Designing Safety Regulations for High-Hazard Industries (2018)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

5 Designing Macro-Means Safety Regulation in High-Hazard Industries When regulators have decided to develop a regulation, they must assess the advantages and disadvantages of various regulatory designs for their policy purposes. The study committee was asked to help inform and advise regula- tors as they make such assessments. In particular, the committee was asked for its advice with respect to the use of regulations that call for management systems to supplement the use of traditional “prescriptive” regulations to promote safety in high-hazard industries such as the pipeline and offshore oil and gas sectors. This chapter begins with a brief review of the preced- ing chapters of this report and a recap of why the committee has adopted the label “macro-means” for regulations that require firms to establish and maintain safety management systems. The chapter then proceeds to exam- ine challenges that U.S., Canadian, and North Sea pipeline and offshore safety regulators have faced in using this type of regulation to address the prevention of low-frequency, high-consequence events. Their experiences suggest important reasons for and practical considerations in the use of such regulations by any safety regulator. The chapter concludes with ob- servations and advice applicable to regulators of all high-hazard industries. RECAP OF REASONING AND FINDINGS OF REPORT Chapter 2 provided a conceptual framework for characterizing and compar- ing regulation design types, including those calling for the use of manage- ment systems. The terms “prescriptive” and “performance-based,” which are used in the study charge, were shown to be ambiguous and often mis- leading. In particular, the term “performance-based” is misapplied when it 124

DESIGNING MACRO-MEANS SAFETY REGULATION 125 is used to describe regulations that require firms to establish management systems. Such regulations are not performance-based in the traditional sense of obligating firms to meet or avoid specified outcomes through means of their choice. On the contrary, by requiring the use of management systems, these regulations specify the means to be used rather than the outcomes to be achieved. In this report, regulations that require management systems are called “means-based,” because the prescribed systems are the means by which a firm is expected to ensure safety. The label “macro-means” is used be- cause the management systems such regulations require aim directly at the ultimate problem of catastrophic risk. They are intended to direct a firm’s managers to plan, analyze, and manage in a more comprehensive manner with the ultimate goal of safety in mind. The analysis and planning required by most macro-means regulations are intended to increase the industry’s awareness of risk factors and sources, including failure of technology, hu- man error, and the interactions between technology and human behavior. In addition, macro-means regulations call on firms to develop plans, practices, or procedures to address both technological and human risk factors and then to keep track of compliance with those procedures, report on progress, and periodically reevaluate and improve internal risk management efforts. In considering the use of macro-means regulation in high-hazard in- dustries, the committee examined the pipeline and offshore oil and gas industries in the United States, Canada, Norway, and the United Kingdom. The case studies in Chapter 3 showed how regulators in all four countries have adopted a combination of regulatory designs to address the range of safety risks arising in each industry. Some of these risks are well known and can be addressed with highly targeted and trusted interventions; others arise from the complexities of individual facilities, operations, and practices. To address the latter risks, pipeline and offshore safety regulators across the four jurisdictions use macro-means regulations to require firms to create management plans and establish customized internal programs for manag- ing the specific risks created by those firms’ facilities and operations. Chapter 4 explained how regulators can decide when to use macro- means or other regulation design types and how they can structure any given regulation falling within a design type in various ways. General observations about the advantages and disadvantages of regulation design types can be misleading because they can overlook differences in the condi- tions under which any individual regulation will be applied and can fail to account for the various ways of structuring a specific regulation within any of the four main design types. Nevertheless, as observed in the case studies, high-hazard industries do share some conditions that appear to have led dif- ferent safety regulators to adopt regulations with general similarities in their designs. Across the two high-hazard industries and all jurisdictions studied,

126 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES regulators use both micro-means and micro-ends design types. However, because the sources of catastrophic risk associated with high-hazard in- dustries are varied and context-specific, regulators supplement micro-level regulations with macro-means regulations that require the establishment of safety management programs customized to each firm’s facilities, operating procedures, management capacities, and environmental setting.1 The case studies show differences as well as commonalities in how macro-means regulations are structured. For example, to a greater degree than in the United States, regulators in Europe require firms to subject their facilities’ management plans to an extensive review by the regulator before the commencement of operations and periodically thereafter. This process is known as a “safety case.” As discussed in Chapter 4, safety case regulation is one way of structuring macro-means regulation. The burden of demonstrating the adequacy of a firm’s management analysis and planning to the regulator is placed on the firm, as opposed to the regulator having to demonstrate the inadequacy of a firm’s required analysis and planning. Structural differences like this affect not only how a regulation performs in practice but also what advantages and disadvantages it will exhibit. As Chapter 4 indicated, relevant conditions include the nature of the specific problem or threat to safety that needs to be addressed, specific industry characteristics and capacities, and the resources and capabilities of the regu- lator and its organization and personnel. Because of these context-specific variations, general propositions about the pros and cons of any regulatory design must be qualified to take account of the relevant structural features of a regulation falling within that design type and the conditions under which it will be applied. In the sections that follow, consideration is given to the reasons U.S., Canadian, and North Sea pipeline and offshore safety regulators have set forth for adopting macro-means regulations and to the challenges they have faced in implementing and enforcing these regulations. RATIONALE FOR USING MACRO-MEANS REGULATION IN HIGH-HAZARD INDUSTRIES Safety regulators of all high-hazard industries are expected to reduce the occurrence of low-frequency, high-consequence events, whose risks can arise from the interaction of many context-specific factors. The complex- ity inherent in high-hazard activities, combined with the low frequency of catastrophic incidents, limits a regulator’s ability to use highly targeted, 1 As has been observed previously by Bennear (2015), the combining of regulatory design types by regulators of high-hazard industries has evolved over time, which suggests conver- gence toward this pattern but not necessarily inevitability.

DESIGNING MACRO-MEANS SAFETY REGULATION 127 micro-level regulatory designs because of the impracticality of ensuring that each possible causal pathway to catastrophe has been taken into account. Many sources of risk that are common among firms in high-hazard indus- tries are susceptible to regulation; the use of macro-means regulation can be viewed as a way of addressing the residual risk created by factors that are unknown to the regulator and that can arise from interactions. Macro- means regulation can thus serve as a backstop strategy for addressing the residual risk not covered by micro-level regulation as well as the risk cre- ated by the interaction of facets of an industrial operation. As this section explains, the same complexity and relative rarity of catastrophic events that may help justify the use of macro-means regulation can present challenges in their implementation. As Chapter 3 showed, regulators of high-hazard industries have aug- mented micro-level rules with macro-means regulations. Requiring manage- ment activities, though, does not assure the regulator or regulated industry that these activities actually reduce the risk of catastrophic events. Require- ments for risk analysis and the development of management programs do not necessarily even demand that such programs, once established, lead to a demonstrable end state of improved safety. With respect to high-hazard industries, of course, the absence of such a binding performance metric is understandable because catastrophic incidents are rare to begin with, and any requirement for a program to achieve a demonstrated reduction in the frequency of these incidents would be impractical. In assessing the impact of any regulatory intervention, regulators must seek an understanding of the causal relationship between the interven- tion and reductions in risk. For regulation aimed at low-frequency, high- consequence events, such causal relationships may be harder to identify, but trends and patterns in the occurrence of more frequent, lower-consequence incidents may provide insight into changes in catastrophic risk. In addition, the regulator may monitor conditions and events believed to be indicative of catastrophic risk, such as reports of conditions known to be associated with failures, operator errors, and so-called “precursor” and “near-miss” events. The aim is to capture relevant data that will allow quantitative methods of risk analysis to inform decisions about future regulatory interventions or modifications in existing interventions, such as changes in required risk management plans and programs. Examples of such quantitative methods are provided in Box 5-1. The importance of collecting and analyzing data to develop a better un- derstanding of the regulatory problem—reducing the risk of low-frequency, high-consequence events—is recognized in the pipeline and offshore oil and gas sectors. The Bureau of Safety and Environmental Enforcement (BSEE), which oversees offshore safety in the United States, has enlisted the U.S. Department of Transportation’s Bureau of Transportation Statistics

128 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES to develop and manage a voluntary and confidential near-miss reporting system.2 BSEE’s plan is for information provided by this database to be shared with industry and the public to help identify safety issues in their incipiency, guide regulatory decisions, and aid operators in developing and implementing their safety management programs. Other data collection examples can be found in the surveys of offshore workers that Norway’s Petroleum Safety Authority (PSA) conducts and in its efforts to analyze reports of certain types of precursor incidents (e.g., losses of well control, fires and explosions, and gas leaks) to identify areas that need more regula- tor and operator attention. Despite such efforts (including the use of methods described in Box 5-1), confirming the risk-reducing effects of regulatory actions remains problem- 2 See https://near-miss.bts.gov. Box 5-1 Risk Analysis for Low-Frequency, High-Consequence Events Quantitative risk assessment methods for low-frequency, high-consequence events have been developed and discussed over the past three decades in both the general risk analysis literature (Kunreuther 1994; Waller and Covello 1984) and the petroleum engineering risk analysis literature (Threadgold 2011). Traditional technical methods for using data, modeling assumptions, and under- standing of complex system architectures to estimate the risks of rare but high- consequence failures and the effects of preventive measures include probabilistic risk assessment (Modarres 2006; Oldenburg and Budnitz 2016), Bayesian belief networks (Luxhøj and Coit 2006), and Monte Carlo simulation techniques (Mignan et al. 2014). Within probabilistic risk assessment, Bayesian methods for analyzing accident precursor events and near misses and hierarchical analysis in modeling uncertainties about local conditions and failure rates have been well established as useful approaches for risk assessment when adequate data are available (El-Gheriani et al. 2017; Yi and Bier 1998). More recently, deep learning methods and related machine learning tech- niques for predictive maintenance using sensor data have been developed (Liao and Ahn 2016; SAP 2017). They promise to enable system owners and opera- tors to make better use of available sensor log data in detecting and applying predictively useful patterns to quantify failure risks and recommend preventive risk management interventions. Commercial deployment and empirical evaluation of the performance of these methods in the oil and gas industry are under way. Such big-data, machine learning methods may help meet the technical chal- lenges of predicting and evaluating how preventive actions affect the probability distributions for times-to-failure and hazard functions for occurrence rates of rare, high-impact events.

DESIGNING MACRO-MEANS SAFETY REGULATION 129 atic because of variability and uncertainty in the sources of risk—the very reasons why management programs can be a relatively attractive regula- tory option. On the basis of a formula weighting the safety data it collects, Norway’s PSA has created (as discussed in Chapter 3) a composite indicator of major accident risk. The indicator suggests that the likelihood of a major accident in the country’s oil and gas sector has been reduced by about 50 percent over the past decade. The low frequency of major accidents has precluded verification of the accuracy of PSA’s estimate. Even if the estimate of risk reduction offered by this index is accepted, how much (if any) of that reduction can be causally attributed to PSA’s macro-means regulation is unclear. PSA’s risk reduction calculation was one of only a few estimates that the committee could find purporting to support a claim about the risk-reducing effects of a regulatory regime that requires safety management plans and programs. In a related context, Coglianese and Lazer (2003) report insur- ance industry data showing a 40 percent decline in damage claims during roughly the 10-year period following the adoption of macro-means regu- lations by the Occupational Safety and Health Administration to address incidents at major chemical facilities. Coglianese and Lazer also report data indicating at least some initial decline in cases of foodborne illnesses after the adoption of federal macro-means food safety regulation and in reported toxic pollution after the introduction of state-level macro-means environmental regulation. However, as the authors acknowledge, caution is required with regard to inferring any causal connection between the macro- means regulations and improvements in these measures. Bennear (2007) offers the only study of which the committee is aware that can support a causal connection between macro-means regulation and an improvement in regulatory outcomes. Bennear analyzed more than 30,000 regulated manufacturing facilities in the United States. She com- pared levels of toxic chemical emissions from facilities located in states with macro-means pollution prevention regulations with emissions from facilities in states without these regulations. After controlling for other factors, she estimated that facilities in states with macro-means regulations reduced their emissions by about 30 percent compared with facilities in states without these regulations. Such evidence suggests that, under some circumstances, macro-means regulations can achieve regulatory objectives. Despite such evidence and the theoretical reasons why macro-means regulation appears to be well suited to addressing the complex sources of risk that give rise to low-frequency, high-consequence events, the extent to which such regulation will yield safety improvements in any particular high-hazard setting remains uncer- tain. As noted in Chapter 4, not all macro-means regulations are structured uniformly, nor are they applied under uniform or static conditions. PSA’s

130 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES macro-means regime, like others that require management programs, has a particular structure and is implemented under conditions that may not exist elsewhere. Indeed, the case studies indicate considerable variability in regulatory structures and conditions. Thus, acceptance of PSA’s calculations that its macro-means regulations have reduced the risk of catastrophes does not mean that a comparable level of risk reduction can be expected from the application of such a regulatory design in other contexts. According to Bennear’s 2007 study of macro-means pollution regulations in the United States, facilities in states that had adopted these regulations were no longer showing any statistically significant improvements after 6 years, which sug- gests either that conditions can change or that the effectiveness of macro- means regulations can decline over time. A question that some observers have raised concerning management regulation is whether all the attention paid to system-level thinking will undercut or slow progress in achieving risk reduction through other means, such as more creative thinking or more effective communication (Ely and Meyerson 2010). For example, if the most important causes of catastrophes are neither linear nor hierarchical but more chaotic, the regulator may want to consider the possibility that requirements for linear and hierarchical management activities will prove ineffectual or even counterproductive. This report does not examine the safety effectiveness of macro-means regulation generally or provide answers to questions about its efficacy in addressing different causes of catastrophic risk. These are legitimate can- didates for further research, especially as experience with macro-means regulation grows. The focus of the report has been on providing regulators with an understanding of the factors they will need to consider as they de- cide whether to use macro-means regulation with its many structural vari- ants. Designing and implementing a macro-means regulation to address the problem of catastrophic risk can be challenging, or even futile, if conditions such as industry characteristics and regulator enforcement capabilities are not supportive. Some of the challenges are discussed in greater detail below on the basis of examples from the case studies in Chapter 3. USE OF MACRO-MEANS REGULATION IN HIGH-HAZARD INDUSTRIES WITH VARIED CHARACTERISTICS Chapter 3 set forth case studies of two high-hazard industries: pipeline transportation and offshore oil and gas development. Other high-hazard industries, which the committee did not study in similar detail, are also subject to safety regulation. Among them are chemical manufacturing, air transportation, and nuclear power. Regulators face many of the same con- siderations in designing safety regulations for other high-hazard industries as those that have been raised throughout this report, as briefly noted in

DESIGNING MACRO-MEANS SAFETY REGULATION 131 Box 5-2. One of the considerations in selecting and structuring macro- means regulation in any industry will be the characteristics of the firms within that industry. As discussed in Chapter 4, the level of diversity or heterogeneity among the firms within an industry can affect the applicability of any regula- tory design type. Heterogeneity can be characterized along a number of dimensions. Chapter 4 emphasized how heterogeneity in facility design and operation can sometimes provide a justification for a macro-means approach, especially when difficulties in monitoring and enforcing outputs make ends-based regulation unworkable. Macro-means regulation does not depend on uniform facility design and operation, and its flexibility often makes it a promising option when firms exhibit a high level of diversity in technological design and organizational operations. Firms in a regulated industry may differ not only in their facilities, tech- nologies, and operations but also in their size and in their managerial and analytic sophistication. For example, firms in the pipeline industries of the United States and Canada range from multinational corporations operating transcontinental oil and gas transmission pipelines to public utilities operat- ing local gas distribution networks. All of these systems, even small utilities (because of their proximity to concentrations of people), have the potential for catastrophic events. However, the different capacities of smaller and larger pipeline operators often lead to different views about the practicality and utility of macro-means regulations. Small operators are more resistant to the adoption of regulations re- quiring safety management programs. They sometimes complain about the lack of specificity in macro-means regulations, which they claim leads to uncertainty and unpredictability about the actions they are expected to take. They also claim that they do not possess and cannot readily acquire the specialized technical and management competencies in some areas, such as risk analysis, needed to develop and implement the required management activities. Smaller operators reportedly tend to prefer micro-means regula- tions that give them clear direction. They view the terms “prescriptive” and “one-size-fits-all” as somewhat positive rather than altogether nega- tive descriptors of regulation. Operators of larger and more varied pipeline systems usually have more of the capabilities needed to conduct the risk analysis and internal planning called for by macro-means regulations. They tend to favor these regulations because of the flexibility offered in the tech- nological and operational means of reducing risks. Even for these opera- tors, if a macro-means regulation contains too many prescriptive demands about program elements and their execution, the flexibility benefits may be diminished and the regulation’s perceived advantages may be reduced. The offshore case studies also show how the degree of operational and technological complexity can affect the applicability and appeal of

132 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Box 5-2 Safety Regulation in the Nuclear and Chemical Sectors The nuclear and chemical sectors, which were not included as case studies in this report but were addressed in presentations to the committee, are high-hazard industries that raise societal concern about catastrophic accidents. Their regula- tion can be examined on the basis of the conceptual framework developed in this study. The U.S. Nuclear Regulatory Commission (NRC) is responsible for promot- ing the safety and security of commercial nuclear power plants, other commercial nuclear facilities, and commercially used nuclear materials. The commission relies extensively on micro-means as well as macro-means regulations as part of its Reactor Oversight Process (ROP), which applies to the country’s 100 nuclear power plants.a The ROP uses input from NRC inspectors, at least two of whom are permanently posted at each plant, as well as “performance indicator” data from the operators of the reactors. As part of the ROP, the safety culture of the licensee is evaluated. Licensees are expected to require a “questioning attitude” in their employees, who are expected to be able to question management decisions. Information from inspections is used to establish whether a more thorough risk assessment and additional inspections are necessary. Accordingly, NRC’s regula- tory work depends on the quality of its inspectors and technical staff. In addition, there are about 20,000 nuclear materials licensees in the United States. Because of the high number of entities and the significantly smaller risks they pose, NRC has agreements that delegate regulatory authority to state safety agencies, whose regulation tends to be more micro-level in its orientation. The chemical sector has a significant degree of heterogeneity, which can affect the applicability of regulation design types. In the European Union, for example, the same regulatory frameworkb that is applied to large petrochemical companies and oil refineries is applied to more varied manufacturing companies that use chemicals for cleaning, fuel, and manufacturing processes. Large mul- tinational corporations often have significant in-house expertise in engineering, risk analysis, and planning, whereas smaller companies may be dependent on consultants and third parties for these functions. These differences are relevant to the ability of firms to comply with regulations as well as to perceptions about the practicality and utility of a particular regulatory design. For these reasons, the Eu- ropean chemical sector is regulated through a mix of regulatory designs, including macro-means regulations requiring management systems and safety cases and a collection of micro-means and micro-ends regulations targeting specific risks. a See https://www.nrc.gov/reactors/operating/oversight/rop-description.html. b Control of major accident hazards involving dangerous substances (“Seveso III Directive”) (http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012L0018).

DESIGNING MACRO-MEANS SAFETY REGULATION 133 regulations requiring management programs in the high-hazard domain. Norway’s offshore regulators were among the first to adopt regulations requiring management programs in response to the installation of massive and complex production facilities to accommodate the harsh weather and marine conditions of the North Sea. The Norwegian regulators realized that these facilities presented risks that could not be targeted solely by adding more detailed micro-level regulations. They responded by making funda- mental changes in their country’s regulatory regime to emphasize safety management planning by offshore operators. As discussed in Chapter 3, the disproportionate representation of large, multinational firms in Norway’s offshore oil industry was relevant to this decision. Oil and gas exploration and production activity in U.S. waters is more varied. It is carried out in many smaller, simpler facilities in shallow waters and a small but growing number of more complex, technologically sophis- ticated facilities in the deeper areas of the Gulf of Mexico. The country’s offshore safety regulatory regime reflects this diversity in that it consists of a mix of micro- and macro-level regulations, with more of the former. The continued presence of many long-standing micro-means regulations may be viewed as undercutting the flexibility afforded by the more recent addition of macro-means regulations that require management systems. However, micro-level regulations may be more appropriate for the hundreds of op- erators that have not experienced dramatic changes in technology and op- erational complexity and whose facilities and operations are more uniform and better understood by regulators. These situational differences illustrate how a macro-means regula- tion can be affected by the characteristics of the industry being regulated. Heterogeneity in the technologies, facility designs, and operational and behavioral practices within an industry may justify the use of macro-means regulation. Heterogeneity in firm size and managerial capacities can make this form of regulation more challenging or even questionable. USE OF MACRO-MEANS REGULATION IN HIGH-HAZARD INDUSTRIES BY REGULATORS WITH VARIED CAPABILITIES Five safety regulators were studied in this report. The U.S. Pipeline and Hazardous Materials Safety Administration (PHMSA) and Canada’s Na- tional Energy Board (NEB) were reviewed in the pipeline case studies. BSEE, Norway’s PSA, and the United Kingdom’s Health and Safety Execu- tive (HSE) were reviewed in the case studies of the offshore oil and gas industry. The regulations administered by these five regulators provide a rich set of examples of regulation design types and insight into how each regulator’s capabilities can affect the suitability of regulatory design choices. All five regulators use macro-means regulations requiring operators

134 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES to establish management programs, but the regulations are structured in different ways. BSEE’s and PHMSA’s macro-means regulations have promi- nent roles in their regulatory regimes, but they are clearly supplemental to a larger collection of micro-means and micro-ends regulations that target individual sources of risk. In contrast, HSE’s and PSA’s regulations requir- ing management plans and programs are central features of their regimes, despite these requirements being accompanied by macro-ends (liability) regimes and by many micro-means and micro-ends requirements found in regulations, guidance documents, and referenced industry consensus standards. In regulating interprovincial pipelines, Canada’s NEB relies on macro-means regulation more than PHMSA does, but it too enforces many micro-level regulations. Macro-means regulation was made central to HSE’s and PSA’s offshore safety regimes more than two decades ago. In doing so, officials made calcu- lated decisions to overhaul their regulatory programs in ways that they be- lieved would support and complement the new regulatory approach. Both agencies changed their compliance and enforcement strategies to emphasize greater collaboration with regulated operators. In turn, operators were given the responsibility, in consultation with workers, to develop their own risk management plans and programs and make a convincing argument—or “safety case”—that the plans would be executed and would prove effective. Rather than reviewing each operator’s proposed management plan strictly with regard to compliance with regulatory provisions, HSE and PSA review the proposed plans and then meet with operators to offer ideas on how to improve them. In this respect, the regulators view themselves as joint problem solvers with industry, and that view extends to the role government officials play in enforcement.3 UK and Norwegian regulators deploy teams of skilled personnel to operators’ facilities, and team leaders meet with facility managers to verify that the actions promised in plans are being taken. Before they issue citations for observed instances of noncom- pliance with the approved management plans, the regulators try to work with operators to resolve any deficiencies. HSE and PSA illustrate how their organizations’ capabilities can be integral to the functioning of regulations requiring management programs. Both regulators had determined that, to implement a macro-means regu- latory approach, they would need to make major changes in personnel. “Checklist” inspectors would be phased out in favor of engineers and other subject matter experts with the skills to oversee macro-means regulation. This meant that the regulator needed staff capable of reviewing proposed 3 This collaborative approach is considered in various forms in the scholarly literature. For examples, see Coglianese and Kagan 2007; Huising and Silbey 2011; Thomas and Hawkins 1984.

DESIGNING MACRO-MEANS SAFETY REGULATION 135 management plans, consulting with operators on needed improvements, and identifying and proposing solutions to gaps in execution. Significantly, each country’s elected officials granted the regulators the freedom and re- sources to make these supportive changes, including the ability to adopt a regulatory approach that emphasizes collaboration among regulators and regulated entities. In this regard, policy makers have accepted the notion of collaboration among directly affected parties in the setting of risk manage- ment priorities and deemphasized public openness and participation in that process. The existence of routines for consultation with offshore workers through unions and other labor representatives adds some openness and transparency to the collaborative process. However, the safety case docu- ments produced under the macro-means regulations in the North Sea are not publicly available, and there is little opportunity for direct engagement with members of the general public. The structuring and implementation of management regulations in the U.S. offshore and pipeline sectors have occurred under legal and in- stitutional conditions different from those of the North Sea countries. For example, U.S. safety regulators must follow well-defined administrative procedures for issuing regulations. They must share certain regulatory responsibilities with state governments and even sometimes with private organizations when statutes contain citizen-suit provisions—all of which can affect a federal regulator’s flexibility in enforcement methods. The con- ditions in Norway and the United Kingdom that supported policy makers and regulators in adopting a highly collaborative approach with industry and labor do not exist in the United States (Kagan and Axelrad 2000). North Sea regulators have a much smaller number of regulated entities to oversee than do regulators in the United States, and the former inhabit more tightly bound social networks that appear to reinforce compliance within a more collaborative regulatory environment. U.S. regulators have structured and implemented their approach to macro-means regulation differently, in a manner reflecting the conditions under which they operate. The U.S. regulatory approach does not generally involve a high degree of collabora- tion, and implementation by U.S. regulators of macro-means regulation in the same manner as the North Sea countries would be impractical. For example, the much greater number of regulated facilities would require greater resources and time if a safety case approach to regulation were ap- plied in the United States. Whether the U.S. or North Sea regulatory approaches are more ef- fective in promoting offshore safety was not considered in this report. An assessment of the effectiveness of any jurisdiction’s regulatory approach was not part of the study charge. Furthermore, the infrequent occurrence of catastrophic events would make any assessment based on such events impractical for the committee within the parameters of its charge.

136 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES Consideration of the applicability of macro-means regulation based on conditions existing in the regulatory setting may be a more tractable approach. In this regard, PHMSA’s implementation of its integrity man- agement (IM) requirements and BSEE’s implementation of its safety and environmental management systems requirements could indicate several challenges associated with each regulator’s capabilities and constraints. Some are common among U.S. regulatory agencies; others are specific to these regulators. For example, one regulator-specific constraint affecting implementa- tion of a macro-means regulation is PHMSA’s current need to rely on state personnel to enforce compliance with its gas distribution integrity manage- ment program (DIMP) regulations. DIMP regulations require operators to develop, write, and implement an IM program that, among other things, evaluates and prioritizes risks, identifies and implements measures to ad- dress risks, and monitors and evaluates results. Because of the operator- specific nature of this planning and its execution, physical inspections of equipment and facilities must be supplemented with audit-like reviews of operator records. PHMSA has issued an 11-page inspection form concern- ing DIMP audits for the guidance of state agencies,4 which are likely to encompass a wide range of inspection resources and capabilities simply because of their large number. The approximately 50 questions on the form focus on whether certain required program elements are present in the operator’s written plan rather than on more holistic assessments of the quality of the program and its execution. Inspectors are asked to give mostly yes/no answers to questions such as the following: “Do the written procedures contain the method used to determine the relative importance of each threat and estimate and rank the risks posed?” “Has the operator demonstrated an understanding of its system?” “Were commercially avail- able product(s)/templates used in the development of the operator’s written integrity management plan?” If PHMSA had the staff to perform all DIMP inspections, or if it could reasonably expect all state enforcement partners to perform in a manner comparable with that of the most qualified states, the protocols might be more demanding. For example, to guide PHMSA’s personnel in reviewing the IM programs of interstate gas transmission systems, the agency has developed a 132-page inspection manual.5 Clearly, that manual offers con- siderably more detailed guidance than does the 11-page checklist form for DIMP inspections. A likely reason for the shorter form is that the DIMP requirements themselves are less complicated than the IM requirements ap- 4 See https://primis.phmsa.dot.gov/dimp/docs/Form_22_PHMSA_DIMP_InspectionForm_192.1005_ Operators.pdf. 5 PHMSA Gas Integrity Management Inspection Manual: Inspection Protocols with Results Forms, August 2013 (https://primis.phmsa.dot.gov/gasimp/documents.htm).

DESIGNING MACRO-MEANS SAFETY REGULATION 137 plicable to transmission systems. However, the two protocols also differ in quality. The 132-page manual does not merely call for yes/no answers about whether certain program elements are contained in the operator’s plan. PHMSA’s IM auditors are expected to make more sophisticated assess- ments of the content of the program by reviewing records and conducting interviews. For example, audit teams are asked to verify that the operator’s threat identification has considered interactive threats, that risk assessments were revised as necessary as new information was obtained or conditions changed on the pipeline segments, and that the operator has checked the data for accuracy. Audit teams are instructed to review operator records to the point where they can achieve an “adequate understanding regarding the degree of an operator’s commitment to compliance with applicable require- ments and/or the degree to which the operator’s program has been effective with respect to achieving compliance.”6 It is unclear whether the more thorough audit protocol for pipeline transmission systems is better suited to the enforcement of PHMSA’s macro- means IM regulations than the simpler DIMP checklist used by state inspec- tors. PHMSA likely believes that the former is superior in at least some respects; otherwise, it would have required a simpler protocol for its own auditors. The simpler protocol was apparently introduced in part because PHMSA recognized that not all of its state partners could be expected to conduct such detailed audits, given the diversity of their technical compe- tencies and resources. This aspect of PHMSA’s experience in implementing IM regulations provides another example of the importance of considering underlying conditions in assessments of the applicability of different types of safety regulations. It illustrates further the ambiguous and potentially mislead- ing nature of terms such as “prescriptive” and “performance-based.” If a regulator lacks the resources—in terms of budget, personnel levels, or staff skills—to oversee macro-means regulation, that regulatory design cannot be expected to deliver as many safety advantages as what might be needed. OTHER MACRO-MEANS ISSUES DESERVING ATTENTION Macro-means regulation can be an attractive regulatory design for high- hazard industries with complex and diverse sources of catastrophic risk. However, as the previous sections suggest, regulators cannot assume that it will be a good fit under all circumstances. In some cases, achieving the best fit will mean modifying the structure of the macro-means regulation to suit the circumstances. In others, it will mean modifying some of those circumstances—especially with respect to enhancing the resources and ca- 6 PHMSA Gas Integrity Management Inspection Manual: Inspection Protocols with Results Forms, August 2013, p. 3.

138 DESIGNING SAFETY REGULATIONS FOR HIGH-HAZARD INDUSTRIES pabilities of the regulator. The regulator will want to consider many issues in structuring a macro-means regulation consistent with the regulator’s own implementation capabilities. Several points that were discussed in Chapter 4 bear highlighting: • The regulator will want to develop the capability to assess the quality of a firm’s management plans in terms of criteria such as comprehensiveness, degree of efficacy, adequacy of internal moni- toring and controls, and commitment to implementation and im- provement over time. • The regulator will want to assure a strong connection between what a firm’s management plan calls for and what actually happens at a complex facility. The regulator must keep in mind the possibil- ity that the threat of harsh punishment of a firm’s failure to comply with internal plans or to meet internally adopted goals may lead firms to establish less ambitious goals or to plan less rigorously. • The regulator will want to be able to assess a firm’s seriousness in sustaining high-quality management to ensure that its management requirements do not become routinized and that its planning does not turn into empty paperwork exercises. There is evidence that safety vigilance tends to taper off irrespective of regulatory design. Because the implementation of management systems cannot be directly observed in the same manner as micro-means standards, efforts to prevent such slippage over time may be particularly im- portant for this form of regulation. • The regulator will want to be attentive to the possibility of some firms taking advantage of the operational flexibility afforded by macro-means regulation. They may seek to hide or they may con- veniently overlook hazardous practices or conditions. They may create internal plans with diffused and vague requirements that are largely facades masking resistance to high-quality safety practices. • The regulator will want to be aware of how other types of regula- tions governing the same problem and the same firms might affect the success of macro-means regulation and seek to make those other regulations complementary rather than obstructive. For ex- ample, a firm’s planning efforts under a macro-means regulation might result in promising ideas for addressing safety risks, but ex- isting micro-level regulations demanding actions incompatible with these ideas may diminish the value of macro-means regulation. In addition, the interaction between macro-ends regulation and macro-means regulation should be considered. The background threat of liability in the event of a catastrophe may motivate a firm to plan more carefully, but the possibility of a firm’s internal plans

DESIGNING MACRO-MEANS SAFETY REGULATION 139 being used against it in a subsequent action for liability could have the opposite effect of causing the firm to plan less ambitiously. REFERENCES Bennear, L. S. 2007. Are Management-Based Regulations Effective? Evidence from State Pollution Prevention Programs. Journal of Policy Analysis and Management, Vol. 26, No. 2, pp. 327–348. Bennear, L. S. 2015. Positive and Normative Analysis of Offshore Oil and Gas Drilling Regu- lations in the U.S., U.K., and Norway. Review of Environmental Economics and Policy, Vol. 9, No. 1, pp. 2–22. Coglianese, C., and R. A. Kagan. 2007. Regulation and Regulatory Processes. Ashgate Publish- ing. Farnham, U.K. Coglianese, C., and D. Lazer. 2003. Management-Based Regulation: Prescribing Private Man- agement to Achieve Public Goals. Law and Society Review, Vol. 37, No. 4, Dec., pp. 691–730. El-Gheriani, M., F. Khan, D. Chen, and R. Abbassi. 2017. Major Accident Modelling Using Spare Data. Process Safety and Environmental Protection, Vol. 106, pp. 52–59. Ely, R. J., and D. E. Meyerson. 2010. An Organizational Approach to Undoing Gender: The Unlikely Case of Offshore Oil Platforms. Research in Organizational Behavior, Vol. 30, pp. 3–34. Huising, R., and S. S. Silbey. 2011. Governing the Gap: Forging Safe Science Through Rela- tional Regulation. Regulation and Governance, Vol. 5, March, pp. 14–42. Kagan, R. A., and L. Axelrad. 2000. Regulatory Encounters: Multinational Corporations and American Adversarial Legalism. University of California Press, Berkeley. Kunreuther, H. 1994. Protection Against Low Probability High Consequence Events. http:// opim.wharton.upenn.edu/risk/downloads/archive/arch160.pdf. Liao, L., and H. Ahn. 2016. Combining Deep Learning and Survival Analysis for Asset Health Management. International Journal of Prognostics and Health Management. http://www. phmsociety.org/sites/phmsociety.org/files/phm_submission/2016/ijphm_16_020.pdf. Luxhøj, R. J., and D. W. Coit. 2006. Modeling Low Probability/High Consequence Events: An Aviation Safety Risk Model. Proceedings of the Reliability and Maintainability Sym- posium, June 14–16. Mignan, A., S. Wiemer, and D. Giardini. 2014. The Quantification of Low-Probability, High Consequence Events: Part 1. A Generic Multi-Risk Approach. Natural Hazards, Vol. 73, No. 3, Sept., pp. 1999–2022. Modarres, M. 2006. Risk Analysis in Engineering: Techniques, Tools, and Trends. Taylor and Francis Group, Boca Raton, Fla. Oldenburg, C. M., and R. J. Budnitz. 2016. Low-Probability High-Consequence (LPHC) Fail- ure Events in Geologic Carbon Sequestration Pipelines and Wells: Framework for LPHC Risk Assessment Incorporating Spatial Variability of Risk. Report LBNL-1006123. Lawrence Berkeley National Laboratory, University of California, Aug. 26. SAP. 2017. Data Science and Machine Learning in the Internet of Things and Predictive Main- tenance. April. https://d.dam.sap.com/a/xOXXb/50764_GB_46588_en.pdf. Thomas, J., and K. Hawkins (eds.). 1984. Enforcing Regulation. Kluwer Nijhof, Leiden, Netherlands. Threadgold, I. M. 2011. Reducing the Risk of Low-Probability High-Consequence Events. So- ciety of Petroleum Engineers Conference Paper SPE-141763-PP. doi: 10.2118/141763-MS. Waller, R. A., and V. T. Covello (eds.). 1984. Low-Probability High-Consequence Risk Analy- sis: Issues, Methods, and Case Studies. Springer, New York, New York. Yi, W., and V. M. Bier. 1998. An Application of Copulas to Accident Precursor Analysis. Management Science, Vol. 44, No. 12, Part 2, pp. S257–S270.