4

Rationalizing and Enhancing the Inspection Program’s Safety Role

As discussed in Chapter 2, the offshore oil and gas industry has been evolving over the past several decades as technological advances have enabled exploration and production in deeper water and led to larger, more sophisticated, and more complex facilities. Ensuring the safety of these facilities is imperative to prevent incidents with potentially catastrophic consequences because of the large volumes of oil and gas they produce from high-pressure reservoirs and the large number of personnel who work and live on them. Facilities in shallow water that are typically far less complex and account for a smaller and declining share of offshore production are nevertheless predominant and present their own safety assurance demands and challenges. They are generally older, owned and operated by smaller entities, less technologically sophisticated, and not as intensively monitored as the larger, more heavily staffed deepwater facilities.

As it monitors, regulates, and otherwise seeks to motivate, reinforce, and promote the safe performance of this varied and changing industry, the Bureau of Safety and Environmental Enforcement (BSEE) has made changes to its own procedures, requirements, and capabilities, including those pertaining to its inspection and enforcement functions, as discussed in Chapter 3. Evolving and adapting the processes and procedures of any government regulatory agency requires leadership, foresight, persistence, and strategic thinking. The committee believes that by commissioning this study and asking the series of questions that comprise the Statement of Task, BSEE recognizes the need to evolve and adapt its inspection program, not only to improve its ability to verify compliance with safety and environmental

regulations but to expand and strengthen its role in motivating and promoting safe and environmentally sound offshore operations generally.

In this chapter, BSEE’s inspection program is considered in the broader context of its functioning with other agency enterprises and initiatives—from those focused on emerging technologies and data support to Safety and Environmental Management Systems (SEMS) implementation—in furthering the general mission of promoting offshore safety and environmental protection. More specifically, the focus of the discussion is on the inspection program’s efforts and accomplishments in pursuit of what the committee refers to in Chapter 1 as the five “aspirational goals”—that is, to be more outcome-oriented, data-informed, holistic in the treatment of risk, discerning of new technologies, and adaptable to changes in the industry and technology. Consideration is given to what is implied by these aspirational goals, and why an emphasis on each is essential for BSEE to innovate and evolve its inspection program to keep pace with a changing offshore industry. In each case, the committee finds that BSEE has taken constructive steps to further these goals and provides examples.

However, before focusing on BSEE’s experience, it bears considering how regulators tend to use inspections to further their safety and environmental protection goals, and how some have found success in doing so by assuming roles that go beyond compliance verification. Examples of other high-hazard industries and regulatory programs from other sectors and abroad suggest that an inspection program can contribute more broadly to the improvement of the regulated industry’s safety and environmental systems by viewing compliance verification and enforcement as only one part of the program’s purpose to promote safe behavior and performance. Indeed, the committee assumes that BSEE’s aspirations for its inspection program, as reflected in the questions and themes of the study charge, derive from a growing interest in becoming a regulator that can promote safety and environmental protection through many varied and complementary ways.

A BROADER VIEW OF INSPECTION PROGRAM GOALS AND CHALLENGES

It is helpful to consider BSEE’s regulatory role at its most fundamental level, which like all regulators of high-hazard industries is to prevent or solve a problem. To do so, regulators create rules, monitor compliance, and issue penalties for noncompliance. However, the central objective, and a key challenge, of any regulatory program is to encourage behavior and actions that will achieve these desired goals. While an inspection encounter to verify compliance is one means to prompt the desired behavior and actions, the inspection program can have a positive influence in other ways, which

if considered explicitly and valued appropriately would come to shape the design and implementation of the program. Consideration would be given, for instance, to how the inspection program can best

• Motivate desired behaviors and conditions through positive reinforcement (e.g., using incentives) and deterrence (e.g., imposing penalties), affecting both the individual entities whose operations and facilities are inspected and the industry more broadly (e.g., general compliance and deterrence);
• Inform regulated entities about the types of problems they may have with their facilities and operations, including problems that need solving for reasons other than avoidance of regulatory penalties, such as potential for increased insurance premiums, tort liability, and community pressure;
• Model ways in which the regulated entities can identify vulnerabilities with their operations and facilities on a regular basis (e.g., through self-audits), assuming they have other incentives to do so; and
• Teach the managers and personnel of regulated entities about the desired outcomes of the regulatory program, not only by using inspection encounters to convey applicable legal obligations, but also to use the encounters for advocating ways that managers and their personnel could do better to achieve the desired outcomes.

Ideally, the inspection program would be designed and implemented with an understanding of multiple ways by which it can further the mission of the regulatory agency. To do so, however, also requires an understanding of the challenges that some regulators can face such as

• Limited knowledge about the facilities, technologies, and operations of the regulated entity, which can be especially true for complex systems where information asymmetries can exist between a regulator and regulated entity.
• Uncertainties about the effects of regulations and regulatory interventions on safety, which can be especially difficult to measure because low-frequency, high-consequence events are rare. Hence, the safety or environmental protection impacts of any given regulation or regulatory intervention (e.g., enforcement, mentoring) may be not be readily ascertained or directly attributable.
• Heterogeneity among the facilities inspected, both across facilities (as no two will be alike) and on the same facilities that can change even over short time periods as crews rotate on and off. With multiple shifts and crews rotating on and off facilities, along with the

• turnover in offshore staff, the expertise and training of personnel can vary over time. This heterogeneity extends to the regulated entities themselves, such as with respect to their size (large versus small operator) and performance (leader versus laggard).
• Operational constraints that can arise from inflexible public-sector budgeting and personnel deployments, as well as from the particular characteristics of the regulated industry, such as offshore facilities scattered over large areas that can complicate inspector visits and require the use of boats and helicopters whose reliability can be limited by weather.

Thus, whereas an inspection program has the potential, at least in theory, to further the goals of a regulatory agency through various means—from incentivizing to modeling and advocating desired behavior—practical impediments and constraints can make the inspection encounter a limited tool. It may not be realistic to expect a facility inspection by itself to fulfill all of the functions listed above when visits are infrequent and short in duration. For instance, even as BSEE inspectors are expected to visit offshore production platforms at least once per year, the finite availability of personnel and helicopters and the remote location of facilities (requiring lengthy trips requiring larger windows of acceptable flying weather) can mean that some inspections will last for only a few hours during part of the day. For inspections of large, complex industrial operations, an inspector or inspection team may only be able to observe or test a small subset of all possible aspects of an operation that could be out of compliance or that presents risks, and they will have limited ability to interact with the facility managers and personnel. Accordingly, the single inspection that focuses on finding deviations from compliance may provide only a snapshot of the regulated entity’s behavior and performance, and perhaps one that is less accurate than hoped for in cases where inspections are announced in advance.

For these reasons, inspectors whose only engagements with the regulated entity consist of such periodic and brief encounters are inherently challenged as they try to encourage and reinforce safe behaviors and risk awareness and control. Indeed, an inspection program that is characterized by such brief encounters could very well hinder the ability of an inspection program to play the fuller and more beneficial safety role described above. Time constraints that lead to routine, “checklist-like” methods of inspection could prove counterproductive by motivating compliance with narrow rules and failing to raise awareness and model best practices aimed at reducing risks not associated with a given regulatory requirement.

Whereas regulated entities may focus on making sure that they are in compliance with requirements that can be readily observed by inspectors (e.g., that all safety valves are in place and functional), they may

underinvest the time and resources needed to control other risk factors that are not subject to physical inspections, such as those associated with human factors, training, and operational processes. Accordingly, the inspection program must be designed and implemented to make the most of its encounters with regulated entities—encounters that may address only a slice of the overall operations. Not only must the encounters be leveraged for maximum effect, but they must also be designed so that they avoid having detrimental effects on the regulated entity’s general effort to ensure safety through means that are not amenable to physical inspections.

Cognizant of the shortcomings of the typical inspection, regulators in a range of domains have been embracing new roles and strategies to effect meaningful change and improved outcomes across their respective jurisdictions. As discussed next, these efforts are being informed by increased understanding of, and attention to, systems thinking, risk consciousness, and continual learning and improvement.

SYSTEMS THINKING FOR CONTINUAL LEARNING AND IMPROVEMENT

Systems thinking in the context of safety assurance has been described as “the systematic identification of important hazards, risks, or patterns of non-compliance” (Sparrow 2000, p. 131). For the safety regulator, this thinking implies a more comprehensive understanding of risks to enable more proactive approaches to improve the safety system as a whole as opposed to simply reacting to and addressing deficiencies found with individual system elements. When systems thinking is employed, short-term reactive problem solving is undertaken in the context of more holistic solutions (Senge et al. 2015).

Known for taking a proactive and preventive approach to safety assurance, leaders of the nuclear power industry have identified the need for even more systems thinking in their domain. For instance, in its report on the Fukushima-Daiichi disaster, the International Atomic Energy Agency called for a more systemic approach to safety that better addresses

Indeed, one can make a case that regulators are uniquely positioned to apply systems thinking because of their particular vantage point within the safety system—they are part of the system but on the perimeter. The U.S.

Chemical Safety Board describes the benefits of this position: “regulators can track more broad-based indicators, which they can then use to diagnose systemic problems in the safety management systems across industry … and analyze macro trends to focus on big picture issues and initiatives to improve industry safety performance” (USCSB 2016, p. 80).

A previous National Academies committee observed a historic tendency for the offshore oil and gas industry and its regulators—both domestically and abroad—to view safety deficiencies as being isolated, or “one-off,” events that warrant interventions targeted to immediate or proximate causes rather than resolving systemic causal and contributing factors (TRB 2016). The role assumed by the offshore regulator in this context placed a heavy emphasis on the enforcement of rules under the premise that strict compliance with the rules would, in and of itself, mitigate risk and therefore warrant singular scrutiny. Compliance was evaluated predominantly as binary choice (i.e., absence or presence of compliance), resulting in warnings or notices for a violation without any evaluation of what caused the deviation from the regulation or how the deviation could be more effectively prevented in the future.

The tendency to overemphasize rule compliance, however, has been changing in the regulatory field, as evidenced by an increased regulator and industry attention—first embraced by North Sea offshore regulators and now formalized in industry standards and safety management regulatory designs in North America—to the importance of identifying and managing risks using strategies such as

• Considering alternative regulatory roles beyond traditional enforcement methods;
• Increasing reliance on regulatory instruments that focus industry efforts on systemic fixes;
• Leveraging industry-wide data and trends to understand deficiencies across the system;
• Fostering dialogue among regulators and industry that seeks to improve understanding of safety system challenges and best practices; and
• Developing internal competency relative to human and organizational factors (e.g., governance models, decision making, risk evaluation, resource allocation, and safety culture).

In pursuing these strategies, regulators’ perceptions about how they can seek to ensure safety have been changing. While regulators continue to monitor and enforce regulatory compliance, they are more apt to view this function as part of a broader responsibility to achieve the end goal of

ensuring safe and environmentally sound outcomes through the application of a range of tools and methods.

Regulators who view safety advocacy as a fundamental obligation may intervene in many ways, such as by promoting and facilitating the sharing of safety information across companies and working with industry (both companies and industry associations) to detect and draw attention to potential blind spots to safety assurance. By dedicating resources to better understand safety risks and by creating supporting networks through outreach and dialogue, the regulator’s interventions can be subtle but nevertheless aimed at building, reinforcing, and sustaining a culture of learning and continual improvement by individual companies and across the industry. Accompanied by traditional compliance verification and enforcement strategies, the regulator’s efforts to promote organizational learning and improvement will expand its role and potentially make it more effective in furthering its safety assurance mission.

The potential for an overemphasis on compliance verification to impair wider safety management and innovation efforts was recognized more than 30 years ago in the UK Cullen Report, which followed the Piper Alpha offshore platform disaster in the North Sea (Cullen 1990). More recently, a 2016 National Academies report posited that

Developing a safety advocacy mindset can be particularly challenging for regulatory agencies that have traditionally focused almost exclusively on issuing and enforcing rules that target individual risk factors, such as requirements prescribing the placement of warning signs, safety valves, and handrails. As noted earlier, when such targeted rules dominate the regulatory framework, they can promote the use of an absence/presence test for efficient compliance verification, which in turn can foster a compliance mindset among enforcement personnel and the regulated entities seeking to avoid violations and any penalties associated with them (TRB 2018). When this happens, offshore operators may devote a disproportionate amount of time and attention to resolving minor and repeat deviations, while neglecting the systemic deficiencies causing them and their recurrences, including the broader problems they may be signaling (Bradley 2017). A regulator that has more tools available to promote safety may still issue penalties for noncompliance but will do so more strategically with more explicit

consideration being given to the potential for punitive measures to create a compliance mindset that detracts from problem solving.

This shift in how safety regulators are viewing their roles reflects an increased understanding of how the regulator can influence outcomes, both positively and negatively, through formal and informal regulatory policies, priorities, decisions, and behaviors (Saji 2003). Although concerns about claims being made that the industry will exert undue influence over, or “capture,”¹ the regulator may deter some agencies from embracing such an advocacy approach, the experience of regulators abroad and in a range of industries suggest that compliance verification and enforcement can coexist with advocacy to achieve positive results.

Pointing to the traditional focus of offshore safety regulations on meeting technical requirements for equipment and other hardware, a 2016 National Academies study committee observed that regulators have tended to hire personnel with engineering expertise, but not always the knowledge or skillsets required to identify and work effectively with industry to address sociotechnical hazards such as those related to human and organizational factors (e.g., safety culture) (TRB 2016). Consequently, that committee recommended that regulators strengthen their capabilities to assess organizational cultural deficiencies by hiring and training staff with sociotechnical expertise. The United Kingdom Health and Safety Executive (UK HSE), which oversees and advocates for offshore safety in the United Kingdom, expects its inspectors to positively influence the management and control of risks by the operators they visit. UK HSE recruits technical specialists with relevant industry experience but also requires advanced training to develop a range of regulation, legal, and organizational safety core competencies (TRB 2018).

As discussed in Chapter 3, Norway’s Petroleum Safety Authority (PSA) is a prominent example of a regulator leveraging a “beyond compliance” strategy (TRB 2018). The agency maintains that its most important regulatory instruments are safety management program audits, regular status meetings with operators and their suppliers, and user survey guidelines and knowledge-sharing activities (TRB 2018). Collaborations among the “tripartite” of the regulator, industry, and labor unions to identify relevant safety topics and promote continual improvement are a cornerstone of the PSA approach intended to promote a learning culture inside the agency and among regulated entities. The PSA view is that such concerted efforts to build relationships and engage in ongoing dialogue foster knowledge sharing and improved awareness of issues critical to promoting safety.

Bradley (2017) has identified a number of ways that a safety regulator may support a learning culture, including

___________________

¹ Regulatory capture implies that the regulator’s dominant interest is to serve the entities they regulate and not the public interest.

• Actively working to build relationships with regulated entities to improve trust;
• Gathering and analyzing data and intelligence from industry members, trade associations, and other regulators;
• Open and transparent sharing of information with regulated entities to improve clarity of regulatory expectations;
• Regular meetings with regulated entities to have a two-way discussion about safety and operational performance; and
• Formal mechanisms for ongoing engagement with company leaders about safety culture in order to promote self-reflection and continual learning.

The development of a learning and safety culture within the regulatory organization is also a priority. For example, UK HSE inspectors share their learning internally within their own teams and across the specialty divisions. The reasons for doing so are to ensure consistent oversight and moderations through peer review, but also to promote knowledge sharing needed for continual safety and environmental protection improvements.

ASPIRATIONAL GOALS FOR BSEE’S INSPECTION PROGRAM

It is difficult to know whether BSEE fully subscribes to the idea, as espoused above, that an inspection program should not only strive to motivate safe behavior but also model and advocate for it. It also not clear if BSEE has the interest, capacity, and latitude to make the major changes to its inspection program that would be needed to align with the kind of systems thinking characteristic of the regulatory approach of Norway and the United Kingdom. To be sure, BSEE’s rules requiring each offshore operator to establish SEMS² is indicative of a recognition that relying on operators to comply with a body of highly prescriptive regulatory requirements is not sufficient to ensure safety and could be detrimental if verifying compliance becomes overemphasized at the expense of efforts to ensure system-level safety.

In introducing the requirement for SEMS, however, BSEE did not make changes to the overall design and implementation of its traditional inspection program. The program continues to focus on physical inspections of facilities, and the inspection protocol remains centered on inspectors verifying that a predefined list of regulatory requirements is being met by the operator. The operator’s compliance with the requirement of a SEMS program is verified separately by the agency through monitoring and reviewing third-party program audits. This approach is distinct from that of

___________________

² See BOEMRE 2010 and BSEE 2013. SEMS regulations in Subpart S are available at http://cfr.regstoday.com/30cfr250.aspx#30_CFR_250_p_SUBPART_S.

the offshore safety regulators of Norway and the United Kingdom, where program personnel are trained in safety management and have familiarity with each operator’s program and its execution. Facility inspections in Norway and the United Kingdom consider the operator’s adherence with standards for subsystem-level components and processes within the broader context of the operator’s implementation of its safety management program (TRB 2018).

Some of the questions posed by BSEE in commissioning this study suggest that it may be open to fundamental changes to its inspection program, for instance, by asking for a review of whether the program is accomplishing its mission, insights on practices used by offshore safety regulators in other countries (including the United Kingdom and Norway), and advice on how the agency might evolve the inspection program in the near and longer terms. Many of the questions, however, suggest an immediate interest in making the current inspection program more efficient and effective—for instance, by placing additional emphasis on SEMS implementation and by employing risk-based inspection methods and real-time remote monitoring technologies.

For reasons explained in Chapter 1, the committee viewed the six themes and more than 20 questions in the study charge as being indicative of BSEE’s desire to make its inspection program not only more efficient but also more effective to the agency’s mission. Looking across the varied themes and questions, the committee perceived an interest by BSEE in suffusing the inspection program with the following qualities:

• Being more outcome-oriented by focusing more directly and proactively on approaches for reducing the occurrence and severity of offshore incidents, and recognizing that measures of total inspections and compliance with individual regulations may not be indicative of mission progress;
• Being more data-informed by marshaling and leveraging information obtained from facility inspections, near misses and incidents, SEMS audit reports, equipment failure reports, and other records to identify themes and trends in order to inform regulatory practices and priorities and to measure the progress and effectiveness of the inspection program in reducing risk and increasing the transparency of its inspection methods and focus;
• Being more holistic in the treatment of risk by considering the varied causes and contributors to incidents and the system-level means that can be employed for reducing them, including the consideration of environmental, technology, organizational, process, and human behavior–related risk factors;

• Being more discerning of the opportunities and challenges associated with new technologies, such as by being attuned to the promise of new technological capabilities for improved decision support and inspection functions, but clear-eyed about their potential limitations; and
• Being more adaptable to a changing offshore landscape by recognizing that the nature of risks and means for reducing risks are changing as the offshore industry changes, requiring an inspection program that has increased agility and more varied capabilities.

In the sections that follow, consideration is given to what is implied by each of these features and current efforts by BSEE to reinforce or instill them in its inspection program.

BSEE’s Current Efforts to Become More Outcome-Oriented

The monitoring and measuring of a regulatory program’s outcomes, as opposed to strictly its inputs and outputs, should be connected as closely as possible to the organization’s mission, which in the case of BSEE is to reduce the number and severity of offshore incidents. Inputs are generally expressed as the effort or resources devoted to the organization’s activities, such as the number of inspectors or inspections conducted. Outputs are measures of what the inputs yield directly, typically quantified numerically, such as the number of issued Incidents of Noncompliance (INCs). While often correlated with inputs and outputs, outcomes are distinct and can be difficult to measure fully, particularly in high-hazard industries where a desired reduction in the potential for catastrophic incidents can be difficult to ascertain. Under these circumstances, there can be a tendency for regulators to focus on inputs and outputs.

The timely and transparent reporting of outcomes is important for an organization’s learning and improvement over time. Yet, organizations will often focus on inputs and outputs because they are usually easier to measure. They may also focus on certain outcomes that can be measured, such as changes in the number of workplace safety incidents, which are easier to identify than changes in the potential for catastrophic events. However, this focus can lead to resource deployments that are suboptimal for achieving all of a program’s desired outcomes. As a notional example of why being outcome-oriented is important, consider two offshore operations. The first is a newer large complex located in deepwater and run by a more established and integrated operator with a good safety record. The second is an older and smaller complex located in shallower water and run by a less established operator with a less established safety record. The first complex has higher production, more overall components, and more

Potential Incidents of Noncompliance (PINCs). If the inspection regime is focused strictly on outputs as measures of performance—such as the number of INCs—this may skew the deployment of inspections in favor of targeting the larger complex where there are more opportunities to find INCs. However, an inspection regime focused on the outcome of reducing incidents might focus inputs instead on the smaller complex, which, although having fewer components, exhibits other indications that overall safety is questionable. Alternatively, if the outcome of interest is reducing the potential for catastrophic events, the inspection regime may concentrate more on the larger complexes that produce more oil and gas and have more workers exposed.

As noted, a challenge that BSEE faces, like regulators of all high-hazard industries, is in knowing whether its allocation of inputs is producing the desired reduction in the likelihood of high-consequence events, which occur with such low frequency that it can be difficult to ascertain whether the regulator’s interventions, including inspections, are having an appreciable risk reduction effect (TRB 2018). In these cases, a focus on particular outputs may be necessary to guide the allocation of inputs and to assess program performance; however, the outputs that are selected should be as close to the desired outcome as possible. For instance, inspections targeted to facilities that are believed, with valid reason, to pose a higher potential for incidents or severe incidents would be expected to have a greater potential to further the regulator’s safety mission than inspections performed on facilities selected arbitrarily or for other reasons such as to ensure that visits are made to every facility. A program that targets inspections to high-risk facilities, and tracks this “output,” could therefore be characterized as being more outcome-oriented than a program that deploys resources to meet a simple inspection quota.

Because there is the expectation that all offshore facilities be inspected annually, the total number of facility inspections conducted, and particularly the number in relation to regulated facilities, has an important role in guiding BSEE’s inspector deployments. Inspectors visiting facilities work through a standard list of PINCs to meet this expectation. Accordingly, the program places a premium on devoting certain inputs, the number of inspections, to produce certain outputs, which are the number of PINCs reviewed.

As it seeks to achieve these two annual input and output goals, BSEE’s ability to deploy its inspection resources in a more targeted, risk-focused manner to further its mission to reduce offshore incidents and their severity is constrained. BSEE has nevertheless shown that it does have at least some flexibility to concentrate on the outcome of risk reduction, most notably through the Gulf of Mexico (GOM) region’s Risk-Based Inspection (RBI)

program.³ As discussed in Chapter 3, the RBI program, which supplements its annual facility inspection program, consists of two components that are intended to provide a risk-guided basis for inspection deployments—Performance-Based Risk Inspections (PBRIs) and Facility-Based Risk Inspections (FBRIs).

The PBRI program focuses on identifying specific activities and components that may have higher risks of causing or contributing to incidents. Incident reports and INC data are reviewed to identify activities and components that warrant more intense supplemental inspections, such as fired vessels, lifting operations, and compressors. Informed by these reviews, BSEE conducts “blitz” inspections of equipment and activities on multiple facilities and operators during a short period of time. When the inspection findings indicate a potential safety risk, BSEE will issue industry-wide safety alerts containing recommendations for practices to address the problem.⁴

In the case of the FBRI, BSEE uses the Argonne National Laboratory (ANL) Risk Model to develop a risk metric for each offshore facility, ranking each by the relative risk of having a severe incident. The model uses data from past inspections and incident reports, including INCs, to estimate the likelihood of a future incident on the facility. According to analyses conducted to construct the ANL model, inspected facilities that received an INC in the previous year were twice as likely to experience an incident in the following year than inspected facilities that did not receive an INC. Likewise, inspected facilities that experienced an incident in the previous year were found to have a much higher likelihood.

As discussed in Chapter 3, BSEE has been placing increased emphasis on making more effective use of data that have long been at its disposal, as well collecting and analyzing additional data and making them publicly available in a useable form.⁵ In its FY2021 budget request, BSEE emphasizes its intention to make more concerted use of the array of quantitative and qualitative data to further its strategic goals.⁶ The RBI program is a good example of how information from inspections such as INCs, incident investigations, and reports on facility features can be used to become more outcome-oriented to make more effective use of inspection resources. Indeed, BSEE seems to recognize the need for improvements to its databases and analytic capabilities to support such efforts and has taken steps to become more data driven for the purpose of informing its own programming

___________________

³ See https://www.bsee.gov/sites/bsee.gov/files/reports/bsee-rbi-2019.pdf.

⁴ See https://www.bsee.gov/sites/bsee.gov/files/reports/bsee-rbi-2019.pdf.

⁵ See https://www.data.bsee.gov/Main/Default.aspx.

⁶ See https://www.bsee.gov/budget-justifications/fy2021-bsee-budget-justification-c.

decisions as well to influence the situational awareness and operational practices of the offshore entities it regulates.⁷

The committee observes that BSEE’s issuance of safety alerts and safety bulletins stems from information derived from reviews of incident and INC data intended to detect and resolve potential safety issues before they become widespread. As part of its SafeOCS program, BSEE has established a confidential “near-miss,” or incident precursor, reporting system managed by the Bureau of Transportation Statistics in the U.S. Department of Transportation. While most operators have internal safety data reporting programs, they may not share the data with BSEE or other operators for legal and proprietary reasons. SafeOCS was established to provide anonymity and greater aggregation of operator experiences, such as in failures of safety and pollution prevention valves.⁸ BSEE has been making use of the data to gain more insight into failure locations (e.g., shallow water, deepwater, surface, subsea), causes (e.g., mechanical, environmental), and type (e.g., failed to close, failed to open, leak). However, the program’s potential has been only partially tapped, as efforts continue to improve data quality and operator participation in reporting.

In another example of BSEE’s increased emphasis on data-informed decision making is the creation of an internal group (the Safety Performance Enhanced by Analytical Review [SPEAR] committee) that is charged with examining advanced data analysis tools that can be used on its databases to identify current and emerging offshore hazards and to guide its RBI program.⁹ For example, the SPEAR committee is investigating the use of machine learning and artificial intelligence (AI) techniques to capitalize on existing databases, and is tapping the National Aeronautics and Space Administration’s (NASA’s) probabilistic risk analysis tools and expertise.¹⁰ Decision aids such as AI are changing how government agencies conduct their work,¹¹ and therefore it is essential that BSEE proceed in this direction. However, to fully leverage such analytic tools, BSEE will need to ensure that it is collecting relevant data while also organizing and standardizing it in ways that provide transparency and enable public consumption. Opportunities for increasing data quality and relevance to facilitate both its

___________________

⁷ See https://www.bsee.gov/budget-justifications/fy2021-bsee-budget-justification-c.

⁸ See https://www.safeocs.gov/2019_SPPE_Annual_Report_Early_Release.pdf.

⁹ See https://www.bsee.gov/newsroom/latest-news/statements-and-releases/press-releases/bseesnewest-safety-initiative-is.

¹⁰ See https://www.bsee.gov/what-we-do/offshore-regulatory-programs/risk-assessment-analysis/probabilistic-risk-assessment-analysis.

¹¹ See https://www.acus.gov/research-projects/agency-use-artificial-intelligence.

internal and external use, which are key to BSEE’s aspiration to becoming more data-informed, are identified in the next chapter.

Current BSEE Efforts to Treat Risk in a Holistic Manner

An outmoded approach to risk management is to identify and try to control risk factors individually, whereas a more modern approach is to consider the interrelationships among many risk factors in recognition that most incidents, and especially major incidents, arise from system failures. Yet, inasmuch as most of BSEE’s offshore safety and environmental protection regulations consist of requirements targeted to specific devices, equipment, and components, they tend to focus on individual risk factors, as do BSEE’s facility and component inspections (TRB 2018). However, the causal chain of an incident will inevitably consist of numerous factors interacting with one another. The focus on individual risk factors facilitates the process of compliance verification, but not necessarily risk reduction. For instance, compliance with a regulatory requirement for a properly functioning safety valve can be readily tested at a point in time, but the testing may not consider the means by which the valve is maintained to ensure its continued readiness to function or the willingness and knowledge of personnel to use it when manual activation is required. Any one or more of these factors involving hardware and human decisions can be in the chain of events that can lead to an incident and affect its severity. Regulations that focus on individual elements in the causal chain (e.g., hardware) are bound to overlook important interacting factors (e.g., the human element and organizational drivers such as resourcing) and thus fail to influence decisions and actions needed to prevent or disrupt the chain itself.

In highly complex, changing, and heterogeneous systems such as large offshore drilling rigs and production facilities and their operations, the myriad equipment and human operations can defy uniform, component-by-component regulation. In these cases, the regulator cannot know all of the risk factors that are present, much less know how they could interact to create a potentially catastrophic incident. Nevertheless, a regulator thinking holistically about risk and safety will inherently recognize that measures to prevent such interactions are essential and seek ways to advocate for their inclusion by regulated entities. To do so, the regulator may turn to the facility operator, who is likely to be in a better position to identify and control all of the potential causal chains and their elements, but who may need guidance and prompting to do so. That guidance and prompting may be in the form of regulations that require the operator to identify all determinable hazards and build and measure active barriers to prevent escalation. The regulator may also require that the operator establish procedures for manager and worker training as part of a learning system to develop competent

and knowledgeable staff that can make good “management of change” decisions about previously unknowable hazards or failure sequences and interrelationships (Silbey and Agrawal 2011).

BSEE’s SEMS rule is an explicit attempt to treat offshore safety and environmental risks in a more holistic manner. Indeed, the rule is based on process safety and safety management system concepts having extensive use in high-hazard industries and documented for offshore operations in American Petroleum Institute (API) Recommended Practice 75. While BSEE has retained its detailed regulatory requirements, the SEMS rule was promulgated to prompt and ensure more holistic thinking about risk by offshore operators and by BSEE. As discussed in Chapter 3, a compliant SEMS program must include, among other things, a formal hazards analysis of facilities and activities, written management-of-change procedures, a program for training personnel to perform their duties safely, and procedures for investigating incidents. BSEE requires operators to have their SEMS programs audited for compliance with these elements and field effectiveness by a third party accredited by a BSEE-approved accreditation body. Under agreement with BSEE, API’s Center for Offshore Safety is responsible for the development of good practice documents for SEMS programs and for accrediting and ensuring that third-party auditors meet the program’s goals and objectives.

In 2013 after issuing the SEMS rule, BSEE went a step further by emphasizing the importance of operators striving to develop a culture of safety within their organizations and those of the contractors who provide many of the services and personnel for offshore facilities.¹² The safety culture statement emphasizes the importance of leaders demonstrating a commitment to safety and environmental stewardship in their decisions, behaviors, and communications; work processes that are planned and implemented with safety and environmental stewardship as the top priorities; personnel having the freedom and means to raise safety and environmental concerns; and reviewing existing conditions and activities on a continuing basis to identify and eliminate those that risk errors and inappropriate actions. Success in creating a positive organizational safety culture was characterized as being essential to a dynamic SEMS program, and instilling greater confidence in BSEE that operators will comply with (and properly integrate their contractors’ safety management into) the SEMS requirements conscientiously rather than in perfunctory or mechanical ways.

BSEE’s requirement for SEMS and emphasis on safety culture are indicative of the agency engaging in systems thinking in the manner discussed earlier in this chapter. There remains, however, significant opportunity for

___________________

¹² See https://www.bsee.gov/sites/bsee.gov/files/bsee-policy-manual-section/internal-guidance/final-safety-culture-statement.pdf.

extending this thinking across more of BSEE’s practices and programs, such as through more cross-learning from SEMS audits and traditional inspections. Some of these opportunities are discussed in the next chapter.

Current BSEE Efforts to Be More Discerning of New Technologies

Advances in technology have enabled the oil and gas industry to explore and produce in more remote and deeper waters, higher-temperature and higher-pressure reservoirs, and harsher weather and marine conditions. Consequently, aspects of the safety regulator’s job have become more challenging, both in trying to issue component- and activity-specific regulations that are applicable to more complex and facility-specific operations and in trying to verify and enforce regulatory compliance through inspector visits to facilities. At the same time, the technological advances have provided operators with new and improved capabilities for monitoring safety and environmental protection, including technologies that regulators and inspectors can exploit to perform their roles more effectively.

The questions posed in this study’s Statement of Task suggest that BSEE wants to be more discerning of new technologies that can make its inspection program more efficient and effective in promoting safety and environmental protection. Technologies that allow for remote monitoring of offshore operations, as mentioned in one of the questions, is an example, but presumably BSEE’s interest extends to many other current and future technologies, including those that can improve analytic capabilities, such as AI and those that can facilitate the monitoring and inspection of remote and subsea facilities, such as robotics and automated systems. Because BSEE has limited resources to develop or procure advanced technologies, its success in capitalizing on them to enable or enhance inspections will depend largely on its leveraging ability and capacity to recruit and train personnel who are competent in using them. While the lure of technologies can be the promise of budgetary savings, such as by replacing manned assets with unmanned assets (drones replacing manned helicopters) or substituting on-site inspections with remote monitoring, the prospect of new and improved capabilities may be more important, and more realistic, than reduced agency expenditures.

BSEE has a number of units and programs that assess and seek to advance offshore safety technologies. The main technology unit, the Emerging Technologies Branch (ETB),¹³ identifies and assesses how new technologies may be applied and integrated into new and modified regulations and industry consensus standards. ETB’s Best Available and Safest Technology Section assesses drilling and production technologies to ensure that they

___________________

¹³ See https://www.bsee.gov/about-bsee/our-organization/national-programs.

meet statutory requirements for the use of the best available and safest technologies, and its Systems Reliability Section oversees quality assurance testing of offshore equipment for service fitness in terms of quality assurance and quality control for reliable and safe operation.¹⁴ These units contract with universities, private firms, and government laboratories to evaluate safety-related technologies. The work is also supported by BSEE’s in-house Houston Engineering Technology Center.

In addition to assessing and seeking to further the safety of technologies used for offshore drilling and production, BSEE has undertaken a number of research, development, and technology initiatives to improve its own operations and decisions. Its eRecords initiative, as discussed in Chapter 3, is aimed at increasing the time inspectors spend offshore performing physical inspections rather than reviewing records that could otherwise be reviewed onshore separate from visiting the facility. As noted earlier, BSEE is investigating the use of machine learning and AI tools to mine its databases and is taking advantage of NASA’s probabilistic risk analysis tools and machine learning tools through its SPEAR program.

Responsible for regulating the safety of one the world’s most technologically sophisticated and rapidly advancing industries in terms of technology introduction, BSEE must make prudent choices about where and how it can apply and leverage technologies to enhance its inspection functions, as well as its regulatory programs more generally. Further consideration is given in the next chapter to how BSEE can be attentive to, and sufficiently discerning of, the possible means by which new and emerging technologies can serve this purpose.

Current BSEE Efforts to Be More Adaptable to Change

As discussed elsewhere in the report, advances in technologies used for exploration, drilling, and production and new concepts in deepwater systems and facilities have enabled the oil and gas industry to reach and manage production from new reservoirs from facilities in remote locations, including on the seafloor. At the same time, the number of active facilities that are regulated by BSEE has been decreasing, largely because of declining activity at many older, lower-production platforms in shallow waters, which in recent years has been accelerated by lower oil and gas prices. Thus, even as the total number of facilities that BSEE must inspect has been decreasing, the facilities that remain are becoming more technically and operationally complex and less accessible for inspection visits.

___________________

¹⁴ See https://www.bsee.gov/what-we-do/offshore-regulatory-programs/emerging-technologies.

In this changing environment, however, BSEE has shown limited ability to adapt its inspection personnel and resource deployments. For many reasons—including some that are shared by other federal agencies—BSEE is constrained in its ability to recruit new inspectors and engineers with specialized technical and operational competencies, relocate existing inspection personnel to align better with offshore activity, and make fundamental changes to work patterns and schedules (e.g., changing inspection lengths, scheduling inspectors for multiday or multiweek rotations outside their base districts). Adaptability to a changing industry, therefore, has become a major challenge for the agency’s inspection program—one that is likely to become even more pronounced and problematic as the industry’s operational context, technologies, and economics continue to evolve, including the advent of new responsibilities such as overseeing offshore windfarm safety and potential plans for energy exploration and development off of Florida, other Eastern seaboard states, and Alaska.

Having limited ability to transform its regulatory and inspection programs (akin to the offshore regulatory programs of Norway and the United Kingdom), BSEE has responded with modest but nevertheless meaningful programmatic changes, such as by employing more risk-based inspections, holding operators more accountable for vigilant safety management (through SEMS programs), conducting document reviews onshore (eRecords initiative), creating a “near-miss” operator reporting data system, and issuing more timely safety bulletins to alert the industry to safety problems in their incipiency. As discussed above, BSEE has also established a number of technology programs in recognition that advanced analytic tools and the judicious leveraging of industry technologies, such as remote and real-time monitoring, will be essential for the inspection program to keep pace with the changing offshore environment, particularly operations in locations with limited physical access for monitoring and inspections.

Going forward, it will be important for BSEE to adapt its program in an even more comprehensive and proactive manner if is to keep pace with a fast-changing industry and reap the benefits of continually advancing technology (e.g., AI applications for targeting inspections).¹⁵ In this regard, and as discussed more in the next chapter, BSEE’s aspiration to be more adaptable must become a strategic imperative of the agency.

___________________

¹⁵ For guidance on the use of artificial intelligence systems by federal agencies, see https://www.acus.gov/research-projects/agency-use-artificial-intelligence and https://www.napawash.org/uploads/Using_AI_to_Improve_the_Fairness_and_Equity_of_Government_Decision_Making.pdf.

REFERENCES