and other issues. An extensive list of references provides access to other PSM-related information. Mine Safety and Health administration MSHA was created in the U.S. Department of Labor in 1977 with the pas- sage of the Federal Mine Health and Safety Act of 1977 (the 1977 Mine Act) and has responsibility for enforcing safety and health rules in all mines and mineral-processing operations in the United States, regard- less of their size, the number of employees, or the method of extraction. The Mine Act provides that MSHA inspectors shall inspect each surface mine at least two times a year and each underground mine at least four times each year (seasonal or intermittent operations are inspected less frequently) to determine whether there is compliance with health and safety standards or with any citation, order, or decision issued under the Mine Act; to determine whether an imminent danger exists; and to ensure that actual practices comply with approved plans and programs.3 Some of MSHA’s other important mandatory activities are • Reviewing for approval mine operators’ mining plans and education and training programs, • Developing improved mandatory safety and health standards, • Investigating petitions for modification of mandatory safety standards, • Investigating mine accidents and hazardous condition complaints, and • Assessing and collecting civil monetary penalties for violations of mine safety and health standards. To fulfill its mandate, MSHA currently has approximately 800 coal inspec- tors and 345 metal and nonmetal inspectors; the agency also has more than 200 full-time exempt employees in support of its technical support function. In FY 2011, MSHA had 2,200 full-time exempt employees and a budget of approximately $380 million. See http://www.msha.gov/REGS/ACT/ACTTC.HTM. 3

OCR for page 63
52 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems MSHA pursues several other activities that support the carrying out of the mandates of the 1977 Mine Act. Some of the important activities are associated with the education and training of mine inspectors, mine officials, and miners; the testing, approval, and certification of certain mining products for use in mines; and the provision of technical assis- tance to the states and small mine operators. These are accomplished through specific mechanisms such as MSHA’s • National Mine Health and Safety Academy, • Approval and Certification Center, • Pittsburgh Safety and Health Technology Center, and • Directorate of Educational Policy and Development. The partial list of MSHA’s mandatory and support activities given above points to a number of opportunities for auditing the status of health and safety in mines. In addition to mandatory inspections, strate- gic impact inspections at mines that may need greater attention are also conducted. Such mines could be characterized as having a high risk of explosion; a poor history of compliance; or a high incidence of injuries, illnesses, fatalities, violations, or complaints. Auditing in MSHA’s Approval and Testing Center encompasses a large number of verification, validation, and approval processes. Of particular importance is the postapproval audit by the agency. Review and approval of mine operators’ mining plans, training programs, and certification of trainers and mine officials provide the basis for verification and valida- tion during inspections and audits. MSHA has one of the most comprehensive computerized databases of mining operations and mine health and safety statistics in the world. The National Institute for Occupational Safety and Health (NIOSH) has converted this database into two popular formats—dBase IV and SPSS (which includes labels and coding information)—so that NIOSH and other interested parties (including consultants, universities, and the National Safety Council) can access and analyze MSHA data in the course of researching and advancing health and safety experiences in the mining industry. MSHA’s work with NIOSH, industry, and states to develop health and safety programs is extensive. States and trainers use MSHA’s State

OCR for page 63
53 Existing Approaches for Assessing Safety Management Systems Grants Program for miner training programs and MSHA’s training resource materials to conduct health and safety training. MSHA also has an alliance with the National Stone, Sand, and Gravel Association (NSSGA)—a sand, stone, and gravel operators group— to help in the development and implementation of health and safety programs to create a culture that will prevent accidents and injuries in these mines. The NSSGA–MSHA Alliance has defined, described, and developed examples of 11 fundamental principles of a safety program that covers elements such as management commitment, training and development, employee involvement and participation, incident inves- tigation, and accountability. Recently, MSHA has undertaken a new rule-making process to imple- ment new regulations for safety and health management programs in the mines. MSHA believes that operators with effective safety and health management programs will identify and correct hazards more quickly and successfully, which will reduce the number of accidents, injuries, and illnesses. In October 2010, MSHA held three public information- gathering meetings. Information received from these meetings indicates that companies with a safety and health management program have bet- ter health and safety records. MSHA is still gathering data to determine what actions the agency might take, including implementation of specific regulations governing safety and health management programs. For example, to gather infor- mation on existing model programs for best practices for safety and health management programs, MSHA held a public meeting on November 10, 2011, in Birmingham, Alabama, in conjunction with the Sixth Annual Southeastern Mining Safety and Health Conference. Proposed rules are expected sometime in 2012 and may be similar to the Injury and Illness Prevention Programs being proposed by OSHA.4 In summary, MSHA has an extensive program encompassing compli- ance inspections, impact inspections, equipment testing and approval, review and approval of mine plans, compliance assistance, education and training programs, trainer and official certification, and technical services, all of which may provide some insights to BSEE. L. Zeiler, United States Department of Labor, Mine Safety and Health Administration. Presenta- 4 tion to the committee, Washington, D.C., August 31, 2011.

OCR for page 63
61 Existing Approaches for Assessing Safety Management Systems changes in terminology were more significant than might be thought at first sight. The supervision concept, for instance, was not confined to mere monitoring. It covered all activities that provided the necessary basis for determining whether the companies had accepted responsi- bility for complying with the regulations in every phase (PSA Norway 2010). By way of simple analogy, under quality management, the super- visor of a factory floor does not just inspect the factory’s work product and fire employees who do not perform. Rather, the supervisor works with employees to ensure performance continuously improves. The change in philosophy created a climate in which PSA worked with the industry to improve safety instead of acting in the role of a compliance inspector and guarantor of the acceptability of company activities. In the context of PSA, supervision is directed at the operator’s administrative management system, which the companies actually use to ensure acceptable operation. PSA works with individual operators with the intention of helping to make them more successful, but also works with the industry by chair- ing an industry board that consists of representatives from employers’ representatives (operators, manufacturers, and shipping associations), employees (represented by five unions) and regulators to define the reg- ulations and issue nonbinding recommendations and guidelines. PSA works very closely with employers and employees, but PSA ultimately makes the decisions. These recommendations and guidelines make fre- quent reference to international industrial standards for equipment, structures, and procedures. To confirm that there is an SMS in place, PSA conducts audits of companies to ensure acceptable operation. These audits are conducted by personnel with the special expertise and experience necessary. Dur- ing the audit, the operator must demonstrate both a commitment to and an expertise in complying with the frame conditions that govern its operations. According to PSA, the requirements of a performance-based system audit place a great demand on industry, employees, and the regu- lator in terms of expertise, management, and flexibility.13 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 13

OCR for page 63
62 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems A typical audit is conducted by a team of at least two but up to five or six people. From planning through execution and reporting, the audit takes 2 to 5 weeks. Notice is usually given about a month in advance, and separate meetings are held with union safety delegates to ensure that employee views are heard. The audit team and plan vary according to the type of operation being audited. Detailed audit guidelines are designed for each audit, and each audit team is led by a certified audit team leader. Audit team membership is driven by the competencies needed to perform the task. For example, if maintenance management is of particular interest, the team will include a maintenance specialist. Scheduling of audits is not determined solely by frequency, but by using a risk-based approach. Operations and particular operators are chosen for audits based on risk. In addition to the risk-based audits, an audit of each installation is conducted at least once every 3 years. For the purpose of integrity, there are never fewer than two auditors present. Norway, however, is a comparatively small country (4.8 mil- lion residents; in comparison, Louisiana has 4.5 million residents) with a relatively large petroleum industry (the industry accounts for more than 20 percent of the country’s gross domestic product). Therefore, no attempt is made to limit audit team membership on the basis of prior or current involvement of a family member or friend in the organization being audited. Norway has not felt a need to institute detailed conflict of inter- est regulations beyond direct financial involvement with the operator.14 Either the operator or an independent designee conducts inspections (both independent and internal) as a normal part of the management system. PSA may or may not request the results of these inspections as part of its management system audit. In addition to audits, PSA conducts incident investigations with special focused teams as necessary. The results of these investigations are used to improve operations in the investigated operator’s organization and to inform and improve operations in orga- nizations with similar kinds of operations. PSA uses several formal instruments other than audits and inspections to assess how well an operator’s SMS is working (PSA Norway 2011d). M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 14

OCR for page 63
63 Existing Approaches for Assessing Safety Management Systems Although structured, a few of these instruments are, to some extent, quantitative: • Dialogue. The bulk of practical supervision consists of dialogue between PSA and the industry to assess trends and request plans, analyses, docu- mentation, and information. Meetings between PSA and the relevant company involve both appropriate managers and employees. General- ized results that do not identify specific operators or installations are summarized in reports that are then posted to PSA’s website.15 • Notification of undesirable incidents. Companies are required to notify PSA about undesirable incidents. The regulations clearly define what must be reported and require the use of a dedicated form. Approxi- mately 800 to 900 notifications are received every year. The number of undesirable incidents and the character of these incidents also help PSA assess an operator’s management system. An abnormally low number of incidents may indicate a problem with an operator’s reporting sys- tem and, therefore, with the operator’s entire SMS. An abnormally high number of incidents may indicate a safety problem. • Hotline. PSA has a hotline staffed around the clock for reporting emer- gencies. Such reports are first received and registered by the duty offi- cer, who also makes the initial assessment of the seriousness of the incident and the possible immediate actions required. If necessary, the duty officer activates PSA’s emergency response center to monitor a serious ongoing incident. • Tailored follow-up. Each undesirable incident is allocated to a case offi- cer who checks it, categorizes its seriousness (which may differ from the operator’s assessment), and selects a tailored follow-up for the opera- tor or company. In the case of very serious events, PSA may decide to launch an investigation or conduct another type of close follow-up. The response to less serious incidents is tailored to their nature. • Risikonivå i norsk petroleumsvirksomhet (RNNP). The RNNP process was initiated in 1999–2000 to develop and apply a tool for measur- ing trends in risk level in Norwegian petroleum activity. This process monitors risk trends with the aid of various methods, such as inci- dent indicators, barrier data, interviews with key informants, working See http://www.ptil.no/main-page/category9.html?lang=en_US. 15

OCR for page 63
64 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems seminars, and fieldwork. A major questionnaire-based survey is also conducted every 2 years. This work has acquired an important posi- tion in Norway’s oil and gas industry because it contributes to a shared understanding of risk developments on the part of everyone involved. Results from these studies are presented in annual reports, which also provide the basis for taking action to combat a negative trend. Pub- lished around April 20 each year, the annual reports provide a realistic picture of developments in the risk level from year to year. The RNNP process only indirectly helps assess a particular operator’s management system, but does provide trend information that helps PSA take action. • Whistleblowers. Whistleblowers help to shape and complete the pic- ture of the safety position. PSA receives information from employees in the industry about poor safety or conditions open to criticism in their workplace. Such input is closely followed up in accordance with established and legally required routines. The anonymity of whistle- blowers is protected. Whistleblowers help PSA understand how a particular company’s management system is working by identifying possible issues that are not found by other means. • Daily Drilling Report System (DDRS). Since 1984, companies have been required to provide information via the DDRS database on all drilling on the Norwegian Continental Shelf. PSA can extract from the DDRS the essential facts about each current operation and thereby assure itself, if necessary, that undesirable well incidents have actually been reported. PSA applies the necessary measures to ensure that activities are con- ducted in accordance with regulatory requirements and through formal instruments.16 These measures include the following: • Observations with comments, which are discussed with the operator; • Improvement possibilities, which drive discussion and are reported to the operator (the operator is required to inform PSA of the changes made as a result); • Issuance of a “not in compliance” notice, with a requirement to fix the problem in less than 3 weeks; M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 16

OCR for page 63
65 Existing Approaches for Assessing Safety Management Systems • Police investigation for willful violation (which has happened once); • Recommendation to the ministry to remove the operator’s license; and • Recommendation that the operator be banned from future drilling blocks in Norway. It is PSA’s responsibility to define the terms for responsible operation of the petroleum industry and to check that companies are working on prevention and on continuous improvement of safety levels. Because PSA views criminal law as the province of the police (PSA Norway 2010), almost all PSA enforcement actions are in the form of observations or improvement possibilities. PSA believes that the following aspects of its program (presented in no particular order) are critical to its program’s effectiveness: • Doing nothing to take responsibility away from the industry. The PSA model is based on the conviction that the government cannot inspect quality into the industry. The industry itself must ensure that quality is achieved and maintained (PSA Norway 2010).17 • Dialogue on problems. PSA believes in working with operators and the industry to make them more successful. The internal control system can only work as intended if it is operated in close collaboration and consultation with safety delegates, employees, and the regulator (PSA Norway 2010).18 • A focus on functional requirements and system orientations rather than on checking compliance.19 • A “fit-for-purpose” approach to constituting audit teams. Teams must consist of sufficient personnel with the expertise and experience neces- sary for a specific audit.20 • The RNNP approach, which provides flexibility and focus to supervi- sion (PSA Norway 2010). • Allowing operators, to a great extent, to choose for themselves the solutions they will adopt to meet official requirements (PSA Norway 2011c). M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 17 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 18 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 19 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 20

OCR for page 63
66 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems • Involvement of PSA specialists in both monitoring and participating in the development and revision of industrial standards to help make sure that these are constantly relevant and reflect best practices (PSA Norway 2011c). • Recognition that the work involved in a performance management system can easily be underestimated, and that it is therefore important to emphasize that this form of regulation demands much more of the industry, employees, and government than detailed regulations (PSA Norway 2011c). PSA uses the RNNP process and the past performance of the industry, particular operators, and technological trends to create key focus areas that change over time. Changes in focus areas are based on development plans, activities, audit plans, safety-critical activities, input from class societies, experience with operators as a whole and with individual oper- ators, and new or revised regulations. PSA’s current priority areas are 1. Assuring top management’s role in managing major risks, 2. Conducting specific studies of technical and operational barriers (on the basis of risk and incidents), 3. Reducing risk to the external environment from subsea operations, and 4. Focusing on occupational risks to specific groups of people, such as sand blasters. PSA also plans to change its system and program periodically as the sources of risk change. The Macondo well accident led PSA, like many regulators, to conduct a detailed investigation of the blowout’s causes and the industry’s response (PSA Norway 2011a, 2011b). Particular interest was paid to the question, “Could this happen in Norway?” and to what changes should be made in how PSA manages safety. The formal conclusion was that there was no reason to revise the system and no need for major overhaul, but that there were issues that the industry needed to address in light of the Macondo accident, including lack of understand- ing of risks, lack of supervision, and failure to follow procedures. PSA posed this question to the industry: “Do you think you can oper- ate safely without a capping and containment system?” The industry response was no. PSA also asked the industry, “Do we need better orga- nization of emergency response?” The industry response was yes. So

OCR for page 63
67 Existing Approaches for Assessing Safety Management Systems while some changes were and are being made in Norway in response to the Macondo accident, PSA has not seen a need to change its basic approach to ensuring that adequate management systems are in place on the Norwegian Continental Shelf.21 centeR foR offSHoRe Safety: a Self-Policing Safety oRganization Like the nuclear power industry in 1979—in the immediate aftermath of the Three Mile Island accident—the nation’s oil and gas industry needs now to embrace the potential for an industry safety institute to supplement govern- ment oversight of industry operations. —National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling22 The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (the presidential commission) recommended that a self-policing safety institute be set up by and for the companies working offshore. This proposal recognizes that although government regulators are not likely to achieve the technical safety expertise of private industry, the nation must have a high level of assurance that operations on the Outer Continental Shelf (OCS) are as safe as possible. In this regard, the commission thought that the Institute of Nuclear Power Operations, which was set up by the nuclear power industry after the accident at Three Mile Island, was the desirable model for the U.S. offshore oil and gas industry, although the commission recognized that the number of nuclear facilities that the Institute of Nuclear Power Operations oversees is far smaller than the number of OCS facilities in U.S. waters. In March 2011, largely in response to the presidential commission’s recommendation, and after some internal deliberation, the industry set up COS, the self-described mission of which is to promote the highest level of safety for offshore drilling, completions, and operations through effective leadership, communication, teamwork, use of disciplined SMSs, M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 21 Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, 2011, p. 241. 22

OCR for page 63
68 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems and independent third-party auditing and certification.23, 24 The Com- mittee for Analysis of Causes of the Deepwater Horizon Explosion, Fire, and Oil Spill to Identify Measures to Prevent Similar Accidents in the Future endorsed the concept of a center for offshore safety to train, monitor, and certify (license) offshore oil and gas personnel, stating, This center has the potential to engage the CEOs of oil and gas compa- nies, drilling contractors, and service companies in risk management; set standards for training and certification; develop accreditation systems for industry training programs; and facilitate industry participation in safety audits and inspections.” (NAE-NRC 2011, p. 121) According to the COS website25 and other information provided to the committee, a key operational feature of the center will be a process for independent validation of SEMS programs, with API RP 75 as the basis for the auditing program. The process will encompass audit proto- cols with metrics for the new SEMS regulation, third-party audits, and accreditation and certification of audit service providers. A major objec- tive of COS is to have BSEE embrace the center’s accredited third-party audits as an effective means of complying with regulations and improv- ing industry performance. Although COS is still in the process of being established, some dis- cernible progress is being made. For example, the COS office just opened in Houston, and its governing board is virtually in place. When fully appointed, the board will have a maximum of 24 members, including an executive director. The allocation of seats on the board is intended to achieve a balance between producer–operator members and drill- ing contractor and service supply companies. Membership is open to all companies that operate, drill, or complete wells or provide sup- port services to deepwater drilling, completions, and operations. A company does not have to be a member of API to be a member of the center; however, all API members that work on the OCS must become members of COS. J. Toellner, ExxonMobil. Presentation to the committee, Houston, Texas, October 19, 2011. 23 C. Williams, Shell Energy Resources Co. Presentation to the committee, Washington, D.C., 24 August 31, 2011. 25 See http://www.centerforoffshoresafety.org/main.html.

OCR for page 63
69 Existing Approaches for Assessing Safety Management Systems COS is organized within API, and the COS governing board was established by the API executive committee. The chairman of the board is nominated by the API Upstream Committee and approved by the API executive committee for a term of 3 years. According to the COS website, the center is “organized within API to leverage the existing resources and experience embodied in the long established API certification and standards group.”26 The integration of this nascent self-policing safety organization and API presents a significant credibility problem for COS and was a major concern of the presidential commission, which strongly urged that the new safety institute be completely separate from API. API, known for representing virtually all aspects of the oil and gas industry, is a consen- sus organization that generally settles on that to which a broad majority of interested member companies will agree. It is an organization that has many missions and objectives, including lobbying and policy advocacy. The committee, however, believes COS should have only one function— safety, both of the personnel working on offshore facilities and of the surrounding coastal and marine environment. Nevertheless, it was probably inevitable that the initial offshore safety organization would be set up by API. API’s standards and certification unit, which is the nonadvocacy part of the organization, does so much technical work that it would probably have been difficult to get support to create a parallel and completely independent institute with enough leadership commitment in time and money. Only time will tell whether COS can be an effective, independent force for safety. It is helpful that COS is now based in Houston rather than Washington, D.C., and that it was formed by the standards com- mittees of API rather than the policy advocacy arm. The presidential commission recommended that the new safety institute be established by the companies, and, notwithstanding the commission’s clear con - cerns about credibility, an API relationship was the industry’s decision. The COS leadership will need to demonstrate over time that it can set a direction independent from API. COS must show that the SEMS pro- grams of the companies working offshore are deserving of the nation’s See http://www.centerforoffshoresafety.org/governance.html. 26

OCR for page 63
70 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems trust and confidence. This is a serious challenge, but one that the industry must succeed in meeting if it is going to convince the nation, including the government officials in BSEE who regulate the industry, that the safety mission of the offshore energy companies will not be compromised. SUMMaRy It seems clear from the experiences of the regulatory agencies discussed in this chapter, especially CSLC and PSA Norway, that agencies with charges similar to those of BSEE and many years of experience in overseeing the SMS programs of offshore operators have found that issuing incident of noncompliance notices against a checklist of yes or no requirements27 tends to lead to a culture of compliance rather than a culture of safety. Instead, these agencies have migrated toward a system that • Audits operations with a qualified team of auditors, • Discusses with personnel at different levels of the operation the way in which the elements of the SMS are actually being used, • Feeds the results back to the top management of the operating com- panies, and • Monitors for continuous improvement. These agencies have found that engagement with the industry is more productive than punishment, although they maintain the threat of pun- ishment if needed. Each of these agencies has developed a program and established regulations to assure the compliance of the specific activities and cultures of the industries under its purview. Each of these agencies has uniquely tailored its regulatory role so as to assure the compliance of the specific activities and cultures of the industries under its purview. In doing so, however, each has been moving from prescriptive regula- tions to a goal-oriented or risk-based approach of regulatory oversight in order to better promote continuous improvement in safety. Even before the Macondo well blowout, MMS had undertaken efforts to change regulations for the offshore oil and gas industry, but the blow- For example, “Have written operating procedures been developed and implemented which include 27 the job title and reporting relationship of the person(s) responsible for each of the facility’s operat- ing areas?” [30 CFR, Part 250, Section 250.1913(a)].

OCR for page 63
71 Existing Approaches for Assessing Safety Management Systems out was the catalyst for swift and sweeping regulatory changes, including the restructuring of MMS.28 In response to the Macondo accident and these regulatory changes, the offshore oil and gas industry established COS, whose mission is to promote the highest level of safety through effective leadership, communication, teamwork, use of SMSs, and pro- cess auditing and certification. Although still in the process of being established, COS has the potential to be of great value to the industry. The history of the restructuring of MMS is discussed in both the preface and Chapter 1. 28