Designing Safety Regulations for High-Hazard Industries (2018)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

4 Considerations for Choosing a Regulatory Design To illustrate the options available to regulators for addressing safety in high-hazard industries, the case studies in Chapter 3 showed the various regulatory designs used to promote safety in oil and gas pipeline transpor- tation and offshore oil and gas development in the United States, Canada, the United Kingdom, and Norway. In both industries, the purpose of the regulation is to reduce the occurrence of harmful incidents, including catas- trophes. In each country, safety regulators use a mix of the four basic types of regulations—micro-means, micro-ends, macro-means, and macro-ends— as described in Chapter 2. Table 4-1 gives common labels for regulations conforming to each of these four design types, which are available to the regulators of any industrial sector. The case studies suggest that safety regulators do not find any single design type applicable to all circumstances. Specific circumstances can matter so much that reliance on generalities about a given design type’s advantages and disadvantages can be misleading. This chapter explains why such generalities can be more confusing than helpful. By drawing on available research and examples from the case studies, the chapter shows how contextual factors such as the nature of the regulatory problem, in- dustry characteristics, and local conditions (e.g., the regulator’s capacity) can change the distribution of advantages and disadvantages of each type of regulation. Those advantages and disadvantages are also affected by the details of the regulation’s design; that is, choices about how to structure a regulation have implications for implementation and compliance. The discussion in this chapter is intended to help regulators of any high-hazard industry choose among available regulatory designs and then explain their 89

90 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES choices to policy makers and the public. The discussion here also informs Chapter 5, where the report elaborates on the challenges associated with macro-means safety regulation. In an overall assessment (see Chapter 6), the report responds specifically to the study request to compare the ad- vantages and disadvantages of the various regulatory designs used in high- hazard industries. REGULATION AS PROBLEM SOLVING Regulators must decide which combination of the four regulation design types promises to achieve the ultimate goal of the regulatory regime as well as any other policy goals and criteria. For clarity of presentation and analysis, the chapter examines separately the regulator’s choices about (a) which of the four design types to use and (b) how to structure rules within each design type. In practice, of course, choices about a regulatory design type and more specific structural details need to be made in concert. On the basis of the assumption that a regulator has made at least a preliminary determination that a regulation is needed, this section considers the role of the following three factors in choosing the design of a regulation: • The nature of the problem to be solved, • The characteristics of the regulated industry, and • The regulator’s resources and capacities. Figure 4-1 gives examples of potentially relevant elements of each of these three factors: problem, industry, and regulator. The relationships among these factors, as well as their interaction with a regulatory design type, affect regulatory outcomes. The relationships can be expressed, for illustrative purposes, in the following simplified function statement: TABLE 4-1 Four Basic Regulation Design Types with Examples of Commonly Used Descriptors Means Ends Micro Micro-means “Prescriptive” Micro-ends “Performance-based” Macro Macro-means “Management-based” Macro-ends “General duty/liability” Outcome: f [regulatory design, (problem, industry, regulator)] factors

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 91 Although elements of the three factors may often be largely external to the regulation itself, they may not be fixed. Some, such as the regulator’s legal authority and its budgetary resources for enforcement and supportive activities, can be changed by policy makers. Other elements may change for reasons such as market or technological developments that affect the size, scope, complexity, and technological and managerial sophistication of the regulated industry. The possibility of change in these elements implies that a regulator may wish to make changes over time in the mix of regulatory designs that are used. In the following sections, the role of each of the three factors is dis- cussed in more detail, with examples from the case studies. Although the discussion in this chapter proceeds by first taking up each factor in turn and then considering each regulatory design separately, the regulator will benefit from incorporating consideration of all factors and designs into its decision making. Furthermore, as the case studies show in high-hazard industries, regulators often use a combination of different regulatory de- signs. For example, they may augment their micro-level regulations with FIGURE 4-1 Factors affecting the selection of regulation design. Nature  of  Problem   Severe  consequences?   High  or  low  frequency  of  occurrence?   Well  or  poorly  understood  causes  and  risks?   Trusted  interven<ons?   Industry  Characteris7cs   Private  incen<ves  aligned  with  regulatory  goals?   A  few  large  firms?  Many  small  firms?  Mix  of  sizes?   Degree  of  variability  in  ac<vi<es  and  opera<ons?   Technological  diversity  and  rate  of  change?   Regulator  Capabili7es   Legal  authority?   Sensi<vity  to  public  and  poli<cal  expecta<ons?     Administra<ve  and  procedural  constraints?   Budgetary  resources?   Human  capital  and  hiring  flexibility?   Time  availability?  

92 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES macro-means regulations intended to address varied and context-specific risks. The three factors discussed in this chapter may seldom justify the use of just one overall regulatory design for regulating an entire sector. Instead, they may indicate the use of different designs for targeting distinct facets of safety within an industry. Nature of the Problem The problems that regulations are intended to remedy vary in their likeli- hood, their complexity, their severity, and the degree to which their causes are understood. In choosing a regulatory design, the safety regulator will be mindful of the ultimate problem to be solved—the prevention of harm- ful outcomes such as fatalities, injuries, and environmental damage. To find remedies, the regulator almost always disaggregates the problem into its parts. For example, the regulator may focus on individual contributors to risk and then design regulations targeted to each. How the problem is disaggregated is relevant to the choice of regulatory designs because some design types may work better in addressing one risk contributor while oth- ers may work better for other contributors. The result may be a regulatory regime consisting of multiple regulatory design types. Reliance on a mix of regulatory designs was observed in the case stud- ies of Chapter 3. For example, pipeline regulators administer regimes that are intended to prevent the catastrophic harm caused by occasional major pipeline ruptures as well as the harm caused by the more common prob- lem of leaks. One contributor to both failures is external corrosion of steel pipe. To address this relatively well-understood mechanism, both the U.S. Pipeline and Hazardous Materials Safety Administration (PHMSA) and the Canadian National Energy Board (NEB) require pipeline operators to install cathodic protection,1 an established means of preventing external corrosion of pipe steel under a wide range of conditions. The nature of this contributor to the pipeline safety problem—a phenomenon that is well understood and that can be mitigated with a material intervention applied uniformly across all regulated entities—lends itself to a micro-means regula- tion that some would call “prescriptive.” Other contributors to problems may not have such singular remedies. Their causes may be assessed in ways allowing for regulations that obligate firms to achieve a specific quantitatively measured end or performance level rather than to use specific interventions. For example, a pipeline may fail from a crack or split at its seam when it is overpressurized. The likelihood of such damage can be influenced by steel type, wall thickness, fabrication 1 Cathodic protection generally involves the application of a low-voltage electric current to the pipeline.

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 93 methods, and other design and technology choices. Instead of making each of these choices for the pipeline operator, PHMSA regulations establish a formula for calculating a pipeline’s safe maximum operating pressure. A pipeline designer can adjust the choice of pipeline parameters, materials, and fabrication options to keep operating pressure within specified limits. Other interests in addition to ensuring safety, such as adding throughput capacity or accommodating local conditions, may also be achieved. In this case, a source of the safety problem—a risk contributor that can be measured and addressed through various means—lends itself to a “performance-based,” or micro-ends, regulation. Some causes of pipeline failure cannot be addressed with micro-level regulations alone. Pipelines are damaged by excavation strikes and other activities such as the plowing of agricultural fields. Damage caused by third parties is a major risk concern because the presence of people can make the outcomes catastrophic (PHMSA 2014). “Call-before-you-dig” systems are a proven way to reduce the incidence of excavation damage, and therefore PHMSA requires their use by all pipeline operators. However, the potential for third-party strikes varies according to context-specific factors. Among them are whether the pipeline passes near residential, agricultural, or in- dustrial locations with different degrees of exposure to human activities that can damage buried pipes and to concentrations of people who could be harmed by ruptures. Therefore, the agency requires operators to develop a customized damage prevention program with the understanding that the elements of the program—such as whether protective pipe casings will be installed, rights-of-way patrols will be deployed, or public awareness campaigns will be intensified—will reflect context-specific risk factors. In this way, PHMSA combines a micro-means regulation (requirements for call-before-you-dig notification systems) with a macro-means regulation (requirements for written damage prevention management programs) to address a multifaceted problem ill-suited to a single regulatory design. Some safety problems are more difficult to disaggregate into contribut- ing factors. They involve interactive sets of factors that can vary over time and across regulated entities. For example, regulators of offshore oil and gas facilities face a particular challenge in designing regulations to pre- vent catastrophic incidents whose risks arise from the interaction of many facility- and operations-specific factors. An important part of these regula- tors’ responsibility is to reduce foreseeable harms associated with offshore occupations, such as injuries to workers during drilling jobs, helicopter transport, and maintenance activities. However, success in reducing foresee- able workplace harms may have little discernible impact on risk factors that can lead to catastrophic events such as facility explosions, fires, and capsiz- ings. As oil and gas producers have expanded their activities into deeper waters requiring more complex facilities and operations, the risk factors

94 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES have been changing. They have sometimes become more difficult for regu- lators to identify or measure so that one or more micro-level regulations can be applied. In recognition of this circumstance, the United Kingdom’s offshore regulator, the Health and Safety Executive (HSE), chose its “safety case” regime, which seeks a more holistic approach to regulation. Similarly, the Bureau of Safety and Environmental Enforcement (BSEE), which regu- lates the U.S. offshore sector, requires offshore operators to institute safety and environmental management systems (SEMS) that incorporate a variety of risk planning, analysis, communication, and reporting processes. Both SEMS and safety case regulations overlie a collection of highly targeted, micro-level regulations intended to address specific risks that are common among offshore installations, are fairly well understood, and can be reliably mitigated with specific interventions. The macro-means require- ments of SEMS and safety case regulations demand that the operator man- age any additional risk factors that are not targeted directly by micro-level regulations. In this sense, the SEMS and safety case regulations are intended to fill gaps in traditional micro-level regulations to improve the regulator’s ability to reduce the severity and frequency of foreseeable incidents. In calling for the establishment of programs that identify risks and implement risk management systems, the macro-means SEMS and safety case regulations are also intended to address the context-specific risks inter- acting with one another to produce catastrophes. As discussed in Chapter 1, the systemic problems that can arise from such interactions—called normal, inescapable, and thus inevitable problems by Perrow (1984)—cannot be fully addressed simply by imposing micro-level requirements for the use of specific facility designs or for the performance of specific equipment. Like macro-ends regulations that penalize firms or impose liabilities on them should a harmful incident occur, macro-means regulatory designs are concerned not only with the risks relating to how facilities are designed and equipped but also with how the facilities are operated on a daily basis. These examples from the pipeline and offshore industries show how the nature of the problem can affect the choice of the regulatory design types that make up a regulatory regime. The challenge in making these choices can be described as identifying a good fit between the problem that needs to be solved and the characteristics of a regulatory design. Industry Characteristics The degree of government intervention into and regulation of a safety prob- lem depends in part on the industry’s incentives and ability to address the problem as well as the public’s demand that the problem be mitigated. In- dividual industries and firms have incentives to ensure safety. For example, a commercial airline presumably has an interest in safety because—among

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 95 other reasons—its customer demand would disappear if its planes were prone to crashes. Government intervention by regulation is often demanded in cases where an industry is not believed to have internalized a perceived threat fully or to have selected an optimal level of safety precaution from a societal standpoint. Some industries or firms may lack sufficient incen- tive to address a safety problem. Some may lack the ability to recognize and respond to a problem, perhaps because the harms are slow to manifest themselves and long term in nature. Therefore, at the most basic level, an understanding of the industry is important in deciding on a need for govern- ment regulation (Coglianese 2010). An understanding of the industry is also important for choosing the design of a regulation. In particular, the degree of heterogeneity of the firms and technologies in the industry can be an important factor in choosing a design (Coglianese 2010). An industry consisting of firms whose size, re- sources, operations, and technology are similar presents a regulatory chal- lenge different from that presented by an industry whose firms differ widely in these characteristics. In the former case, micro-means regulations may be a promising design type, because the prescribed technologies, materials, and practices may have widespread applicability. However, circumstances can vary. The uniformity of micro-means requirements may be problem- atic in cases where uniform actions would be ill-suited to some firms and would preclude the use of alternative means that may be more cost-effective (Gunningham and Johnstone 1999; Hahn 1989). Under these conditions, ends-based regulation allowing the regulated firm to choose among options for achieving the desired ends may be more promising (Gunningham 1996). Many industry consensus standards that are referenced in government regulations, as exemplified in Chapter 3, can be characterized as having an ends-based quality because they do not mandate the use of a particular practice or technology (e.g., the grade of steel in a pipe) but instead define the qualities or outcomes to be achieved (e.g., pipe strength properties). These standards are often developed by industry actors cognizant of the need to accommodate a range of users and applications. The case studies in Chapter 3 show that the offshore oil and gas and pipeline industries use a wide range of technologies and practices. BSEE regulates more than 2,000 offshore facilities in the Gulf of Mexico alone. Some operate in shallow waters and others in deeper waters, where facility designs and operations are much more complex. The complexity of offshore facility designs and operations has grown as production has expanded to deeper waters and harsher environments. In the North Sea, HSE and the Petroleum Safety Authority (PSA) regulate considerably fewer offshore facilities, but many of them are massive structures serviced by hundreds of workers. Many platforms have multiple contractors and complex manage- ment configurations, which make coordination and accountability difficult,

96 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES if not opaque. PHMSA and NEB regulate pipeline systems ranging in scope from transcontinental networks owned by multinational corporations to lo- cal distribution systems run by small gas utilities. The systems share many basic features and have many similar risk concerns, but they differ in many fundamental aspects such as physical design and configuration, technology vintage, use patterns, operating environments, capitalization, history, and staffing capabilities. Knowledge of all the context-specific risks contributing to a safety problem in such complex industries can be challenging for a government regulator (Coglianese and Lazer 2003; Huising and Silbey 2011; Silbey and Ewick 2003). Cognizant of the challenge, BSEE, NEB, HSE, PHMSA, and PSA have all issued macro-means regulations requiring operators to establish customized management plans and systems to identify and control all their significant sources of risk. Each of the five agencies recognized the importance of accounting for the diversity and complexity of the activities and businesses it regulates when it chose this regulatory design. As some of these regulators have found, a diverse industry can also complicate the use of such macro-means regulations. Both the offshore and the pipeline industries consist of operators with a range of manage- ment capabilities because of variability in the size and resources of firms. The offshore industry, particularly in the United Kingdom and Norway, consists mostly of large multinational drilling and production companies who generally prefer macro-means regulations that give them flexibility to control their facility-specific risks. Such companies are more likely than smaller operators to have resources for assessing risks and designing locally appropriate systems. Larger pipeline operators exhibit a similar preference for such regulations. However, when PHMSA extended its macro-means requirements for integrity management programs to gas distribution sys- tems, hundreds of smaller gas utilities were affected. Many of these pipeline operators complained about the impracticality of developing and imple- menting management system requirements with small engineering depart- ments and limited staffing resources. They preferred the more direct and comprehensible requirements of “prescriptive” micro-means regulations that create more predictability about the actions required for compliance. The case studies illustrate how another industry characteristic—the degree of technological diversity across firms and rate of change in the state of technology over time—can affect the choice of a regulatory design. Where technologies are diverse or fast-changing, safety regulators who rely extensively on micro-means regulations run the risk of the require- ments being inapplicable, becoming outdated, or creating an obstacle to the introduction of beneficial new technologies (Silbey and Ewick 2003). As noted, offshore oil and gas production technology has become more com- plex as development has moved to deeper waters. BSEE continues to rely

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 97 on many highly targeted micro-means regulations but has also introduced some micro-ends regulations in recognition of a dynamic technological landscape. For example, in its 2016 well control regulation,2 BSEE states that an operator’s casing and cementing program must provide adequate centralization to ensure proper cementation around the casing.3 By allow- ing operators to use conventional bow-type centralizers as recommended in referenced industry consensus standards but not requiring them to use such a device, the regulation recognizes that advances in technology and practice are leading to other options to ensure the desired outcome of centralization. The macro-means regulations of offshore and pipeline regulators can also be applicable when technologies or processes vary across firms or change over time. By requiring uniform management actions such as plan- ning and systems analysis, this form of regulation leaves the details of facil- ity design or operational technologies to each firm. Regulator Capabilities No matter how well a regulation is designed, its potential to have impact will depend on the regulated industry’s level of compliance (Coglianese and Lazer 2003). Examples of the regulator’s role in motivating and compelling compliance are provided in the case studies in Chapter 3. They show how regulators can use persuasion or technical support to promote compli- ance. For example, regulators provide guidance on best practices, conduct research to develop compliant technologies and practices, and partici- pate in the development of industry consensus standards to operationalize regulations. The case studies also show how regulators use enforcement mechanisms such as inspections, audits, and fines. Because the support and enforcement capacity of a regulator bear on the prospects for compliance and because the capabilities required vary with regulatory design, they are important considerations in the choice of a regulatory design. PHMSA’s program for ensuring compliance with its pipeline safety regulations illustrates how regulatory design types and regulator capabili- ties relate, both with one another and with industry characteristics. The agency’s enforcement program was established to ensure that pipeline op- erators comply with a specific type of regulatory design, micro-level regula- tions. In what is often called a “checklist” process, inspectors visit facilities to ensure that specified procedures, technologies, equipment, and systems are in place and being used. For example, they may verify that a specific valve type is installed and functioning as required. To aid in the inspection 2 81 Federal Register 25888, 25918 (April 29, 2016). 3 Centralization entails keeping the casing or liner in the center of the wellbore to help ensure efficient placement of a cement sheath around the casing string.

98 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES of thousands of pipeline systems that can span tens of thousands of miles, PHMSA enlists state pipeline safety agencies to help enforce its regulations. Personnel from state agencies inspect nearly all gas distribution systems, most other intrastate transmission systems, and some interstate transmis- sion systems as well. A challenge for PHMSA has been to ensure that federal and state personnel have the capabilities needed to enforce its newer macro-means regulations that require integrity management programs. Determining what constitutes an adequate integrity management program demands a different skill set on the part of the regulatory inspector, because both the auditing of management processes and physical inspections of facilities are required. When PHMSA issued its first integrity management regulations nearly 20 years ago, it recognized that its enforcement program would need to adapt. The agency continues to experience problems in hiring and retaining enforcement personnel with the necessary expertise, in part because of dis- parities between government and private-sector pay scales. PHMSA’s heavy reliance on state inspectors presents an additional challenge. Like some federal inspectors, many state inspectors are accustomed to checklist pro- cedures rather than program audits. When integrity management programs were mandated for gas distribution systems, states became responsible for enforcing compliance. Thus, PHMSA must not only make changes to its own inspection workforce but also ensure that dozens of state programs have the requisite enforcement capabilities and resources.4 PHMSA’s experience illustrates how a regulator choosing among regu- latory designs may want to consider each design’s compatibility with the regulatory designs and capabilities of other regulators of the subject in- dustry. Industries must often comply with regulations issued by multiple authorities. North American transmission pipeline operators are subject to federal and state regulations in the United States, as well as regulations in Canada. Offshore mobile drilling units are governed by both BSEE and U.S. Coast Guard (USCG) regulations when operating in U.S. waters and by the requirements of other countries when operating elsewhere. In such cases, the regulator may want to choose regulatory designs that align with those of other regulatory regimes, both to facilitate industry compliance and to leverage the enforcement capabilities of multiple regulators.5 4 Canada’s NEB has also experienced challenges in obtaining adequate resources for instruc- tion and training of enforcement personnel to accommodate macro-means regulations. NEB reported that with existing staff resources, nearly 1 year can be required for the agency to complete an audit of an operator’s management systems. 5 As noted in Chapter 3, BSEE and USCG have closely aligned jurisdictional and regulatory responsibilities related to offshore energy development on the U.S. outer continental shelf. The two agencies collaborate to reduce the redundancy and ensure the consistency and clarity of their regulations. They also coordinate inspection and other enforcement activity.

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 99 BSEE’s experience in enforcing its macro-means SEMS regulations of- fers another example of the relationship between regulatory design and regulator capabilities. BSEE is faced with overseeing compliance by hun- dreds of offshore operators and their contractors and has many of the same personnel issues as PHMSA. Like those of PHMSA, BSEE’s inspectors had traditionally enforced micro-level regulations by visiting offshore facili- ties and inspecting for compliance through use of a checklist procedure. The agency uses approximately 125 inspectors to enforce compliance on more than 2,000 facilities. Because micro-level regulations can be enforced relatively quickly by using standardized protocols, BSEE has been able to function with a smaller enforcement workforce having fewer techni- cal experts. The addition of SEMS requirements has caused the agency to begin reevaluating its enforcement personnel needs and strategies. BSEE has sought to compensate for its difficulties in hiring and training auditors for SEMS compliance by requiring offshore operators to hire independent program auditors. Nevertheless, the agency must develop a capability to evaluate the auditors and their accreditors. The regulatory activities of HSE and PSA in the North Sea also il- lustrate how a change in regulatory design can have implications for the regulator’s personnel and other capabilities. As discussed in Chapter 3, these regulators employ relatively large workforces to oversee compliance at fewer than 500 offshore facilities. The detailed reviews of required man- agement plans in safety cases and acknowledgment of compliance (AOC) applications are labor-intensive activities calling for a range of skills and industry competencies among regulatory personnel. HSE and PSA have therefore had to obtain the budgetary commitments to employ personnel having such expertise, including knowledge of risk analysis and experience in the offshore oil and gas industry. However, HSE’s and PSA’s adoption of macro-means regulatory approaches required more than transformations of their workforces over the past two decades. Both agencies have changed the way they oversee the offshore industry in the North Sea region, which has had implications for a range of required capabilities. To support their macro-means regulations, HSE and PSA have chosen to develop a capability to collaborate with the offshore industry and work- force. HSE is required by law to work with offshore operators to improve their safety cases, and it functions in part as a “problem solver.” When HSE personnel visit offshore facilities to verify conformity with safety case plans, they do not conduct checklist inspections but instead spend days meeting with workers and managers and observing their practices and performance. Before inconsistencies with safety case plans are cited and sanctions imposed, HSE personnel meet with operators to discuss options for resolving them, unless there is an immediate risk of serious harm that warrants a notice to stop the activity immediately. PSA’s collaborative ef-

100 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES forts to facilitate compliance are perhaps illustrated best by its deployment of multidisciplinary teams to each operator’s onshore control room. These teams not only validate that operators are following the plans and processes promised in their AOCs but also contribute engineering and industry pro- cess expertise to inform operators about safe practice. Both HSE and PSA contend that the capability to engage in this high degree of collaboration and consultation is essential to the implementation of their macro-means regulations because it provides valuable insight into the context-specific risks that can arise at individual facilities and across operators. On a smaller scale than HSE and PSA, PHMSA has demonstrated an increasing willingness and capability to collaborate with U.S. pipeline op- erators to facilitate compliance with its macro-means integrity management regulations. When PHMSA first introduced the requirement for integrity management programs, it expected pipeline operators to develop exper- tise in risk modeling and analysis that would soon permeate the industry. Because the development of this industry expertise has been slower than expected, PHMSA has had to compensate by developing its own risk mod- eling expertise and collaborating with industry in work groups to further the state of practice. In addition, by working with small pipeline operators, the agency has developed a computer program known as SHRIMP (Simple, Handy, Risk-Based Integrity Management Plan) to help this segment of the industry comply with its integrity management regulations. These examples indicate that the selection of a regulatory design type and its use in combination with other design types can have significant im- plications for the regulator’s enforcement program and for its other support- ive activities. The examples illustrate the importance of a regulator having or being able to develop the capacity to implement and enforce a selected design. A regulator that lacks or cannot develop a required capacity, such as a staff with sophisticated risk analysis and auditing competencies, may find that the attributes of a regulation type that make it attractive can cre- ate a considerable burden and practical obstacle to regulatory effectiveness. ISSUES IN REGULATORY DESIGN, IMPLEMENTATION, AND EVALUATION In deciding how to design a regulation, the regulator must do more than merely identify a promising general type of regulatory design. Regulations of the same design type can differ markedly in their structural details, which will have implications for how well they will achieve the regulator’s goals. Faced with many constraints, the regulator may not be able to structure a regulation of the preferred design type that produces the desired response. Under these circumstances, other design types may need to be considered. This section explains how and why the structural details within each

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 101 design type matter. For example, although micro-ends regulations may offer regulated firms greater flexibility than do micro-means regulations, not all micro-ends regulations will be the same in terms of the degree of flexibility they offer. Coglianese and Nash (2017) discuss the history of the federal tailpipe emission standards, which are micro-ends regulations intended to provide flexibility to vehicle makers in reducing emissions by adjusting engine op- erating conditions, changing fuel requirements, installing after-treatment devices, and taking other measures. However, when the U.S. Environmental Protection Agency (EPA) reduced its permissible nitrous oxide limits by nearly 90 percent in 2007, most engine manufacturers were forced to adopt catalytic converters for after-treatment, the only available means to meet the new standard at the time. Thus, the flexibility imparted in this case was minimal because of a structural feature—the degree of stringency in the performance limit established by the regulation. A micro-ends requirement structured so that it can be met with only one available technology is, for practical purposes, just as constraining, in the short term, as if the regulator had imposed a micro-means obligation to use that technology (Coglianese 2016).6 Much the same can be said of the other regulatory design types. For example, a micro-means regulation that simply requires the use of “moni- toring technology” will have effects different from that of one requiring the use of a specific type of sensing equipment. The structural details of a regulation can affect not only compliance flexibility but also the regulation’s performance with regard to a variety of policy objectives, such as the prospects for implementation (including com- pliance and enforcement) and ease of evaluation of impacts. A regulator is likely to have multiple objectives in selecting a regulation, so offering a “recipe” for choosing an appropriate structure for each design type is im- practical. On the basis of experience from actual regulations, however, there are some common questions—as discussed in the following sections—that a regulator should consider in deciding how to structure a given type of regulation to meet policy objectives. Micro-Means (Prescriptive) Regulations As shown in the top left-hand cell of Table 4-1 and noted in Chapter 2, micro-means regulations are often described as prescriptive and sometimes called design, specification, technology-based, or command-and-control 6 Such a restrictive ends-based requirement may still promise flexibility in the longer term if it eventually can be met by using new technologies. A micro-means regulation, in contrast, can accommodate future technological change only through waivers from or amendment of the regulation.

102 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES regulations (Coglianese 2010). A common characteristic of these regula- tions is that they obligate regulated firms to take or refrain from taking particular actions (e.g., following a certain procedure, using a given mate- rial, or installing a type of equipment). In general, the decision to use a micro-means regulation implies that the regulator has a good understanding of the specific hazard, means of mitigation, the capacities of the applicable technologies, and the operations of the regulated firms. Only with such an understanding can the regulator prescribe specific actions and have confi- dence that the actions will be suitable and effective. Even when circumstances suggest that a micro-means regulation may be desirable—such as the existence of a trusted control measure used by a homogeneous industry—the regulator has many choices to make in de- veloping and applying such a regulation in a particular case. Some of the choices are illustrated by the following questions: • What kind of means should the regulator require (e.g., use of a technology, design, practice, or procedure)? • Should the regulator give firms more than one means from which to choose (e.g., “the manufacturer shall install either automatic seat belts or air bags”)? • Should all firms be required to use the same means? Or should dif- ferent means be required for different categories of firms, depend- ing on, for example, the size of a regulated facility or its operating conditions? • Should waivers or exemptions be permitted? If so, on what basis should they be granted? • Should the means requirement be combined with an equivalency provision allowing the regulated entity to substitute another means that yields an equivalent outcome? If so, who should bear the bur- den of proving the equivalency (or lack thereof): the regulated firm or the government? • Are required means themselves subject to required performance tests [e.g., “the facility shall install pressure relief valves (means) that activate at X pounds of pressure (ends)”]? • What paperwork or monitoring protocols, if any, should be im- posed on regulated firms to document their use of the required means? The answers to these questions can have implications for the structure and performance of a micro-means regulation. Assessment of the desir- ability of using micro-means regulation will depend on answers to ques- tions such as these. For example, consider the question, “Should all firms be required to use the same means?” If allowing different types of firms

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 103 to use different means would indeed be desirable, the very applicability of a micro-means design may be questionable. On the other hand, if a given practice or technology is widely available, known to be effective, and can feasibly be used by most firms, the regulator may conclude that requiring the uniform use of that means is appropriate, even if some exceptions or different categories might need to be provided. After all, a micro-means design can also provide advantages, such as greater clarity with regard to the actions expected of the regulated firm and thus greater assurance that the actions will be undertaken (Coglianese 2010). In the case studies, many observers claimed that smaller operators of gas pipeline systems tended to favor such specific means-based regulatory commands because they provide greater certainty and simplify decision making, which can be important for firms with limited resources and technical staff. However, the clarity and directness of a “one-size-fits-all” means-based regulation can lead to rigidity. Such regulations prevent firms from ap- plying more innovative solutions, which was a concern raised by larger pipeline operators in the case studies. In deciding whether to use this form of regulation, the regulator will need to consider whether it will be able to recognize when changes in the state of practice and technology demand changes in regulatory requirements and then to make these changes. If the process for changing regulatory requirements is cumbersome and costly— for example, lengthy rulemaking proceedings are required—the regulator may be concerned that any micro-means requirements it imposes today will become outdated and hinder the introduction of more effective remedies. This concern may be abated if the regulation can be designed to ensure that requirements are kept current—for example, by basing them on regularly updated consensus standards developed by nongovernmental standards- setting organizations. Such an option will prove less helpful in the United States, because ordinarily, regulations must still be amended to require later versions of consensus standards. In all countries studied in Chapter 3, pipe- line and offshore safety regulators reference industry consensus standards, although the mechanisms for ensuring that the most recent standards are referenced vary. The regulator may consider other modifications to compensate for an overly inclusive micro-means regulation. One option would be to add an equivalency provision allowing firms to substitute other means for the re- quired one as long as the alternative met certain performance requirements. This decision will need to be considered carefully. It may require that the regulator institute a process for assessing equivalency, which may be costly and complicated to implement if the industry is large and waiver requests are abundant. Adding such a provision can also affect enforcement. One of the implementation advantages of a one-size-fits-all means-based regula- tion is that inspectors may be more readily trained and able to work more

104 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES quickly when they are tasked with observing whether uniformly required means are being followed. Uniformity of means can be helpful for a regu- lator such as BSEE, whose inspectors make more than 20,000 inspections per year. They often visit multiple offshore facilities in 1 day and follow a checklist of standardized items to observe. Federal and state pipeline in- spectors follow similar checklist procedures for enforcing the many micro- means regulations that apply to thousands of operators and hundreds of thousands of miles of pipeline. The use of different oversight techniques may be required when compliant means are more varied. Micro-Ends (Performance-Based) Regulations As shown in the top right-hand cell of Table 4-1 and discussed in Chapter 2, micro-ends regulations are often referred to as performance-based, goal- based, process-based, and risk-based. Other terms, such as outcome-based, are also used. Regulations of this type require the regulated firm to attain or avoid a specific set of outcomes as an intermediate step in addressing the ultimate problem that motivates the regulation (Gunningham 1996; Viscusi 1983). The flexibility afforded by micro-ends regulations has made them attractive to policy makers. Indeed, an executive order on regulation adopted during the Clinton administration and is still in force directs fed- eral agencies to specify performance objectives when new regulations are developed wherever feasible. The Chapter 3 case studies describe micro-ends regulations that are tar- geted to specific aspects of the ultimate safety problem of preventing harm- ful failures in pipelines and offshore facilities. Examples include BSEE’s requirement that welding be done in a manner that ensures resistance to sulfide stress cracking, HSE’s requirement that lifeboats have sufficient places for 150 percent of the workers on the facility, and PHMSA’s require- ment that pipeline coating systems have sufficient strength to resist soil stresses. These regulations prescribe outcomes to be achieved—resistance to stress cracking, evacuation capacity for workers, and strength to resist soil stresses—rather than mandating the particular means for achieving these outcomes. A regulator interested in pursuing a micro-ends regulatory design faces many choices about how to structure such rules. They are illustrated by the following questions: • Can clearly defined performance indicators be identified that will capture the relevant end outcomes? • How specifically should performance be defined (e.g., “avoid un- safe pressures” versus “avoid pressures above X psi”)?

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 105 • Who is collecting the performance data? How can the integrity of the data be verified? • On the causal chain leading to the ultimate problem, how close to that ultimate outcome should performance be set (e.g., on an early step or nearer to a penultimate one)? • Who should bear the burden of proving that performance has or has not been satisfied—the regulator or the regulated facility? • Should performance be measured in actual practice, or should compliance be based on predicted outcomes and assessed via simulation? • On what criteria should levels of performance be determined (e.g., feasibility, de minimis risk, current technical achievability)? • Should performance requirements be applied to individual units (e.g., each smokestack) or to an aggregate collection of units (e.g., the entire facility)? • How should the required performance levels vary with the char- acteristics of the regulated unit or facility (such as age or size)? Or should all regulated units or facilities be required to achieve the same level of performance? • Should a facility be able to bank or trade, within the facility or with other regulated entities, any desirable performance achieved in excess of minimally required ends? • What kind of recordkeeping or reporting requirements should be imposed on facilities to document their performance? • Should regulators prepare micro-means guidance to accompany micro-ends regulation? Answers to questions such as these can have significant implications for the regulation’s outcome as well as for the burdens imposed on the regulator and the industry. For example, the regulator must decide how to define “performance.” A basic design challenge for a micro-ends approach is finding performance indicators that capture the outcomes sought. For complex functions, a measure or set of measures that capture poorly de- fined risks may be difficult to find. Vague performance measures can lead to difficulty for the regulator in ensuring compliance in a uniform fashion (May 2011).7 For example, in environmental regulations, chemical releases are easily measurable but not as accurate as indicators of risk, which are harder to measure (Bennear 2006). A performance requirement presumably must not be so ambitious or 7 New Zealand adopted flexible performance-based regulatory standards for buildings, but enforcement failed because the standards were so vague that performance became difficult for regulators to ensure (May 2003).

106 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES strict that it offers no feasible means of compliance. If it is defined very narrowly, the requirement can limit the flexibility of firms to innovate and respond in more cost-effective ways. If the only feasible way to meet a tightly defined performance requirement is to use a particular technology, the micro-ends regulation will lead to outcomes identical to those of a micro-means regulation that prescribes the use of that technology (Ashford et al. 1985). In designing micro-ends regulations, a regulator must understand the causal pathways to the larger problem, because the regulations need to focus on an intermediate problem or step on the causal chain leading to the ultimate problem (May 2003). For example, if the goal of a regula- tor is to reduce fire risks at industrial facilities, establishing a micro-ends regulation to limit the level of equipment noise will unlikely do much to address the ultimate problem. The relevant causal pathways or network may be relatively clear for ascertaining how certain intermediate outcomes such as levels of pollutants can adversely affect human health, which is the ultimate regulatory concern. In other cases, such as problems arising in complex industrial systems, these relationships may not be well under- stood (Coglianese 2016). In the examples of regulations governing lifeboat occupancy capacity and pipeline stress resistance capability, micro-ends regulations target concerns on the causal pathway that are far removed from the ultimate safety problem. However, micro-ends regulations can be written to mandate outcomes that are closer to that ultimate problem. An example is the EPA regulation that limits mercury emissions from power plants to a given number of pounds per unit of energy output. A plant can meet the EPA limit by using various combinations of control technologies and operational processes (EPA 2012). In this case the ultimate problem is the prevention of cancer and neurological illnesses attributed to levels of mercury in the environment. Because a major portion of the mercury in the environment derives from power plants, the structure of EPA’s regulation of this emissions source leads to a response that is closely connected to the ultimate problem. Structuring a regulation that mandates desired outcomes with a di- rect bearing on the ultimate problem and that are measurable or can be accurately modeled, as is the case with the emission of mercury, can be challenging for a regulator. In the EPA example, the problem of mercury contamination is well understood. In addition, a plant’s compliance with a quantitative performance requirement can be assessed with technolo- gies for monitoring mercury combustion flue gases and by-products from power plant stacks. When sources of an ultimate problem are numerous and diffuse, identification of measurable ends with a strong connection to the problem may be difficult for the regulator. The regulator might be able to identify some intermediate, measurable outcomes that contribute to the

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 107 problem, but not all of them—especially when the problem concerns indus- trial catastrophes that can arise from one of any number of combinations of intermediate outcomes (Reason 1997). Knowledge by the regulator of whether the outcomes required have a causal connection to the ultimate problem is important in choosing a performance requirement (Coglianese 2010; Stavins 1998). As discussed in Chapter 3, BSEE has enlisted the U.S. Department of Transportation’s Bureau of Transportation Statistics to develop and manage a near-miss reporting system.8 Analysis of such data (e.g., by using anomaly detection and predictive maintenance algorithms) could provide BSEE with a better understanding of the most likely causes of offshore catastrophes. Measur- able outcomes (e.g., behaviors or types of events) connected closely enough to catastrophic risk that they can serve as proxies for catastrophes may be identifiable. With this information, BSEE may be able to design micro-ends regulations that rely on such proxies for the ultimate problem as the basis for the outcomes embedded in the regulatory obligation. In choosing how to structure a micro-ends regulation, the regulator will need to consider the measurability of the relevant outcomes for the purpose of ascertaining compliance. Methods of determining performance can vary. They include direct observation of actual outputs or outcomes on a continu- ous or periodic basis, testing under conditions similar to actual conditions, and computer simulations based on models of the relationship between inputs and outputs (Coglianese 2016). Offshore facilities are dispersed and in remote locations. Thus, monitoring of outcomes (e.g., the incidence and volume of releases) may prove challenging, especially in comparison with conducting spot checks to ensure that well-defined micro-means regulations are being followed. Decisions about measurability could fall prey to the “streetlight effect,” a type of observational bias that occurs when people search for something and look only where doing so is easiest. This bias is illustrated by the par- able of the drunk looking for his lost keys under a lamppost, simply because that is where the light is. A regulator may inadvertently impose regulatory obligations to meet intermediate objectives of a larger problem that are more easily measured but less significant in terms of their causal relevance to the ultimate problem. The relevance and measurability of outcomes are only some of the issues that a regulator will need to consider in designing a micro-ends regulation. Another issue is the need to ensure that the required tests for performance are well calibrated and reflect the full trade-offs of values and interests at stake. A micro-ends regulation that mandates the design 8 The program is called the Safe Outer Continental Shelf Confidential Reporting System, or SAFEOCS (https://www.safeocs.gov).

108 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES of child-resistant packaging for pharmaceuticals and hazardous household products may succeed in inducing manufacturers to produce packages that children cannot open; however, these packages may prove exceedingly diffi- cult for adults to open as well (Coglianese 2016). Another possibility is that the flexibility afforded by micro-ends regulation will bring about perverse responses, as in the case of the “teaching-to-the-test” phenomenon. Some firms may satisfy the performance test in ways that do not address the ul- timate problem that motivated the regulation (Coglianese and Nash 2017; May 2003). This occurrence is a form of goal displacement made possible if performance measures do not fully capture outcomes. Manipulation of performance metrics by the regulated entity is another form of performance perversity. Massaging or simply making up data has been found in regulation and multiple policy areas where those being assessed also collect the data for which they are being held accountable (Moynihan 2017). One technique for dealing with this problem is to moni- tor a variety of metrics beyond those included in regulatory standards that might reveal perverse behavior. Macro-Means (Management-Based) Regulations As shown in the bottom left-hand cell of Table 4-1 and noted in Chapter 2, macro-means regulations are often referred to as management-based. These regulations seek to harness the special information advantage that a regu- lated firm possesses about the details of its operations and facilities. They are premised on two beliefs. The first is that firms themselves, with their many interactive human and technological processes, are in a better posi- tion than the regulator to know what actions should be taken to achieve the regulatory outcome. The second is that if firms are given the flexibility to act, they will have greater opportunity to find more cost-effective out- comes and a higher likelihood of compliance (Ayres and Braithwaite 1992; Coglianese 2010; Coglianese and Nash 2001; Kleindorfer 1999). As discussed in Chapter 2, this type of regulation is referred to by many names, including process regulation, performance-based regulation, systems-based regulation, safety case regulation, and enforced self-regulation (Coglianese 2010). It has been applied in a variety of domains around the world, including food safety, mine safety, rail safety, chemical accident avoidance, and pollution prevention (Bennear 2007; Coglianese and Lazer 2003; Hutter 2001). It is often used in contexts exhibiting high levels of heterogeneity in industry practices and for problems associated with sys- temic interactions. In such circumstances the regulator can have difficulty in identifying both widely applicable micro-means requirements and outcomes that are sufficiently discrete, relevant to the problem, and measurable. The case studies in Chapter 3 illustrate how macro-means regulations

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 109 can differ in use and design details. The safety case and AOC regulations are viewed as central to HSE’s and PSA’s regulatory regimes, whereas BSEE’s SEMS regulation is viewed as an accompaniment to a larger suite of micro-level regulations. In regulating pipelines in Canada, NEB administers a large number of macro-means regulations in combination with micro- level regulations. PHMSA uses macro-means regulation in a more targeted manner to focus on integrity management. The following are examples of the choices regulators face in the design of macro-means regulations: • How detailed should the management requirements be? For ex- ample, should they simply call for facilities to engage in a “com- prehensive risk plan,” or should they specify what such plans should contain (e.g., start-up procedures, emergency operations, inspection protocols, etc.)? • Should regulated entities be required to submit their management plans to the regulator before commencing operations (as in the HSE safety case)? Or must they merely develop the plans and keep them and any other documentation on file for whenever a regula- tor inspects (as is the case with PHMSA’s integrity management regulations)? • How will regulators address poorly developed plans? • What kind of recordkeeping and documentation, and how much, should be required? • How will the regulator ensure that the plan is being followed? • Should regulated entities be required to obtain a third-party audit of their management plan and system? • Should a specific frequency of audits be mandated so that manage- ment can know whether the plan is being followed, or should man- agement merely be mandated to develop a procedure for ensuring that the plan is being followed? • To what extent should performance measures be used as a sup- plemental regulatory obligation (via ends-based regulations), or should they merely be used as feedback loops for improvements in the management system? Many of these questions have been addressed by the regulators studied in Chapter 3. For example, the question about the level of detail of manage- ment requirements is being considered by PHMSA as it revises its integrity management regulations in response to concerns about the safety perfor- mance of some operators. When PHMSA first introduced these regulations, the emphasis was on allowing operators to customize required elements of their management programs. The intent was to encourage programs that would be more applicable to individual circumstances and to prompt in-

110 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES novation in areas such as pipeline risk analysis and management. PHMSA has been adding more prescription to the regulations in recent years to ad- dress concerns about the ambiguity of the requirements and to give opera- tors more guidance on how to improve their risk management processes. Meanwhile, HSE and PSA have taken the contrary approach. They have limited the amount of prescription in their macro-means regulations out of concern that too much direction could curb the ambition, capacity, and commitment of operators to take more responsibility for safety. This ap- proach rests on what might be called a corporatist philosophy that regards health and safety as a shared responsibility of the firm, the workforce, and government (Hutter 2001). The varying approaches regulators have taken to defining the requirements of macro-means regulation illustrate how a regulator’s choice of regulatory structure can be affected by a desire to balance various objectives. The structure of a macro-means regulation can affect not only the objective of ensuring that firms are compliant but also the objective of motivating firms to assume direct responsibility for solving the underlying problem (Hutter 2001). One of the structural questions about macro-means regulation concerns whether the regulated firm should be required to submit its management plans for approval or keep them on file for inspection. The case studies illustrate how variations in this aspect of regulatory design can have im- plications for agency staffing. Both the UK safety case and the Norwegian AOC regulations require offshore operators, or “duty holders,” to demon- strate to their respective regulators (HSE and PSA) that their safety plans are based on rigorous analysis before they can begin the planned activity. In contrast, PHMSA’s integrity management regulations do not require advance approval, but inspectors may review the program’s content and execution once the program is in place. As noted earlier in this chapter, preapproval of plans by HSE and PSA can entail a process of intense scru- tiny by the regulators’ technical experts, as well as collaboration with the applicants to strengthen their proposals. To undertake timely and thorough review and collaboration, HSE and PSA maintain a large staff with techni- cal and industry expertise, including proficiency in risk analysis. Because PHMSA’s retrospective reviews of plans do not require the same timely response as a preapproval, the staffing and competency demands on agency personnel are more modest, perhaps in alignment with the agency’s con- strained hiring capabilities. BSEE, which faces similar constraints on the hiring of technical personnel, has designed its SEMS regulation to require third-party audits and certifications of operator programs within 2 years of initial implementation and once every 3 years thereafter. This strategy is intended to help mitigate enforcement problems associated with limited government resources (Coglianese 2010). Lack of clarity in aspects of the management plan may lead to parts

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 111 of the plan being neglected (Haines 2009). Smaller firms, in particular, may struggle with interpretation. One study of the use of risk management plans for hazardous chemicals found that some smaller firms engaged in gaming behaviors to present a false perception of compliance (Chinander et al. 1998). One tactic was to store hazardous chemicals off-site so that the firm technically fell below the threshold for regulation. Risk was increased because some chemicals were being stored in unsafe conditions. Macro-means regulation appears to be associated with a reduction of risks in some settings in which it has been applied. However, research suggests that the behavioral impact of such regulation may be difficult to sustain over a longer period of time as required management planning becomes, for at least some firms, a paperwork exercise (Bennear 2007; Coglianese and Nash 2004; Silbey and Agrawal 2011). One concern with regard to macro-means regulations is what some in the offshore industry call “pencil-whipping”—extensive documentation of the management sys- tem that may have little relation to practice. Management-based regulation may help induce managers to start thinking about previously ignored prob- lems, but once the easier problems have been resolved, ongoing diligence in risk management activities may become more challenging to ensure. Macro-means regulations usually require a governmental oversight presence to ensure that firms conduct the necessary planning and implement their plans (Coglianese 2010). To ensure that approved plans are being followed, HSE and PSA observe the actions and procedures of offshore operators by visiting facilities for extended periods or by integrating agency personnel into operations centers. Officials at the two agencies indicate that this approach requires the employment of personnel with extensive knowl- edge of industry procedures. Audit-like reviews of planning documents and records, which is characteristic of PHMSA’s inspections of operator integrity management programs, do not verify the execution of plans in the same direct manner that, say, inspection of installed safety devices can verify compliance. Regulators who impose macro-means regulation may need to enhance their enforcement capabilities or find effective ways to rely more on government inspectors or third-party auditors. Regulators face a challenge in structuring a management-based regula- tion that can be evaluated for impact. Such an evaluation may be expected by policy makers to justify a form of regulation that, on the one hand, may be perceived as impinging too deeply on a firm’s internal affairs or, on the other, as ceding too much control to firms in the identification, prioritiza- tion, and management of risks. Despite the potentially greater need for justifying macro-means regulations with demonstrable results, their impact in reducing harms associated with infrequent events arising from a diverse, context-specific set of causes can be difficult to discern. That would be the

112 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES case for any form of regulation under these circumstances, but evaluation of the impacts of macro-means regulations poses additional challenges. First, the benefits of this type of regulation can be difficult to isolate. They derive not from anything directly measurable but from whatever ad- ditional improvements are made in management systems. As Dawson et al. (1988) conclude, the creation of health and safety structures and pro- cedures within a company is an “imperfect measure” that does not in itself indicate an improvement in health and safety. Because most firms will have had some management systems in place before the regulation, the relevant benefits will be the marginal risk reductions resulting from any changes in management practices. Most offshore drilling contractors are interna- tional firms subject to macro-means regulations of multiple countries. For example, whether BSEE’s SEMS requirement has led to any consequential changes in the management programs used by a multinational firm based in the United Kingdom, where similar programs have been required for years, can be difficult to ascertain. Second, estimation of the costs of macro-means regulations can be dif- ficult because of the flexibility afforded by this type of regulation. The costs to firms can take two forms: (a) administrative costs related to the planning, analysis, and documentation required and (b) capital and operating costs related to the actions that firms implement as a result of this planning and analysis. Identification and quantification of these costs in advance by the regulator can be complicated, because each firm may respond differently to the management requirements, precisely as the flexibility of this regulatory design allows. Macro-Ends (General Duty/Liability) Regulations As shown in the bottom right-hand cell of Table 4-1 and discussed in Chap- ter 2, macro-ends regulations impose a general duty on firms to achieve safe outcomes; a liability and penalties may result if they do not. The general duty may be stated outright in a regulation, such as the Occupational Safety and Health Administration’s general duty provision calling for the removal of all recognizable workplace hazards. The obligation to achieve safe out- comes may also arise in an ex post manner from more general liability law (e.g., tort law) or as a result of specific statutory liability, such as under the Clean Water Act’s provisions providing penalties for polluting spills. Unlike the other three regulation design types, the legal obligation con- tained in a macro-ends regulation imposes no explicit prospective require- ments, either means or ends, related to any of the nodes or links on the causal pathway leading to the harm. The consequences for the firm follow from the occurrence of the harmful event. Although this form of regulation applies its consequences after the fact, it can create ex ante incentives for

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 113 preventive behavior (Kolstad et al. 1990). In this sense, a macro-ends regu- lation may be viewed as the ultimate form of “performance” regulation. It can cause some firms to identify and control their risks in a systematic and thorough manner. The absence of explicit requirements can raise concern that some firms’ managers may neglect their responsibility. They may accept a calculated risk of some future losses from lawsuits and other penalties, especially if such losses might be ameliorated by insurance or bankruptcy (moral hazard), or if the risk of losses may be discounted because of short-sightedness or the “NIMTOFF” (not in my term of office) tendency (Kunreuther and Meyer 2017). There may also be legal limits on liability for catastrophes, as is the case for nuclear accidents and oil spills. Even without legal caps on liabil- ity, the losses arising from events may be so large that some liable firms in industries consisting of a range of firm sizes may be unable to compensate in full parties claiming damage. These conditions can create an incentive for regulators to augment the macro-ends form of regulation with other types of ends- and means-based regulation to prevent catastrophic incidents from occurring in the first place. Tort and statutory liability constitute macro-ends regulation in the U.S. pipeline and offshore industries. Norway, the United Kingdom, and Canada also have highly developed liability systems for claims from pipeline and offshore oil and gas incidents (Bennear 2015; BIO by Deloitte and Stevens and Bolton 2014). Issues that policy makers and regulators may want to consider in using this form of regulation include the following: • In designing a macro-ends regulation, the main tasks will be to define one or more triggering events and corresponding penalties, liability, or other consequences. Should the triggering event for liability be defined generally (e.g., failing to operate safely or in compliance with regulations) or in terms of specific occurrences (e.g., explosions, injuries)? The latter may help to define (but not necessarily be exclusive of) the former. • Should authorities impose strict liability that requires no showing of fault? Or should liability be based on a showing of negligence? • Should joint and several liability be allowed and, if so, how far should chains of liability run? • What defenses, if any, should be available to firms to excuse them from or to limit their liability? • Should liability be based on a showing of actual damages or be determined on a fixed basis (akin to liquidated damages)? • How readily can damages be quantified? • What role, if any, should insurance play in providing coverage for any liability?

114 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES • Should punitive damages be allowed? • Should liability be capped? • Should criminal liability be available? • For regulated entities that are corporations, should liability be lim- ited to the organization, or should individual officers or directors be subject to civil or criminal liability? Implementing liability is comparatively easy. It does not depend on a routine regimen of inspection and monitoring. A catastrophe that triggers liability will presumably be visible and difficult for a regulated entity to hide. To the extent that liability depends on a showing of fault, the govern- ment will need to have the capacity to build the case for responsibility and the expertise to quantify and monetize the level of harm created. Dispute resolution and claims processing functions may also be needed. One difficulty in evaluating the impact of liability on safety outcomes is the possibility that, even though the consequences of a macro-ends regula- tion do not apply until after an accident occurs, such regulation can create ex ante incentives that may be hard to observe (Kolstad et al. 1990). A fur- ther difficulty lies in finding a counterfactual benchmark to show what hap- pens in cases where such a regime does not exist and then comparing that benchmark with what occurs under the liability regime. Cross-jurisdictional comparisons may provide some insight as to the possible ex ante effects of liability, but other differences between jurisdictions could confound infer- ences about the impact of liability. OTHER FACTORS AFFECTING REGULATORY CHOICE As has been shown, safety regulation entails much more than making a generic choice about which of the four main types of regulatory designs to use for each component of the regulatory program. Within each design, regulators face many important choices concerning how to structure, imple- ment, and evaluate the regulations. Decisions concerning these subsidiary choices will be based on the nature of the problem, the characteristics of the industry, and the capacity of the regulator. In some cases, these sub- sidiary considerations will help determine which main design to deploy. In principle, certain design types may have great appeal, such as those often associated with flexibility, namely micro-ends (performance) regulation or macro-means (management) regulation. However, in some circumstances, consideration of the subsidiary choices discussed above may dampen that appeal and make other regulatory designs more attractive. Regulatory design choices can also be affected by other factors such as requirements of the U.S. federal rulemaking process, including directives governing public engagement and regulatory impact analysis, statutory

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 115 mandates, and the prospects for judicial review. Some of these factors are noted below. Public Engagement As outlined in Box 4-1, U.S. federal regulatory agencies develop rules through a process called “notice and comment” rulemaking. Under this procedure, an agency publishes a proposed rule in the Federal Register, invites the public to submit input on that proposal, and takes any com- ments into consideration in developing its final rule. Beyond this minimal role for public involvement in rulemaking, agencies can involve the public in regulatory decision making in a range of ways. Among them are public hearings, dialogue sessions, and advisory committee meetings. Public input can provide agencies with information helpful in structuring, implementing, and evaluating any of the four types of regulations. For example, regula- tors in the course of developing a means-based regulation may benefit from hearing industry’s comments about existing best practices. They may benefit from hearing community members’ concerns when mandatory ends are selected or the sufficiency of a firm’s management system is assessed. Box 4-1 Overview of U.S. Federal Regulatory Process In issuing regulations, U.S. federal agencies are required to follow a public rule- making process. The Administrative Procedure Act (APA) generally requires agen- cies to provide notice of a proposed rule, solicit public comments on the proposal, and explain how comments were considered before issuing the final rule. An agency’s decision to propose a new rule or modify an existing one may be in- fluenced by statutory requirements; studies and recommendations from agency staff; concerns arising from accidents or problems affecting society; recommenda- tions from congressional committees or federal advisory committees; presidential directives or requests from other agencies; lawsuits; and petitions by citizens, businesses, governments, and interest groups. In following the APA process, an agency in the early stages of rulemaking may publish an “advance notice of proposed rulemaking” in the Federal Register, even before it issues a notice of proposed rulemaking, to solicit early feedback and information from the public.a In developing a proposed rule, most agencies— a Some agencies develop proposed rules through a negotiated rulemaking. Under this pro- cess, the agency invites representatives of affected interests to meetings, where they attempt to reach a consensus on the terms of the proposed rule. If the participants reach an agree- ment, the agency may endorse their ideas and use them as the basis for the proposed rule.

116 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES with the exception of independent agencies such as the Nuclear Regulatory Commission—are required by executive order to analyze the benefits and costs of proposed rules likely to have an annual national economic impact of more than $100 million and to have their analysis reviewed by the Office of Information and Regulatory Affairs (OIRA). Federal regulators must also make allowances for the requirements of other statutes such as the Regulatory Flexibility Act, which effectively requires regulators to take into account how their requirements will affect businesses of different types; the National Environmental Policy Act, which requires environmental impact assessments; and the National Technology Trans- fer and Advancement Act, which requires that the voluntary technical standards of consensus bodies be used whenever practicable. When an agency issues a “notice of proposed rulemaking” in the Federal Register, it formally announces its proposed rule and provides the public with an opportunity to comment.b During the comment period, the agency may hold public hearings to improve understanding of the proposed rule’s coverage and requirements and to provide additional opportunities for interested parties to make statements and submit data. When it drafts the final rule, the agency must explain its reasoning and demonstrate that it has taken the comments, scientific data, expert opinions, and other feedback obtained during the rulemaking process into account. For economically significant rules issued by executive (nonindependent) agencies, the draft final rule must be forwarded again to OIRA for a review that can request additional analysis and lead to further changes to the rule before publication in the Federal Register as a final rule. Once a final rule is published in the Federal Register and takes effect, it can be added to the Code of Federal Regulations. After publication of the final rule, the agency’s attention turns to the practical demands of ensuring compliance. Consideration will likely have been given to compliance during a rule’s development. For example, a regulation that prescribes specific actions by the regulated entity, such as an occupational safety rule requir- ing shop workers to wear protective eyewear, is certain to create compliance and enforcement demands on the regulator different from those of a rule calling for the manufacturer to institute safety management procedures aimed at the more generalized goal of providing a workplace free of hazards. b Agencies place each rulemaking and supporting document (e.g., proposed and final rule, economic or environmental analyses and information collection materials) and all public com- ments received, sometimes including any ex parte communications and late-filed comments, in a public docket. Box 4-1 Continued

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 117 As the case studies indicate, offshore safety regulators in the United Kingdom and Norway strongly believe that their macro-means regulations (i.e., safety case and AOC management-based regulations) demand con- siderable collaboration and trust among regulators, industry, and labor. If such tripartite collaboration is in fact essential—and pursued without op- portunity for direct public participation—this finding warns of a potential issue for the application of a similar regulatory design in the United States. Federal regulators operate under norms that limit communication with just a subset of interested parties. Other transparency rules and procedural constraints can affect the ability of regulatory officials to engage in dialogue with the regulated industry and other interests, including labor, consumer, and environmental representatives. Regulatory Impact Analysis For many significant rules, governmental procedure in the United States requires the conduct of certain types of analyses before a regulatory de- cision. Among the analyses are regulatory impact analysis, cost–benefit analysis, analysis of impacts on small businesses or local governments, and paperwork burden analysis. The requirements for fulfilling each of these analyses may depend on the choice of a regulatory design and on its specific structure. A review of the effects of all of these required processes is not given here, but some implications can be illustrated by reference to the key process requirements of White House regulatory review. Executive Order (EO) 12866 requires that all significant regulatory proposals, includ- ing those with an annual effect on the economy of $100 million or more, contain estimates of the costs and benefits of regulatory alternatives. The estimates must be submitted for review by OIRA, which is in the Office of Management and Budget (OMB).9 OIRA Circular A-4 gives agencies guid- ance concerning how to comply with the regulatory review requirements in EO 12866.10 EO 12866 encourages agencies to design their regulations “in the most cost-effective manner to achieve the regulatory objective” and to “identify and assess alternative forms of regulation.” In particular, the order says agencies “shall, to the extent feasible, specify performance objectives, rather than specifying the behavior or manner of compliance that regulated enti- ties must adopt.” Circular A-4 further encourages agencies to consider ends-based standards: “Because they allow firms to have the flexibility to choose the most cost-effective methods for achieving the regulatory goal, 9 See https://www.reginfo.gov/public/jsp/Utilities/EO_Redirect.jsp. 10 See https://www.federalregister.gov/documents/2003/10/09/03-25606/circular-a-4-regulatory- analysis.

118 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES and create an incentive for innovative solutions, performance standards are generally preferred to design standards.” On the basis of such statements, agencies may find that, all things being equal, OIRA will look more favorably on proposed and final rules taking the form of micro-ends standards, or even those imposing macro-means management requirements. Both of these forms of regulation are likely to be proposed for situations in which the regulated industry is highly heterogeneous. Since firms are expected to act differently to comply with the regulation, the costs and benefits may be difficult to assess with a high level of precision. These variable responses will need to be considered by the regulator and OIRA along with the many other issues presented in this chapter. Statutory Mandates and Judicial Review Since the passage of the National Technology Transfer and Advancement Act of 1995, federal policy has encouraged the use of consensus standards as opposed to standards unique to the government. OMB guidance (Cir- cular A-119) to agencies participating in standard-setting activities speci- fies that such standards should be developed on the basis of performance criteria when appropriate.11 In addition, some statutes direct agencies to use particular types of regulation. For example, the Motor Vehicle Safety Act of 1966’s provision calling for federal automobile safety standards to be written in “objective terms” has long been understood to require that the National Highway Traffic Safety Administration only write micro-ends standards. Agencies must adhere to such statutory requirements, even if con- ditions suggest that another regulatory design would be more appropriate. After a U.S. federal agency issues a final rule, anyone affected by that rule may file a petition in court asking for a review of the rule’s legality. The court’s assessment is made against the underlying statute, all applicable administrative procedures, and, under the “arbitrary and capricious” test, various indicators of reasonableness and reasoned decision making. Under the arbitrary and capricious test, agencies are expected to consider alterna- tives and choose among them on the basis of available evidence or expert judgment. Finally, litigation periodically arises with respect to each of the four types of regulatory designs. The information available to the committee does not allow it to conclude whether one of the four main regulatory types fares better in terms of staving off litigation or withstanding judicial scrutiny. At least until further research can be completed, estimating the 11 See https://www.federalregister.gov/documents/2016/01/27/2016-01606/revision-of-omb- circular-no-a-119-federal-participation-in-the-development-and-use-of-voluntary.

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 119 risk that an agency regulation will be sent back by the courts will pre- sumably continue to necessitate a context-specific inquiry into statutory constraints and the evidence and options before the agency when it issued its regulation. ASSESSMENT The study’s statement of task calls for a review of the advantages and dis- advantages of regulations that are frequently referred to as “prescriptive” and “performance-based” and asks for advice on when safety regulators of high-hazard industries should choose the latter. On the basis of the conceptual framework in Chapter 2 and the case studies in Chapter 3, this chapter has examined several factors that can make a regulatory design and its structural variants more or less advantageous in addressing specific safety problems under a range of implementation conditions. The discus- sion indicates that the degree of advantage and disadvantage exhibited by any regulation design type can depend on the details of its design and the context of its use—that is, the nature of the problem being addressed, the characteristics of the industry being regulated, and the capabilities of the regulator responsible for implementing and enforcing the regulation. Blanket statements about each regulation design type’s pros and cons may offer an apparently attractive set of heuristics to start the decision-making process. However, such statements are apt to be misleading if they are used as a basis for selecting a regulation design type because of the importance of structural details and the context of implementation. As summarized in Chapter 2, the various regulatory designs are associ- ated with certain advantages and disadvantages. The following sets forth some of the claimed advantages by design type: Micro-means (prescriptive) regulations (a) may be easier to follow by regulated firms and to communicate to workers given that the regulations tell firms exactly what to do and (b) may be easier to enforce, for much the same reason. Micro-ends (performance-based) regulations (a) may allow more flex- ibility by different firms in how to meet the regulation with different means and (b) may allow greater opportunities for firms to innovate over time in ways that meet the regulation. Macro-means (management-based) regulations (a) may allow for flex- ibility and opportunities for innovation by firms within the regulated in- dustry; (b) may be used when outcomes are difficult to measure directly;

120 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES and (c) may help infuse a sense of responsibility, accountability, or safety culture into the regulated industry. Macro-ends (general duty/liability) regulations (a) may provide flexibil- ity and opportunities for innovation by firms within the regulated industry and (b) may reinforce other types of regulatory designs as a backstop. Regulatory design types are also often associated with certain disad- vantages. The following sets forth some of the potential disadvantages by design type: Micro-means (prescriptive) regulations (a) may result in less effective or less cost-effective methods of addressing risk at some firms because one size does not always fit all and (b) may not afford regulated entities room to change if they are not updated, even with the availability of more cost- effective risk management strategies or innovations in underlying technolo- gies or processes. Micro-ends (performance-based) regulations (a) may be difficult for the regulator to monitor or establish compliance with and (b) may foster a “teaching-to-the-test” effect or encourage gaming of the performance standard. Under macro-means (management-based) regulations, (a) both the regulated firm and the regulator may need to develop new skills to imple- ment or oversee the regulation effectively and (b) the regulator may have difficulty in monitoring and establishing compliance and in maintaining motivation for continuous improvement. Macro-ends (general duty/liability) regulations (a) may not adequately prevent harms because regulatory consequences are only imposed after an event occurs and (b) may not provide adequate direction to firms that lack knowledge of what to do or lack the incentives to find out. The diversity of claimed advantages and disadvantages indicates the challenge a regulator faces in choosing among regulatory designs. The purported advantages and disadvantages listed above are numerous, and each design type can be said to have its advantages and disadvantages. In addition, the purported advantages and disadvantages of each design are relative to the other designs. The regulator’s task is to determine how well different designs or combinations of designs will work under the constraints and conditions encountered in practice in comparison with other regulatory designs or combinations. All conditions being equal, a micro-means regula-

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 121 tion may be expected to provide less flexibility than a micro-ends regulation while being easier to monitor and enforce. But conditions are not always equal, and comparisons can only be made in the context of the conditions under which a regulation will be applied and in reference to the particular problem it is intended to address. A regulation’s advantages and disadvantages will also depend on how it is structured. A regulation that is micro-ends in character will not nec- essarily provide firms with flexibility. If in a particular context a required end can only be achieved in one way at the present time, an ends-based regulation will be no different from a means-based regulation in terms of the flexibility offered. Ultimately, generalizations about advantages and disadvantages may provide useful guidance for a regulator who is just starting to think about regulatory options. However, generalized claims about the advantages and disadvantages of different regulatory designs cannot adequately substitute for careful analysis of how a regulation will apply in a particular setting. Such analysis, as opposed to general claims, is needed to ensure effective decisions by regulators. In Chapter 5, the application of macro-means safety regulation to high- hazard industries is discussed on the basis of insights from this chapter. In that context, regulators must choose among regulatory designs to develop a regulatory approach that will reduce the risk of low-frequency, high- consequence events. REFERENCES Abbreviations EPA U.S. Environmental Protection Agency PHMSA Pipeline and Hazardous Materials Safety Administration Ashford, N. A., C. Ayers, and R. F. Stone. 1985. Using Regulation to Change the Market for Innovation. Harvard Environmental Law Review, Vol. 9, No. 2, pp. 419–466. Ayres, I., and J. Braithwaite. 1992. Responsive Regulation: Transcending the Deregulation Debate. Oxford University Press, New York. Bennear, L. S. 2006. Evaluating Management-Based Regulation: A Valuable Tool in the Regulatory Toolbox? In Leveraging the Private Sector: Management-Based Strategies for Improving Environmental Performance (C. Coglianese and J. Nash, eds.), Resources for the Future, Washington, D.C. Bennear, L. S. 2007. Are Management-Based Regulations Effective? Evidence from State Pol- lution Prevention Programs. Journal of Policy Analysis and Management, Vol. 26, No. 2, pp. 327–348. Bennear, L. S. 2015. Positive and Normative Analysis of Offshore Oil and Gas Drilling Regu- lations in the U.S., U.K., and Norway. Review of Environmental Economics and Policy, Vol. 9, No. 1, pp. 2–22.

122 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES BIO by Deloitte and Stevens and Bolton, LLP. 2014. Civil Liability, Financial Security and Compensation Claims for Offshore Oil and Gas Activities in the European Economic Area: Final Report. European Commission, DG Energy. Chinander, K. R., P. R. Kleindorfer, and H. C. Kunreuther. 1998. Compliance Strategies and Regulatory Effectiveness of Performance-Based Regulation of Chemical Accident Risks. Risk Analysis, Vol. 18, No. 2, pp. 135–143. Coglianese, C. 2010. Management-Based Regulation: Implications for Public Policy. In Risk and Regulatory Policy: Improving the Governance of Risk (G. M. Bounds and N. Malyshev, eds.), Organisation for Economic Co-operation and Development, pp. 159–183. Coglianese, C. 2016. Performance-Based Regulation: Concepts and Challenges. In Compara- tive Law and Regulation: Understanding the Global Regulatory Process (F. Bignami and D. Zaring, eds.), Edward Elgar, Northampton, Mass. Coglianese, C., and D. Lazer. 2003. Management-Based Regulation: Prescribing Private Man- agement to Achieve Public Goals. Law and Society Review, Vol. 37, No. 4, Dec., pp. 691–730. Coglianese, C., and J. Nash (eds.). 2001. Regulating from the Inside: Can Environmental Management Systems Achieve Policy Goals? Resources for the Future, Washington, D.C. Coglianese, C., and J. Nash. 2004. The Massachusetts Toxic Use Reduction Act: Design and Implementation of a Management-Based Environmental Regulation. Report RPP-07- 2004. Center for Business and Government, Kennedy School of Government, Cambridge, Mass. Coglianese, C., and J. Nash. 2017. The Law of the Test: Performance-Based Regulation and Diesel Emissions Control. Yale Journal of Regulation, Vol. 34, No. 1, Article 1. Dawson, S. P., M. Willman, M. Bamford, and A. Clinton. 1988. Safety at Work: The Limits of Self-Regulation. Cambridge University Press, Cambridge, United Kingdom. EPA. 2012. Final Rule. National Emission Standards for Hazardous Air Pollutants from Coal and Oil-Fired Electric Utility Steam Generating Units and Standards of Performance for Fossil-Fuel-Fired Electric Utility, Industrial-Commercial, Institutional, and Small Indus- trial Commercial-Institutional Steam Generating Units. Federal Register, Vol. 77, No. 32, Feb. 16, pp. 9304–9513. Gunningham, N. 1996. From Compliance to Best Practice in OHS: The Role of Specification, Performance, and Systems-Based Standards. Australian Journal of Labor Law, Vol. 9, pp. 221–246. Gunningham, N., and R. Johnstone. 1999. Regulating Workplace Safety: Systems and Sanc- tions. Oxford University Press, Oxford, United Kingdom. Hahn, R. W. 1989. A Primer on Environmental Policy Design. Harwood Academic Publish- ers, New York. Haines, F. 2009. Regulatory Failures and Regulatory Solutions: A Characteristic Analysis of the Aftermath of Disaster. Law and Social Inquiry, Vol. 34, No. 1, pp. 31–60. Huising, R., and S. S. Silbey. 2011. Governing the Gap: Forging Safe Science Through Rela- tional Regulation. Regulation and Governance, Vol. 5, No. 1, pp. 14–42. Hutter, B. 2001. Regulation and Risk: Occupational Health and Safety on the Railways. Oxford University Press, Oxford, United Kingdom. Kleindorfer, P. R. 1999. Understanding Individuals’ Environmental Decisions: A Decision Science Approach. In Better Environmental Decisions: Strategies for Governments, Busi- nesses, and Communities (K. Sexton, ed.), Island Press, Washington, D.C., pp. 37–56. Kolstad, C. D., T. S. Ulen, and G. V. Johnson. 1990. Ex Post Liability for Harm vs. Ex Ante Safety Regulation: Substitutes or Complements? American Economic Review, Vol. 80, No. 4, pp. 888–901.

CONSIDERATIONS FOR CHOOSING A REGULATORY DESIGN 123 Kunreuther, H., and R. Meyer. 2017. The Ostrich Paradox: Why We Underprepare for Di- sasters. Wharton Digital Press. May, P. J. 2003. Performance-Based Regulation and Regulatory Regimes: The Saga of Leaky Buildings. Law and Policy, Vol. 25, No. 4, pp. 381–401. May, P. J. 2011. Performance-Based Regulation. In Handbook on the Politics of Regulation (D. Levi-Faur, ed.), Edward Elgar, pp. 373–384. Moynihan, D. P. 2017. Performance Principles for Regulators. In Achieving Regulatory Excel- lence (C. Coglianese, ed.), Brookings Institution, Washington, D.C., pp. 273–290. Perrow, C. 1984. Normal Accidents: Living with High-Risk Technologies. Princeton University Press, Princeton, N.J. PHMSA. 2014. A Study on the Impact of Excavation Damage on Pipeline Safety. U.S. Depart- ment of Transportation, Washington, D.C. Reason, J. 1997. Managing the Risks of Organizational Accidents. Ashgate, Aldershot, England. Silbey, S. S., and T. Agrawal. 2011. The Illusion of Accountability: Information Management and Organizational Culture. Droit et Société, No. 77. Silbey, S. S., and P. Ewick. 2003. The Architecture of Authority: The Place of Law in the Space of Science. In The Place of Law (A. Sarat, L. Douglas, and M. Umphrey, eds.), University of Michigan Press, Ann Arbor, pp. 75–108. Stavins, R. N. 1998. What Can We Learn from the Grand Policy Experiment? Lessons from SO2 Allowance Trading. Journal of Economic Perspectives, Vol. 12, No. 3, pp. 69–88. Viscusi, W. K. 1983. Risk by Choice: Regulating Health and Safety in the Workplace. Harvard University Press, Cambridge, Mass.