National Academies Press: OpenBook

TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems (2012)

Chapter: 4 Existing Approaches for Assessing Safety Management Systems

« Previous: 3 Methods for Assessing Effectiveness
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 63
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 64
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 65
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 66
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 67
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 68
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 69
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 70
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 71
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 72
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 73
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 74
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 75
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 76
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 77
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 78
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 79
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 80
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 81
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 82
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 83
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 84
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 85
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 86
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 87
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 88
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 89
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 90
Suggested Citation:"4 Existing Approaches for Assessing Safety Management Systems." Transportation Research Board. 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. Washington, DC: The National Academies Press. doi: 10.17226/13434.
×
Page 91

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

4 Existing Approaches for Assessing Safety Management Systems It is impossible for a regulator to inspect quality into the petroleum industry. The industry itself must ensure quality. —Magne Ognedal, Director General, Petroleum Safety Authority Norway This chapter presents a description of the safety management programs of various U.S. and international regulatory agencies whose safety mandate is similar to that of the Bureau of Safety and Environmental Enforcement (BSEE). Each of these agencies has developed a program and established regulations to assure the compliance of the specific activities and cultures of the industries under its purview. In addition, the newly established Center for Offshore Safety (COS) is described, and its potential value to the U.S. offshore oil and gas industry is discussed. The Committee on the Effectiveness of Safety and Environmental Management Systems for Outer Continental Shelf Oil and Gas Operations (the committee) received presentations from and conducted follow-up inquires with the Occupational Safety and Health Administration (OSHA) and Mine Safety and Health Administration (MSHA) of the U.S. Depart- ment of Labor, the U.S. Coast Guard (USCG), and the California State Lands Commission (CSLC), as well as with the United Kingdom (UK) Health and Safety Executive (HSE) and Petroleum Safety Authority (PSA) Norway. On the basis of the information gathered, the committee attempted to address the following questions for each agency, as applicable: • What has been done to ensure there is a safety management system (SMS) in place? • How does the regulatory authority know that the SMS is working? • How does the regulatory agency enforce it? 43

44 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems • Now that the agency has had some experience with a safety manage- ment program, what does it believe is effective in the program? What would the agency change in the program if it could? U.S. RegUlatoRy agencieS U.S. coast guard The USCG policy for enforcing the International Safety Management (ISM) Code is divided into two major areas. The first area of responsibility is for U.S. flag vessels mandated to comply with the ISM Code. USCG is the flag administration agency for the implementation and enforcement of the ISM Code on U.S. flag vessels and administers this responsibility through a delegation of recognized and authorized organizations according to 46 CFR 8, “Vessel Inspection Alternatives.” The second area of responsi- bility is verification of compliance with the ISM Code on foreign-flag ves- sels entering U.S. ports. Detailed guidelines for enforcement of the ISM Code on foreign-flag vessels subject to the U.S. Port State Control program are contained in Navigation and Vessel Inspection Circular (NVIC) 4-98. This NVIC contains all of the applicable International Maritime Organiza- tion guideline documents for the ISM Code. Compliance with the ISM Code is unique because the code is integral to nearly every other aspect of overall regulatory compliance. A basic tenant of any SMS is that the system must be in constant compliance with requirements for safety and environmental protection. Because of this, USCG marine inspectors will, in the course of routine material and human element inspections, provide a means of measuring compliance with the ISM Code. Confirmation of compliance can take several forms, the most basic of which is simply to verify that the vessel has a valid ISM Code Safety Management Certificate and a copy of the company’s Docu- ment of Compliance Certificate. The next, and more complex, level is to identify links between any deficiencies noted during the course of rou- tine inspections and the vessel’s SMS. The latter task requires that marine inspectors have a working knowledge of the elements of the ISM Code as well as knowledge of the duties and training of shipboard personnel. To assist marine inspectors in making these judgments, a training course has been established at the Marine Inspection and Investigation School at the USCG Training Center in Yorktown, Virginia. All USCG marine

45 Existing Approaches for Assessing Safety Management Systems inspectors and vessel-boarding officers are required to read and become familiar with the ISM Code and NVIC 04-98. USCG oversight of ISM Code auditing or ISM Code certification pro- cesses for the SMS of a U.S. company or vessel is coordinated through the authorized organization. Any examination of a vessel for any purpose is also an opportunity to judge the effectiveness of the SMS. Although ISM oversight is not the primary purpose of the visit, inspectors are alert to whether the deficiencies they find while performing other inspections should have been managed with the SMS. Oversight may also occasion- ally arise from investigations into vessel casualties, reports by vessel crew members, or at the direction of the USCG commandant. Any time an authorized organization’s surveyor notes significant material deficiencies, serious lack of maintenance of a vessel or its equip- ment, or failure of the crew to follow safety procedures, the potential or actual failure of the SMS procedures is analyzed. This analysis may include instances of a lack of routine maintenance of critical systems or of equipment or material failures that have not been submitted as a corrective action request and that indicate a clear failure of the crew to follow maintenance or safety procedures. Information to make this type of determination may be collected by • Observing or interviewing the crew members responsible for the area of the SMS where the deficient item was noted. Crew members should be knowledgeable about the responsibilities required of them by SMS procedures. • Verifying that SMS procedures are being carried out with regard to the area of deficiency. • Asking the master or responsible crew member to give an account of what corrective action has been initiated under the SMS and to cite evidence of this action. Failure to submit corrective action reports is noted and, depending on the severity and number of instances, is reported to the organization that issued the Safety Management Cer- tificate. When these failures are found, the representative of the autho- rized organization acting on behalf of the United States must provide a report, orally or in writing, to the cognizant local officer in charge, marine inspection. These reports are required to be submitted as soon as possible; in addition, oral or written reports (the latter of which can be delivered via e-mail) are supposed to be made within 48 hours.

46 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems If it appears that any portion of the SMS is not being followed, USCG personnel may issue a vessel deficiency citation (Form CG-835, Notice of Merchant Marine Inspection Requirements) to the vessel’s master requesting verification of compliance from the authorized organization that issued the vessel’s Safety Management Certificate. If the noncon- formity is linked to shoreside operations, then compliance from the authorized organization that issued the company’s Document of Com- pliance Certificate is also required. It is the vessel master’s responsibility to notify the organization that issued the Safety Management Certificate or Document of Compliance Certificate. Depending on the severity of the deficiency, USCG may allow a reasonable period of time to satisfy the requirements of the CG-835. In cases in which the deficient item would restrict the vessel from sailing, the time allowed by the CG-835 for veri- fication of the SMS should be proportionally short. U.S. occupational Safety and Health administration Process safety management (PSM) is an OSHA regulation intended to prevent or minimize the consequences of a catastrophic release of hazardous materials from specific onshore processing operations, nota- bly chemical and hydrocarbon facilities. PSM is similar to Safety and Environmental Management Systems (SEMS) in that it involves com- prehensive procedures and management practices to ensure safe opera- tions that protect workers and, by extension, minimize environmental consequences. The PSM rule is contained in 29 CFR 1910.119, “Process safety management of highly hazardous chemicals.” PSM was initiated in 1992 after several large-scale chemical incidents, including the explosion in Flixborough, England, in 1974; the toxic release in Bhopal, India, in 1984; the toxic release at the Union Carbide facility in Institute, West Virginia, in 1985; and others. Investigations and studies of these events indicated that a performance standard was needed that would provide a comprehensive management program— a holistic approach that would integrate technologies, procedures, and management practices. The details of such a program are contained in 29 CFR 1919.119. PSM covers 225 different industry subsectors with an estimated 10,000 to 15,000 processes. The PSM regulation (29 CFR 1910.119) was first pub-

47 Existing Approaches for Assessing Safety Management Systems lished in February 1992. Covered facilities were required to comply with the standard by May 26, 1992. The standard provided a period of approxi- mately 5 years for employers to conduct their initial process hazard analyses (PHAs), with 25 percent of the PHAs to be conducted in each year, starting in 1994, and all PHAs to be completed by May 1997. The PHA element of PSM must be updated and revalidated at least every 5 years [29 CFR 1919.119 (c)(6)], and audits to ensure compliance with all provisions of PSM must be conducted at least every 3 years [29 CFR 1919.119 (o)]. In contrast, the SEMS regulation was published in October 2010, with full implementation required by November 15, 2011 [30 CFR 250.1900 (a)]. Although November 2011 was the deadline for implementation of a SEMS plan, operators were not required to submit a written plan. Instead, they have been subject to audit at any time thereafter and must be able to dem- onstrate they have a SEMS plan in place if there is an incident. Several American Petroleum Institute (API) publications that address PSM with regard to oil and gas operations are available, including API Recommended Practice (RP) 750, Management of Process Hazards (API 1990); API RP 752, Management of Hazards Associated with Location of Process Plant Buildings (API 2003); API RP 754, Process Safety Per- formance Indicators for the Refining and Petrochemical Industries (API 2010b); and API RP 755, Fatigue Risk Management Systems for Personnel in the Refining and Petrochemical Industries (API 2010a). The latter two incorporate recommendations from the study of the 2005 Texas City explosion (ABSG Consulting Inc. 2006; BP U.S. Refineries Independent Safety Review Panel 2007). PSM also references several publications related to chemical plants and other types of industrial facilities that handle hazardous materials. Because PSM is a performance manage - ment standard, it requires employers to identify the codes and stan- dards they use with respect to equipment and to document that they have complied with recognized and generally accepted good engineer- ing practices for the design, inspection, and testing of their equipment. For offshore oil and gas operations, SEMS likewise references API RP 75, Recommended Practice for Development of a Safety and Environmental Management Program for Offshore Operations and Facilities (API 2004). BSEE used the Safety and Environmental Management Program (SEMP)

48 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems as the underlying philosophy for SEMS. BSEE informed the committee that they conferred with the OSHA PSM group while developing SEMS in order to incorporate lessons learned and other findings from OSHA’s approximately 20 years of experience with PSM. The initial PSM rule had 12 elements; two more elements (employee participation and trade secret protection) were added later. The PSM elements are similar to the SEMS elements (see Table 4-1). There are TABLE 4-1 Comparison of SEMS Elements with OSHA PSM Elements Similar OSHA PSM Element SEMS Element (CFR reference) (PSM element number) General Description 1. General (30 CFR 250.1909) Implementation, planning, and management approval of program 2. Safety and environmental Process safety information (2) Compilation of written process safety information (30 CFR 250.190) and environmental information, including hazard information 3. Hazards analysis Process hazards analysis (3) Conduct of PHA for each covered (30 CFR 250.1911) process 4. Management of change Management of change (10) Establishment and implementation (30 CFR 250.1912) of written procedures to manage change 5. Operating procedures Operating procedures (4) Development of written operating (30 CFR 250.1913) procedures that provide clear instructions for safely conducting activities 6. Safe work practices Hot work (9) Development and implementation (30 CFR 250.1914) Line breaking (4) of practices for hazardous Lockout–tagout (4) operations Confined space entry (4) 7. Training (30 CFR 250.1915) Training (5) Conduct of training of employees Contractors (6) and contractors alike; training must emphasize safety and environmental hazards 8. Mechanical integrity Mechanical integrity (8) Development of written procedures (30 CFR 250.1916) for the ongoing integrity of process equipment 9. Pre-start-up review Pre-start-up safety review (7) Confirmation that the construction (30 CFR 250.1917) and equipment of a process are in accordance with design specifications 10. Emergency response and Emergency planning and Development and implementation control (30 CFR 250.1918) response (12) of an emergency action plan (continued)

49 Existing Approaches for Assessing Safety Management Systems TABLE 4-1 (continued) Comparison of SEMS Elements with OSHA PSM Elements Similar OSHA PSM Element SEMS Element (CFR reference) (PSM element number) General Description 11. Investigation of incidents Incident investigations (11) Investigation of each incident that (30 CFR 250.1919) resulted in, or could reasonably have resulted in, an incident 12. Auditing (30 CFR 250.1920) Compliance audits (13) Evaluation of the program of compliance 13. Record keeping Maintenance of documentation (30 CFR 250.1928) that describes the elements of the program 14. Stop work authoritya Stipulation that any and all personnel (30 CFR 250.1930) (employees or contractors) can stop unsafe or hazardous work 15. Ultimate work authoritya Identification of the person with (30 CFR 250.1931) ultimate authority for the facility 16. Employee participationa Employee participation (1) Development of a written plan of (30 CFR 250.1932) action regarding the implementa- tion of employee participation 17. Guidelines for reporting Provision of procedures to report unsafe work conditionsa unsafe work conditions (30 CFR 250.1933) 18. None Trade secrets (14) Information required by the PSM standard is to be made available as needed (confiden- tially if necessary) Additional element issued under SEMS II in September 2011 (BOEMRE 2011a). a 13 original SEMS elements, and several more were proposed in the notice of proposed rulemaking published in September 2011 (SEMS II) (BOEMRE 2011a). Early PSM compliance used a program quality verification scheme in which compliance safety and health officers audited an operation for PSM compliance and OSHA issued citations for noncompliance. Program quality verification was resource intensive, although relatively few cita- tions were issued, and was too broadly focused. It did not focus the compliance safety and health officers on specific issues for the many types of facilities and processes covered by PSM (in contrast, SEMS is generally limited to offshore oil, gas, and sulfur operations). Program quality veri- fication was subsequently replaced with the current National Emphasis

50 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems Program for PSM enforcement. This system uses a list-based approach for determining compliance via a publicly available “static list” of compli- ance items to be inspected and a “dynamic list” that is not publicly avail- able and is ever changing. Because the National Emphasis Program is able to conduct more inspections with the same number of resources, there is more incentive for better compliance with the standard. The National Emphasis Program has uncovered many more significant findings than the previous program quality verification approach. This is partly because of the large-scale refining and chemical facilities and operations to which PSM applies, as it is easier to identify deficiencies when there is a focus on specific items to evaluate. OSHA has also increased PSM training for compliance safety and health officers in order to provide a more effec- tive workforce. Discussion between the committee and OSHA identified the follow- ing actions that could be taken to improve PSM:1 • Revise the wording of the PSM regulations to make them more defen- sible against legal arguments that try to work around the phrasing in the Code of Federal Regulations. OSHA believes that the PSM requirements are not fundamentally flawed; rather, some modifica- tions in the wording of the requirements would improve the ability to enforce them. • Look at specific performance requirements to determine whether they can be made more prescriptive without burdening the employer. • Use dedicated staff with experience and background in the industry that is being inspected. • Emphasize the need for comprehensive training for enforcement staff and managers. Additional information about PSM can be found on the OSHA PSM website.2 This website provides the PSM regulations and references for equipment design and in-service practices (including inspection, testing, preventative and predictive maintenance, repair, alteration, rerating, and M. Marshall. OSHA’s PSM Regulation. Presentation to the committee, Washington, D.C., 1 August 31, 2011. See http://www.osha.gov/SLTC/processsafetymanagement/index.html. 2

51 Existing Approaches for Assessing Safety Management Systems fitness-for-service evaluations). The website also covers other important aspects of PSM, including PHA, human factors, facility siting (blast), fire protection, mechanical integrity, procedures, management of change, and other issues. An extensive list of references provides access to other PSM-related information. Mine Safety and Health administration MSHA was created in the U.S. Department of Labor in 1977 with the pas- sage of the Federal Mine Health and Safety Act of 1977 (the 1977 Mine Act) and has responsibility for enforcing safety and health rules in all mines and mineral-processing operations in the United States, regard- less of their size, the number of employees, or the method of extraction. The Mine Act provides that MSHA inspectors shall inspect each surface mine at least two times a year and each underground mine at least four times each year (seasonal or intermittent operations are inspected less frequently) to determine whether there is compliance with health and safety standards or with any citation, order, or decision issued under the Mine Act; to determine whether an imminent danger exists; and to ensure that actual practices comply with approved plans and programs.3 Some of MSHA’s other important mandatory activities are • Reviewing for approval mine operators’ mining plans and education and training programs, • Developing improved mandatory safety and health standards, • Investigating petitions for modification of mandatory safety standards, • Investigating mine accidents and hazardous condition complaints, and • Assessing and collecting civil monetary penalties for violations of mine safety and health standards. To fulfill its mandate, MSHA currently has approximately 800 coal inspec- tors and 345 metal and nonmetal inspectors; the agency also has more than 200 full-time exempt employees in support of its technical support function. In FY 2011, MSHA had 2,200 full-time exempt employees and a budget of approximately $380 million. See http://www.msha.gov/REGS/ACT/ACTTC.HTM. 3

52 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems MSHA pursues several other activities that support the carrying out of the mandates of the 1977 Mine Act. Some of the important activities are associated with the education and training of mine inspectors, mine officials, and miners; the testing, approval, and certification of certain mining products for use in mines; and the provision of technical assis- tance to the states and small mine operators. These are accomplished through specific mechanisms such as MSHA’s • National Mine Health and Safety Academy, • Approval and Certification Center, • Pittsburgh Safety and Health Technology Center, and • Directorate of Educational Policy and Development. The partial list of MSHA’s mandatory and support activities given above points to a number of opportunities for auditing the status of health and safety in mines. In addition to mandatory inspections, strate- gic impact inspections at mines that may need greater attention are also conducted. Such mines could be characterized as having a high risk of explosion; a poor history of compliance; or a high incidence of injuries, illnesses, fatalities, violations, or complaints. Auditing in MSHA’s Approval and Testing Center encompasses a large number of verification, validation, and approval processes. Of particular importance is the postapproval audit by the agency. Review and approval of mine operators’ mining plans, training programs, and certification of trainers and mine officials provide the basis for verification and valida- tion during inspections and audits. MSHA has one of the most comprehensive computerized databases of mining operations and mine health and safety statistics in the world. The National Institute for Occupational Safety and Health (NIOSH) has converted this database into two popular formats—dBase IV and SPSS (which includes labels and coding information)—so that NIOSH and other interested parties (including consultants, universities, and the National Safety Council) can access and analyze MSHA data in the course of researching and advancing health and safety experiences in the mining industry. MSHA’s work with NIOSH, industry, and states to develop health and safety programs is extensive. States and trainers use MSHA’s State

53 Existing Approaches for Assessing Safety Management Systems Grants Program for miner training programs and MSHA’s training resource materials to conduct health and safety training. MSHA also has an alliance with the National Stone, Sand, and Gravel Association (NSSGA)—a sand, stone, and gravel operators group— to help in the development and implementation of health and safety programs to create a culture that will prevent accidents and injuries in these mines. The NSSGA–MSHA Alliance has defined, described, and developed examples of 11 fundamental principles of a safety program that covers elements such as management commitment, training and development, employee involvement and participation, incident inves- tigation, and accountability. Recently, MSHA has undertaken a new rule-making process to imple- ment new regulations for safety and health management programs in the mines. MSHA believes that operators with effective safety and health management programs will identify and correct hazards more quickly and successfully, which will reduce the number of accidents, injuries, and illnesses. In October 2010, MSHA held three public information- gathering meetings. Information received from these meetings indicates that companies with a safety and health management program have bet- ter health and safety records. MSHA is still gathering data to determine what actions the agency might take, including implementation of specific regulations governing safety and health management programs. For example, to gather infor- mation on existing model programs for best practices for safety and health management programs, MSHA held a public meeting on November 10, 2011, in Birmingham, Alabama, in conjunction with the Sixth Annual Southeastern Mining Safety and Health Conference. Proposed rules are expected sometime in 2012 and may be similar to the Injury and Illness Prevention Programs being proposed by OSHA.4 In summary, MSHA has an extensive program encompassing compli- ance inspections, impact inspections, equipment testing and approval, review and approval of mine plans, compliance assistance, education and training programs, trainer and official certification, and technical services, all of which may provide some insights to BSEE. L. Zeiler, United States Department of Labor, Mine Safety and Health Administration. Presenta- 4 tion to the committee, Washington, D.C., August 31, 2011.

54 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems california State lands commission CSLC requires operators to comply with API RP 75 (SEMP) and conducts a program called the Safety Assessment of Management Systems (SAMS) that conducts an external independent safety audit of California’s oil and gas facilities every 5 years. SAMS is based on a joint industry project performed in the 1990s by Paragon Engineering Services with assistance from the University of California, Berkeley, and sponsored by the Miner- als Management Service (MMS), CSLC, HSE, the National Energy Board of Canada, the American Bureau of Shipping (ABS), Chevron, and Tex- aco. CSLC has been using SAMS to audit API RP 75 SEMP performance for more than 15 years. This technique was originally developed by the joint industry project and modified slightly with experience; CSLC has used SAMS to review some installations three times over the years. CSLC also conducts a physical condition, design, and safety compli- ance audit on the same 5-year interval as SAMS. This audit complements the inspection program and provides for strong familiarity with the facil- ity before the SAMS audit is conducted. CSLC believes that a hardware- oriented inspection or audit program does not address the SMS, human factors, or safety culture, and the commission saw the need for these new types of audits more than a decade ago. CSLC has observed steady improvement in safety management performance and culture using the SAMS process and attributes these improvements to working with opera- tors to increase their compliance rather than punishing them with fines and shut-ins for areas that may need improvement. In affording operat- ing companies the latitude to develop their programs, CSLC has observed that several operators have made great strides in using behavioral safety observations to identify areas for improvement and in fostering improved safety culture among their employees. CSLC staff try both to work closely with operators to improve safety culture and to avoid the perception of being adversarial regulators. They ride the company crew boat with company personnel; attend company- required facility safety orientations and morning safety meetings; and observe the actual use of work permits, prejob safety reviews, lockout– tagout procedures, and company operations. They also discuss the SAMS programs with the people that implement and use them and observe improvements that occur as a result. Firsthand knowledge of general

55 Existing Approaches for Assessing Safety Management Systems maintenance conditions, work processes, maintenance backlog, and the number of sensors in bypass are additional qualitative performance measures and indicators that are employed. In essence, the emphasis is on promoting a culture of safety, from senior management down to the rig floor workers, rather than on safety compliance. As a safer culture develops, CSLC inspectors have noted that operator staff who have participated in CSLC’s behavioral safety observation programs appear to take more pride in their work and are willing to describe how their programs have evolved and improved.5 In CSLC’s view, these are some of the elements that have helped them be successful where other regulatory, corporate, and even third-party paperwork audits have failed.6 Verified documentation does not equate to a true implementation of a positive safety culture, but working closely with operator staff appears to do so.7 inteRnational RegUlatoRy oRganizationS UK Health and Safety executive The current UK offshore regulatory goal-setting regime was born out of a public inquiry into the Piper Alpha explosion in 1988. The goal-setting legislation replaced older prescriptive legislation, and HSE replaced the UK Department of Energy as regulator. HSE set up the Offshore Division, which has two types of inspectors: regulatory management inspectors and specialist or topic inspectors. Topic inspectors specialize in areas such as process safety; mechanical, electrical, and marine issues; and occupational health. They provide in-depth assessments of safety cases and input into offshore inspections and investigations. Regulatory management inspec- tors manage the assessment of safety cases and lead offshore inspections and investigations, with the participation of topic inspectors. M. Steinhilber, California State Lands Commission. Presentation to a subgroup of the committee, 5 Long Beach, California, March 24, 2010. M. Steinhilber, California State Lands Commission. Presentation to a subgroup of the committee, 6 Long Beach, California, March 24, 2010. M. Steinhilber, California State Lands Commission. Presentation to a subgroup of the committee, 7 Long Beach, California, March 24, 2010.

56 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems As a regulator, HSE engages with industry at all levels. HSE influences a duty holder’s (operator’s) senior management by meeting with them in other forums; participates in industry committees, workgroups, joint industry research, and conferences; and, finally, conducts regular off- shore inspections and investigations. During offshore visits, inspectors engage with offshore management and the workforce through formal and informal interviews and discussions to seek evidence of compliance. Inspectors usually spend 3 days offshore. They travel to an installation via the regular scheduled helicopter flights that serve it and do not pay for meals or overnight stays while offshore. The duty holder is invoiced for the inspectors’ time. To ensure there is an SMS in place, the UK offshore regulatory system requires companies that operate production installations and those that own nonproduction installations (e.g., drilling rigs)—both referred to as “duty holders”—to submit a safety case to HSE for assessment and acceptance prior to operation of an installation. The Safety Case Regula- tions 2007 require several specific items to demonstrate that the man- agement system is adequate: • Compliance with the relevant statutory provisions with respect to matters within the management system’s control; • Satisfactory management arrangements with contractors and subcon- tractors; • Established adequate arrangements for audits and for making reports thereof; • Identification of all hazards with the potential to cause a major acci- dent; and • Evaluation of all major risks and implementation, or plans for imple- mentation, of measures to control those risks to ensure compliance with the relevant statutory provisions. HSE assesses the evidence provided in the safety case and, if the evidence is deemed sufficient, accepts the case. The duty holder is then allowed to operate the installation. If the safety case is not accepted, operation of the installation would be illegal. During the assessment process, HSE often identifies weaknesses in a case and discusses with the duty holder the required additional information.

57 Existing Approaches for Assessing Safety Management Systems HSE undertakes planned inspections covering a range of topics and issues within the safety case and checks compliance with all relevant statutory provisions to determine whether the SMS is working. These inspections involve testing the effectiveness of the duty holder’s SMS as applied on the offshore installation. The system is also tested when HSE investigates accidents and incidents. Inspections and investiga- tions involve checking the duty holder’s policies and procedures; exam- ining records and other documents that are a product of the system (e.g., maintenance records); and speaking to onshore and offshore duty holder managers and members of the offshore workforce to seek evi- dence of their understanding of the management system and its applica- tion to specific work activities or operations and practices. On occasion, HSE inspectors formally record interviews as formal statements when HSE is undertaking an investigation or anticipating a formal enforce- ment action. Inspectors observe work activities and, from time to time, seek demonstration of the effectiveness of particular equipment. For example, an inspector might require the deluge system in a module to be operated to check for blocked nozzles and water spray coverage and to ensure that it meets performance standards. HSE has a public enforcement policy8 that is supported by a guide known as the Enforcement Management Model.9 HSE has a range of tools for enforcement and applies these in a proportionate and targeted way; however, evidence of breaches of legislation is required before any enforcement steps are taken, and then inspector judgment must be used in applying the enforcement policy. The tools and approaches avail- able include • Serving a duty holder or employer an improvement or prohibition notice, • Directing a duty holder to revise a safety case, and • Prosecuting the duty holder or other employer. An improvement notice is served when an inspector believes that a breach of legislation has occurred and that it would be appropriate to serve such a notice. The notice explains the breach and provides the date See http://www.hse.gov.uk/pubns/hse41.pdf. 8 See http://www.hse.gov.uk/enforce/emm.pdf. 9

58 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems by which the duty holder must comply. A schedule describing the actions the duty holder should take to achieve compliance is often attached to the notice. Duty holders, however, are not required to follow the proposed actions; they are entitled to take any other effectively equal measures to achieve compliance. HSE then visits the offshore facility to determine whether the duty holder has complied with the notice. If the original date for compliance becomes unrealistic for genuine reasons, the duty holder may seek an extension. A prohibition notice is served when the inspector believes there is evi- dence that an activity or operation will lead to serious injury. The notice describes the operation or activity and the circumstances that give rise to the risk of serious personal injury. When the notice is served, the activ- ity or operation that gives rise to the identified risk must be changed. A schedule similar to the improvement notice schedule may be attached. Improvement and prohibition notices are both legal documents; thus, the duty holder can appeal them to question the inspector’s reasoning and evidence. An appeal is heard in an employment tribunal. When an improvement notice is appealed, the duty holder does not have to take any steps to comply with it until the tribunal renders a decision. If the appeal fails, the duty holder must comply with the notice. When a prohibition notice is appealed, the prohibited activity must stop and may only start up again if the tribunal rules in the duty holder’s favor. Tribunals, which can take months to arrange, can last from several days to many weeks. Appeals against notices do happen, but they are infrequent. Failure of a duty holder to comply with a notice is a pros- ecutable offense. The Offshore Division serves about 35 to 50 improve- ment notices and two to three prohibition notices each year. In consideration of the Deepwater Horizon accident, the UK govern- ment is currently undertaking a review of the existing health, safety, and environmental regime for the UK Continental Shelf. The report of the findings of this review is expected to be released later this year. PSa norway PSA Norway has regulatory responsibility for the technical and opera- tional safety of petroleum activities, including emergency preparedness and the working environment (Norwegian Petroleum Directorate 2011,

59 Existing Approaches for Assessing Safety Management Systems p. 18). PSA reports through the Ministry of Labor, while a sister agency, the Norwegian Petroleum Directorate, has responsibility (e.g., leasing, collection of royalties) for developing Norway’s petroleum resource and reports through a separate Ministry of Petroleum and Energy. PSA was established in 2002 when the government split it off from the Norwegian Petroleum Directorate (which at that time was respon- sible for both safety and petroleum resource development) to form two separate agencies, each reporting to different ministries. The new PSA assumed responsibility for safety on all offshore petroleum facilities and those onshore facilities associated with offshore petroleum production. PSA takes a holistic approach to the meaning of safe operations and extends the concept of safety to include protection of human life, health, and welfare; the natural environment; financial investment; and opera- tional regularity. PSA currently regulates more than 40 operating companies with 70 offshore production facilities, two onshore facilities, 14,000 km of pipelines, and about 30 floating and 12 platform drilling rigs on the Norwegian Continental Shelf (Norwegian Petroleum Directorate 2011, p. 25; PSA Norway 2011d). About 25,000 people work offshore in Norway. The great majority of offshore operations in Norway are at water depths of less than 350 m, although one field (Orme Lange) operates at a water depth of about 1,100 m. To regulate and audit these operations, PSA employs about 166 staff, of which about 110 are professionals. Sixty of the professional staff are qualified audit team leaders [qualifications were initially based on ISO 9000 (ISO 2005), but it was not specific enough, and requirements and training have since been improved].10 PSA personnel are compensated at a level about two-thirds that of personnel with comparable Norwegian petroleum industry responsibilities.11 The Norwegian petroleum sector’s initial approach to regulation was based on the assumption that the oil companies were not capable of performing safely without strict regulatory policing (PSA Norway 2010). The initial approach was to establish prescriptive laws and regulations M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 10 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 11

60 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems that set specific requirements for structures, technical equipment, and operations in order to prevent accidents and hazards. Quite compre- hensive inspections of facilities and activities were conducted with detailed regulatory punch lists, with the goal of ensuring compliance. At one point, regulations required quantitative calculation of the maxi- mum acceptable risk that an accident would occur and specified that it should not be greater than a statistical probability of 1 in 10,000; how- ever, experience with this approach, including several blowouts and several high-profile tragedies—most notably the loss of 123 lives on the Alexander L. Kielland—was not as desired.12 With quantitative risk calculation, it was found that discussions on the risk requirements for approving new developments on the Norwe- gian Continental Shelf quickly became pure number-crunching exer- cises. That, in turn, meant it was easy for statisticians to document that the various risks in such projects were within the acceptable limits (PSA Norway 2010). Furthermore, prescriptive, detailed compliance inspection was found to have encouraged a passive attitude among companies. They waited for the regulator to inspect, identify errors or deficiencies, and explain how these were to be corrected. As a result, the authorities became, in some sense, a guarantor that safety in the industry was adequate, and they thereby assumed a responsibility that should have rested with the companies (PSA Norway 2010). These limitations led Norway, over time, to move from prescriptive to performance-based regulation, which involves specification of the per- formance or function to be attained or maintained by the industry (PSA Norway 2010). The regulatory role involves defining the safety standards that companies must meet and checking that they have management systems that ensure such compliance. For their part, the companies are given a relatively high degree of freedom in selecting good solutions that fulfill the official requirements. The term “inspection” was replaced with the preferred term “super- vision,” and “approvals” was replaced with “consents.” PSA believed the M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 12

61 Existing Approaches for Assessing Safety Management Systems changes in terminology were more significant than might be thought at first sight. The supervision concept, for instance, was not confined to mere monitoring. It covered all activities that provided the necessary basis for determining whether the companies had accepted responsi- bility for complying with the regulations in every phase (PSA Norway 2010). By way of simple analogy, under quality management, the super- visor of a factory floor does not just inspect the factory’s work product and fire employees who do not perform. Rather, the supervisor works with employees to ensure performance continuously improves. The change in philosophy created a climate in which PSA worked with the industry to improve safety instead of acting in the role of a compliance inspector and guarantor of the acceptability of company activities. In the context of PSA, supervision is directed at the operator’s administrative management system, which the companies actually use to ensure acceptable operation. PSA works with individual operators with the intention of helping to make them more successful, but also works with the industry by chair- ing an industry board that consists of representatives from employers’ representatives (operators, manufacturers, and shipping associations), employees (represented by five unions) and regulators to define the reg- ulations and issue nonbinding recommendations and guidelines. PSA works very closely with employers and employees, but PSA ultimately makes the decisions. These recommendations and guidelines make fre- quent reference to international industrial standards for equipment, structures, and procedures. To confirm that there is an SMS in place, PSA conducts audits of companies to ensure acceptable operation. These audits are conducted by personnel with the special expertise and experience necessary. Dur- ing the audit, the operator must demonstrate both a commitment to and an expertise in complying with the frame conditions that govern its operations. According to PSA, the requirements of a performance-based system audit place a great demand on industry, employees, and the regu- lator in terms of expertise, management, and flexibility.13 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 13

62 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems A typical audit is conducted by a team of at least two but up to five or six people. From planning through execution and reporting, the audit takes 2 to 5 weeks. Notice is usually given about a month in advance, and separate meetings are held with union safety delegates to ensure that employee views are heard. The audit team and plan vary according to the type of operation being audited. Detailed audit guidelines are designed for each audit, and each audit team is led by a certified audit team leader. Audit team membership is driven by the competencies needed to perform the task. For example, if maintenance management is of particular interest, the team will include a maintenance specialist. Scheduling of audits is not determined solely by frequency, but by using a risk-based approach. Operations and particular operators are chosen for audits based on risk. In addition to the risk-based audits, an audit of each installation is conducted at least once every 3 years. For the purpose of integrity, there are never fewer than two auditors present. Norway, however, is a comparatively small country (4.8 mil- lion residents; in comparison, Louisiana has 4.5 million residents) with a relatively large petroleum industry (the industry accounts for more than 20 percent of the country’s gross domestic product). Therefore, no attempt is made to limit audit team membership on the basis of prior or current involvement of a family member or friend in the organization being audited. Norway has not felt a need to institute detailed conflict of inter- est regulations beyond direct financial involvement with the operator.14 Either the operator or an independent designee conducts inspections (both independent and internal) as a normal part of the management system. PSA may or may not request the results of these inspections as part of its management system audit. In addition to audits, PSA conducts incident investigations with special focused teams as necessary. The results of these investigations are used to improve operations in the investigated operator’s organization and to inform and improve operations in orga- nizations with similar kinds of operations. PSA uses several formal instruments other than audits and inspections to assess how well an operator’s SMS is working (PSA Norway 2011d). M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 14

63 Existing Approaches for Assessing Safety Management Systems Although structured, a few of these instruments are, to some extent, quantitative: • Dialogue. The bulk of practical supervision consists of dialogue between PSA and the industry to assess trends and request plans, analyses, docu- mentation, and information. Meetings between PSA and the relevant company involve both appropriate managers and employees. General- ized results that do not identify specific operators or installations are summarized in reports that are then posted to PSA’s website.15 • Notification of undesirable incidents. Companies are required to notify PSA about undesirable incidents. The regulations clearly define what must be reported and require the use of a dedicated form. Approxi- mately 800 to 900 notifications are received every year. The number of undesirable incidents and the character of these incidents also help PSA assess an operator’s management system. An abnormally low number of incidents may indicate a problem with an operator’s reporting sys- tem and, therefore, with the operator’s entire SMS. An abnormally high number of incidents may indicate a safety problem. • Hotline. PSA has a hotline staffed around the clock for reporting emer- gencies. Such reports are first received and registered by the duty offi- cer, who also makes the initial assessment of the seriousness of the incident and the possible immediate actions required. If necessary, the duty officer activates PSA’s emergency response center to monitor a serious ongoing incident. • Tailored follow-up. Each undesirable incident is allocated to a case offi- cer who checks it, categorizes its seriousness (which may differ from the operator’s assessment), and selects a tailored follow-up for the opera- tor or company. In the case of very serious events, PSA may decide to launch an investigation or conduct another type of close follow-up. The response to less serious incidents is tailored to their nature. • Risikonivå i norsk petroleumsvirksomhet (RNNP). The RNNP process was initiated in 1999–2000 to develop and apply a tool for measur- ing trends in risk level in Norwegian petroleum activity. This process monitors risk trends with the aid of various methods, such as inci- dent indicators, barrier data, interviews with key informants, working See http://www.ptil.no/main-page/category9.html?lang=en_US. 15

64 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems seminars, and fieldwork. A major questionnaire-based survey is also conducted every 2 years. This work has acquired an important posi- tion in Norway’s oil and gas industry because it contributes to a shared understanding of risk developments on the part of everyone involved. Results from these studies are presented in annual reports, which also provide the basis for taking action to combat a negative trend. Pub- lished around April 20 each year, the annual reports provide a realistic picture of developments in the risk level from year to year. The RNNP process only indirectly helps assess a particular operator’s management system, but does provide trend information that helps PSA take action. • Whistleblowers. Whistleblowers help to shape and complete the pic- ture of the safety position. PSA receives information from employees in the industry about poor safety or conditions open to criticism in their workplace. Such input is closely followed up in accordance with established and legally required routines. The anonymity of whistle- blowers is protected. Whistleblowers help PSA understand how a particular company’s management system is working by identifying possible issues that are not found by other means. • Daily Drilling Report System (DDRS). Since 1984, companies have been required to provide information via the DDRS database on all drilling on the Norwegian Continental Shelf. PSA can extract from the DDRS the essential facts about each current operation and thereby assure itself, if necessary, that undesirable well incidents have actually been reported. PSA applies the necessary measures to ensure that activities are con- ducted in accordance with regulatory requirements and through formal instruments.16 These measures include the following: • Observations with comments, which are discussed with the operator; • Improvement possibilities, which drive discussion and are reported to the operator (the operator is required to inform PSA of the changes made as a result); • Issuance of a “not in compliance” notice, with a requirement to fix the problem in less than 3 weeks; M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 16

65 Existing Approaches for Assessing Safety Management Systems • Police investigation for willful violation (which has happened once); • Recommendation to the ministry to remove the operator’s license; and • Recommendation that the operator be banned from future drilling blocks in Norway. It is PSA’s responsibility to define the terms for responsible operation of the petroleum industry and to check that companies are working on prevention and on continuous improvement of safety levels. Because PSA views criminal law as the province of the police (PSA Norway 2010), almost all PSA enforcement actions are in the form of observations or improvement possibilities. PSA believes that the following aspects of its program (presented in no particular order) are critical to its program’s effectiveness: • Doing nothing to take responsibility away from the industry. The PSA model is based on the conviction that the government cannot inspect quality into the industry. The industry itself must ensure that quality is achieved and maintained (PSA Norway 2010).17 • Dialogue on problems. PSA believes in working with operators and the industry to make them more successful. The internal control system can only work as intended if it is operated in close collaboration and consultation with safety delegates, employees, and the regulator (PSA Norway 2010).18 • A focus on functional requirements and system orientations rather than on checking compliance.19 • A “fit-for-purpose” approach to constituting audit teams. Teams must consist of sufficient personnel with the expertise and experience neces- sary for a specific audit.20 • The RNNP approach, which provides flexibility and focus to supervi- sion (PSA Norway 2010). • Allowing operators, to a great extent, to choose for themselves the solutions they will adopt to meet official requirements (PSA Norway 2011c). M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 17 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 18 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 19 M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 20

66 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems • Involvement of PSA specialists in both monitoring and participating in the development and revision of industrial standards to help make sure that these are constantly relevant and reflect best practices (PSA Norway 2011c). • Recognition that the work involved in a performance management system can easily be underestimated, and that it is therefore important to emphasize that this form of regulation demands much more of the industry, employees, and government than detailed regulations (PSA Norway 2011c). PSA uses the RNNP process and the past performance of the industry, particular operators, and technological trends to create key focus areas that change over time. Changes in focus areas are based on development plans, activities, audit plans, safety-critical activities, input from class societies, experience with operators as a whole and with individual oper- ators, and new or revised regulations. PSA’s current priority areas are 1. Assuring top management’s role in managing major risks, 2. Conducting specific studies of technical and operational barriers (on the basis of risk and incidents), 3. Reducing risk to the external environment from subsea operations, and 4. Focusing on occupational risks to specific groups of people, such as sand blasters. PSA also plans to change its system and program periodically as the sources of risk change. The Macondo well accident led PSA, like many regulators, to conduct a detailed investigation of the blowout’s causes and the industry’s response (PSA Norway 2011a, 2011b). Particular interest was paid to the question, “Could this happen in Norway?” and to what changes should be made in how PSA manages safety. The formal conclusion was that there was no reason to revise the system and no need for major overhaul, but that there were issues that the industry needed to address in light of the Macondo accident, including lack of understand- ing of risks, lack of supervision, and failure to follow procedures. PSA posed this question to the industry: “Do you think you can oper- ate safely without a capping and containment system?” The industry response was no. PSA also asked the industry, “Do we need better orga- nization of emergency response?” The industry response was yes. So

67 Existing Approaches for Assessing Safety Management Systems while some changes were and are being made in Norway in response to the Macondo accident, PSA has not seen a need to change its basic approach to ensuring that adequate management systems are in place on the Norwegian Continental Shelf.21 centeR foR offSHoRe Safety: a Self-Policing Safety oRganization Like the nuclear power industry in 1979—in the immediate aftermath of the Three Mile Island accident—the nation’s oil and gas industry needs now to embrace the potential for an industry safety institute to supplement govern- ment oversight of industry operations. —National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling22 The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling (the presidential commission) recommended that a self-policing safety institute be set up by and for the companies working offshore. This proposal recognizes that although government regulators are not likely to achieve the technical safety expertise of private industry, the nation must have a high level of assurance that operations on the Outer Continental Shelf (OCS) are as safe as possible. In this regard, the commission thought that the Institute of Nuclear Power Operations, which was set up by the nuclear power industry after the accident at Three Mile Island, was the desirable model for the U.S. offshore oil and gas industry, although the commission recognized that the number of nuclear facilities that the Institute of Nuclear Power Operations oversees is far smaller than the number of OCS facilities in U.S. waters. In March 2011, largely in response to the presidential commission’s recommendation, and after some internal deliberation, the industry set up COS, the self-described mission of which is to promote the highest level of safety for offshore drilling, completions, and operations through effective leadership, communication, teamwork, use of disciplined SMSs, M. Ognedal, PSA Norway. Presentation to the committee, Houston, Texas, October 19, 2011. 21 Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, 2011, p. 241. 22

68 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems and independent third-party auditing and certification.23, 24 The Com- mittee for Analysis of Causes of the Deepwater Horizon Explosion, Fire, and Oil Spill to Identify Measures to Prevent Similar Accidents in the Future endorsed the concept of a center for offshore safety to train, monitor, and certify (license) offshore oil and gas personnel, stating, This center has the potential to engage the CEOs of oil and gas compa- nies, drilling contractors, and service companies in risk management; set standards for training and certification; develop accreditation systems for industry training programs; and facilitate industry participation in safety audits and inspections.” (NAE-NRC 2011, p. 121) According to the COS website25 and other information provided to the committee, a key operational feature of the center will be a process for independent validation of SEMS programs, with API RP 75 as the basis for the auditing program. The process will encompass audit proto- cols with metrics for the new SEMS regulation, third-party audits, and accreditation and certification of audit service providers. A major objec- tive of COS is to have BSEE embrace the center’s accredited third-party audits as an effective means of complying with regulations and improv- ing industry performance. Although COS is still in the process of being established, some dis- cernible progress is being made. For example, the COS office just opened in Houston, and its governing board is virtually in place. When fully appointed, the board will have a maximum of 24 members, including an executive director. The allocation of seats on the board is intended to achieve a balance between producer–operator members and drill- ing contractor and service supply companies. Membership is open to all companies that operate, drill, or complete wells or provide sup- port services to deepwater drilling, completions, and operations. A company does not have to be a member of API to be a member of the center; however, all API members that work on the OCS must become members of COS. J. Toellner, ExxonMobil. Presentation to the committee, Houston, Texas, October 19, 2011. 23 C. Williams, Shell Energy Resources Co. Presentation to the committee, Washington, D.C., 24 August 31, 2011. 25 See http://www.centerforoffshoresafety.org/main.html.

69 Existing Approaches for Assessing Safety Management Systems COS is organized within API, and the COS governing board was established by the API executive committee. The chairman of the board is nominated by the API Upstream Committee and approved by the API executive committee for a term of 3 years. According to the COS website, the center is “organized within API to leverage the existing resources and experience embodied in the long established API certification and standards group.”26 The integration of this nascent self-policing safety organization and API presents a significant credibility problem for COS and was a major concern of the presidential commission, which strongly urged that the new safety institute be completely separate from API. API, known for representing virtually all aspects of the oil and gas industry, is a consen- sus organization that generally settles on that to which a broad majority of interested member companies will agree. It is an organization that has many missions and objectives, including lobbying and policy advocacy. The committee, however, believes COS should have only one function— safety, both of the personnel working on offshore facilities and of the surrounding coastal and marine environment. Nevertheless, it was probably inevitable that the initial offshore safety organization would be set up by API. API’s standards and certification unit, which is the nonadvocacy part of the organization, does so much technical work that it would probably have been difficult to get support to create a parallel and completely independent institute with enough leadership commitment in time and money. Only time will tell whether COS can be an effective, independent force for safety. It is helpful that COS is now based in Houston rather than Washington, D.C., and that it was formed by the standards com- mittees of API rather than the policy advocacy arm. The presidential commission recommended that the new safety institute be established by the companies, and, notwithstanding the commission’s clear con - cerns about credibility, an API relationship was the industry’s decision. The COS leadership will need to demonstrate over time that it can set a direction independent from API. COS must show that the SEMS pro- grams of the companies working offshore are deserving of the nation’s See http://www.centerforoffshoresafety.org/governance.html. 26

70 Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems trust and confidence. This is a serious challenge, but one that the industry must succeed in meeting if it is going to convince the nation, including the government officials in BSEE who regulate the industry, that the safety mission of the offshore energy companies will not be compromised. SUMMaRy It seems clear from the experiences of the regulatory agencies discussed in this chapter, especially CSLC and PSA Norway, that agencies with charges similar to those of BSEE and many years of experience in overseeing the SMS programs of offshore operators have found that issuing incident of noncompliance notices against a checklist of yes or no requirements27 tends to lead to a culture of compliance rather than a culture of safety. Instead, these agencies have migrated toward a system that • Audits operations with a qualified team of auditors, • Discusses with personnel at different levels of the operation the way in which the elements of the SMS are actually being used, • Feeds the results back to the top management of the operating com- panies, and • Monitors for continuous improvement. These agencies have found that engagement with the industry is more productive than punishment, although they maintain the threat of pun- ishment if needed. Each of these agencies has developed a program and established regulations to assure the compliance of the specific activities and cultures of the industries under its purview. Each of these agencies has uniquely tailored its regulatory role so as to assure the compliance of the specific activities and cultures of the industries under its purview. In doing so, however, each has been moving from prescriptive regula- tions to a goal-oriented or risk-based approach of regulatory oversight in order to better promote continuous improvement in safety. Even before the Macondo well blowout, MMS had undertaken efforts to change regulations for the offshore oil and gas industry, but the blow- For example, “Have written operating procedures been developed and implemented which include 27 the job title and reporting relationship of the person(s) responsible for each of the facility’s operat- ing areas?” [30 CFR, Part 250, Section 250.1913(a)].

71 Existing Approaches for Assessing Safety Management Systems out was the catalyst for swift and sweeping regulatory changes, including the restructuring of MMS.28 In response to the Macondo accident and these regulatory changes, the offshore oil and gas industry established COS, whose mission is to promote the highest level of safety through effective leadership, communication, teamwork, use of SMSs, and pro- cess auditing and certification. Although still in the process of being established, COS has the potential to be of great value to the industry. The history of the restructuring of MMS is discussed in both the preface and Chapter 1. 28

Next: 5 Role of the Bureau of Safety and Environmental Enforcement in Evaluating Safety and Environmental Management Systems Programs »
TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems Get This Book
×
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems recommends that the Bureau of Safety and Environmental Enforcement (BSEE) take a holistic approach to evaluating the effectiveness offshore oil and gas industry operators' Safety and Environmental Management Systems (SEMS) programs. According to the report, this approach should, at a minimum, include inspections, audits by the operator and BSEE, key performance indicators, and a whistleblower program.

SEMS is a safety management system(SMS) aimed at shifting from a completely prescriptive regulatory approach to one that is proactive, risk based, and goal oriented in an attempt to improve safety and reduce the likelihood that events similar to the April 2010 Macondo incident will reoccur.

According to the committee that produced the report, it is not possible for a regulator to create a culture of safety in an organization by inspection or audit; that culture needs to come from within the organization. To be successful, the tenets of SEMS must be fully acknowledged and accepted by workers, motivated from the top, and supported throughout the organization and must drive workers' actions.

The report also notes that BSEE can encourage and aid industry in development of a culture of safety by the way it measures and enforces SEMS. The Committee believes BSEE should seize this opportunity to make a step change in safety culture by adopting a goal based holistic approach to evaluating the effectiveness of SEMS programs.

In recommending a holistic approach to evaluating the effectiveness of SEMS programs, the report explores in detail SEMS' role in helping to develop a culture of safety, highlights the pros and cons of various methods of assessing the effectiveness of a SEMS program, and investigates existing approaches for assessing the SMS programs of various U.S. and international regulatory agencies whose safety mandates are similar to that of BSEE.

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook, NAP.edu's online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  6. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  7. ×

    View our suggested citation for this chapter.

    « Back Next »
  8. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!