Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
5 CONSIDERATIONS IN EVALUATING OCS INSPECTION ALTERNATIVES Having identified five possible alternative approaches to the present inspection system, the committee sought to develop a process for evaluating the relative merits of the alternatives (as well as the present practice). Eight considerations were identified that an inspection program ought to address and that should be considered in evaluating the alternatives: 1. Does the alternative being considered promote industry safety awareness? 2. Does it help to maintain public confidence in the safety of OCS operations? 3. Does it use inspection resources efficiently? 4. What is the impact on the qualification and training of the inspector force? 5. Does the program provide for identification of safety trends and warnings? 6. Does it promote safety performance accountability? 7. Is it adaptable to changing circumstances? 8. Are there valid precedents? These questions are elaborated upon below and the alternative programs evaluated in Chapter 6. PROMOTION OF INDUSTRY SAFETY AWARENESS Several points are relevant here. First, the main objective of any inspection program is to promote industIy safety awareness at all levels, including supervision and management. The program should provide timely feedback to operating and supervisory personnel as well as to the management personnel who have control of resources. Another consideration is whether there are sufficiently large penalties and incentives built into the system to ensure timely attention and action by managers in control of resources. Especially for alternatives 4 and 5 (third-party and self-inspection), it is relevant to ask whether the inspection system and the associated data and feedback process can support civil' and, if necessary, criminal penalties for persistent nonperformance and/or non-compliance with regulations, recommendations, or requirements emerging from inspections. There should be appropriate, timely, and effective follow-up reviews and/or inspections, and a means to communicate to operators the degree of criticality of observed deficiencies, to ensure an Currently the civil penalty provisions of the OCSLA are not an effective enforcement tool. Court decisions require MMS to afford an operator time to correct a deficiency before imposing a civil penalty. In effect, the operator never is subject to civil penalties. 51
52 appropriate priority to corrective action, and to determine and support enforcement actions and criminal penalties when these are required. The goal of enhancing industry awareness of safety factors implies a requirement for an effective safety evaluation methodology and for a significantly increased level of enforcement and follow-up when crucial deficiencies are observed or reported. It is the committee's view that meeting the minimum requirements of the Outer Continental Shelf Lands Act (OCSLA) regulations does not ensure the high levels of safety that should be demanded of large industrial operations involving potentially hazardous or polluting materials. Effective ways to accomplish these objectives can be built into any safety inspection program. It is easier, however, to achieve the goal with a program that stresses accountability rather than one that stresses compliance. MAINTAINING PUBLIC CONFIDENCE In general, MMS must ensure that the actual safety performance of OCS operators and the public perception of it engenders a consensus that MMS is effectively overseeing public interests on the OCS. Several different areas of concern not now addressed by MMS must be considered when evaluating whether an alternative inspection system would contribute to public confidence concerning the safety of OCS operations. View of Congress The MMS traditionally has focused its efforts on literal compliance with the inspection function described in the OCSLA, i.e., to conduct annual and spot inspections.2 In the event of a serious accident on the OCS, such as the one that destroyed the Occidental Oil platform Piper Alpha in the North Sea in July 1988, it is likely that the Congress would conclude that literal compliance with the OCSLA reflected only weak credit on MMS's stewardship, if other risk-reducing activities of the general kind taken by federal agencies regulating other risk-intensive operations had not been taken. Most of the alternative inspection programs described in Chapter 4 contemplate the addition of modest planning and risk-analysis activities that could be undertaken within current budgetary levels. These activities are not being carried out at present. It is likely that such analytical efforts would lead to changes in the priorities, processes, and performance of some of the inspections. The adoption of modern system safety techniques for inspection and enforcement probably would provide a more meaningful way to measure compliance with the intent of the OCSLA (see Appendix C). Apart from the direct benefits such improvements would bring, they would also help in the event of a serious accident to deflect criticism that MMS has not been sufficiently aggressive in promoting safety. Media and Public Opinion The media have a powerful impact on public opinion. Currently there is intense interest in the media as to how well U.S. inspection and enforcement practices help prevent accidents. This interest has grown out of such events as Challenger, Bhopal, Chernobyl, a spate of aircraft structural failures, breakdowns in government-mandated airport security measures, and the Exxon Valdez oil spill. 2As noted in Chapter 3, and discussed in Appendix G. the MMS's view of its safety role is focused on Section 1348 of the OCSLA (43 U.S.C. 1331-1356) and may not reflect the broader overall policy mandate of the OCSLA
53 Fine-tuning of inspection procedures, personnel practices, and organizational roles in the ways discussed in the five alternatives is desirable and appropriate. But these actions would not seem to be sufficient to respond to present public expectations regarding safety and environmental protection. An explicit and defensible rationale for establishing priorities and standards and providing at least a general basis to reply to the question How safe is safe enough?" is urgently needed to give MMS's and the industry's safety consciousness credibility. While the perception of OCS operations held by the local community is largely created by the media, it also is a function of the interaction of the operator with local government. These are matters beyond the direct control of the MMS. Comparability With Other Federal and State Agency Practices Present MMS inspection practices appear to be more rigorous than the counterpart state practices. However, other federal agencies have more extensively documented rationales underpinning their practices in inspection, testing, and enforcement to implement the intent of legislation analogous to the OCSLA in their areas of responsibility. The Environmental Protection Agency, the Food and Drug Administration, the Occupational Safety and Health Administration, and the Nuclear Regulatory Agency are examples. EFFICIENT USE OF RESOURCES An important consideration in assessing any inspection scheme is how efficiently it utilizes resourcespersonnel, time, and money. Both government and operator resources are at issue. Government Resources An alternative inspection program that reduces MMS offshore inspection time will reduce government costs. To the extent that these savings can be realized without sacrificing safety, there will be an overall improvement in the benefits of inspections; the benefit will be even greater if the alternative better promotes safety. Any of the alternatives, as well as the present program, can be improved to minimize the amount of paperwork done offshore and to make more efficient use of helicopter time. At the facility, hands-on inspection that can be done only onsite needs to be emphasized over paper reviews that can be carried out onshore. An improved system should provide incentives to organize paperwork to maximize the effectiveness of onsite inspection time. To some extent, scheduling is independent of the specific program alternative selected, but some alternatives may be better adapted to accomplish these objectives. The scheduling process should include provisions for moving people from one office to another when peak loads occur for inspection, reinspection, or follow-up. Any near-term change in the MMS inspection system should emphasize greater productivity and more efficient use of current levels of manpower and budget. If the decision is made to adopt an inspection system with enhanced data collection and safety analysis capabilities, more efficient use of available inspection time will be necessary to offset the increased cost of enhancing these capabilities. Greater efficiency in use of inspection time could be obtained through the use of sampling techniques, for example, with no decrease in safety and with lower cost. Opportunities for leveraging MMS inspections should be sought. For example, a system of thorough, well-documented inspections by an operator, contractor, or other qualified third party could be structured to be acceptable as annual inspections without detracting from safety.
54 Operator Resources Operators on the OCS perform thousands of inspections and tests each year. Except for the unscheduled, unannounced checks, MMS inspections ideally should make use of the operator's planned schedule for tests and inspections whenever there is a history of good compliance and few deviations from reported conditions or in test results. An alternative inspection program ought not to impose large increases in the operator's cost of compliance, viewed in terms of the industry average of costs. (That is, only operators with a poor safety program likely would incur high costs in bringing their practices up to standard.) A reasonable increase in recordkeeping costs can be absorbed, but the largest costs ought to be front-end setup costs. Societal Costs and Benefits Modest increases in the government costs of OCS safety inspection and enforcement are not likely to provoke public objection. The budgets involved are small and are distributed nationally. Furthermore, public surveys and voting patterns indicate a willingness on the part of the public to pay for increased safety and environmental protection activities, provided those activities are seen as effective, i.e., few or no major events occur. Major events (blowouts, spills, fires, etc.) have large direct and indirect costs to the public as well as to the owners and operators. These costs appear in the form of federal and state taxes, insurance fees, public medical expenses for families of people killed or injured, the intangible human emotional costs of losses of life and property, and the costs of damage or destruction of environmental resources and cleanup. Any inspection system that increases safety produces cost savings in these areas. QUALIFICATION AND TRAINING OF INSPECTOR FORCE A- change in the inspection program could have an impact on the basic qualifications and training of the MMS inspector force. If the change is significant, there will be an associated cost for retraining and possibly for a complete restructuring of the staff. An inspection program should involve uniform inspection processes and performance standards. However, as was discussed in Chapter 3, rigid adherence to checklists in order to achieve uniformity can lead to a compliance mentality, to the detriment of overall safety. An inspection program requires a balance between specific criteria for equipment tests and procedures on the one hand, and a necessarily subjective analysis of safety attitudes, training, and management commitment on the other. The greater the emphasis on compliance with rigid standards, the easier it is to train the work force. However, the real objective is greater safety, not facilitating training; and the subjective elements will have to be emphasized strongly if inspectors are to inspect for adherence to performance standards. IDENTIFICATION OF SAFETY TRENDS AND WARNINGS An inspection program should provide the means to identity safety trends and spot warning signals of impending problems. This implies that the inspection system must include data collection, reporting, and safety analysis systems to provide a high probability of detecting and diagnosing conditions or trends that are likely precursors to accidents. The data systems should provide a basis for focused follow-up and enforcement actions when these are indicated.
ss Data systems encompass the safety management systems and operating procedures of operators, including associated training manuals and curricula, frequency of training and measures of efficiency, and procedures for dealing with abnormal conditions, including major and minor accidents. The reporting and review elements of an inspection system should include ways to measure the adequacy of coverage, frequency, and probable error or "miss" rates of the operator's inspections. There should be sufficient definition of these factors to provide a basis for determining whether acceptable levels of safety can be expected from reliance on inspection data of operators who have excellent safety records and a demonstrated corporate commitment to safety. Any of the alternative inspection programs described in Chapter 4 could be designed to permit collection and analysis of such data. However, the various alternatives differ in the extent to which MMS inspectors would witness and verify the accuracy of data collected. As a result, they differ in the amount of resources that would be released for safety analyses. The greater the extent to which MMS personnel witness data collection, the more reliable the data are likely to be; correspondingly, the less available will be funds and personnel for analytical activities and spot inspections (unless the budget is increased). The most effective inspection program in this regard will be one that reduces MMS witnessing of data collection without affecting data reliability, while simultaneously freeing more resources for analytical activities and spot inspections. SAFETY PERFORMANCE ACCOUNTABILITY The candidate inspection systems encompass a variety of ways to monitor performance of MMS personnel, operators, and the inspection system itself. The data collection and safety analysis effort required to produce safety trend information will provide much of the basic data needed for monitoring of operator performance. Any of the alternative programs can be designed to incorporate a system of accountability for individual MMS inspectors, supervisors, and district offices. The inspection system must provide measures of the effectiveness of each element of the inspection process, and of the effectiveness of the overall process in supporting the ability of management (both MMS and operator) to observe and correct deficiencies. Measures of MMS managerial effectiveness should allow for the different degrees of complexity of facilities in different areas and differing travel requirements. While easily measured statistics such as the number of inspections and INC/PINC (incidents of non-compliance/potential incidents of non- compliance) ratios can be useful in gauging productivity, the real goal should be to hold MMS personnel responsible for the degree to which they bring out good safety procedures and attitudes on the part of the operators. This can be difficult to measure objectively. Safety records of the various operators in a given geographic area and steps taken by MMS personnel to encourage improved safety are two categories of data that might aid in this determination. The extent to which the various alternative programs facilitate the collection and analysis of such data is thus a major point to consider in selecting an alternative. With any alternative being considered, provision must be made for avoiding conflicts of interest. The potential for conflicts of interest is especially pertinent in alternative 4, third-party inspection. The operator contracting for third-party inspection services may be tempted to look for a Responsive" contractor; the contractor or his employees in turn may want to ensure continued employment and thus be tempted to be responsive. With the MMS offshore presence being greatly reduced, it would be imperative to guard against the potential for these circumstances to denigrate safety.
56 ADAPTABILITY OF THE INSPECTION SYSTEM TO CHANGING CIRCUMSTANCES An inspection system should be flexible and able to evolve in the face of changing conditions, public perceptions, and regulatory requirements. This is particularly important with regard to the following factors: . Technology: the technology of structures, exploration, and production is undergoing continual refinement. The technology of safety assessment and control is also evolving and at an even faster rate. An inspection system should include a technology update/watch and a procedure to incorporate important developments in safety technology into existing operations and new facilities. · Inspection methods: the nature and coverage of the inspection should be adaptable to fit changing needs. It should take advantage of developments in safety/risk analysis. For example, two important near-term developments in safety technology have so far found little application in the MMS inspection program: (1) the increased use of systematic risk assessment to set priorities and key target items for inspections, and (2) the development of improved sensor and computer technology to extend the effectiveness and efficiency of personnel. · Aging facilities: as platforms approach the end of their useful lives, the spectrum of hazards to be addressed by the inspections should be expanded. A continual process of review and updating of inspection targets and priorities is required, together with a structured approach to defining the end of a facility's useful life. Acceptable measurements have to be defined to support extension of the service life of old facilities. PRECEDENTS The consideration here is whether the inspection procedure follows a generally accepted pattern and whether it incorporates a process for maintaining MMS awareness of relevant experience in other regions, other industries, and other countries. · Related oilfield and platform experience: surveys of related experience in oilfields and on OCS platforms in the past (including records of events in state waters) should be conducted. Periodically these surveys should be updated and analyzed, especially to identify those circumstances that contributed to major breakdowns or failures; the results should be made available for use in selecting and constructing better systems. · Related experience in other industries: current practices and related experience in other industries in which a substantial risk of public safety hazards or an environmental pollution potential may exist should be reviewed continually to keep abreast of technological developments having possible application to OCS activities. There should be a mechanism for assessing the impact of changes in public expectations as to safety and environmental pollution. · Related experience in other countries: awareness of current practices and related experience~specially accident experience-in other countries can provide important additions to the U.S. data base. Experience, not only in the oil and gas industry but also in other industrial activities where potential hazards to public safety and/or the environment are present, can be useful. GENERAL CONSIDERATIONS Underlying the eight considerations discussed above is a fundamental requirement that any acceptable MMS inspection program must satisfy: it must contribute toward the overall goal of safely operating facilities on the OCS. This basic goal includes
57 1. the safety of personnelthat is, that the selected program encompasses training, procedural, and operational guidelines that will promote operational safety and reduce lost-time injuries and fatalities; 2. protection of property and facilities; 3. environmental protectionthat is, the program incorporates equipment monitoring and operating practices that provide acceptable margins of safety against spills, blowouts, and fires or explosions; and 4. preservation and conservation of energy resources. Primarily, the MMS inspection program must be responsive to its congressional mandate. The OCSLA requires an annual inspection of every facility and a program of spot inspections. This requirement can be interpreted as a congressional determination that a comprehensive annual inspection by MMS is essential to achieve important public and national goals including overall safety. However, the OCSLA is not explicit about what constitutes an inspection or who performs it, as long as the MMS inspection program ensures that those goals are being achieved. Thus it would appear that MMS is free to implement measures it believes would be more effective than current practices in achieving its safety goals (based on MMS's interpretation that the law requires its inspectors to witness testing of every safety device annually). If MMS concludes that existing law impedes the adoption of measures it believes would enhance safety on the OCS, clarifying legislation could be sought.
