HID CI / SI Inspection Manual

Open Gov. Status: Fully Open Issued: 11/04/2001 Review: 11/04/2003

HID CI, SI Inspection Manual

• Introduction • Audits • Major Hazard Intervention Policy • Operation of the Lead Unit System • Major Hazard Intervention Plans • Assessing Risk Control Systems • Incumbents Ratings System • Recording Major Hazard Intervention Information on • Inspection Techniques CIS

Introduction

1. The Hazardous Installations Directorate is part of the Operations Group. Core processes, including inspection, are controlled by agreements reached by the Operations Management Team (OMT). The OMT sets broad standards that HID needs to operate within, including the OG wide inspection procedure.

2. HID needs to provide information to its staff and have written procedures to ensure that inspectors carry out the inspection process in the most effective way, drawing on the best practice that has been developed over time. It also aids consistency across all Units and between inspectors irrespective of their grade and experience.

3. This manual is targetted at the Chemical Industries and Specialist Industries divisions in HID. A separate OSD inspection manual is provided for staff in HID's Offshore Division. This manual should be read in conjunction with other guidance, which is linked by the hypertext. It will be updated and reviewed on an annual basis.

4. A major review of this manual is now underway following introduction of the OG wide investigation procedure. Until this review is complete, discrepencies between this manual and the OG wide inspection procedure may exist. Staff should note that the OG wide procedure sets the minimum standard, whilst any more onerous HID specific standards imposed by this manual will remain valid unless formally withdrawn.

5. A hard copy of the manual will not be produced (although sections can be printed by staff who require it), as it is more efficient to present the manual on the INTRANET, and make updates and amendments to it in this way.

Definition

6. Inspection is the process carried out by HSE warranted inspectors which involves assessing relevant documents held by the duty holder, interviewing people and observing site conditions, standards and practices where work activities are carried out under the dutyholder's control. It's purpose is to secure compliance with legal requirements for which HSE is the enforcing authority and to promote improving standards of health and safety in organisations

Contact HID HQ 1D St Anne's House VPN : 523 3939

Major Hazard Intervention Policy

• Introduction • LD Industry Groups • Priorities • Enforcement • Non-MH Health & Safety Work • Appendix 1 - Summary • Contractors • Appendix 2 - COMAH Installation Prioritisation • Intervention Approaches Table

• Appendix 3 - The Intervention Process

INTRODUCTION

1. This Chapter provides guiding principles for inspectors on interventions at LD premises. It covers:

• Aims and objectives;

• Prioritising sites;

• Role of sectors;

• Intervention approaches.

Scope

2. This guidance applies to LD1, 2 (except explosives sites), 3 and 4. LD2 have separate arrangements in place for explosives sites to meet HID's intervention policy.

Policy

3. LD's intervention policy is to

• Give priority to those premises that have the greatest hazards and risks;

• Eliminate or reduce risks of major accidents;

• Meet operational priorities;

• Adopt intervention approaches that are proportionate to the size, complexity, hazards and risks at those premises;

• Ensure that all COMAH installations are inspected at least once every five years.

A summary of this policy is at Appendix 1.

Aims and objectives

4. The aim of all interventions is to prevent injuries and ill health. Within this broad aim:

• All interventions aim to fulfil HSE's Mission and to deliver the HSC enforcement policy;

• Interventions are consistent with current HSC continuing aims, strategic themes and objectives;

• Intervention activity is targeted according to hazard, risk and operational priorities;

• Interventions are conducted consistently across the duty holders subject to inspection by the Division;

• There is an appropriate use of a range of intervention techniques.

5. The objective(s) of particular interventions will depend on the intervention topic(s) selected. At a TT COMAH establishment, for example, an objective may be to reduce the risk of a release of chlorine. At other premises an intervention may be carried out as part of LD's Priority Programme and seek, for example, to prevent falls from road tankers.

Principles of intervention

6. Inspectors should apply the following hierarchy, to ensure that duty holders:

1. Eliminate hazards and reduce risks at source where reasonably practicable e.g. by reducing inventories of dangerous substances or designing processes to minimise loss of containment;

2. Control risks by e.g. employing management systems for maintaining plant integrity;

3. Minimise the effects of any incidents by suitable mitigation measures.

INTERVENTION PRIORITIES

LD Intervention priorities at major hazard installations Planned interventions at:

• existing COMAH establishments • existing non-COMAH premises • new premises

Identification of new premises

7. Inspectors should use the screening methods below to prioritise installations / sites for interventions.

LD Intervention priorities at major hazard installations

8. As a first screen, LD's intervention priorities are (in order):

1. Top-tier COMAH establishments;

2. Lower-tier COMAH establishments;

3. Sub-COMAH premises e.g. premises that are outside the scope of COMAH but which have dangerous substances with MH potential such as those subject to the Planning (Hazardous Substances Consent) Regulations 1992.

9. Units should plan annually to deploy resources proportionately against each of these categories.

10. Screening solely according to hazard based on COMAH thresholds fails to take into account several other important factors, such as the population at risk and the type of installation. A risk calculation tool, ARICOMAH (an acronym for Approximate Risk Integral for COMAH sites) has been developed and applied to a number of TT establishments to produce an indication of the magnitude of the societal risks they present. As more ARICOMAH values are calculated over the next couple of years, the intention is to use them as the main screening tool for COMAH installations.

11. In the meantime, units should use the two tools described below to provide a further screening:

• For COMAH installations the installation prioritisation table at Appendix 2 should be used. Inspectors may also use this table for sub-COMAH sites when there are significant hazards present and they wish to rank these sites against COMAH installations;

• For other sites the HID rating system (Incumbents Ratings System) should be used.

12. Neither of these two tools is sophisticated enough to give absolute measures but both provide a broad indication of relative site / installation intervention priorities.

Planned interventions at existing COMAH establishments

13. All planned major hazard interventions at these establishments are required to be recorded on an intervention plan (see Major Hazard Intervention Plans).

14. All sites should be inspected during the work year that their installation score exceeds 50. This will ensure that all COMAH installations are inspected at least every five years. Installations with the highest scores should be considered for interventions first.

Planned interventions at existing non-COMAH premises

15. The relative priority for interventions at fixed premises that are known to LD is initially determined by either the prioritisation table at Appendix 2 (for sub-COMAH sites with significant hazards) or the rating system (see Incumbents Ratings System) for others. Premises where the prioritisation table is used should be inspected at least once every five years i.e. when the score reaches 50. Premises with the highest scores / ratings should be targeted first.

Planned interventions at new premises

16. All new premises should be contacted within two months of coming to our attention. This may be a telephone contact to establish, for example, the size, complexity and hazards at the premises. Inspectors will need to compare this information with their knowledge of existing premises to determine whether an inspection should be carried out and its priority, using the screening methods described under LD Intervention priorities at MH installations as a guide. Where the decision whether to inspect is marginal it is better to inspect.

17. The primary purposes of initial inspections of COMAH sites are to:

• Assess whether operators have in place management systems for the prevention and mitigation of major accidents;

• Identify issues to include in the intervention plan for the establishment;

• Bring the establishment into the planning system by giving an inspection rating using the prioritisation table.

18. The purposes of inspections at non-COMAH premises that LD has not previously visited are to:

• Identify any serious risks and take appropriate action;

• Bring the establishment into the planning system by giving an inspection rating, using either the prioritisation table or inspection rating system.

Identification of new premises

19. LD will identify new premises from a number of sources. They include:

• Receipt of notifications e.g. COMAH, Factories Act and RIDDOR from duty holders;

• Information from the public e.g. complaints;

• Information from other HSE directorates;

• National and local initiatives focusing on specific sectors and issues, e.g. warehousing, that requires the Division to identify previously unknown premises.

20. New premises identified by RIDDOR notifications or complaints may need to be visited urgently depending on the nature of the incident (see SPC/Enforcement/04).

NON-MAJOR HAZARD HEALTH AND SAFETY WORK

21. Selecting non-MH premises for interventions is based on three criteria:

• LD's rating system (for those we know of) and the need to give priority to those not previously visited;

• LD's Programmes, which will target particular industry groups and issues;

• A means of developing less experienced inspectors.

INTERVENTIONS WITH CONTRACTORS

22. Our intervention strategy is based primarily on contacts with duty holders at fixed LD-registered sites. However, there are other duty holders such as contractors, whose activities can significantly affect health and safety at LD sites. Our approach here is twofold:

a. To continue to focus regulatory effort on the operators of fixed sites who engage contractors and seek to ensure that they have adequate arrangements for selecting and controlling contractors. This will usually entail some direct contact with contractors on site to assess standards and verify that operators' arrangements are effective;

b. Where appropriate to intervene directly with contractors' senior management centrally, possibly jointly with other directorates / divisions. The criteria below provide a guide for when this approach may be appropriate:

• Contractors who are engaged to carry out safety critical work, including designing plant / equipment;

• Major contractors e.g. who work across a number of sectors (and D/Ds);

• Contractors who are identified as having poor safety performance.

INTERVENTION APPROACHES

23. Table 1 indicates the normal intervention approaches and inspector experience required for different types of premises. All interventions require a balance of observing workplace standards, verifying hardware and software risk control measures, examining documents and interviewing personnel. As the hazards increase and management structure becomes more sophisticated the scope of the intervention approach will continue to involve inspection of workplace precautions and controls and extend to examining management systems and senior management influence such as leadership.

Table 1: Intervention approaches for different types of LD premises.

Premises Normal intervention approach

1. Small firm (<5 employees). No MHs. 1 or 2 management levels i.e. self-employed or director and employees only.

Primarily observation of workplace precautions. Select sample topic(s). Implicitly inspect against POPMAR to identify underlying causes of defects found e.g. inadequate risk assessments; failure to monitor preventive measures. Intervention by Band 4 inspector or above.

2. SME (>5;<50 employees). No MHs. Basic management structure i.e. director plus manager(s) / supervisor(s) and employees.

As 1 above but with explicit inspection against POPMAR to identify underlying causes of defects found. Intervention by Band 4 inspector or above.

3. Simple site with MHs but below COMAH thresholds e.g. storage of dangerous substances and / or simple processing activities.

As 1 or 2 above depending on size and sophistication of management structure. Intervention by Band 3 inspector or above.

4. Complex site with MHs but below COMAH thresholds e.g. complex processes with potential for latent defects.

Inspection of key risk controls in place for preventing / mitigating major accidents. Intervention by Band 3 inspector or above with at least 1 year's experience at Band 3.

5. COMAH installation with only storage / simple processing activities.

Inspection of key risk controls in place for preventing / mitigating MAs. Intervention plan required to ensure that technical and SMS aspects addressed, including verification of risk control measures in safety reports and other documents, over period of plan. Intervention by Band 3 inspector or above with at least 1 year's experience at Band 3.

6. Complex COMAH installation. Inspection of key risk controls for preventing / mitigating MAs and verification of risk control measures in safety reports and other documents. Intervention by Band 3 inspector or above with at least 3 years' experience at Band 3. Intervention plan required.

LD INDUSTRY GROUPS

24. LD 1,3,4 & 6 have identified 6 industry groups. One of the objectives of these groups is to target key hazards and risk control systems to direct HSE's resources to areas of greatest need within their group.

25. The 6 groups are:

• Chemical manufacture and storage (including waste);

• Paints and coatings (including glues & sealants);

• Health and hygiene products (including pharmaceuticals);

• Carriage of dangerous goods;

• LPG and other industrial gases;

• Oil refining & associated industries.

26. As intelligence regarding these groups is developed HID will identify the most important intervention issues and provide benchmarks for appropriate intervention resources for types of premises. Inspectors should contact LD6 for more information about this work.

27. LD6 also develop and publish annually national operational priorities that address major hazard and conventional occupational health and safety issues.

ENFORCEMENT ACTION

28. Inspectors should use the Enforcement Management Model (EMM) and relevant operational guidance such as SPCs to inform decisions on enforcement action.

THE INTERVENTION PROCESS

29. All interventions follow a common process. This is described in more detail in Appendix 3 but the elements are listed below:

• Planning and preparation;

• Carrying out the contact;

• Recording the outcome;

• Monitoring action and progress;

• Reviewing the intervention.

APPENDIX 1: SUMMARY OF INTERVENTION POLICY

Selecting for intervention: first

1. TT COMAH Installations 2. LT COMAH Establishments/ Installations

3. Non-COMAH Premises

screen

Second screen Prioritisation table (Appendix 2). Select installations with highest

Prioritisation table (Appendix 2). Select establishments /

Prioritisation table for sub-COMAH sites with significant

scores first installations with highest scores hazards. Rating system first (Incumbents Ratings System) for

others. Select premises with highest scores / ratings first

Intervention Safety management system Safety management system Depends on size, complexity, approach inspection for MH controls (see inspection for MH controls (see hazards & risks. See Table 1 for

Table 1) Table 1) guidance

Operational priorities

Published annually by LD6 Published annually by LD6 Published annually by LD6

APPENDIX 2: COMAH INSTALLATION PRIORITISATION TABLE

Installation type Score Population at Risk

HID Intervention

Information & Performance

Overall Score

TOXIC Alkylation unit 10 Large

Site in built-up area. Large Nos in most parts of CD and/or large nos of people on site i.e. >100. Score 4

Add 10 for each year that there has been no COMAH site visit by an HID inspector (regulatory or discipline specialist).

The years are counted from the start of the 1999/00 work year i.e. 1 April 1999 when COMAH came into force.

This is an optional column to adjust scores to take account of factors listed in Major Hazard Intervention Plans. Inspectors should summarise the reasons for adjustments (+ or -) and indicate the adjustment score.

Any reduction must be limited to ensure that the score after 5 years is at least 50 so that all installations are inspected at least once every five

Installation Type score x Population at risk score + HID Intervention score, modified as described under Information & Performance = the Overall score.

Manf. Liquefied toxic gases 10

Chem manf. Sites with bulk storage of liquefied toxic gases.

8

Ammonium Nitrate Manf. 7

Water treatment using bulk chlorine

6

Water treatment using chlorine drums

4

Bulk storage of toxic chemicals

5

Chemical user. Toxics in drums

3 Medium

Some local pop Large parts of CD with low nos and/or significant on site population i.e.>50. Score 2

Packaged goods chemical warehouse

3

FLAMMABLE Petrochemical processing, including Refineries

8

Gas terminal 6

LOX manf. 6 years.

U/ground cavity storage LNG 5

LNG Storage 5

HP Gas storage 4 Small

Low pop density in all parts of CD. Few people on site i.e.<10. Score 1

Chemical Manf. Sites with flamm liquids in process

4

Chem. manf. Sites withbulk flamm liquids in storage

3

Peroxide Manf. 3

LPG bottling 4

LPG Bulk vessels and 3 distribution

LPG cylinder storage 1

Spirit bottling 1

How to Use the COMAH Installation Prioritisation Table

1. The table provides a means of scoring all COMAH installations. Those installations with the highest scores should be selected for intervention first.

Installation type

2. Use the list provided to identify the type of installation and take the corresponding score. For example if the installation is a packaged goods chemical warehouse the score will be 3. In cases where installations have both toxic and flammable substances, select the option that gives the highest score. For example if an installation stores both flammable and toxic substances select score 5 for the toxics rather than 3 for the flammables.

Population at risk

3. COMAH defines an installation as a unit in which dangerous substances are, or are intended to be produced, used, handled or stored. Most establishments will comprise a single installation but some refineries will have a

number of installations. Inspectors can divide establishments into installations as they see fit. Installations may be set based on e.g. processes, site layout, safety report submissions or size.

4. Select the most appropriate category for the installation in question and take the corresponding score. The population at risk is the highest population in the vicinity of the installation and should include people on site, at neighbouring workplaces and, for example, houses, schools, shops etc.

5. Multiply the installation type and population at risk scores. For example, an ammonium nitrate manufacturing installation (score 7 for installation type) with a medium population at risk (score 2) would score 14.

Regulatory intervention

6. Identify the relevant score from the HID Intervention column. For example, if the installation has not received a COMAH intervention, i.e. an intervention that addresses major hazard issues, for 3 years enter 30 (10 for each year).

7. Add the regulatory intervention score to the product of the installation type and location scores.

Information and Performance

8. This column takes account of other factors that may affect inspection priorities and frequencies. The factors are listed in Major Hazard Intervention Plans paragraph 19. Inspectors should record any relevant factors and how they affect the score. The score may be increased or decreased depending on the factors. For example, an installation that has very high standards of control of hazards may have its score reduced. However, the minimum inspection frequency of once every five years should be maintained.

9. The installation's overall score is the product of the installation type and location scores plus the regulatory intervention score, modified by information and performance factors.

APPENDIX 3: THE INTERVENTION PROCESS

Interventions

1. Interventions are planned processes designed to secure compliance with the law and include:

• Inspections and audits - including verification to test conformity with information contained in safety reports and to monitor duty holders' implementation of stated prevention, control and mitigatory measures;

• Other methods of contact such as projects;

• Interventions do not include incident and complaint investigations.

2. The Intervention Process section lists the five elements of the intervention process. This Appendix provides more detail on what each element involves. Where appropriate it provides further information on issues or refers to other sources.

Planning and preparation

• Intervention priorities;

• Deciding which topic(s) to address (see also Major Hazard Intervention Plans);

• Deciding on an intervention approach to use (Table 1);

• Identifying experience required for interventions (Table 1);

• Informing the duty holder (unless an unannounced visit is proposed - see below).

3. HID LD policy is to allow local inspectors a choice of whether or not to pre-arrange visits. There are advantages and disadvantages of unannounced visiting.

4. Advantages:

• Conditions found reflect the normal state of affairs;

• Can be more efficient use of inspectors' time because they can go directly from one site to another with no wasted time between appointments.

5. Disadvantages:

• In practice the ability to significantly improve conditions before an inspector's visit is very limited - companies whose health and safety performance is poor often do not know what standards apply and inspectors will readily identify duty holders' hasty attempts;

• Inspections at larger and more complex sites include a greater scrutiny of safety management issues and the systems for controlling health and safety. This involves examining documents and interviewing people in addition to observing workplace conditions. It is more effective to pre­arrange these visits so that inspectors see the right people who are properly prepared with the relevant documents available.

6. In general, unannounced visits are appropriate at smaller, less complex sites when a relatively short, ie less than half a day's, inspection is proposed.

Carrying out the contact

• Explain inspector's role and powers (leaflet HSC14 - see below);

• Explain purpose of the intervention;

• Gain an understanding of the management structure and interview the right people, examine documents and observe workplace conditions;

• Use the appropriate intervention approach to ensure that duty holders have SMS in place for maintaining plant integrity (see below);

• Inform personnel of the outcome of the intervention; in particular any enforcement action proposed.

7. Inspectors should ensure that duty holders and their employees whom we contact for the first time are given a copy of leaflet HSC14 What to expect when a health and safety inspector calls.

8. A suggested process safety management system-based intervention approach for major hazard issues is shown in Figure 1. In this example the process is preventing loss of containment from bulk storage of flammables. The process on which to focus at any particular intervention will be informed by whatever the most significant major accident scenario is at the installation under consideration.

9. The smaller solid circles around the perimeter of the central circle represent primary risk control systems (RCS) that are relevant to controlling the process. Inspectors should examine these RCS to the extent that they feel necessary to be confident that each is adequate. For example, confirmation of adequate plant design for existing plant may require little more than confirming vessel design standards. Planned plant inspection, on the other hand, particularly for older vessels, may need to be examined in much greater detail.

10. The dotted circles represent secondary (in that they are subsets of the primary RCS but no less important in terms of control measures) RCS that are likely to be relevant. Figure 1 shows two examples linked to the maintenance RCS, though they may also be relevant to other primary RCS.

11. This inspection model is currently being developed and more detailed information will be provided in other chapters of this manual in due course.

Figure 1 - Example of a Process Safety Management System Based Intervention Approach for the Inspection of Bulk Storage of Flammables Showing Primary & Secondary RCS

Recording outcomes

• Confirm matters in writing;

• Complete CIS records;

• Update intervention plans.

12. The EMM provides guidance on when inspectors should send letters to duty holders. Inspectors may choose to confirm matters outside the EMM criteria at their discretion.

13. A timeline and inspection report should be completed on CIS following an inspection.

14. For interventions carried out based on intervention plans the plans should be updated following visits eg to confirm that the visit has been carried out.

Monitoring progress

• Check duty holder's progress with action required.

15. Inspectors are required to check compliance with all enforcement notices that they issue. Improvement notices should be checked as soon as possible after the date specified on the notice for compliance and in any case

within 10 days of it. The expectation is that compliance will be checked by site visit except when sufficient confirmation can be achieved by other means.

16. Audits describes the requirements for audit follow up reports.

17. Inspectors should usually seek confirmation that duty holders have complied with legal requirements and inspectors' recommendations in letters. The expectation is that this would be achieved by eg seeking written confirmation from duty holders or by telephone.

Review

• Assess effectiveness of intervention.

18. Inspectors may find it useful to review some of their interventions, perhaps using the five elements listed here as a guide, to consider whether alternative approaches could have been more effective. For trainee inspectors this will be a more formal process carried out with line managers and / or more senior colleagues.

Major Hazard Intervention Plans

• Introduction • Format of Intervention Plans • Aim & Objectives • Managing Resources • Timing of Preparation & Review • Informing Duty Holders & Employees • Identification of Intervention Issues • Appendix 1 - Summary of Process for TT COMAH • Roles & Responsibilities • Appendix 2 - Summary of Process for LT COMAH • Links with the Environment Agencies

INTRODUCTION

1. COMAH regulation 19 places a specific duty on the competent authority (CA) to have in place a system of inspection for COMAH establishments. HID policy is to implement this requirement by following the principles set down in the European Commission's Guidance on Inspections Required by the Seveso II Directive. This guidance pragmatically implements relevant parts of the EC guidance through preparation of intervention plans.

2. Arrangements for ensuring that intervention plans are fit for purpose are described throughout this guidance. They ensure that more rigorous quality assurance is applied at those establishments where hazards and risks are greatest. In addition, CIU will periodically audit the intervention planning procedures.

Scope

3. This guidance applies to intervention plans for establishments within HID LD Units 1, 3 and 4. LD2 have separate planning arrangements for gas, explosives and pipeline installations.

4. It applies to major hazard interventions at all COMAH sites. Interventions are planned processes to secure compliance and include:

• Inspections - including verification to test conformity with information contained in safety reports and to monitor duty holders' implementation of stated prevention, control and mitigatory measures;

• Other methods of contact such as projects.

5. Interventions do not include incident and complaint investigations.

AIM AND OBJECTIVES

6. The aim of intervention planning is to produce a programme of interventions to periodically check, by examining operators' technical, organisational and managerial systems, that a high level of protection for man and the environment is being achieved and capable of being maintained. The objectives of the intervention planning process are to:

• Identify and prioritise intervention issues, focusing on ensuring that the key risk control measures for preventing and mitigating major accidents are maintained;

• Match interventions with available resources;

• Show the rationale for intervention issues;

• Show how interventions are closed-out.

Quality factors

7. Preparing plans for complex sites can be time consuming but is essential to meet COMAH requirements and is an important element in demonstrating that HID meets the HSC enforcement policy principles of Proportionality, Consistency, Transparency, Targeting and Accountability (PCTTA) and the HSE enforcement statement quality management principles.

Contents of plans

8. All plans should contain details of proposed major hazard interventions (including estimated resources) for at least the period between preparing the plan and the start of the next planning year. The basic major hazard planning templates on CIS default to a five-year plan for TT sites. Inspectors may, at their discretion, identify future years' work in the plans. This information need not be so detailed and may, for example, simply identify proposed intervention topics with more detail added nearer to the intervention.

9. Individual plans may also, at inspectors' discretion, include a statement of the aim(s) of the programme of interventions. Stating the aim(s) of the plan will help inspectors to assess at the end of the plan's duration whether the programme of interventions have been effective in meeting the aim(s). For example, a core aim might be to ensure that operators have in place adequate controls to prevent major accident scenarios being realised.

TIMING OF PREPARATION AND REVIEW OF INTERVENTION PLANS

10. The planning process comprises two main stages:

• the initial planning event; and

• annual reviews and agreement of annual plans.

The initial planning event for COMAH TT installations

11. The initial planning event is the stage when the intervention plan is first prepared. This is crucial because it identifies the key intervention issues that, based on verifying the control measures for preventing/mitigating major accident scenarios described in the safety report, will form a rolling programme of interventions over time. It therefore sets the framework for all future interventions.

12. The initial plan should ideally be agreed during safety report assessment outcome meetings (see COMAH Safety Report Assessment Manual, Part 1 Chapter 4), when all those with a role in identifying topics for the plan should be present.

13. Planning at this stage ensures that the conclusions from safety report assessments can inform future interventions. However, the plan should not be dependent on the completion of the safety report assessment process and interventions can take place at any time irrespective of whether they are included in the plan. This includes during the safety report assessment phase, for example to verify information in the safety report or to meet existing intervention commitments. Inspections at top-tier installations should not be postponed or cancelled due to the need to resolve any outstanding safety report assessment issues.

14. If there is no outcome meeting or it is not practicable to agree the plan at the meeting the assessment team should agree alternative arrangements for preparing the plan.

The initial planning event for COMAH LT establishments

15. Plans for lower-tier COMAH establishments should be based on the LD intervention policy in Major Hazard Intervention Policy and developed as part of pre-visit preparation. As with plans for TT sites, the initial plan sets the framework for all other interventions. They should cover the period that is appropriate for the issues involved, which will usually be between one and five years. Local arrangements should be made to ensure that the plans are developed in consultation with EA/SEPA and HID discipline specialist teams and agreed with them.

Annual Reviews and agreement of annual plans

16. All plans should be reviewed at least annually as part of the annual work planning process. The purposes of the annual review are to:

• check that the previous year's plan was implemented and deal with outstanding work;

• assess progress with achieving the aim(s) of the plan (where an aim is specified);

• identify / confirm proposed intervention topics from the rolling programme and/or add new ones and add details to the plan for the next year i.e. resources and dates.

Intervention plans for lead unit companies

17. Lead unit co-ordinating inspectors are responsible for preparing and managing a single intervention plan for each lead unit company. Lead unit co-ordinators should inform relevant regulatory inspectors when company-wide intervention plans have been developed. This does not extend to agreeing specific local issues, nor does the lead unit co-ordinator have authority to prescribe intervention issues for specific sites (see Lead Unit System for Multi - Establishment Companies).

IDENTIFICATION OF INTERVENTION ISSUES

18. Intervention plans should take into account two main issues:

Hazards and risks at establishments

• Plans should include verification of the key control measures for preventing/mitigating major accident scenarios, starting with the worst-case scenarios. A rolling programme of interventions will be required to ensure that operators continue to manage these key measures over time;

• National / sector priority programmes that address major hazard topics e.g. the occupied buildings and plant integrity projects;

• Topics identified as requiring improvements based on the assessment of COMAH safety reports or by other means.

Information about and performance of establishments

19. Factors related to major accident hazards that may affect inspection topics and their priorities and/or frequencies, are listed below. Not all of these factors will be relevant at all sites.

Outcomes of previous interventions.

Inspectors should set a time for re-examining the control measures based on the standards found at the original intervention. Sites that do not comply with legal requirements or relevant good practice are likely to require more frequent inspection and be a higher inspection priority.

Size and complexity Large and complex sites are likely to require more frequent inspection. This is to ensure that a representative set of major accident scenarios are inspected; and because sites with large quantities of dangerous substances, complex processes and processes that operate at high temperatures and pressures tend to have greater risks - making them a higher inspection priority.

Reports of major accidents and other accidents, incidents and near misses.

All reports of COMAH major accidents should be investigated promptly. Sites that have poor incident history are likely to require more frequent inspection and be a higher inspection priority.

Complaints. All complaints alleging breaches that could lead to a major accident should be investigated promptly.

Receipt of revised safety reports. Plans should be reviewed and, where necessary, revised to take account of new information when revised safety reports are assessed.

Changes of site ownership. Sites should be contacted within one month of HSE being notified of changes. The purpose of the contact is to establish the significance of the change and determine when an intervention is necessary.

New knowledge about scientific or technical matters.

When inspectors receive new intelligence that could have significant impact on existing major hazard controls they should contact relevant sites promptly and in any case within one month. The purpose of the contact is to alert duty holders to the new information and determine when an intervention is necessary.

Reports of modifications, rebuilding, plant extensions etc. where there are significant repercussions for major accidents.

Sites should be contacted promptly and in any case within one month of HSE being informed of developments. The CA will normally receive notification of such modifications under regulation 8 of COMAH.

Frequent process chemistry changes.

Sites which are subject to frequent process changes need to have robust change management systems which need to be checked/verified during each five year period.

Major changes in staffing levels. Sites should be contacted within one month of HSE being notified of changes. The purpose of the contact is to assess the impact of the changes and determine when an intervention is required.

Lead unit intervention plans. Certain sites which are part of a lead unit company may receive less frequent visits when they share common processes and management arrangements with others and HSE can be confident that intervention findings at one site will be disseminated and acted upon by others within the company.

20. Plans should identify, in order of priority, all major hazard work that is considered necessary at a site over the period of the plan. Priorities will be determined by the major accident potential of a failure of risk control measures: the greater the potential, the higher the priority. For TT COMAH sites the information in safety reports and advice from predictive and discipline specialists will inform priorities. For LT COMAH sites regulatory inspectors will need to seek information from operators about major accident scenarios and key control measures, seeking advice from predictive and discipline specialists as necessary.

21. Inspectors may also include other, non-major hazard work in plans at the discretion of those preparing the plan.

ROLES AND RESPONSIBILITIES

22. We adopt a team approach to planning and carrying out interventions and follow the principles below:

• Regulatory and discipline inspectors should jointly develop, agree and review intervention plans;

• Regulatory inspectors manage the intervention programme and all HSE staff visiting installations should agree the purpose of their visit with the site regulatory inspector before visiting;

• Units should plan to deploy regulatory and discipline inspectors where their respective skills and knowledge are most appropriate to address intervention topics.

23. In most cases the site inspector i.e. the Band 3 regulatory inspector will be responsible for preparing the intervention plan, communicating it to EA/SEPA staff and completing the CIS planning templates. Discipline specialists, EA/SEPA staff and line managers are responsible for contributing topics for inclusion, providing details of their available resources for implementing plans and recording information on the CIS templates. For TT COMAH establishments the safety report assessment team is responsible for agreeing the post-assessment intervention plan. Appendices 1 (TT) and 2 (LT) summarise the roles and responsibilities of those involved in the planning process.

24. The Band 3 regulatory inspector should liaise with discipline specialists, EA/SEPA and others as necessary when carrying out reviews.

25. The Head of Land Division is ultimately responsibility for ensuring that the intervention planning process and procedures are implemented and that available resources are deployed such that field teams are able to implement the procedures.

LINKS WITH THE ENVIRONMENT AGENCIES

26. Chapter 11 of the COMAH Manual (SIP Products 2(b) and 2(c)) explains the agreed intervention planning arrangements between HSE and the agencies. In summary, Band 3 regulatory inspectors should include planned agency major hazard interventions at COMAH establishments on CIS. Inspectors have discretion to determine how much detail to include but should at least identify the intervention topic and record when the work has been completed. EA and SEPA officers should inform HSE of work they have done at COMAH establishments.

27. COMAH also requires the CA to communicate to operators of TT establishments the conclusions of its examination of safety reports. This includes informing operators which topics from the assessment process will be carried forward into the intervention plan for the period of the plan. See the COMAH Safety Report Assessment Manual, Part 1 Chapter 4 for more information.

FORMAT OF INTERVENTION PLANS

28. A format for intervention plans can be found as a template on the HID Templates tab in Microsoft Word and should be linked to the incumbent record on CIS when completed. LD will review the recording arrangements because inspectors have sometimes found the template difficult to use for preparing a single establishment plan at large complex establishments with several COMAH installations.

29. The plans should identify any follow-up interventions necessary to check that duty holders have complied with requirements. For COMAH establishments this will help meet the requirement in regulation 19(3)(d) to pursue matters where necessary within a reasonable period following inspections.

MANAGING RESOURCES

30. Major Hazard Intervention Policy provides information on inspection policy and identifies factors to consider when prioritising interventions at LD premises. Plans should be realistic and be based on the resources that are available. However, Band 1 Heads of Unit should be informed of work that inspectors consider necessary but which cannot be resourced. Band 1s are responsible for deploying resources across their units to ensure that necessary major hazard work is done. Decisions to re-prioritise planned work in intervention plans due to resource issues should be explained and recorded on the CIS intervention planning template.

INFORMING DUTY HOLDERS AND EMPLOYEES

31. Duty holders and their employees should be informed of the contents of intervention plans, both for individual sites and, where relevant, for lead unit companies. It is not necessary to provide a copy of the plan itself. This helps meet HSE's statutory duty under Section 28(8) of the Health and Safety at Work Act and can help establish ownership of plans by duty holders and employees. It can be used to confirm that the correct issues have been identified, particularly if duty holders and employees are given the opportunity to discuss the plans

and influence priorities. However, whilst these views should be taken into account, responsibility for the plan rests with the regulator and inspectors have the final say over its content.

32. It is good practice to meet with duty holders' directors/senior managers to discuss plans. This ensures that the controlling minds of duty holders are aware of priority issues. Note that plans should only be released to duty holders and their employees once resource issues have been resolved. For establishments subject to charging the plans will also assist duty holders' budgeting. It is not necessary to provide full details of proposed work and inspectors should retain the option of carrying out unannounced visits.

Appendix 1

SUMMARY OF INTERVENTION PLANNING PROCESS FOR TT COMAH ESTABLISHMENTS

WHO WHAT WHEN NOTES

Safety report assessment team

Agree intervention plan. Plan should as minimum include

At safety report assessment outcome meetings; or 5 years after

This is the initial plan & framework for future

verification of control measures for receipt of an operator's first safety interventions major accidents. Topics will be re- report visited on rolling programme, frequency depending on information / performance factors

Line manager (usually Agree resources for plans. Resolve At safety report assessment Band 2 site regulatory any disagreements outcome meetings; or 5 years after inspector) of person receipt of an operator's first safety preparing plan report

Line manager (usually Refer any outstanding issues, Soon after SR assessment Band 2 site regulatory especially resource problems, to outcome meeting inspector) of person Band 1 preparing plan

Person preparing plan Prepare intervention plan and When the plan has been agreed by (usually Band 3 site complete CIS template the assessment team regulatory inspector)

Line manager of person Complete 'Band 2 endorsement' When the plan has been agreed by preparing plan section of CIS template the assessment team

Band 1 Head of LD Take decisions on any outstanding Soon after safety report This action is only field unit issues referred by the Band 2 and assessment outcome meeting required by Band 1s

record the decisions on the CIS when issues are planning template referred to them

Band 1 Head of LD field unit

Consider plan and complete Band 1 endorsement section of CIS template

Soon after safety report assessment outcome meeting for initial plan and annually as part of annual work planning cycle; and at other times as necessary

COMAH TT only

Person responsible for Monitor implementation of the plan Throughout each year of the plan preparing plan

Person leading specific Record outcome of intervention Soon after each intervention interventions

Person responsible for Record outcome of agency-only Soon after each intervention preparing plan interventions

All those identified in Implement their part of the plan As specified in the plan the plan

All those identified in Inform Band 3 site regulatory As soon as possible the plan inspector if unable to fulfil

commitments

Band 3 site regulatory inspectors and their line

Review implementation of previous year's plan and identify

Annually as part of annual work planning cycle; and at other times

Need to liaise with others identified in plan

managers resources/dates for next year's as necessary e.g. when revised to confirm their plan. Information / performance safety reports are submitted availability factors will influence priorities & frequencies

Appendix 2

SUMMARY OF INTERVENTION PLANNING PROCESS FOR LT COMAH ESTABLISHMENTS

WHO WHAT WHEN NOTES

Site regulatory Agree intervention plan. Plan Following appropriate This is the initial plan & inspector, their line should as minimum include contact/consideration of MAPP framework for future manager, discipline verification of control measures for interventions specialist inspector(s) major accidents. Topics will be re-and agency officer visited on rolling programme,

frequency depending on information / performance factors

Line manager of person Agree resources for plans. Resolve Following appropriate preparing plan (usually any disagreements contact/consideration of MAPP Band 2 site regulatory inspector)

Line manager of person Refer any outstanding issues, When necessary preparing plan (usually especially resource problems, to Band 2 site regulatory Band 1 inspector)

Person preparing plan Prepare intervention plan and When the plan has been agreed (usually Band 3 site complete CIS template regulatory inspector)

Line manager of person Complete 'Band 2 endorsement' When the plan has been agreed preparing plan section of CIS template

Band 1 Head of LD Take decisions on any outstanding Soon after referral This action is only field unit issues referred to them. Record the required by Band 1s

decisions on the CIS planning when issues are template referred to them

Person responsible for Monitor implementation of the plan Throughout each year of the plan preparing plan

Person leading specific Record outcome of intervention Soon after each intervention interventions

Person responsible for Record outcome of agency-only Soon after each intervention preparing plan interventions

All those identified in Implement their part of the plan. As specified in the plan. the plan

All those identified in Inform Band 3 site regulatory As soon as possible the plan inspector if unable to fulfil

commitments

Band 3 site regulatory Review implementation of previous Annually as part of annual work Need to liaise with inspectors and their line year's plan and identify planning cycle; and at other times others identified in plan managers resources/dates for next year's plan

Information / performance factors as necessary to confirm their

availability will influence priorities & frequencies

Incumbent Ratings System

• Introduction • Rating file note • Application • Further information • Description of the rating system • Annex 1 - Application of the HID (LD) Rating • How to allocate rating to incumbents System • When to rate incumbents • Annex 2 - Rating Criteria • Flexibility • Annex 3 - Background Information • How the rating system is to be used • Annex 4 - Example Input Screen • Entry to the rating input screen • Annex 5 - CIS Ratings Profile

INTRODUCTION

1. This Chapter provides guidance to enable inspectors to understand and use the rating system and Annex 3 provides more general background information.

2. The aim of the rating system is to prioritise incumbents for inspection in a consistent, logical and defensible way. It is a facility that can be used flexibly by management to design inspection programmes and is not intended to be a constraint over professional judgement.

3. The new HID (LD Units 1-4) CIS incumbent rating system replaces the FOCUS rating system that was designed for the wider range of FOD incumbents. This system is very much simpler but retains the necessary elements to ensure that incumbents are inspected on a priority based on risk.

APPLICATION

4. The rating system applies to most incumbents that are inspected by HID LD. The exceptions are where the rating would not serve a useful purpose or where we use an alternative system to select incumbents or clients for inspection. The application to particular activities is described below and summarised in Annex 1.

5. COMAH TT establishments

Regulation 19 requires "a programme of inspections for all establishments". For Top Tier establishments there should be an inspection by the competent authority at least once in 12 months unless the programme is based on a systematic appraisal of major accident hazards. This is described more fully in Major Hazard Intervention Plans. Because there is a presumption of annual inspection and an annual review of the inspection plan for each TT establishment based on a consideration of the risks, the assessment of the safety report and the inspection history, there is nothing to be gained by including a rating. Therefore, TT establishments are not rated.

6. Non Major Hazard aspects of TT establishments

These can be dealt with by creating, using and rating a separate unit or units for these topics and considered independently of the TT work.

7. Explosives

For explosives COMAH sites the approach identified in para 5 will form the basis of the inspection programme. For explosives non-COMAH sites the current explosives rating system will continue as it provides a structured means of identifying the essential criteria pertinent to explosives eg. sensitiveness, quantities, quantity distance relationships and others in determining the risk level and prioritising an inspection programme. This explosives rating system links into the HID LD rating system at the "initial rating" stage.

8. Pipelines

Inspection priorities are determined by inspectors' knowledge of operators and their professional judgement drawing on information from Pipelines Notifications, Offshore and Onshore Safety Cases (eg. GSMR). This is a matter for Unit 2 and the establishment of client based inspection programmes.

9. CDG

The principle intervention is by roadside checks with reactive visits to head offices. This can be managed by preparing inspection plans for individual clients rather than incumbents. If the head office is associated with an establishment inspected by HID then that incumbent would be rated.

10. Section 6

Supply issues should be dealt with by both reactive and proactive visits and these are described in, "FOD Guide to the inspection of manufacture and supply of products and substances". This does not suit a rating system and a programme of client based inspection should be applied.

11. Other cases

There may be some dutyholders for whom inspection is planned and conducted using a strategic company specific approach. The current example is Transco where the Gas Safety Lead Team, under the management of HID LD 2, have prepared and agreed a three year rolling programme with the industry and provided this information to inspectors. Any additional examples will need to be dealt with on a company basis, be subject to review and supported by HID MB.

DESCRIPTION OF THE RATING SYSTEM

12. The rating system provides a consistent and auditable way of prioritising the inspection of incumbents.

13. It does not propose frequencies of visits or targets but can be used to direct resources where they are most likely to be needed.

14. The rating system enables this resource to be used to the best effect by identifying those incumbents with the highest overall rating. The rating is derived by inspectors considering the intrinsic "hazard" of the activity and the adequacy of "control" of the risks leading to an "initial rating". An "elapsed years" factor is added automatically to give an "overall rating".

HOW TO ALLOCATE RATINGS TO INCUMBENTS

15.

a. Hazard. (See Annex 2, Table 1) relates to the hazard inherent in the processes carried out by the incumbent. It is not concerned with generic hazards such as the use of fork lift trucks, working from heights or provision of welfare facilities. The incumbent needs to be put into one of the categories according to the table which will produce a score from 1-7.

Note:

i. Where an irregular site specific Consultation Distance (CD) has been established take the furthest distance for categorisation.

ii. If the "consent" Regulations have resulted in an artificially high CD based on the maximum possible inventory that has been applied for then although a CD for the actually quantity held is more appropriate for rating purposes the issue is not of sufficient concern to be taken into account. Use the CD applied for planning purposes.

iii. The table illustrates how types of incumbents may be rated but any particular incumbent may actually be more appropriately placed in a different category from that suggested. That is a matter of judgement (See also para 19).

b. Control. (See Annex 2, Table 2). This is a measure of the duty holders performance in controlling the risks and is linked to the actions that an inspector considers appropriate after the visit. Inspectors' actions should be based on the application of the Enforcement Management Model. This means that this judgement of control is a fair reflection of the risk . Having established the broad band of control ie good, medium or poor, inspector's can select an appropriate score, taking their confidence in management into account.

These two elements are combined simply to produce an initial rating by averaging. A copy of the input screen is included in Annex 4 .

Note: The input of the Hazard and Control are not for explosives incumbents but a figure will be added directly to the "initial rating "box. For other inspections this box does not require an entry as it is calculated by CIS automatically from the Hazard and Control figures.

c. Elapsed Years. The elapsed years is derived from the time since the last rating. An entry is required in the "Date of Rating" box. There is no input required for elapsed years - it is automatically added to the rating when an entry is made. The elapsed years are measured from the year of the last inspection and this element does not take account of investigations and other interventions.

WHEN TO RATE INCUMBENTS

16. The aim of the rating system is to provide a means to prioritise the future inspection of the incumbent. Therefore, a rating should be applied after each inspection. It flows naturally from asking the question - "What should the future inspection approach be?"

17. However, there may be other interventions such as the investigation of complaints, accidents or dangerous occurrences which provide information about the control standards that ought to be reflected in the rating. For example a previous perception of good control may be undermined when information comes to light during an accident investigation and this should be reflected by increasing the control element of the rating. If such an amendment is made then it should be recorded in the Rating File Note (see para 25.)

18. If this amendment is made then it is still necessary, because of the built in CIS validation system, to change the "Date of Rating". However, to retain the existing elapsed years it is suggested that the consecutive rather than actual date be added. eg from 03.07.97 to 04.07.97. (A fudge that may be eliminated with updates of the CIS programme.)

FLEXIBILITY

19. The rating is dependent on the inspector's judgement and whilst the guidelines should be followed for the scoring system there may be some particular issue which suggests an alternative score be given.

20. This is acceptable provided a reason for the change from the guidance is recorded on the Rating File Note (see para 25.)

21. As an example, some inspectors have devised their own criteria for the prioritisation of visits based on such issues as inventory coupled with proximity to sensitive areas ie. a larger Chlorine storage facility close to housing will require prioritisation over a facility in a rural location. These local issues can be taken into account in modifying the hazard element.

HOW THE RATING SYSTEM IS TO BE USED

22. The rating system will primarily provide a means to prioritise inspections. The outputs from CIS can be used to draw up a profile of ratings for each Field Management Unit (Group), LD Unit or for all of HID LD.

23. Each management unit will then be able to select establishments for inclusion in an inspection programme for the year. A detailed method for doing this is provided as Annex 5. The process will be as follows:

a. Estimate the resources available for non Top Tier work,

b. Derive from National figures the number of incumbents that can be inspected with that resource. (Approximately one contact per available day).

c. Select a corresponding rating to produce that number of incumbents.

d. Input to CIS which will produce a list that can be saved ,stored, ordered, updated etc.

ENTRY TO THE RATING INPUT SCREEN

24. When reporting on an intervention the Rating Input Screen should be opened and the Hazard and Control ratings selected from the drop down menu. The "Date of Rating" should be entered in the form dd/mm/ yyyy. ie 05/07/2001.

RATING FILE NOTE

25. The Rating File Note can be located at the Issue Screen and has been specifically provided to enable any comments of references to the rating system to be recorded. For example, when amending the rating after an investigation (see para 17) or when making an amendment tot he rating because of local factors (see para 20) it is necessary to record the action taken. This information will be necessary to enable a following inspector to see why a particular rating has been given.

26. In addition the Rating File Notes can be analysed centrally to enable consistencies or trends to be identified and to support any audit of the system.

FURTHER INFORMATION

ISSUE CONTACT

Operation and Implementation of Incumbent Rating System David Kyle, LD CSSU

HID Rating System Policy and Procedures Neil Rothwell, HID OPU2

CIS HIDHelp, via Lotus Notes or VPN 523 4194

Annex 1

APPLICATION OF THE HID (LD) RATING SYSTEM

The use of Ratings or alternatives for preparing HID inspection programmes

Topic Application of rating system

Major Hazard work

COMAH TT A rating system will not be used.

See Major Hazard Intervention Plans for inspection plans for these establishments.

COMAH LT Rating system applies.

NIHHS As above.

Non Major Hazard issues at MH The expectation is that where there are significant Non MH issues at MH premises premises (and this is likely to be for the majority) then one or more separate inspection Units

will be created or designated and rated.

Explosives Note that some explosives sites will be subject to COMAH (TT).

For COMAH (LT) explosives inspectors will retain their own rating system but link this to the rating system.

Pipelines Rating is not appropriate and reliance is placed on a system of centrally co­ordinated client based inspection programmes.

Carriage of Dangerous Goods. The rating of premises is not representative of the CDG risks and reliance is placed (CDG) on a system of client based inspection programmes.

Section 6 and supply issues. A system of reactive and proactive visits is described in the FOD Guide and the inspections should be largely reactive based on specific client information.

Non MH premises. Rating system applies.

Annex 2

Table 1

RATING CRITERIA

Table to determine the appropriate Hazard category

Hazard Description

Indicators Examples Score

High Incumbents subject to COMAH LT with a CD >/= to 250m.

LPG Bulk storage, 7

Chlorine storage in drums.

Incumbents subject to COMAH LT with a CD < LPG smaller bulk storage. LPG gas cylinder 6 250m. (Extending off site) storage.

Chlorine in cylinders.

Incumbents where there is a potential risk to Incumbents that store/use large quantities of 5 the public and multiple fatality to employees toxic gas or LPG but are below the COMAH LT inherent in the process. threshold.

Medium Incumbents subject to COMAH LT with a zero CD or CD entirely within the site boundary.

Premises where COMAH applies due to the environmental risk.

4

Some gas holders and storage of flammable liquids sites.

There is potential for fatalities or multiple Paint manufacturers not subject to COMAH. 3 serious injuries to employees from the process.

Most pharmaceutical companies. or

There are large quantities of toxic or harmful substances in use.

Low No potential for fatality or serious injury from the process.

Production of toiletries. 2

Limited or no use of toxic or flammable substances.

Most Laboratory work where chemicals are used on a small scale.

No foreseeable risks from the process. Small scale repackaging. 1

Annex 2

Table 2

TABLE TO DETERMINE THE APPROPRIATE CONTROL CATEGORY

Control Description

Action Taken (Based on the EMM) Confidence in Management Score

Good Provision of advice or confirmatory letter only with no plans for follow up.

All the evidence shows that the company is self regulating and standards are likely to be maintained.

1

The high standards may not be maintained. 2

Medium Letter requiring action to be taken of sufficient concern to plan a follow up visit or seek

Standards are likely to be improved. 3

confirmation that action has been taken. Standards are likely to be maintained. 4

The standards may deteriorate. 5

Poor Formal enforcement action taken or proposed. Standards may improve. 6

There is no evidence indicating that the standards will improve.

7

Annex 3

BACKGROUND INFORMATION

Validation

28. In designing the new rating system account was taken of the views of inspectors and their experience of the previous FOCUS system. The key elements required by inspectors were:

a. simplicity;

b. clarity;

c. no hidden calculations and adding of weightings;

d. relevance, such that inspectors had confidence that the rating was meaningful.

29. An early draft of the proposal was put to a number of inspectors and a pilot exercise run with a favourable response. The only real concern being that some less experienced inspectors thought that they may have difficulty in making a judgement of the hazard and control elements. The guidance has been expanded following the pilot and this issue should be resolved.

30. It is important that any difficulties in understanding what is required or the use of the system is reported to OPPG so that modifications can be made to achieve continuous improvement.

31. The information on CIS will be analysed by OPPG and useful information produced to help direct future priorities and particularly to provide evidence of the balance between COMAH and non major hazard work.

Advantages of the new system

32. HID is not driven by the rating system but can use it to prioritise inspection using the available resources.

33. The rating system is sufficiently flexible to enable inspection cut off points to be specific to groups depending on other demands.

34. It is easy to see what the cut off overall rating (OR) means in practice. For example an OR of 7 means that medium hazard/ medium control incumbents are inspected with 3 elapsed years.

35. The system demonstrates equivalencies. That is incumbents with the same OR might either be high hazard/low control with no elapsed years or low hazard/high control and many elapsed years or any combination of these factors. As a Division we will be able to judge whether the inspection programme looks balanced and the inspection resource sufficient to include appropriate establishments in the programme.

36. The system sets parameters in that high hazard incumbents cannot have an inspection rating of less than 4 and a low hazard premises cannot have an inspection rating of more than 4.

Limitations

37. The system does not distinguish between health and safety. Experience suggests that this is not necessary and inspectors should rate on the basis of what they see, evaluate and take action on - whatever the topic.

38. The system will not hold historical data of rating. Whilst this might be considered a lost opportunity to analyse trends etc in practice the present system cannot be used for this purpose. To design a system with this capability would require a much more complex equation and substantial time to complete at each visit. The gains in simplicity and clarity outweigh the monitoring option.

Annex 4

EXAMPLE INPUT SCREEN

Annex 5

CIS RATINGS PROFILE Purpose

The CIS Rating System provides a consistent and auditable way of prioritising the inspection of incumbents. It does not propose frequency of visits or targets but can be used to direct resources where they are most likely to be needed.

The outputs from CIS can be used to draw up an:

• Overall Ratings Profile; or

• Inspection Programme;

Each Management Group will be able to select incumbents for inclusion in an inspection programme for the year. This annex explains how to do this.

HOW TO CREATE AN OVERALL RATINGS PROFILE

Each management group will be able to select establishments for inclusion in an inspection programme for the year.

To create the Overall Ratings Profile, take the following steps in CIS:

1. Log into CIS.

2. Click on Reports at top of screen.

3. Highlight Reports List.

4. Click on 23 (incumbents rating by overall band).

Click next Click find management group (eg LD3D) (NB. Search in present year). Click next Click finish The information will be displayed in a similar format as at Annex 1 and can be copied/pasted into a word processing file or can be printed from the screen.

HOW TO COPY/PASTE INTO A .doc OR .lwp FILE

1. Right-mouse click " properties " remove P from 'display only' " ok. Highlight all text. Right-mouse click " copy.

2. Open up Microsoft word/lotus word and create a new document and paste the information into the new document. (Some adjustments may need to be made to the presentation of the table)

HOW TO CREATE AN INSPECTION PROGRAMME

Firstly, you will need to create an Overall Ratings Profile as above (an example is shown below).

An Overall Ratings Profile for a Management Group

Rating 1 2 3 4 5 6 7 8 9 10 >10 Total

Incumbents 0 0 9 120 97 58 23 12 6 0 1 326

Units 0 0 0 0 0 0 0 0 0 0 0 0

Total 0 0 9 120 97 58 23 12 6 0 1 326

You will need to identify the resource available for inspection of non TT COMAH establishments for the year (e.g. 42 staff days). Because approximately one inspection can be completed for each available staff day you need to search for 42 establishments. From the profile it can be seen that 42 establishments can be identified from a rating of 7.

From this profile you can select the highest rated incumbents for inclusion in the inspection programme.

To create a programme for inspection, take the following steps in CIS:

1. Log onto CIS

2. Click on incumbents icon at top of screen.

3. Click on the Ratings tab.

4. Right-mouse click " find " advanced " add. In the field box select management group name from the drop down menu. In the condition box select is exactly to Type in the management group name (eg LD3D) (all search

entries are case sensitive) In the logical box select and In the field box select overall rating from the drop down menu. In the condition box select (is after or equal to) and type in value eg.(7)

5. Click Start Search (42 rows retrieved) – This is the priority list of establishments for inspection. To sort the list alphabetically, double click on the grey area of Client Name at the top of the list. This will sort the list in ascending or descending order as required. You can print the entire list at this point if you wish (Step 7).

To find out which of these 42 sites are COMAH LT, steps 1-5 will need to be repeated and the following step included:

6. In the logical box select and In the field box select hazard rating from the drop down menu. In the condition box select (is after or equal to) and type in value 6 (a hazard rating of 6 or more are COMAH LT). Click Start Search (11 rows retrieved) – This is the priority list of COMAH LT establishments taken from the priority list of establishments for inspection.

7. File "print data list " ok. (The information will be displayed in a list format containing client and location details).

Inspection Techniques

• Introduction • Follow-up • The Inspection Process • Techniques Applied Across the HID sector • Inspection Techniques Available • Mailshots and Seminars • Application and Appraisal of Techniques • Inspection tools • TORCH (Transferring Ownership Responsibility and • Management Oversight and Risk Tree (MORT)

Commitment for Hazard control) Analysis; Investigative Methods • Audit • Producing Inspection Plans • TRAM (Technical Risk Audit Method) • Appendix 1 - Inspection Plan

INTRODUCTION

Purpose of the chapter

1. The purpose of this chapter is to provide a guide to inspectors on the aims of inspection, the techniques of inspection available, their resource implications and benefits, and how they link to inspection plans The guidance is based on the 4 high level principles agreed by the DMB under the Inspection Strategy Project in 1998. They are set out below.

a. A range of techniques should be selected with the aim of obtaining greatest effectiveness for the input of resource;

b. Methods for assessing the effectiveness of intervention need to be built into the inspection plan;

c. HID should operate longer term inspection plans with some occupiers;

d. Longer term inspection plans should take account of company health and safety plans as well as business changes.

2. The chapter covers 3 areas - the inspection process, inspection techniques and inspection plans

Definition

3. The term 'inspection' covers the wide range of intervention activities from preventive inspections through to audits and specifically includes investigation. In particular the integration of investigation and inspection is covered.

THE INSPECTION PROCESS

The aims of inspection and investigation

4. From the paper by PJC Scott (FOD) on “The Practice of Inspection” the FOD IN code and the HSE framework for investigations the following aims of inspections and investigations can be derived.

5. The aims of inspection are:

a. To satisfy HSE and other stakeholders that those with duties are complying with their legal responsibilities;

b. To make an assessment of the adequacy of control of risk posed by the work activities to employees and others, and any measures required to ensure adequate control;

c. To persuade, and if necessary enforce, businesses to take action to achieve compliance with the legal minimum standards, such action being commensurate with the risk;

d. To encourage businesses actively to manage health and safety as an integral part of their business, thereby reducing accidents and ill-health through the application of cost-effective controls;

e. To disseminate information and guidance about how to comply with legal requirements;

f. To encourage employees and their representatives to co-operate and play their part in achieving appropriate standards of health and safety controls;

g. To collect information, for distribution as appropriate, as a means for developing legislation, policy and guidance on health and safety at work.

6. The aims of investigation are to:

a. Identify the immediate and underlying causes and consequences of the event;

b. Rectify conditions giving rise to the particular accident;

c. Identify any breaches of the law and the appropriate action to be taken in the circumstances;

d. Ensure that similar conditions are not repeated in other parts of the same premises;

e. Satisfy the expectations of the public, the media and pressure groups who expect action from HSE when a serious accident occurs;

f. Act as a starting point for the analytical assessment of management's ability - a starting point as effective as a basic inspection in some places;

g. To contribute to HSE's knowledge of the causes of incident;

h. Identify any shortcomings in policy, guidance or legislation and any consequential research;

i. Help HSE evaluate the effectiveness of inspection activity; inform duty holders and the public about the causes of incidents and any relevant findings from investigations and;

j. Meet the reasonable expectations of relevant stakeholders in line with Open Government Commitments.

7. These aims should be kept in mind and used to guide inspections and investigations.

The integration of investigation and inspection

8. From the above it can be seen that inspection and investigation have much in common and could both be defined as : "a process for independent assessment of the adequacy of control of work risks, within a legal framework of duties, standards and sanctions".

9. The list below draws together the key aims of inspection and investigation:

a. to make an assessment of the adequacy of risk control measures;

b. to persuade, and if necessary enforce, businesses to take action to achieve compliance with the legal minimum standards;

c. to encourage businesses to manage health and safety;

d. to disseminate information and guidance about how to comply with legal requirements;

e. to encourage the involvement of employees and their representatives in achieving and maintaining standards of workplace health and safety.

10. Investigative work has, in the past, been seen as distinct from inspection, and time spent on the two activities is (and will continue to be) recorded separately. These factors have contributed to the perception that the activities are entirely separate, which in practice is not the case. Inspection and investigation both require the inspector to use the techniques of observation, document review, questioning, reviewing evidence etc. - the significant difference lies in the event which triggers the inspection activity. Inspection and investigative activity both contribute to HSC/E Continuing Aim 2 - to secure compliance with the law in line with the principles of transparency, proportionality, consistency and targeting (TPCT) on a risk-related basis.

11. The IN Code also refers to links between inspection and investigation: 'The investigation of an accident can be used as a starting point for basic inspection,.... Accident investigation can in these cases and in others effectively form part of the basic inspection. It enables both the inspector and management to discuss gaps in management's arrangements for complying with HSWA section 2.'

12. Since the publication of HSG 65, inspectors in FOD, HID and ODDs have targeted their attention on the management issues underlying workplace health and safety - and investigative work should be no different. Investigative techniques such as MORT, Events and causal factors analysis and Root cause analysis all link the investigation of technically complex incidents back to initiating events including health and safety management failings. The conclusions from such an investigation can add significantly to HID's intelligence about a site and make a major contribution to the inspection plan.

13. The activities of investigation and inspection are closely linked, and should inform each other e.g. the findings of an investigation should shape the inspection plan, or may indicate that there would be value in applying a particular inspection technique and the conclusions of an inspection may suggest that particular types of accident should be investigated. The two techniques have common purposes, and in order to achieve the most effective use of HID's interventions, investigation should not be seen as separate from inspection, but in effect as reactive inspection. The boundaries between inspection and investigative activity are not, and should not be, rigidly defined.

14. HID must make the best use of interventions - whether recorded as inspection or investigation. The existence of an inspection plan for a site will facilitate this, by identifying topics for inspection, suggesting effective techniques, and indicating the inspection frequency. The inspection plan must cover both proactive and reactive inspection. There are two main factors which determine the effectiveness of investigation within an inspection plan:

a. Selection of the appropriate incidents for investigation; b. Using the findings of investigations to amend the inspection plan.

15. The topic of inspection plans is discussed more fully later in this chapter (para 93)

16. The OMF (Operations Management Forum) paper (OMF 97/1/6) 'A study of the Application of Quality Assurance Techniques to the Regulatory Activity of FOD and non-HSE Regulators' considers the role of investigation within inspection, including the extent to which accident notifications should prompt and inform inspections. The paper concludes that as a source of information on risk, accident notifications are arguably more reliable (if only because they are in 'real-time') than historical data, such as inspection ratings. They also allow for more sharply targeted inspections.

17. The appropriate selection of accidents for investigation is vital. The HSE Enforcement Statement quality standard document for investigation lists the following selection criteria:

a. actual and potential severity;

b. seriousness of potential breach;

c. track record of duty-holder;

d. enforcement priorities;

e. practicality of achieving results;

f. relevance of event to wider range of premises;

g. political factors and public expectations;

h. legal factors.

i. short term resource constraints.

18. Other relevant factors to be input to the criteria could include HID objectives, companies' approach to the problem and the number and frequency of accidents.

INSPECTION TECHNIQUES AVAILABLE

19. This section sets out the techniques commonly used across HID to influence standards of workplace health and safety. They can be divided into three main groups, depending on who uses them, and how they are applied. Although some techniques are more commonly used than others each technique has circumstances where its use will be appropriate.

20. Techniques applied to specific sites;

a. To assess and influence the adequacy of risk control measures:

i. Inspection - Proactive and reactive

ii. TORCH

iii. Audit

iv. TRAM

b. To assess the adequacy of response to HID's contact:

i. Follow up

21. Techniques applied across the HID sector;

a. To assess and influence the adequacy of risk control measures:

i. Projects

ii. Seminars and mailshots

b. To assess the adequacy of response to HID's contact:

i. Follow up

22. Techniques applied by industry;

a. Benchmarking

b. Self assessment

23. The relationship between these techniques is shown diagrammatically below.

24. Note: An important and integral part of all inspections, regardless of the technique used, is contact with employees and safety representatives, whether appointed under The Safety Representatives and Safety Committees Regulations 1977 or elected under The Health and Safety (Consultation with Employees) Regulations 1996. HID needs to continue to ensure that contacts are made and that employees have the opportunity to raise concerns.

25. Inspectors use various 'tools' to carry out the techniques listed above. Some of these form part of the core competencies for HID inspectors, e.g. legal and technical training, project management, negotiating, presentation skills etc. But in addition there are some recently developed tools which may be used to complement/add value to the inspection process. These tools do not stand alone as the techniques listed above do, but are used to carry out the inspection technique.

26. These inspection tools include:

a. Climate survey tool;

b. MORT analysis;

c. Events and causal factors analysis;

d. Root cause analysis.

27. Further details of the inspection tools are provided later in this chapter (para 81)

APPLICATION AND APPRAISAL OF TECHNIQUES

Preventative Inspection

Background

28. Preventive inspection is the most widely used technique by which HID, in common with HSE's other operational directorates and divisions, assesses standards of control of workplace risks and compliance with legal requirements, leading to regulation. It tends to be process-orientated and can be either hardware or management systems led. In its application, inspectors draw on visual observation, discussion with management and employees, and review of relevant documentation. Visits may be unannounced, or carried out by appointment. The technique may be performed by one inspector, or a multi-disciplinary team.

29. The application of inspection is discussed in Section 2.2 of the 'FOD Guide to the inspection of health and safety management' (the 'FOD Guide'), but this section does not apply the term in the broadest sense of the use suggested in this chapter

How applied

30. Inspection is a flexible technique which can be adapted to a wide range of circumstances. For example, it can be applied across a whole workplace, or to selected parts of it in unitised premises. It can also be used to assess discrete activities or processes, in which case the term 'topic' inspection is commonly used. In all cases, the purpose of the inspection is to assess the adequacy of control of workplace risks.

31. For the purposes of work recording and planning various parts of inspection activity (investigations and enforcement) are separated, and will continue to be so. The recording arrangements are for administrative and political reasons, and should not be taken as implying any difference in application. Inspection can be either proactive or reactive. The technique applied is the same in both cases - the triggering event differentiates

between them. Reactive inspection i.e. investigation will be prompted by a report of an accident, complaint, occupational ill-health or as a result of allegations of breaches of the law (e.g; from local authorities, fire authorities, insurance companies).

Resource requirements

32. Inspection is generally regarded as a relatively quick process and between 0.5 and 1 day of site time is used as an estimate, but there can be variation from this. Large premises are commonly unitised, with each unit traditionally representing about half a day's inspection. The time required for FOCUS data entry, the production of letters and the initiation of follow up action are in addition to site time. The 'office' time is recorded on FOCUS as non-contact time. A 1:1 ratio of site time to office time is typical.

Appraisal of Application by HID

33. Inspection is perceived by HSE as effective because it produces change - immediately if necessary. However little has been done in the way of formal evaluation of inspection. It also provides a quick assessment of the level of risk in a company, informs the HID inspection strategy - the most suitable inspection technique and the relevant topics. The process of preventive inspection is subject to line management review. The technique is flexible - inspectors can modify their approach and priorities during an inspection as circumstances require. The technique is equally valid in large complex workplaces as it is in roadside inspections of the carriage of dangerous goods by road.

Other issues

34. Team working is being used by HID 1, with inspectors acquiring topic specialisms to be applied as needed. The Railway Inspectorate are currently increasing their use of team working, to make the best use of inspectors' experience and expertise. This team working is not always formal (although teams are formally set up for work such as major investigations), but are created to meet the needs of an inspection or investigation.

35. OSD inspectors end all inspections with a close-out meeting with management - a debriefing with the offshore installation manager followed by a management meeting on shore. Typically HID's practice is for all visits to end with a summary discussion to give priorities, direction and timescales etc to the occupier.

TORCH (Transferring Ownership Responsibility and Commitment for Hazard control)

Background

36. The principles and application of the TORCH technique are outlined in Section 2.3 of the 'FOD Guide'. TORCH provides a method of assessing the health and safety management issues in a way which informs HSE but which aims to help employers understand health and safety management as applied to their workplace. It aims to involve the employer in identifying the main risks, controls and management actions required. The 'FOD Guide' contains an outline of the technique, and full details are in the 'TORCH pack' produced by the Operations Unit.

How applied

37. TORCH is mainly based on interviews, with an element of workplace inspection. The technique can be applied to organisations of all sizes. It is best suited to SMEs which have defined management structure, but where auditing by HID is not appropriate. It can be administered at a single site or to representatives from a number of sites at a workshop.

Resource requirements

38. The resources required for a TORCH inspection are variable. The application of TORCH at a single site is likely to require one day on site, with minimal office time, but several brief follow-up contacts, which may not necessitate a site visit. Carrying out a TORCH workshop for up to 30 occupiers lasting half a day will typically require about 2 days of Band 6 time to organise it, and five Band 3 staff to deliver the workshop. A half day visit is made to all the sites, and follow-up is important to monitor progress. Office time is generally less than for preventive inspection - of the order of a 2:1 ratio of site (including workshop) time to office time.

39. TORCH inspections may require a team approach, involving two or three inspectors, and may require input from other divisional specialists depending on the nature of the risks involved.

Appraisal of Application by HID

40. Within HID most use of this technique has been made by the Explosives Unit. They have carried out several workshops targeted at small to medium sized companies. The technique is considered worthwhile, with many companies producing action plans which have subsequently been followed up by inspectors. The key to the success of the technique is this follow up action.

41. Operations Unit are currently reviewing the application and effectiveness of TORCH across the Operations Group, as there is a perception that the application of the technique has moved away from that in the 'FOD Guide'. The outcome of the review is to be considered by the Operations Management Forum.

Application by FOD

42. TORCH is regarded by many FOD inspectors as a useful technique because it permits management issues to be assessed and encourages managers to become involved and take ownership of the management of health and safety. The experience of FOD suggests that it can be applied successfully and efficiently in place of audit at SMEs.

43. TORCH can usefully be applied at a relatively early stage in the inspection plan for a company, but is likely to be best used after an initial preventive inspection has assessed the suitability of a company for the application of TORCH.

AUDIT

Background

44. The audit process as used by HID is defined in HID circular CC/INSPECTION/1rev as: 'a systematic, documented, verification process of objectively evaluating evidence to determine whether an employer has developed a management system and implemented the arrangements necessary to meet its legal obligations in respect of health and safety and the control of risks and whether the system and arrangements are effectively implemented'.

45. The circular defines management systems audit as: 'the audit of a company at a defined level of management.' This may be directed at the corporate level, the divisional level or at the level of the management of a single site. HID applies the following definition of risk control systems audit: ' the audit of a defined and restricted risk control system. It includes both auditing the level of compliance with legal requirements and the audit of the management of that risk'.

46. The STATAS audit methodology (described in section 2.5 of the 'FOD Guide') was developed from an HSL research project to provide a way of assessing loss of containment of hazardous substances from process plant and vessels. The research findings showed that loss of containment could be attributed to one, or a combination, of 10 direct causes and that these in turn could be attributed to one or a combination of eight origins of failure. The audit protocol produced by the researchers did not follow the HSG65 model, so the STATAS 'origins of failure' audit questions were mapped across to the Risk Control Systems questions (or key issues) described in the 'FOD Guide'. The STATAS methodology is now the same as the methodology described in the 'FOD Guide', and is no longer used as a 'stand-alone' technique.

How applied

47. HID has built up much experience and expertise of auditing. HID's plan of work includes a commitment to audit all top-tier CIMAH sites.

48. The 'FOD Guide' includes criteria for selecting sites for audit. These include major hazard sites, multi-establishment companies, employers with well developed management systems which employ more than 200 people or where there are significant hazards. These selection criteria and HSE's application of the audit technique have moved on since the 'FOD Guide' was published, and in its present form it does not reflect HID's use of auditing. Possible additional criteria for selecting companies in the HID sector for audit could include companies changing status under COMAH (i.e. moving into LT from non-COMAH or from LT to TT), companies undergoing major structural change to their management or organisational structure (including large shifts in the use of contractor organisations for hazardous operations) or performing extensive downsizing; company mergers; any other major ‘change’ events; poor hazardous event record.

Resource requirements

49. Auditing is a resource-intensive technique. For the 1997/98 work year HID audits of management systems accompanied by one or more risk control systems required an average of 46 hours non-contact time and 35 hours contact time, and risk control system audits required an average of 41 hours non-contact time and 25 hours contact time. Site audits are normally carried out by at least two inspectors, with a larger team for audits at divisional and corporate levels. Depending on the issues involved, staff from RSG, DST or other DDs may be part of the audit team. The ratio of site time to office time may approach 1:2.

Appraisal of Application by HID

50. In November 1996 the DMB considered a paper (DMB/96/59) which presented the work of the Audit and Lead PI Working Group. The DMB endorsed the use of audits as part of a continuing strategy to gain information about employer's management arrangements and systems. Additionally, the DMB agreed that it was desirable for an audit to be completed for each major hazard employer as a starting point and reviewed at the beginning of each safety report update cycle. These recommendations are still in place.

51. The effectiveness of HSE's use of auditing was evaluated by a project commissioned by the OMF in 1996/97, reported as 'The effectiveness of HSE's audit approach'. The project was based on corporate level audits carried out by FOD, HID and OSD. The review concluded that employers and most inspectors strongly support HSE's use of auditing and that the technique is appropriate in the present regulatory climate. Further conclusions were that HSE generally carries out corporate audits well, and such audits usually influence health and safety management as they raise significant issues with senior managers. These topics do not arise during other HSE interventions. But the review said that HSE does not benefit from the use of auditing to the greatest extent possible, as post-audit action i.e. follow-up is not well executed and there is an apparent lack of use made of audit conclusions to inform and direct subsequent inspections.

52. In 1997, the CIA were involved in a survey to evaluate the effectiveness of audits done by HID (CC/ADMIN/8). The report generally supported HID's current practice and made several suggestions for improvement, but did not address follow-up work.

53. Because the conduct of audits is a major, resource intensive technique carried out by HID the inspection strategy project team identified a need to provide very clear policy and guidance on the use of audits. The first stage in preparing such policy and guidance was a workshop held in July 99 to identify the issues involved and the best way forward.

54. The outcome of the workshop was a report to DMB with recommendations on further action required. The recommendations are now being taken forward as a project by HID OPPG Inspection Section. The project outcome will be the provision of clear guidance on the policy and practice of auditing by HID.

TRAM (Technical Risk Audit Method)

Background

55. This technique has been developed jointly by HSE and AEA Technology. It is a computer-based system for the assessment of technical aspects of process safety at major hazard sites. It involves the identification and evaluation of the number of 'lines of defence' i.e. control, protection and mitigation measures, needed to reduce overall risks.

How applied

56. TRAM is still undergoing development, but has been trialed at several HID premises. It has been developed for the storage of LPG, but there are plans to develop it for application to activities where well-documented standards exist e.g. bulk chlorine storage and ammonium nitrate stores. It is designed for use by all HID inspectors.

57. TRAM is being developed to complement the findings of audit or TORCH, and to provide information which will be useful for the completion of HI 251s.

Resource requirements

58. The site visit should take up to a day, with a further day of associated office time.

Appraisal of Application by HID

59. The technique is currently in the final stages of its development, and needs to be applied at more sites to complete this process. As yet, the technique is fully understood only by those who are developing it, and it's potential for informing issues for inspection has not yet been evaluated. TRAM is envisaged to be a fairly rapid assessment method which will assist in prioritising issues for inspection. As such, it will be suitable for application at an early stage in the inspection cycle of a company, and possibly after the assessment of COMAH safety reports.

FOLLOW-UP

Background

60. The purpose of follow-up is to assess the adequacy of response to HID's contact. Follow-up contacts are by definition targeted, and always follow another contact.

How applied

61. Follow-up can be carried out in a variety of ways, as considered applicable to the particular circumstances. The 'traditional' follow-up technique is a visit to verify some required action, but it may also take the form of information from the firm, such as a letter, action plan, telephone call, discussions at a meeting etc. Continued failure to implement legal requirements should lead to a consideration of formal enforcement. .

Resource requirements

62. The resources employed in follow-up are variable, but should be in proportion to the scale of the risk involved. Where follow-up takes the form of a site visit to check on specific (usually hardware-related) matters, the visit will typically be short - less than half a day. Inspectors from RSG (or other specialisms) may be involved in follow-up visits.

Appraisal of Application by HID

63. All inspections (and initiatives applied as alternative to inspection) need appropriate follow-up for two purposes; to check on action on issues identified at previous inspection, or to provide information on the effect and value of the original intervention.

64. Follow up action is an essential, and integral, component of HID's inspection activity. It is an effective technique which emphasises priorities and encourages firms to take action. Information from follow-up visits should inform the inspection plan, and the consideration of the appropriate means of follow-up should be built in to all inspections. There will be circumstances where no follow-up is required, but these are likely to be in a minority.

TECHNIQUES APPLIED ACROSS THE HID SECTOR

Projects

Background

65. Projects are usually focused on a sector of HID's responsibility. They aim to make comparison across this sector and are seldom site-specific. The project methodology is applied to a particular process, topic, risk control system etc., so that site visits and other contacts relate to a facet of the activity on site. The information collected from the project visits can be analysed and disseminated to other relevant recipients.

How applied

66. HID has moved away from the traditional SPN approach and now carries out national projects which are planned to meet an identified need and require DMB approval. National HID projects are generally run under project management protocols. National projects are not restricted to being completed in one workyear and can be carried out over whatever timescale is required. All inspectors involved in national projects receive training or detailed guidance to enable them to carry out the work for specific projects. Local projects can be carried out to meet local needs and do not require DMB approval. They are usually implemented by a team of inspectors.

Resource requirements

67. The resources required for projects are variable, depending on the scale of project. The need for, and number of, site visits will vary depending on the project. The requirement to provide specific training will require a considerable input of resources.

Appraisal of Application by HID

68. The project methodology can be adapted to meet a wide range of needs, and can involve whatever techniques are suitable, whether inspection or some other method. All projects will be different, and the scale and scope can vary considerably. An example of a small scale project is a series of visits to several examples of a process or sector of industry, designed to provide inspectors new to HID with familiarisation and the opportunity for comparison. At the other end of the scale, the 'Exothermic reactions' project involves most of HID's operational staff, with a substantial training requirement, and documented project planning protocols.

69. Project management techniques are applied to the extent required by the scale and complexity of the project. This imposes a structure, accountability, requirement for evaluation etc. Project working promotes teamworking and involvement of appropriate sources expertise.

70. It is not possible to specify a particular stage in the inspection history of a company when projects should be carried out, as this will depend on the aims and subject of the project. Projects may be the first contact, or may follow a series of inspection contacts.

MAILSHOTS AND SEMINARS

How applied

71. Mailshots and seminars have been used extensively by FOD to reach more firms in the SME sector than was possible through conventional interventions.

72. HID's use of mailshots has been restricted to distributing information before particular interventions, for example as preparation for the 'Exothermic reaction hazards' project.

73. Seminars have been organised by FOD and other DDs for many reasons - including raising awareness, introducing new initiatives, to target poor performers and to carry out TORCH initiatives. FOD's 'Small firms breakfasts' were particularly valuable. In 1997/8, HID organised seminars on CHIP, and on health risk

management. There are plans to organise more seminars in the future, possibly organised jointly with intermediaries.

74. Seminars are used to communicate information. They aim to influence behaviour and provide neutral ground for discussion. They are not a replacement for inspection, but are complementary to it. The HID 2 'CHIP 97' breakfast seminars and the HID 3 'Health risk management' seminar were run as PRINCE projects. DMB/98/13 discusses the HID 2 initiative, and copies of the HID 3 Seminar Toolkit will be distributed to HID Units 1 - 5, to form a model for other seminars.

Resource requirements

75. Both techniques are time consuming, due to the requirement for detailed planning and administration, although this will be borne by HID staff from several grades, in contrast to other techniques, which are applied mainly by Bands 2 and 3. The four CHIP seminars run by HID 2 required approximately 35 days per team, targeted at a delegate list of 50 at each seminar. The HID 3 'Health risk management' seminar took 33 staff days to organise and run for 43 delegates.

Appraisal of Application by HID

76. Between 1995 and 1997 an SPN was set up to evaluate the effectiveness of mailshots, seminars and conventional inspections to SMEs. The work confirmed that inspections and seminars produce more action than mail shots but there are differences depending on the business sector. The work confirmed the previously expressed view of inspectors that organising mail shots is extremely time consuming. The study showed that 'force feeding' information to companies is of limited benefit because often the information will be received by the wrong person at the wrong time. The use of search facilities such as the HSE Internet home page may prove more beneficial and will also allow HSE to monitor demands for information.

77. Seminars and mailshots are valuable techniques, by which HID communicates with a specific audience. Seminars allow firms to meet HSE under 'non-threatening' circumstances, which can promote more open discussion. Both techniques have their place in an inspection programme, to be used as circumstances dictate. The techniques do not replace inspection but are best used to supplement and support, or as a means of reaching SMEs.

78. There has been a perception that seminars only ever 'preach to the converted' and that no action is taken in respect of firms who choose not to attend. But in addition to following-up non-attenders, the correct initial selection of participants is vitally important.

79. It is not possible to specify a particular time when seminars or mailshots are best carried out, as this will depend on the subject and objective of the intervention.

INSPECTION TOOLS

Climate Survey Tool

Introduction

80. This is a software-based tool that uses a set of structured questions to examine the health and safety culture within an organisation. It is intended that firms will buy it and administer it, although HSE has found it useful to apply it to establish a baseline before an audit. It is used to promote employee involvement in health and safety by seeking anonymous views on aspects of health and safety, including reasons underlying safety-related behaviours at work. The software allows the results of the questionnaires to be analysed in a way that suits the needs of the organisation. The manual gives outline guidance on possible ways in which the findings can be taken forward, although the needs and structure of the organisation will to a large extent determine this. The tool aims to provide information which can then form the basis for discussion and involvement of all levels of the workforce in developing a way forward. The tool does not deal with 'hardware' issues and does not measure compliance with legal requirements.

How applied

81. The survey tool is available commercially for firms to buy and use. It can be used by inspectors. In this case, it would be necessary to agree funding for the data entry.

82. HID has a limited amount of experience of using the survey tool, and in carrying out interventions at firms that have used it. The HID Gas team have applied it, as have HID 5.

Resource requirements

83. None, if firms administer the survey tool. If HSE administers it, site time is about one day initially, plus further time to give feedback. In addition to time on site, further time is needed to input the questionnaire results onto the database: but past practice has been to contract this out. Experience of using this technique suggests that the analysis of the results is very time-consuming.

Appraisal of Application

84. The Mines Inspectorate were involved in trialing the climate survey tool, at three companies which HSE was auditing. The survey tool was found to be useful in persuading people that safety performance depends on cultural issues, and the results were useful in airing difficulties and in producing an agenda for action.

85. The HID gas team used the survey tool just prior to an audit of BG storage in autumn 1997. The tool was felt to give a good guide to how people are thinking, but that the results can be difficult to interpret, and need in-depth study. The tool can probably only be used in co-operative companies, and HSE cannot require a company to use it. It is of questionable value in smaller companies.

86. The survey tool does not replace any of HSE's inspection activities, but can usefully complement them, especially auditing.

87. Inspectors who have used the tool have commented that the success is to a large part influenced by HSE's follow-up to monitor progress with actions identified. But at another level, the success of its use will be measured not just by the follow-up to the specific use/visit but by the integration of the gained understanding of an organisation's culture into more directed future intervention plans such as audit, inspection etc.

88. The climate survey tool is not intended to be used as the first contact with a firm, as depth of knowledge about management practice, risk control measures, accident/incident history are needed to inform its use. But it can be used effectively to gain some early intelligence on the culture in a company which will enable the more directed application of other interventions such as audits, etc.

89. HID inspectors need to be aware of the climate survey tool, its purpose and application.

MANAGEMENT OVERSIGHT AND RISK TREE (MORT) ANALYSIS; INVESTIGATIVE METHODS

Introduction and application

90. These are investigative methods, used in accident investigation. All three have been developed recently. Root cause analysis is being developed specifically for HSE by WS Atkins. The three tools are basically similar in that they offer a structured way of approaching an investigation, but Root cause analysis links the causal factors back to HSG 65 issues. They are particularly suited to complex investigations where there are likely to be a number of threads to the investigation.

Resource requirements

91. Variable, depending on the complexity of the investigation.

Appraisal of application by HID

92. These techniques will be valuable in complex investigations. Training in the application of MORT, Events and causal factors analysis and Root cause analysis is now part of the Aston training for Band 4 inspectors. It is unlikely that many experienced HID inspectors have not received this training. Recently developed investigation techniques are part of the Investigating Serious Accidents course (details in the FOD/HID technical training prospectus) available to inspectors via DCT procedures.

INSPECTION PLANS

Principles

93. The high level principles in the inspection strategy project, agreed by the DMB, requires the integration of inspection techniques into a long term inspection plan for large employers.

94. The High Level Principles amplify this by defining 'long term' as five years, and that inspection plans should not be confined to Major Hazard establishments. The plans should identify the priorities, when they will be achieved and by whom and how their effectiveness can be assessed. HID's inspection plans should be flexible so that they can cope with changing priorities, resource availability and the effectiveness of the inspection plan.

Introduction

95. HID needs to demonstrate adherence to the principles of TPCT as applied to the division's inspection activities. This part of the chapter introduces a style sheet for an inspection plan to be used across HID at premises which meet the selection criteria.

Background

96. FOCUS (/CIS) ratings influence the frequency of inspection for all premises except top tier establishments. [Note a new HID rating system is to be introduced in April 2000] Section 4 of the HI 251 requires the identification of topics which need to be addressed at future visits.

97. COMAH requires the production of inspection plans for all establishments which are subject to the Regulations. The Lead Unit approach also requires inspection plans as a basis for co-ordinating HID's activities with multi-establishment companies.

98. HID applies national priorities to proactive inspection, e.g. Legionella, exothermic reactions, GHGB topics, etc. These could equally be applied to reactive inspection, with the addition of local concerns and findings identified from sources including the incident history, findings of inspections, projects, training needs and local pressures etc. These local priorities could be recorded in the inspection plan to assist in the future selection of incidents for investigation. Such notes would not be mandatory or to detract from the application of judgement and discretion.

Definition of inspection plan

99. A structured, rolling plan covering up to 5 years to record all HID's planned inspection activity at a site, to include details of inspection techniques, resources and planned dates. Plans should be produced to a common format, and to be reviewed (and revised if necessary) after all significant interventions.

100. A blank inspection plan is provided at the end of this chapter. This has been developed from the inspection plan in the FOD Guide to the inspection of health and safety management, modified to incorporate features of inspection plans in use by operational HID groups. The plan has been considered by the inspection strategy project team considering inspection for COMAH, and have advised that it meets their requirements at this stage. [Note: The arrangements for recording major hazard inspections will be subject to review as a priority after the introduction of the CIS. Guidance on the current use of the HI 251 can be found in chapter 9 of the COMAH Manual.

Application

101. The need for HID to have inspection plans to structure inspection activity depends on the risk and complexity of the site. At the 'highest risk' end of the spectrum, COMAH requires inspection activity to be subject to inspection plans. The production of an inspection plan is central to the proposed Lead Unit approach for multi-establishment companies. At the other end of the risk/complexity scale are single site companies for which there is limited value in preparing an inspection plan, as the activities are straightforward, the site can be inspected in a day and for which preventive inspection, at the frequency specified by the FOCUS (or CIS) rating is appropriate. This is shown diagramatically below.

Production of an inspection plan

102. There are two overriding principles which should apply to all inspection plans:

a. Each inspection revealing changes that are required should have appropriate follow-up; and

b. the plan should be reviewed, and if necessary revised, after each significant inspection.

103. The inspection plan will need to be initially informed by a preventive inspection of the site if HID has no history of the firm's organisational structure, activities, incident history, response to inspections.

104. A copy of the plan should be kept on file. When the CIS is introduced, it will be possible to link an inspection plan to the Client record. There will be a marker to indicate the existence of an inspection plan.

105. It may be appropriate to replace section 4 of HI 251 with the proposed inspection plan.

APPENDIX 1 - INSPECTION PLAN

Audits

• Introduction • Appendix 1 - Definition • Policy • Appendix 2 - Summary of the Audit Methodology • Roles and Responsibilities • Appendix 3 - Quality Standards • Competencies for Auditors • Appendix 4 - Further Information • Planning • Appendix 5 - Report Structure • Monitoring • Appendix 6 - Follow-up Report Structure

INTRODUCTION

1. This Chapter derives from recommendations by field staff at a workshop on auditing by HID inspectors in July 1999. It explains HID CI, SI's policy and procedures for auditing and provides guidance to staff who carry out audits. LD5 have a separate policy, procedures and guidance document dealing with the application of audits within the mining sector.

2. Auditing is an inspection technique the main purposes of which are to:

a. assess duty holders' compliance with relevant statutory provisions and take appropriate action; and

b. prevent injuries, ill-health and dangerous occurrences.

3. Inspectors should select the audit approach when they wish to employ a structured, rigorous method to:

a. focus on the detailed assessment of the health and safety management arrangements and safety culture of duty holders; and

b. identify underlying management issues and deficiencies;

in a targeted, transparent, consistent and proportionate way.

4. The terms used to describe audits are listed and explained in Appendix 1. The term 'management systems audit' is a collective name for: corporate audit; divisional audit; and site audit. They are all characterised by the auditing of management arrangements and a selection of risk control systems and associated workplace inspections.

Auditing as part of HSE's intervention strategy

5. HSE Enforcement Statement: Continuing Aim 2, Conduct intervention (defined as a process carried out to secure compliance before an incident) specifies auditing, amongst other approaches, as a means to secure compliance before any accident or incident. Audits can also be prompted by incidents where, for example, investigation findings can be used to target audit topics.

6. Auditing requires a balance between interviewing people, examining documents and observation, usually with more time on interviewing and examining documents than observation. It should be considered as an element of a broader intervention strategy for establishments (Major Hazard Intervention Plans).

Legal basis

7. Auditing enables the COMAH competent authority to comply with the Seveso II Directive and inspectors to assess duty holders' compliance with relevant statutory provisions requiring health and safety management arrangements. These are:

8. Regulation 5 of the Management of Health and safety at Work Regulations 1999 (MHSWR) requires employers to make appropriate health and safety arrangements. Further guidance on this duty can be found in HSC publication L21: Management of health and safety at work, Approved Code of Practice and Guidance.

9. HSWA S2 requires employers to prepare a written statement of policy with respect to the health and safety at work of their employees and the organisation and arrangements in force for carrying out the policy.

10. For establishments subject to the Control of Major Accident Hazards (COMAH) Regulations the Competent Authority (CA) is obliged to carry out inspections under regulation 19. Such inspections should be sufficient for a planned and systematic examination of the technical, organisational and management systems employed at establishments.

POLICY

11. It is HID LD policy to carry out audits, where appropriate, as part of a range of complementary approaches to duty holders to secure compliance with relevant statutory provisions.

ROLES AND RESPONSIBILITIES

12. This section explains the roles and responsibilities of HSE staff involved in auditing. Only staff who meet the criteria under `competencies for auditors' below should lead or assist in audits.

13. The resources put into an audit should be proportional to the scope of the audit (see paragraph 37 and Major Hazard Intervention Plans ) and apply all necessary expertise (see paragraph 21). Audits are usually therefore carried out by small teams. An audit leader should be appointed with responsibility to:

a. manage the elements of the audit methodology as summarised in Appendix 2;

b. identify other appropriate auditors and administrative support, ensure their roles are clear and manage their involvement. Note that it is good practice to involve others at an early stage;

c. identify any relevant lead unit involvement and liaise with the co-ordinating inspector where appropriate to ensure that the audit scope is consistent with relevant corporate intervention plans (see also paragraphs 14 and 34 below);

d. for COMAH establishments, inform and, if appropriate, manage the involvement of EA/SEPA in audits (see also Single Implementation Project (SIP) Product 2(g) - policy and procedures for carrying out management system audits (to be prepared and added to Chapter 11 of the COMAH Manual));

e. ensure that audit reports and audit follow-up reports are completed within the time limits in paragraphs 62 and 65 below and Appendix 3.

Lead unit approach and auditing

14. Information on the roles and responsibilities of lead units and co-ordinating inspectors is contained in Lead Unit System for Multi - Establishment Companies of this manual. The lead unit system is designed to ensure a co­ordinated central approach to appropriate multi-establishment companies. The lead unit co-ordinating inspector is responsible for ensuring consistency and efficiency in approaches to duty holders. This includes co-ordinating audit approaches at premises and sharing information about past and proposed interventions. This information will help to inform and influence the audit agenda and scope. For COMAH establishments this includes audit approaches by HSE and EA/SEPA (see also SIP Product 2(d) - policy for lead unit and industry sector regimes (COMAH Manual Chapter 11 Section B) and Product 2(e) - guidance to staff on the lead unit and industry sector regime (to be prepared).

15. The lead unit co-ordinating inspector should also ensure that the results of audits are available to other inspectors and, where relevant, COMAH CA staff who deal with relevant organisations. Staff should use these results to inform their subsequent approaches to lead unit organisations.

16. The lead unit co-ordinating inspector may also be the audit leader where appropriate, for example when corporate audits are carried out. The responsibility for elements of the audits, such as much of the on-site activity and report preparation, may be delegated by co-ordinating inspectors. But the co-ordinating inspector is responsible for communicating with the company's central health and safety contact on where and how the audit fits in with the agreed intervention plan and ensuring that audit reports are received by the central contact.

17. Audit leaders should usually lead the presentation of audit findings to duty holders. However, it will sometimes be appropriate for staff at higher grades to do this. One of the aims of auditing is to try to influence the most senior level of management of the duty holder relevant to the nature and scope of the audit. Level 1 audits (see paragraph 37) have most potential to achieve this but in some cases further influence can be applied by fielding senior HID personnel e.g. Band 1 and above. Audit leaders should consider and discuss with their line managers the appropriate level of HSE representation at the presentation based on the level of the relevant duty holder's management present and significance of the audit findings.

18. The relevant lead unit co-ordinating inspector should be informed and, where appropriate, involved when HSE senior managers are invited to provide pre-audit briefings and/or presentations of audit findings.

19. Band 2 heads of FMUs are responsible for ensuring that:

a. staff with the necessary competencies lead and assist in audits;

b. that there is justification for any significant differences in resources when audits of similar scope are carried out at different establishments, or at the same establishment over time;

c. they lead the presentation of audit findings to duty holders where appropriate (see paragraph 17 above).

20. Band 1 heads of field units are responsible for ensuring that the policy, procedures and guidance in this Chapter are implemented.

COMPETENCIES FOR AUDITORS

21. Competencies for regulatory inspectors to undertake effective audits are contained in the document: Competencies for HID regulatory inspectors (HID Circular CC/Personnel/3). In addition to the skills required for other field work, auditors need to be able to derive findings based on the evidence they obtain from interviews,

documents and observation and link these findings to HSG65 POPMAR elements. Further details of HSG65 and other sources of information are given in Appendix 4.

22. Before leading an audit, HSE staff should as a minimum:

a. be at Band 3 or above; and

b. have attended the ASSMAN training course and assisted in at least one audit (inspectors who are inexperienced in auditing are likely to benefit from assisting in more than one audit to help develop their skills before leading), or have led audits prior to the publication of this guidance; and

c. be familiar with this guidance.

23. Before assisting in an audit staff should have:

a. read HSG65 and be familiar with the POPMAR management model and relevant legal requirements (see paragraph 8 above); and

b. b) be familiar with this guidance.

Deployment of specialist resources

24. Specialists should be involved in audits when their skills are required by the audit leader to ensure that all necessary expertise is applied. The view was expressed at the audit workshop that specialists should contribute to safety management issues at level 2 (audits of RCSs) as well as their technical speciality. Human factors specialists may also be involved in level 1 management systems audits. A report produced for HSE (details in Appendix 4) explored how to derive priority issues for inspection and broad guidelines for the deployment of specialist resources.

25. The report identified that approximately 25% of loss of containment failures occurred in normal operations, 30% in maintenance and a further 30% were due to failures and defects in design or construction. The report suggests that an equivalent proportion of available audit resources should be devoted to examining each activity. The remaining 15% could not be attributed to a particular activity and the report suggests that the equivalent resources could be devoted to auditing mitigation and emergency response measures.

26. The table below uses information from the report and the FOD Guide (see Appendix 4) to derive an audit strategy based on broad issues and links these issues to relevant risk control systems (RCSs). Please note that the information needs to be used with caution. It is derived from averaging the respective contributions of each cause of loss of containment over a range of industries worldwide and may not always be appropriate for a specific industry sector, or specific site. However, it can help inspectors to identify RCSs to audit when site specific information is lacking; and to identify which RCSs to focus on to explore the issues listed.

Issue RCS

Design and Modification of Plant Plant Design

Plant Change

Control of Contractors

Construction of Plant Plant Commissioning

Control of Contractors

Normal Operations Operating Procedures

Human Factors of Operations

Maintenance of Plant Permit to Work

Control of Contractors

Planned Maintenance Procedures

Planned Plant Inspection

Mitigation Emergency Response

27. The choice of specialist disciplines to be deployed will be determined by a combination of the RCS selected and the nature of the plant or process and controls in place. For example, one would usually expect specialist input to

plant design / change issues. Where issues involving reliability of human components of systems are anticipated such as management culture or the operator/process interface, human factors specialists may be required.

28. The report also uses statistics to rank RCSs in order of their contribution to failure rates. This information can be used to assist audit leaders to prioritise RCSs audits. For further details please see the section on selection of risk control systems (see para 48).

29. Specialists should have similar competencies as others who assist in audits (see paragraph 23 above).

30. Staff may also be present during audits as part of their training. In these cases there are no specificcompetencies required.

PLANNING

31. Inspectors should prepare a 5 year intervention plan for all COMAH establishments. Further information on this is provided in Major Hazard Intervention Plans and Inspection Techniques of this manual. The plan should identify planned interventions including audits.

32. When planning an audit inspectors may find it helpful to consider the suggested summary of audit methodology in Appendix 2.

Selection of establishments to audit

33. Major Hazard Intervention Policy explains HID CI, SI's inspection policy and criteria for planning its inspection programmes. Inspectors should refer to this when selecting establishments/premises to audit. Paragraph 3 provides criteria on when to select the audit approach.

34. Audits of establishments may not be appropriate when:

a. they have only a rudimentary safety management system and where the hazards are so few as to make the approach a disproportional use of resources;

b. the establishment / premises are part of a multi-establishment company where there is central intervention and the audit is planned to contact some, but not necessarily all, the company's establishments (see also paragraph 41);

c. the duty holder has a poor attitude or does not have the competence to respond to the audit process, an alternative approach such as conventional inspection may be more appropriate (see also section on hostility - para 59).

35. Some establishments may be audited relatively frequently where there are many issues / RCSs which need to be audited to ensure that the duty holder has adequate control over hazards across the establishment.

Timing of audits

36. The timing of the audit, within the 5 year intervention plan, is at the discretion of the person responsible for preparing the plan. It will depend upon a number of factors including:

a. date of safety report submission and assessment. The outcome of safety report assessment will help inform issues to audit and the resources required for assessment may reduce those available for audit. It may not, therefore, be appropriate to audit during a work year when assessment is carried out;

b. date of any previous audit and follow-up work. Inspectors may wish to leave sufficient time between audits to allow the effects of previous audits to be realised;

c. other planned work at an establishment. Auditing is one of a range of approaches to duty holders. It is good practice to vary the inspection approach over time;

d. duty holders' circumstances e.g. change of management / ownership. Depending on circumstances inspectors may wish to delay planned audits until soon after such changes to assess the new management's ability to manage health and safety;

e. reactive work required e.g. investigation of a major accident. This can disrupt plans and reduce available resources for audits. It can also help identify key audit topics which may be different from any already planned and which could prompt an urgent need to address them.

f. resources available and the number of audits carried out by individual inspectors. There may be other demands on inspectors' resources e.g. (e) above. Also, audits can be psychologically demanding particularly for audit leaders and individuals should not be required to carry out more than they can cope with.

Audit scope

37. For COMAH establishments, COMAH regulation 19 (2) specifies that inspections should not be dependent on the receipt of a safety report (see also COMAH Safety Report Assessment Manual Chapter 4). However, safety reports provide essential information about how operators seek to prevent, control and mitigate major accidents.

Where safety reports have been submitted, assessed and the conclusions identified, the outcome should be used to identify topics for inclusion in any audit programme and included in the 5 year intervention plan. Other sources of information include CIS, FOCUS, office files, previous inspection plans, HI251s and audit reports.

38. There are three levels at which safety management systems operate:

a. level 1 - management arrangements;

b. level 2 - risk control systems; and

c. level 3 - workplace precautions.

39. A balanced audit approach should incorporate all three levels. The preferred option is that audits should assess all the POPMAR elements at level 1 and all the POPMAR elements of at least two risk control systems. This should enable auditors to adequately assess duty holders' safety management systems.

40. Issues should be pursued to the point where auditors are either satisfied that duty holders have adequate arrangements in place or can identify that improvements are required. Auditors should record findings which indicate areas where duty holders perform well in addition to identifying areas where improvements are required.

41. For some operators / organisations, however, it may not be appropriate to carry out a level 1 audit of their individual establishments / premises because, for example:

d. they operate a number of establishments / premises with similar hazards and management systems and carrying out level 1 audits of them all would be duplicating work;

e. they are within scope of the lead unit system and a co-ordinated corporate or divisional audit, the findings of which can be applied to the individual establishments, has been carried out or is planned;

f. the establishments do not have a sufficiently sophisticated management structure to warrant a level 1 approach;

g. they have been previously audited at level 1 and their arrangements are known based on the previous audit.

42. In these cases audits at individual establishments / premises may be restricted to level 2, which focuses on specific risk control systems. Where previous level 1 audits have been carried out, level 2 audits can be used to monitor duty holders' ability to maintain adequate standards and draw inferences about their current management arrangements. At establishments where there are few hazards / activities e.g. some warehouse operations, the audit may be of more limited scope than suggested in paragraph 39. Observation of workplace precautions should form a part of both level 1 and level 2 audits.

43. In all cases and at whichever level it is undertaken, the scope of the audit should usually be sufficient to identify at least one finding against each element of the POPMAR framework.

44. Audits can be used to check that duty holders are doing what they say e.g. to verify information in safety reports and other documents; and to check that their arrangements are adequate to comply with legal and other standards.

45. For duty holders who operate a number of establishments / premises level 1 audits should be applied at the most senior level of management control of the relevant group of establishments. For companies within the lead unit system the relevant lead unit co-ordinator's role is described at paragraph 14.

Audit on-site activity

46. Audits should be carried out as a single event i.e. completed within a short time span, and should lead to a report as described in paragraph 62 and Appendix 5. For the purposes of the quality standards in these procedures (para 74), audit on-site activity is taken to be the period between the initial interview/inspection and on-site closing meeting (see Appendix 2).

47. If a lack of resources prevents the on-site activity being completed within a reasonable time i.e. within one month, then the scope of the audit should be reduced to allow it to be completed within this period. In exceptional cases the audit may need to be postponed until resources become available.

Selection of risk control systems

48. The FOD Guide (see Appendix 4) Section 4 identifies a range of risk control systems (RCSs) with associated assessment procedures and examples of issues / questions for interviews. Auditors should consider the following criteria when selecting RCSs:

a. particular aspects of the duty holder's operation or specific items of plant which are critical for safety i.e. the most significant hazards/risks. For top-tier COMAH establishments auditors should consider RCSs which form part of operators' key measures for preventing / mitigating major accidents identified in safety reports;

b. issues identified as requiring improvements based on the assessment of COMAH safety reports, previous incidents and intelligence gathered from other interventions at the establishment to be audited;

c. issues which are known to be important in the type of industry / establishment / process to be audited and about which assessment is required to establish the adequacy of control at a particular establishment;

d. RCSs which have not previously been assessed at a particular establishment or others under the same duty holder's control.

49. Staff should be cautious about re-examining RCSs which have been previously audited, although this should not prevent re-examination where, for example, sufficient time has elapsed since the initial audit or when it fits in to part of an intervention plan for an establishment. However, one of the benefits of auditing is to achieve long-term improvements and, when there are reasons to suspect that control of previously audited RCSs is inadequate, staff will need to consider why this is so and whether to employ an alternative approach to secure adequate standards.

50. A report produced for HSE identified a rough ranking of RCSs based on their contribution to failure rates and the relevance of preventive and recovery mechanisms. (Details of the report can be found in Appendix 4). The table below shows this ranking. It may assist auditors in targeting RCSs.

Rough Ranking of Risk Control Systems

1 Control of Contractors

2= Plant Process Design

2= Plant Process Change

4 Operating Procedures

5 Assessing Competence

6= Permit to Work

6= Planned Maintenance

8 Planned Inspection

9 Commissioning

10 Site Transport

51. A subsequent report from the US Environmental Protection Agency Chemical Emergency Preparedness and Prevention Office identified inadequate process hazard analysis as a significant cause of accidents. Specific issues identified were failures to:

a. address known equipment failure scenarios;

b. adequately consider hazards of exothermic reactions; and

c. identify all process hazards.

52. These issues are required to be addressed in safety reports for TT COMAH establishments and inadequacies will usually be identified as part of the safety report assessment process. For other premises, however, inspectors will wish to be aware of this cause of accidents and consider it as an audit topic.

Employer involvement and participation

53. In addition to the traditional audit approach i.e. where the regulator carries out the audit, the audit workshop considered two other approaches:

a. audits are carried out jointly with duty holders; and

b. duty holders carry out their own audits and the regulator checks the outcome.

54. These approaches can have the benefit of improved ownership of the audit by duty holders, better targeting of topics for audit and can be an effective and efficient use of HSE's resources. But they do not usually have the same degree of independence as the traditional approach. Inspectors should ensure that adequate regulatory control is maintained when these approaches are employed. HID does have experience of a co-ordinated audit producing a very satisfactory outcome where the duty holder resisted any co-operation with a traditional imposed audit but was very willing to conduct an audit with the regulator under the banner of a `best practice review'. Further work is currently being undertaken to look at the value and the consequences of this type of partnership approach, At this stage we recommend that the traditional approach is taken but that inspectors remain open to suggestions from operators and, if thought appropriate, to discuss the options and safeguards with OPPG.

55. Further guidance on COMAH safety management systems and MAPP assessment criteria and how to assess them can be found in the COMAH SRAM Chapter 2 Part 4. Although this is targeted specifically at COMAH establishments, many of the criteria and evidence can be applied at other premises.

Auditors - non-HSE lead

56. Audits of COMAH establishments may be led and, in some cases, carried out exclusively by EA or SEPA rather than HSE. See SIP Product 2(g): Policy and procedures for carrying out management system audits for further advice in these cases (to be prepared for COMAH Manual Chapter 11).

Enforcement

57. Contraventions identified during audits should be dealt with in the same way as they would be at other interventions and reactive contacts i.e. in accordance with the Enforcement Management Model (EMM). Duty holders subject to audits should be informed of this policy. It is expected that enforcement action i.e. enforcement notices or prosecution should follow when duty holders fail to adequately progress audit action plans where there are breaches of legal requirements.

58. Auditors should make clear when audit findings are the subject of specific legal duties and distinguish them from findings which will help duty holders improve standards, but where compliance with particular legal duties is not required.

Hostility

59. In general the audit approach is supported by duty holders (see CC/ADMIN/8: CIA Report on HID audit inspection method). However, there may be cases where duty holders are hostile to audits. They should be informed that it is HSE policy to examine operators' systems for managing health and safety and to achieve this by auditing. In cases where hostility is so strong as to make auditing unfeasible inspectors will need to shift to an inspection based approach and focus on compliance issues.

Audit methodology

60. A summary of audit methodology is provided in Appendix 2.

Involvement of employees/employee representatives

61. It is HID LD policy to involve employees in interventions and reactive work. By its nature auditing involves interviewing a range of employees across various organisational levels and functions. In addition to this, auditors should ensure that employee representatives are informed about proposed audits and that they are able to see the audit report and are aware of the outcome of the audit follow-up. The decision whether to include employee representatives as audit interviewees is left to the discretion of the audit leader and will depend on the scope and nature of the audit. See OC 111/2 for more information on employee involvement.,

Audit reports

62. A suitable format for audit reports is provided in Appendix 5. Reports should normally be completed and submitted to auditees within two months of the start of the audit field work. Advice on handling requests from the public to disclose reports may be obtained from staff responsible for disclosure issues in OPPG. Staff should be aware that the report may be put in the public domain by others e.g. recipients of the report.

63. The audit report should normally be supported by a presentation to the duty holder. This may be done as a close-out meeting at the end of the audit or as a separate, more formal, presentation once auditors have considered their findings fully (see paragraph 17).

Response to audit report by duty holders

64. Duty holders should be requested to submit a formal response to the audit report. This should include their action plan for addressing the report's findings. Requesting this response serves to make explicit duty holders' responsibilities, can help to secure their commitment and stimulate their activity. The nature and quality of response received will provide an indication of duty holders' commitment and competence in terms of understanding audit reports' findings. The responses should cover all the findings and describe planned and/or completed means of addressing them.

Audit follow-up

65. Audits need to be followed-up to monitor duty holders' progress with findings. One means of doing this is to complete an audit follow-up report - see Appendix 6 for a suggested format. Auditors are not obliged to adhere to this format but should ensure that duty holders' progress with audit findings is clearly recorded and available. Follow-up should be carried out not later than 6 months after the start of the audit on-site activity. It should be pursued to the point where the auditor(s) is satisfied that either progress with findings is satisfactory, though not necessarily complete, or that inadequate progress has been made and further action, including enforcement

where necessary, is required to secure improvements. Issues which require longer than 6 months to address should be monitored against the duty holder's action plan and included as part of future intervention plans.

66. Auditors are not required to undertake formal follow-up interviews with duty holders' staff, although employee representatives should be consulted as part of the follow-up process and able to see the audit follow-up report or other record of progress.

67. The process of carrying out the audit is considered to be complete once the audit follow-up has been completed. Any outstanding issues which should have been addressed by this time but have not been should be considered and prioritised for enforcement action. Auditors should keep a record of progress with these issues by updating the audit follow-up report or similar record - see Appendix 6.

Timing of follow-up issues

68. Duty holders should be requested to prepare a response to the audit report within 2 months of receiving it. Auditors should complete the audit follow-up within 6 months of the start of the audit i.e. the first interview / inspection.

MONITORING

69. There are two elements to this:

a. monitoring the resources spent on audit work done by land division; and

b. monitoring the extent to which these policies, procedures and guidance are implemented.

Recording audit work

70. HID needs to be able to account for the resources spent on auditing. It assists the Directorate to plan future work and helps to promote consistency across the Directorate. Information on HID audits carried out in past years is available from BOIU.

71. Audits should be recorded on CIS. Details of how to do this are included on the CIS help file under `audit inspection'. The CIS help file also explains how to link documents such as audit reports and audit follow-up reports to specific audits.

72. The CIS procedure requires setting up a job type audit and records:

a. contact and non-contact time on audits;

b. names and location of auditors;

c. type of audit i.e. corporate, divisional or single site;

d. level of audit i.e. level 1 management arrangements and / or level 2 risk control system;

e. risk control system(s) audited;

f. certain milestones in the audit process i.e. dates of start and end of on-site activity, submission of audit report and audit follow-up.

73. Monitoring this information should be carried out by field line management. BOIU will evaluate and interpret periodically FOCUS / CIS audit data and make the results available to HID LD.

Quality standards

74. Appendix 3 contains a list of quality standards against which these audit policies, procedures and guidance can be assessed. BOIU will audit and review these periodically. They are designed to monitor whether key audit issues and milestones have been met and the extent to which the information in this Chapter is fit for purpose. The results of this monitoring will assist in reviewing this Chapter and inform our approach to auditing. This guidance forms part of HID LD's quality system and will itself be subject to audit.

Feedback

In addition to the monitoring proposed above, users of this Chapter are invited to suggest improvements to it at any time by sending comments to HID CD OPPG.

APPENDIX 1

DEFINITION OF AUDIT

76. The following descriptions are working definitions to aid consistency in the use of the terms.

Audit - a systematic, documented, verification process of objectively obtaining and evaluating evidence to determine whether an employer has developed a management system and implemented the arrangements necessary to meet its legal obligations in respect of health and safety and the control of risks and whether the system and arrangements are effectively implemented.

Management Systems Audit (MSA) - is the audit of a company at a defined level of management. Such an audit should consider all the elements of the management arrangements i.e. Policy, Organising, Planning and implementing, Measuring performance, Audit and Review - or POPMAR. The following definitions identify the targeted level of management and do not indicate any change of style or approach to the auditing process.

Corporate Audit - the audit of a company directed at the decision making board level.

Divisional Audit - the audit of a company directed at a senior level of management that are able to make long term strategic decisions about the particular business activity or discrete part of the company such as a division or group.

Single site audit - the audit of a company directed at the management of a single establishment/premises. This might be part of a multi-establishment/premises organisation when it operates autonomously.

Risk Control Systems Audit (RCSA) - the audit of a defined and restricted risk control system. It includes auditing both the level of compliance with legal requirements and the auditing of the management of that risk. Such an audit can be used as a free standing inspection technique or as part of a MSA.

APPENDIX 2

SUMMARY OF AUDIT METHODOLOGY

1. PLANNING THE AUDIT 2. ON SITE ACTIVITY 3. REPORTING 4. FOLLOW UP

1. Select dutyholder. 1. Carry out initial briefing. 1. Derive audit findings from 1. Request and record evidence obtained. dutyholder's response to

audit findings.

2. Determine audit strategy 2. Conduct interviews, verify 2. Prepare audit report and 2. Check progress with audit i.e corporate/divisional/site, documentation, observe send to dutyholder. findings. involving LU co-ordinator as workplace conditions. necessary.

3. Determine audit scope i.e. 3. Obtain and evaluate 3. Present audit findings to 3. Include longer-term Level 1 and/or Level 2. evidence. dutyholders (unless already actions on intervention plan

covered in close-out for dutyholder. meeting).

4. Select RCSs. 4. Hold close-out briefing (unless presentation proposed once audit report complete).

4. When audit report complete enter contact and non-contact work on CIS, including report milestone. Link report and other relevant correspondence on CIS.

4. Take enforcement action where legal requirements not met.

5. Identify auditors and their roles.

5. When on-site activity complete, enter contact and non-contact work on CIS,

5. When follow-up complete enter contact and non-contact work on CIS,

including milestone for on-site activity.

including follow up milestone. Link follow up report or similar record on CIS.

6. Inform duty holder, arrange initial briefing and prepare interview schedule.

7. Identify specific issues for interviews / doc. verification and observation.

8. Enter any relevant contacts and record non-contact work on CIS.

9. Set up job-type "audit" on NOTE: audit on-site activity NOTE: audit report should be NOTE: audit follow up should CIS and enter relevant info. should be completed within 1 completed within 2 months of be completed within 6 and milestone for audit month. start of on-site activity. months of start of on-site preparation stage. activity.

APPENDIX 3

QUALITY STANDARDS FOR AUDIT WORK

This Appendix provides a summary of the quality standards against which audits will be assessed. HID Central Division will assess performance against these standards.

a. Appropriate liaison with the lead unit co-ordinating inspector to ensure that the audit scope is consistent with relevant corporate intervention plans

b. For COMAH establishments, appropriate liaison with EA/SEPA

c. Staff with the necessary competencies lead and assist in audits (see para 21)

d. That employees and/or their representatives have been informed about proposed audits and the outcome of completed audits (see section on involvement of employees / employee representatives)

e. That audit on-site activity is completed within one month

f. That an audit report is submitted to duty holders within 2 months of the start of the audit on-site activity

g. That audits are followed-up within 6 months of the start of the audit on-site activity.

APPENDIX 4

REFERENCES AND USEFUL SOURCES OF FURTHER INFORMATION ON AUDITING

Reference 1

78. HSG65: Successful health and safety management:

a. describes the principles and management practices which provide the basis of effective health and safety management;

b. sets out the issues which need to be addressed;

c. can be used for developing audits; and

d. contains a list of useful other references.

Reference 2

79. Report on the specialist inspector role in the assessment of COMAH safety reports. K B Ratcliffe. The report summarises the results of a project undertaken for HSE to map out the extent of the role that specialist inspectors will play in the assessment of safety reports prepared and submitted under COMAH, their involvement in subsequent site interventions and provides a model to determine strategies and priorities. Contact HID CD OPPG for more information.

Other information

80. BS8800: Guide to occupational health and safety management systems provides guidelines based on the general principles of good management. It is designed to enable the integration of occupational health and safety management within an overall management system. It covers both the HSG65 approach and the BS EN ISO 14001 environmental systems approach.

81. The FOD Guide to the inspection of health and safety management. Parts of this overlap with the guidance in this and other chapters of the HID Inspection Manual. The Guide is expected to be revised in due course and the overlaps will then be eliminated. In the meantime, as a general guide, where there are overlaps and / or when this chapter provides additional information and guidance, the latter takes precedence. However the FOD Guide does provide more expansive information on, for example, inspection methods and very useful information to assist auditors to assess a range of risk control systems.

82. The report on `A Review of HID Auditing Approaches to duty holders' by HID's Benchmarking and Operational Intelligence Unit was produced in November 2000 and describes the main findings and recommendations arising from the project. It is a substantial and thorough report that includes a list of further reference documents. It will be available from BOI from January 2001. An executive summary of the report will also be produced and available at that time.

83. The report on the HID audit workshop - HID Divisional Management Board paper DMB/99/53. This provides a comprehensive report on the auditing issues identified and proposals for addressing them and forms the basis for this Chapter of the Inspection Manual.

APPENDIX 5

AUDIT REPORT STRUCTURE

84. A written report should be prepared following an audit. This Appendix provides guidance on a suitable structure for reports.

a. Title page

This should be in the form: Report on Health and Safety Executive or, where relevant, COMAH CA audit of (name and address* of organisation); and state the date the audit report was completed. Earlier draft reports should be marked as such and dated.

*For single site audits the address of the site visited should be stated. For audits which involve visits to more than one site the address should be omitted from the title page and a list of the sites visited included in the report's introduction.

b. Contents page

This should list the contents and associated paragraph numbers.

c. Summary

This should set out the report's purpose, main findings, main conclusions and the action required by the auditee (e.g. to prepare an action plan to address the report's findings). It should list or provide reference to the audit findings (see (e) below).

d. Introduction

This should explain the purpose of the audit, perhaps in more detail than in the summary. It should:

i) state the addresses of the sites visited (unless it is a single site audit - see para. a) above) and the date(s) of the audit.

ii) specify the reason for selecting the particular auditee;

iii) identify any risk control systems assessed and why they were selected;

iv) explain that HSE use the HSG65 POPMAR framework as the means of assessing management systems;

v) include acknowledgements.

e. Findings

This is the main part of the report. It should follow the HSG65 POPMAR framework and be set out as below:

Finding State your finding here. It should be derived from the evidence below.

Relevant legal requirements, ACoP, guidance

State the source and status of any requirements here.

Evidence State the evidence you found which led you to the finding. This could be from interviewees' responses, documents examined or site inspection.

Action required State the action required by the duty holder to address the finding.

Findings are the auditor's assessment of duty holders' performance against elements of the POPMAR framework. They should be derived from the evidence found during the

audit. For example, evidence could be found that emergency showers were not functioning; bund walls were damaged; and pipework was badly corroded. From this evidence an auditor could derive the finding that the duty holder's active monitoring arrangements need improvement.

The relevant legal requirements and other requirements should be considered at this stage so that the status of the finding is clear. This will also assist in any subsequent consideration of action to take should duty holders fail to adequately progress findings. Where level 1 management arrangements and level 2 RCSs are both audited it is helpful to separate the findings for each.

f. Conclusions

These are inferences you draw from the Findings section. This would identify and prioritise the main strengths and weaknesses of duty holders' SMSs. For example, one might conclude that a duty holder has in place effective means of ensuring they have competent staff but that their arrangements for monitoring require improvement and should be addressed urgently.

g. Action required

State what the auditee has to do e.g. prepare a response to address the report's findings, and the required timescale for this. Also state the proposed HSE action e.g. any enforcement action. You should make it clear that the audit will be followed up.

APPENDIX 6

AUDIT FOLLOW-UP REPORT STRUCTURE

85. This Appendix provides guidance on a suggested structure of audit follow-up reports. This format is not obligatory and auditors may record duty holders' progress in other ways. The suggested structure aims to minimise additional work by requiring relatively minor amendments to the audit report.

86. A written report should be prepared within 6 months of the start of on-site activity. Once this report has been completed the process of carrying out the audit is considered to be complete. Audit findings requiring longer-term action should be monitored against the duty holder's action plan and included as part of future intervention plans. The audit follow-up report may follow the structure below (based on the original audit report):

a. Title page

The audit report title page should be amended to indicate that this is an audit follow-up report.

b. Contents page

This is likely to require no changes or only minor amendment from the original audit report.

c. Summary

This should be amended to summarise duty holders' progress with the audit report findings and action proposed by HSE.

d. Introduction

This should be amended to explain the purpose of the follow-up report. Most of the information in the original introduction will remain valid.

e. Findings

An `outcome' heading should be added to the Findings section and should be completed for each finding for which duty holder action is required.

f. Conclusions

This should be amended to draw inferences based on duty holders' progress.

g. Action required

This should state the further action proposed by HSE e.g. any enforcement action as a consequence of inadequate progress with findings, plus the timescales for any subsequent follow-up.

Operation Of The Lead Unit System

• Introduction • Implementation • Overview • Appendix 1 - Lead Unit Document • Management • Appendix 2 - Further details of Definitions • Operating • Appendix 3 - Allocation of Lead Units

INTRODUCTION

Purpose of the chapter

1. The purpose of this chapter is to provide guidance to inspectors on the operation of the Lead Unit system. The system is based on the following four principles that were agreed by the DMB under the Inspection Strategy project:

a. The system should provide for co-ordinated central approach to inspection of appropriate multi-establishment companies;

b. The co-ordination of the inspection should be managed by a Head of Unit;

c. Where a co-ordinated central approach is not considered appropriate, other mechanisms should be in place to ensure consistency between sites of the same company;

d. Special arrangements will have to be made with respect to HID enclaves in FOD sites, where HID or FOD consider that a central approach is appropriate.

2. The chapter covers 4 areas - overview, management, operation and implementation of the system.

Background

3. The potential benefits of co-ordinated interventions with multi-establishment companies are well known, e.g;

a. they improve the consistency, proportionality and transparency of HSE's dealings with those companies by maintaining a central overview;

b. more efficient use of inspection resources can be achieved;

c. they enable better targeting of problem areas within and throughout a company at its various establishment locations;

d. improved communication links with the company;

e. where companies monitor HSE activity across their sites they will be able to identify that we are taking a co-ordinated approach to the company;

4. In addition to these benefits other key issues for HID that will be assisted by co-ordinated central approaches are consistency in the processing of COMAH safety reports and the development of pragmatic charging arrangements across a multi-site company.

5. Along with the advantages it must be remembered that there are resource requirements to set up and fully implement the arrangements required to deal with multi-establishment companies.

6. Consequently attempts have been made in the past to capitalise on these benefits and produce systems for co­ordinating central approaches etc. The main initiatives have been the HOPI (Head Office PI) system set up to co­ordinate safety reports and the Lead PI system, which followed the HOPI initiative and was set up to develop inspection plans for multi-establishment companies. This work was largely linked to the audit programmes for these companies.

7. In 1996 HID set up a working group to review the use of the Lead PI system and auditing in HID. From this working group the topics of audit and Lead PI were separated with the development/replacement of the Lead PI system coming under the Inspection Strategy project.

8. It is from the work on HOPI/Lead PI and other central intervention initiatives such as the HID 5 Lead inspector system and the work of the HID Gas team that the Lead Unit system has been developed. The system builds on the positive parts of the Lead PI/HOPI system and strengthens the weaker aspects.

COMAH Competent Authority Issues

9. The arrangements that have been made to interface with the agencies can be found in the COMAH Manual as chapters 2 and 3.

10. The Agencies do not operate a similar system of intervention because they are of the view that most environmental issues can be dealt with either by the preparation of standards that can be applied to all relevant companies or by dealing with specific establishments at site level as the environment is unique in each location. They achieve consistency by working through a series of industry groups with specific inspectors taking the lead and sometimes setting up task specific responsibilities.

11. However, they recognise that there are some issues that could be dealt with centrally and agree that HSE having a central intervention option may be useful to them. In practice therefore:

a. HID establishment inspectors should involve agency inspectors by consulting the local contact when considering raising issues for central intervention

b. Co-ordinating inspectors should consult the agencies when planning central intervention programmes. In this case the local inspector should be contacted but they may refer the issue to other inspectors who are nominated to deal with a particular industry sector.

OVERVIEW

The Lead Unit System

12. The aim of the system is to deliver central co-ordination of interventions with multi-establishment companies to achieve the goal of efficiently making significant improvements in health and safety standards across a multi-establishment company.

13. The system will be managed by Heads of Operational Units with the approach used being tailored for each company. The system will operate at two levels and includes arrangements for dealing with enclave sites where HID or FOD consider a central approach is appropriate.

a. Level 1 approach - This is aimed at companies where HID has a relatively high level of involvement and will be based on information sharing and accessibility, co-ordination of intervention activity and development of a long term inspection plan for the company.

b. Level 2 approach - This is aimed at companies where HID has a lower level of involvement and will be based on communication, liaison and monitoring of trends to aid consistency of intervention with the company.

14. Multi-establishment companies will be allocated, by the Heads of Operational Field Units forum, to one of HID’s operational units. The allocated Unit will then be responsible for considering if a lead unit approach is likely to be beneficial and if so, developing and co-ordinating the appropriate approach for that company following the guidance set out in this chapter.

15. It is the responsibility of the HOU to ensure the appropriate multi-establishment approach is delivered. Although much of the work will be delegated to Unit staff, direct involvement by the HOU is anticipated when dealing with company senior management.

16. HOUs will allocate a “Co-ordinating Inspector” (CI) to multi establishment companies where the Lead Unit system is to be applied. The CI is responsible for managing the Lead Unit approach for their allocated company.

17. To operate the system effectively staff outside the Lead Unit will be involved in interventions with the company. However this does not mean the Lead Unit assumes the authority to direct those staff. The success of this system will depend on co-operation between Units to contribute to the central approach .

18. To enable the system to function effectively resources need to be allocated to Lead Unit work. To meet this need Lead Unit work has to be planned and specifically included in plans of work at, Divisional, Unit, Group and PWP level. Consequently Lead Unit work will need to be actively reviewed during the work planning cycle.

19. A large proportion of the companies within HID's remit will fall within the multi-establishment definition. From a basic search of FOCUS asking the question "How many HID clients have more than one location recorded against them?" the following figures were obtained:

20. Clients with two or more Locations attached;

NUMBER OF LOCATIONS

2 - 4 5 - 10 11+

Unit 1 94 19 5

Unit 2 232 44 16

Unit 3 229 37 15

Unit 4 338 51 28

Unit 5 32 7 6

Total 925 158 70

21. From these figures it is clear that it is unrealistic, from a resource point alone, to apply the Lead Unit system arrangements to them all. Hence criteria for selection and an approach to implementation are provided.

Definitions

Multi-establishment company

22. A company, or discrete part of a company (e.g. a division) with a number of establishments in the UK linked to a central company point - the intervention locus - for health and safety purposes. (See below for definition of intervention locus and Appendix 2 for further details on the structure of multi-establishment companies and defining intervention loci.)

Establishment

23. Establishment is a defined term under the COMAH Regulations, however for the purposes of the Lead Unit system, which covers both COMAH and non COMAH companies, establishment refers to a geographically or organisationally discrete part of a multi-establishment company.

Lead Unit

24. The HID Unit with overarching responsibility for centrally co-ordinating interventions under the Lead Unit System with a multi-establishment company. (i.e. applying the Lead Unit System)

Lead Unit System

25. The system to deliver central co-ordination of interventions with establishments of multi-establishment companies. The system will operate at two levels - a detailed proactive approach, based on an inspection plan (Level 1) and a less detailed approach of communication between inspectors (Level 2).

Intervention locus (Only relevant for companies subject to a level 1 approach)

26. The point within the multi-establishment company structure where the HID Lead Unit interventions should be targeted to achieve maximum influence This will usually be the highest level of company management that effectively holds the health and safety responsibility. This is not necessarily the legal entity HID would prosecute, but is more the level at which significant company changes to health and safety standards within the company can be authorised.

Co-ordinating inspector

27. The inspector responsible for acting as central contact for co-ordination of HID's approaches to multi-establishment companies under the Lead Unit System. For Level 1 approaches the Co-ordinating inspector will need to oversee the production and implementation of a central inspection plan, whilst for Level 2 approaches, the Co-ordinating inspector's role will be restricted to monitoring central issues and liaising with other inspectors

MANAGEMENT

The Role of the Lead Unit

28. The role of the Lead Unit will depend on the structure and management system of the multi-establishment company and its health and safety performance and will involve the appropriate use of Level 1 and 2 approaches.

29. The role of the Lead Unit is defined as principally one of co-ordination and information sharing. The Lead Unit doesn’t have the authority to dictate that an establishment is inspected, but it will be able to inform and influence the agenda of what is dealt with at an inspection. The responsibility for any one establishment within a company

remains with the Unit holding prime responsibility for inspecting the site . Where an initiative across a number of establishments within the company is proposed the Lead Unit will have responsibility for co-ordinating resource and facilitating the initiative. This will require agreement between HOUs to provide the required resources.

30. The Lead Unit will act as a central point of contact for the company on company wide issues, through a Co­ordinating Inspector.

31. As the system involves information sharing and accessibility IT data quality will be one of the keys to success. Consequently the Lead Unit will be responsible for ensuring that the company FOCUS/CIS record is accurate and reflects the company structure as far as possible, and highlights that the company is subject to the Lead Unit system.

Role of the Heads of Units and the Heads of Field Unit Forum

32. As set out in the introduction to this chapter the second principle the Lead Unit system is based on places responsibility for management of the system at the level of Unit Band 1 as they are accountable to the Head of Division. However this does not prevent the Unit Band 1 from delegating tasks/specific companies within the Unit as deemed appropriate.

33. The Heads of Field Units forum has a key role to play in managing the Lead Unit system. It is at this forum that the Heads of Field Units will consider HID's multi-establishment companies and

a. identify those for which particular Units have Lead Unit responsibilities, and also those for which formal or informal Lead Unit arrangements already exist;

b. agree the allocation of Lead Unit for companies for which the appropriate Lead Unit is unclear;

c. agree cross-Unit resource commitments for Lead Unit approaches. Management tasks that need to be carried out are;

d. Identification of the Co-ordinating inspector (for both Level 1 and Level 2 approaches). It is suggested that in the case of Level 1 approaches, the Co-ordinating inspector role/inspector band should reflect the status/level of company management being interfaced with;

e. Liaison with other HID Heads of Units regarding resource availability for delivering the intervention plan for the company (only applicable to Level 1 approaches);

f. Allocation of the tasks a Lead Unit is required to perform;

g. Allocation of sufficient Unit resources to enable the Lead Unit System to function satisfactorily. This will entail inclusion of the planned Lead Unit work in both Unit, Group and Personal Work Plans. Above this HID will need to include this work in its Divisional Plan of Work;

Role of the Co-ordinating Inspector

34. For individual multi establishment companies subject to the Lead Unit system the Co-ordinating Inspector is the key player in the system. Their role is to manage the Lead Unit system for that company. They will be the point of contact for both Inspectors and the company on centrally co-ordinated issues.

35. In particular the Co-ordinating Inspector will be responsible for delivery of the Level 1 or 2 approach agreed for the company. The tasks listed in the sections “level 1 what to do” and “level 2 what to do” specifically have to be managed by the Co-ordinating Inspector.

36. Both level 1 and 2 approaches will require significant input from the Co-ordinating Inspector and as such will need to be built into PWPs.

Interface with work planning

37. Allocation of adequate resources for operation of the Lead Unit system is vital to the success of the system. Consequently Lead Unit work will need to be considered as a specific issue during the work planning cycle and should subsequently be a specific item in Division, Unit, Group and Personal work plans.

38. As part of the planning cycle Lead Unit work should be actively reviewed and the following issues considered at Heads of Field Unit forum and Unit level;

a. Progress against the Divisional implementation plan (see para 67);

b. Progress with specific companies currently subject to the system;

c. Identification of companies that should be brought into the system;

d. Identification of companies that should come out of the system;

e. Identification of companies that should move from a level 2 to a level 1 approach and vice versa.

39. These issues will obviously need to be considered in the context of the resources available.

OPERATING

Selection of Companies

40. Selection of multi-establishment companies for the Lead Unit System is based on their major hazard potential (i.e. TT COMAH, LT COMAH or non COMAH), the number of people, both on and off site, at risk from their activities and the need for HID to deal consistently and transparently with the company across all locations. From these basic criteria two broad groups of companies can be identified (Group A and Group B):

41. Typical features of a group A multi-establishment company:

a. One or more COMAH installations. (NB the higher the number of TT installations the more weight this criterion carries;

b. Medium or high hazard or complex activities across the company;

c. Multi-national or national company;

d. Significant numbers of employees and MOPs potentially at risk from the company.

42. Typical features of a group B multi-establishment company:

a. Company does not have any COMAH sites;

b. Medium to low hazard, probably non-complex activities carried out across the company;

c. Mainly locally based company or few sites spread nationally.

43. These criteria are intended to be indicative rather than mandatory. Multi-establishment companies do not have to meet all the criteria for a category, and should be placed in the category where the best match of the criteria exists.

44. Group A companies will typically be appropriate for a Level 1 approach and group B companies a Level 2 approach. However the boundaries between the groupings and approaches should be seen as flexible to enable the most appropriate approach to be used. Changes in management structure and organisation will mean that companies will move from one group to another, and that the Lead Unit approach may cease to be appropriate. The possible need to change the way the Lead Unit System is applied should be considered at the annual review stage.

Selection of the Lead Unit

45. The allocation of multi-establishment companies to a Lead Unit is an appropriate function for the Heads of Operational Units' forum as it is these Units that will be charged with operating the Lead Unit System. To assist in the allocation process the following guiding principles are given:

a. The central health and safety function of the multi-establishment company to be in the Lead Unit's geographical area. (NB this is not necessarily the company head office and often will not be.)

b. A significant number of the company's establishments to be in the Lead Unit area.

c. Allocation of multi-establishment companies to be in line with Unit's resources. (NB This does not mean each Unit should be allocated the same number of multi-establishment companies as different companies will require different resource input.)

d. If a Unit is already performing a lead role, whether formally, from previous Lead PI/HOPI work or informally, consideration should be given to maintaining and enhancing that role.

46. Note - If all a multi-establishment company's establishments are located within the geographical area of one HID Unit the Lead Unit System should still be applied within that Unit.

Selecting a Level 1 or Level 2 approach

47. In general group A companies will tend to be appropriate for a Level 1 approach and Group B companies a Level 2 approach (see para 44).

48. When deciding on the level of approach for a company it will be useful to consider HID's anticipated intervention with the company, resources available and any relevant local factors.

49. Changes in management structure, organisation and HID resources will mean that companies may move from one level to another. Also in some cases it may be that the Lead Unit system will cease to be appropriate. The possible need to change the way the system is applied should be considered at the annual review stage.

Level 1 - What to do

50. The Level 1 approach is based on information sharing and development of an appropriate co-ordinated inspection plan across the company. It is aimed at those companies where HID has a relatively high level of involvement and would typically be applied to group A companies.

51. The implementation of this approach will typically have three stages;

a. Stage 1. Information collection

i. collect information on the company structure, organisation and management responsibilities and identify the intervention locus;

ii. obtain an overview of the health and safety performance e.g. from FOCUS/CIS, HI251, safety report assessments etc.;

iii. seek views from inspectors responsible for the company's other sites and any other parts of HSE that may have involvement with the company (e.g. other operating DD’s, policy sections, DST etc);

iv. in the case of COMAH companies information should also be sought from EA/SEPA;

v. at the end of this stage, a decision should be made on the degree and amount of central intervention required. e.g. It may be decided that a Level 2 approach is appropriate;

vi. record information on the Lead Unit document (Appendix 1);

vii. ensure the FOCUS/CIS records reflect the company structure (Ideally any parts of the company which are the responsibility of FOD or other ODDs should also be included);

viii. Make an entry in the FOCUS 'Client clue' to highlight that the HID Lead Unit system (Level 1) is being applied to this company.

b. Stage 2. Development of an intervention plan.

iii. identify how and where the Lead Unit approach should be applied, and the issues it should address. To be effective this will need to be done in consultation with those inspectors with operational responsibility for the company establishments, possibly at a team meeting. Note in the case of COMAH companies EA/SEPA inspectors will need to be involved;

iv. develop a single agreed intervention plan with all inspectors with operational responsibility for the company's establishments. As the plan is intended to apply to all sites of the multi-establishment company the exchange of information and priorities is vital, as is obtaining the agreement and commitment of all the inspectors involved. A team meeting may be the best way of doing this;

v. record the existence of an inspection plan on the Lead Unit document;

vi. Inspection plans should cover the period of time appropriate for the issues involved. For companies that include TT COMAH sites, inspection plans will need to cover the five year period between safety reports and be linked to COMAH inspection plan;

vii. The inspection plan should not exclude inspectors from dealing with local issues at specific sites, but is intended to guide them to look at identified company-wide issues as well as issues arising from local needs . Information on local issues will need to be communicated to the Co-ordinating inspector, who can monitor emerging trends;

viii. The key to the success of the inspection plan is for it to be developed as a team approach, aimed at improving standards across the company;

c. Stage 3. Implementation of the inspection plan.

i. meet the company's management and central health and safety function to explain the Lead Unit approach and introduce the inspection plan;

ii. implement the inspection plan and monitor progress, obtain feedback from inspectors involved in the Lead Unit approach and monitor trends in the company performance;

iii. review and update the intervention plan for the company at regular intervals, perhaps annually. At the review stage, consider whether the level of approach continues to be correct;

iv. where appropriate provide feedback to the company on central health and safety issues;

53. These three stages will be required for all companies subject to the Lead Unit System, but the complexity of stages 2 and 3 will depend on the company structure and performance.

54. For multi - establishment companies that are subject to a level 1 approach and include more than one Top Tier COMAH establishment the Lead Unit will need to consider issues (especially of consistency) arising from safety report assessment work and in particular the central co-ordination of safety report assessment work where appropriate. Lead Units will need to consider these issues on a company by company basis.

55. The issues arising from the assessment of safety reports from multi-establishment companies need to be seen in the light of management controls, technical controls etc. applied both centrally and locally. Some Lead Units will be able to contribute to some of the safety report assessment issues and the process needs to be flexible enough to facilitate this involvement.

56. Estimated resource requirements to implement a Level 1 approach for a company;

CO-ORDINATING INSPECTOR OTHER INSPECTORS

1st year Other years 1st year Other years

Information gathering 2 days 0.5 day 0.5 day Minimal

Developing inspection plan

3 days 2 days 1 day 1 day

Implementation 5 + days 3 + days 1.5 days 1.5 days

'Other ' LU work 2.5 days 2.5 days 0 0

Totals 12.5 days 8 days 3 days 2.5 days

Level 2 - What to do

56. The Level 2 approach is based on information sharing and accessibility to aid consistency of inspections at sites where HID has a lower level of involvement than for the Level 1 approach. It would typically be applied to group B companies.

57. Basic principles of the system;

a. To be managed by the co-ordinating inspector assigned to the company

b. System to be user friendly and accessible to all inspectors involved with the company. (i.e. to be IT based making best use of FOCUS/CIS)

c. Minimal resource required to operate the system

d. System to be based on the sharing of good quality information on the company.

e. To include a periodic (annual) review of information to monitor consistency of approach and emerging trends.

58. This approach will typically have three stages

a. Stage 1. Information collection.

i. Obtain details of the company structure and organisation.

ii. Carry out an initial review of the company's FOCUS records to identify any common issues affecting the consistency of HID's approach e.g. common problems, inconsistencies, emerging trends etc. Any issues identified should be added to the FOCUS Client file note.(see below)

b. Stage 2. Upgrading FOCUS/CIS records

i. Ensure the FOCUS/CIS records reflect the company structure (Ideally any parts of the company which are the responsibility of FOD or other ODDs should also be included).

ii. Make an entry in the FOCUS 'Client clue' to highlight that the HID Lead Unit system (Level 2) applies and that further information is held on the Client file notes. (The character field for Client clue is limited and entries will need to be brief e.g. LPG distributor. See Client file notes re HID Lead Unit information)

iii. Record appropriate information in the FOCUS Client file note. This field has 490 characters available which should be sufficient to record the basic information required by the Lead Unit system - i.e. the HID co-ordinating inspector, where he/she is located and any current company-wide issues.

c. Stage 3. Annual review and Update of FOCUS /CIS records

i. Once per year review the FOCUS/CIS records to identify any common issues affecting the consistency of HID's approach to the company e.g. common problems, inconsistencies, emerging trends etc

ii. Update the Client file note.

59. Inspectors responsible for companies subject to a Level 2 approach have two roles:

a. Prior to interventions with the company the information on the Client file note should be accessed to inform the intervention.

b. Forward to the co-ordinating inspector any potential cross-company consistency issues identified from their dealings with the company.

Resource requirements of the system

60. Start up resources

a. Allocation of companies to HID Units by HOFU forum - 1/2 day

b. Allocation of Co-ordinating inspectors by Unit Band 1 and Band 2s - 1/2 day

61. The estimated time required by the Band 3 Co-ordinating inspector is shown in the table below;

1st year Subsequent years

Checking accuracy of FOCUS record. Recording existence and location of Co­ordinating inspector

1 day Minimal

Reviewing FOCUS contacts 1 day 1 day

Incorporating feedback from other inspectors Up to 1/4 day Up to 1/4 day

62. The input from the other inspectors involved with the company is predicted to be minimal

Enclave Sites

63. As set out in the introduction to this chapter the fourth principle the Lead Unit system is based on requires arrangements to be made with respect to HID enclaves in FOD sites, where HID or FOD consider that a central approach is appropriate.

64. In the case of multi-establishment companies which include enclaves sites the Lead Unit will need to ensure that effective communication is encouraged. HID OPPG (b) leads on HID/FOD demarcation issues and currently have in draft a joint FOD/HID OC regarding enclaves issues.

65. The draft OC sets out how co-ordination of FOD/HID approaches could be achieved with employers at enclave sites. OC 18/5 discusses allocation of premises to HID and FOD, and how enclaves are set up - the draft OC adds specific responsibilities for co-ordinating central approaches at enclaves. The draft OC lists brickworks, manufacture/storage of explosives, and water treatment. These will be the majority of sites involved, but there may be others. The draft proposes the creation of a Lead Division, which has responsibility for the main activity on site. In the case of a multi-establishment company the Lead Division will have responsibility for the activity of the company as a whole. The Lead Division has responsibility for establishing effective communication between HID, FOD and the company, and to take the Lead in dealing with the employer on site-wide issues.

66. The application of the Lead Unit system, will be relevant at multi-establishment companies for which HID is the Lead Division.

IMPLEMENTATION

67. At the April 1999 DMB meeting it was agreed that the Lead Unit system should be implemented within HID over a three year period with specific groups of companies being brought into scope of the system each year. (Details of the three phases are given below.)

68. Each company brought into scope needs to be considered by the Heads of Field Units forum to decide whether a Lead Unit approach is required for the company.

69. Companies where a Lead Unit approach is appropriate will then be allocated to a Unit by the Heads of Field Units forum for implementation of a level 1 or 2 approach.

70. Although the detail will be resolved at the Heads of Field Units forum it is anticipated that phase 1 would result in the allocation of between 50 and 70 companies for consideration of applying the Lead Unit system..

71. Companies in scope are:

Phase Work Year Companies

1 1999-2000 Those companies allocated by Heads of Field Units in October 98, as listed in appendix 3

All companies with at least 1 top tier and 1 or more other COMAH establishments

2 2000-2001 All companies with 2 or more lower tier COMAH establishments but no top tier

3 2001-2002 Remaining multi-establishment companies as resources allow. Consideration to be based on experience gained from phases 1 & 2

72. The implementation plan also includes the overriding principle that any multi-establishment company can be brought into the system at any stage if operational needs direct that this is appropriate. This includes consideration of requests from a company for a central intervention or the maintaining and updating of any existing arrangements. It was also agreed by DMB that a workshop would be run in Autumn 1999 to evaluate progress of the system. From this workshop the implementation plan may be revised.

APPENDIX 1

LEAD UNIT DOCUMENT

Name of company:

Client number:

LEAD UNIT

Location of Lead Unit

Name of Lead Unit contact

Date Lead Unit set up

Reasons for Lead Unit

Other HID Units/groups involved

Other DDs with responsibilities for sites and details of enclaves

COMPANY DETAILS

Location of sites and location numbers

Organisation chart available? - Attach electronic copy if YES/NO possible

Appropriate level for intervention by HID

Name of central contact

Comments - e.g. on joint ventures, holding company, conglomerate etc

INSPECTION DETAILS

Inspection plan prepared? YES/NO

History of central interventions - e.g. issues raised, audit topics etc.

Brief details of type of LU involvement planned

Revision no Prepared by Date

APPENDIX 2

Further details on defining multi-establishment companies (or part of a company)

73. A typical company structure is shown in the attached charts. Depending on the allocation of Health and Safety responsibilities within the company it may meet the multi-establishment company definition in a number of ways.

74. Example 1. Company Head Office has a significant Health and Safety function influencing how the company divisions, units and sites operate. In this case the whole company would be considered for the Lead Unit approach. With the company Head office being the primary intervention locus.

75. Example 2. Company regions have a significant Health and Safety function influencing how the divisions, units and sites operate. The regions have no significant link with the company head office for Health and Safety purposes. In this case each region would be considered for the Lead Unit approach. with the regional offices being the primary intervention loci.

76. Example 3. Company divisions have a significant Health and Safety function influencing how the units and sites operate. The divisions have no significant link with the company regional or head office for Health and Safety purposes. In this case each division would be considered for the Lead Unit approach. with the regional offices being the primary intervention loci.

77. Example 4. Company units have a significant Health and Safety function influencing how the sites operate. The units have no significant link with the company divisional, regional or head office for Health and Safety purposes. In this case each Unit would be considered for the Lead Unit approach with the Unit offices being the primary intervention loci.

78. The key principle is to identify within the company structure the points (intervention loci) where the Lead Unit approach is likely to have a significant effect on Health and Safety performance of that multi-establishment part of the company.

APPENDIX 3

Allocation of Lead Units

Company Lead Unit Co-ordinating Inspector Inspec 4 Flogas 4 Clive Dennis Supergas 4 Powell Duffryn 4 David Perry ST Services 4 David Perry British Aerospace 5 Explosives Developments Ltd 5 Orica Europe Ltd 5 Exchem Industries 5 Chemring Group PLC 5 MOD 5 Akzo Nobel 1 BOC 1 BP Amoco 1 Alistair McNab BP Gas 1 Elementis 1 Alex Keddie Phillips Petroleum 1 Neil Anderson Shell Exploration 1 Terra Nitrogen 1 Alex Keddie Oil & Pipeline Agency 1 Accordis 2 David Snowball Allied Colloids 2 BG Storage 2 Frank Perkins BTP 2 CCL Industries 2 Ciba Speciality Chemicals 2 Croda International 2 Hydro Agri Ltd 2 David Snowball Novartis 2 Shell Gas 2 David Snowball/Graham King Simon Storage 2 David Snowball Transco 2 Frank Perkins Yule Catto 2 Air Products 3 Albright & Wilson 3 Chris Eaton Elf Atochem 3 Terry Durkin ETC Sawmills 3 European Vinyls Corporation. (EVC) 3 Robin Cowley Hays Chemicals 3 ICI Chemicals and Polymers 3 Robin Cowley/Terry Durkin Rhodia 3 Shell UK 3 Ron De Cort Contract Chemicals 3 Agrevo 4 Calor Gas Ltd 4 Clive Dennis Enichem 4 Esso 4 Exxon 4

Assessing Risk Control Systems

• Introduction o RCS 7 - Selection & Management of • RCS 00 - Generic RSC Inspection Guidance Contractors • RCS 01 - Examination and Testing of Safety Critical o RCS 8 - Emergency Response

Plant o RCS 9 - Plant Commissioning

• RCS 2 - Permit to Work o RCS 10 - Plant and Process Design • RCS 3 - Operating Procedures o RCS 11 - Assessing Auditing • RCS 4 - Planned Maintenance Procedures o RCS 12 - Assessing Competence • RCS 5 - Management of Change o RCS 13 - Hazard Identification and Risk

• RCS 6 - Occupational Health - Dermatitis Assessment

INTRODUCTION

1. This guidance is primarily for HID discipline/topic and regulatory specialists, although much of it may prove useful OG wide. It comprises a general guide common to all risk control systems (RCSs), plus a series of topic specific guides.

2. Its purpose is to help inspectors assess the adequacy of RCSs by determining whether the necessary prevention, control and mitigation measures have been provided, are operating effectively, and have procedures in place to ensure their maintenance.

3. The guidance is based on the POPMAR framework:

Policy, Organising, Planning and implementing, Measuring, Auditing and Reviewing,

as explained in HSG 65,'Successful Health and Safety Management'.

4. Inspectors must have the necessary competencies to inspect a particular RCS, and should note that:

• The guidance has not been designed to help staff develop competency in the topic areas covered, and will not effectively support inspections where a required expertise is lacking. Its purpose is to help inspectors apply their expertise to the assessment of particular RCSs.

• Inspectors should be aware that the POPMAR 'Planning and Implementing' phase associated with technical risk control systems is a particular area where the level of expertise needed may rapidly deepen as inspection progresses. It is not practical to offer guidance covering the full range and depth of technical issues that might arise, and inspection may rely heavily on specialist knowledge to question evidence and probe sufficiently to determine the RCS adequacy.

5. The guidance does not specify clear discipline/topic and regulatory specialist interfaces because:

• The inspection planning process manages discipline/topic and regulatory specialist contributions. Allocating responsibility for inspection of each RCS is a matter for agreement by the inspection team, involving all appropriate specialists.

• Where unplanned RCS inspection takes place, the decision to seek specialist support is necessarily a matter for each inspector to judge based on an assessment of his/her own level of competence in the relevant subject area.

What is a risk control system?

6. A risk control system is simply a part of the overall safety management arrangements. It sets out how the safety management system is applied to a specific task or activity.

Guidance scope

7. The following risk control system inspection guides are offered:

RCS 00 - Generic RSC Inspection Guidance

RCS 01 - Examination and Testing of Safety Critical Plant

RCS 02 - Permit to Work

RCS 03 - Operating Procedures

RCS 04 - Planned Maintenance Procedures

RCS 05 - Management of Change

RCS 06 - Occupational Health - Dermatitis

RCS 07 - Selection & Management of Contractors

RCS 08 - On-Site Emergency Response

RCS 09 - Plant Commissioning

RCS 10 - Plant and Process Design

RCS 11 - Assessing Auditing

RCS 12 - Assessing Competence

RCS 13 - Hazard Identification and Risk Assessment

8. The topic guides are being revised as part of an ongoing update process. The format of the revised sections varies from the older parts, which remain valid and available for use.

9. Further guidance on aspects of technical risk control systems can be found in the Safety Report Assessment Guide (Technical Aspects) measures documents.

Using this guidance

10. The general inspection guide covers areas common to all risk control systems. This should be used in conjunction with the individual RCS topic guides.

11. Each topic guide identifies key features that should be part of an effective risk control system, along with typical evidence that would confirm the adequacy of the system. Key issues, questions and guidelines (including benchmarks, where available) are offered.

12. The topic guides are not exhaustive, but they do cover a range of issues and circumstances. It is not envisaged that inspectors will explore every aspect covered, but rather, will exercise their judgement to direct the inspection and gather sufficient information to determine the system adequacy.

13. Guidance on using RCSs as part of a process safety management inspection approach can also be found in Appendix 3 - The Intervention Process (paras 8-11) of the Major Hazard Intervention Policy in the HID (CI, SI) Inspection manual.

Deciding which systems to inspect

14. In the majority of cases inspection plans document the risk control systems to be inspected however Incidents, complaints or issues uncovered during routine inspection may lead to the unplanned inspection of specific risk control systems.

15. The mechanisms for developing inspection plans vary across HID and inspectors should refer to the relevant inspection manual for details:

PM/Enforcement/05 - HID (CI, SI) Inspection ManualPM/Enforcement/07 - OSD Inspection Manual

16. In general, the following criteria should inform the process for selecting risk control systems for inspection:

• Issues arising from previous incidents and intelligence gathered from other interventions at the establishment

• Issues and lessons that are known to be important and relevant to the industry/ installation/ process to be inspected. For example, SPC/ENF/90 - Loss of Containment Incident Analysis, indicates that from around 800 onshore chemical sector incidents analysed, primary risk control systems failings were associated with maintenance, plant and process design, and operating procedures.

• The age and condition of the plant, eg consider;

o The maintenance and examination/testing RCSs for older plant

o The operating procedure RCS for processes with a lot of human intervention

• Any safety report/safety case data:

o Systems safeguarding against the most significant hazards and risks

o Weak areas identified through the assessment process.

• HSE/HID priority programmes addressing major hazard risk control system topics

17. Inspectors should aim to examine a range of RCSs at each site to ensure the full range of major hazard control systems are adequate, including, where relevant, verification of controls, as described in safety cases/reports.

18. Over time it is expected that relevant RCSs will be re-examined to ensure adequacy is being maintained.

Legal basis

19. Inspectors should refer to individual topic guides for clarification of the topic specific legal basis and any associated guidance.

Contact

20. Please direct any queries or comments on the guidance to HID HQ1D.

21. User feedback on this guidance is most welcome. Please use the feedback form that can be returned to HID HQ1D, 3rd Floor, St Anne's House, Bootle.

RCS 00 - Generic Risk Control System Inspection Guidance

Introduction

This guidance comprises generic questions under each POPMAR element. It reduces repetition of these common questions in the specific guidance, and can be used for two main purposes:

• To support the questions in the specific risk control systems guidance • As a set of higher level questions that inspectors can use when examining duty holders' safety management

systems

For some of the questions relevant examples from major incidents are referenced to put the questions into context and demonstrate why the issues are important. Key documents relevant to the POPMAR elements are referenced at the end of the guidance. There are many more references, but for ease of use we have presented a limited number.

1

No Question

Does the policy demonstrate management commitment to health and safety and their intention to include it as an integral part of productivity, competitiveness and profitability?

Longford Explosion

Incident POLICY

The Esso Longford Gas Plant Accident Report of the Longford Royal Commission; Dawson, D Brooks, B.J. June

1999 By Authority. Government Printer for the

State of Victoria No.61-Session 1998-99

Pg 237

Ref

"…Insofar as the failure to conduct the HAZOP study for GP1& the reduction of supervision at Longford. ……were a result of Esso's desires to control its operating costs, asset management practices or policies may have been a contributing factor to the explosion, fire & failure of gas supply"

Example

2 Is there recognition of the potential of operations to cause major accidents and a clear focus on major hazard control within the SMS?

Longford Explosion

The Esso Longford Gas Plant Accident Report

Pg 235

"…The failure to conduct a HAZOP study or to carry out any other adequate procedures for the identification of hazards (in GP1) contributed to the occurrence of the explosion & fire"

3 Is there recognition of need for specific risk control systems e.g. hazard identification & risk assessment, maintenance, Permits To Work, selection & control of contractors, emergency response, operating procedures, managing change?

4 Does the policy recognise that human factors need to be managed with as much rigour as technical measures for roles, responsibilities and tasks which can impact on the control of major hazards?

Longford Explosion

The Esso Longford Gas Plant Accident Report

Pg 240

"…An obligation should be imposed (upon Esso) to demonstrate that its training programmes & techniques impart knowledge of all identifiable hazards & the procedures required to deal with them…."

5 Is there commitment to specifically identify and control all major accident hazards, in addition to occupational health & safety hazards?

Associated Octel

The Chemical Release and Fire at the Associated Octel

Company Limited: A report of the investigation by the

Health & Safety Executive into the Chemical Release and Fire at the Associated Octel Company, Ellesmere Port on 1 and 2 February

"…However, the underlying cause was a failure on the part of the company to identify the risk of a major release in this part of the EC plant…" Octel recognised the hazards from chlorine on site but had not given enough attention to flammable gas

No Question Incident Ref Example 1994. HSE Books 1996 ISBN: 0-7176-0830-1

Para 123

releases.

6 Is there commitment to provide sufficient resources to identify & control major hazards?

7 Is there commitment to set and monitor major hazard performance indicators (in addition to) conventional safety measures like lost time accidents (LTAs)?

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000. A Public Report

Prepared by the HSE on Behalf of the Competent

Authority'.

Pg 65

Inadequate performance measurement and audit systems, poor root cause analysis of incidents, and incorrect assumptions about performance based on lost time accident frequencies and a lack of key performance indicators for loss of containment incidents meant that the company did not adequately measure the major accident hazard potential.

8 Is there recognition of the importance of a positive organisational culture and its direct impact on e.g. compliance with rules and procedures and that management is responsible for ensuring this e.g. by putting in place effective working practices (rather than putting responsibility on individuals and trying to change their attitudes & values) (See Longford Report Chapter 6)?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 200

"Esso's OIMS, together with all the supporting manuals, comprised a complex management system. It was repetitive, circular, and contained unnecessary cross-referencing. Much of its language was impenetrable. These characteristics made the system difficult to comprehend both by management and by operations personnel"

9 Is there commitment to leading by (positive) example e.g. regular site tours by management and taking action when problems found?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 240

"Finally, Esso should be required to show that plant operations are monitored & operating practices are overseen at an appropriate level…& that there would be regular & comprehensive surveillance of operating practices, using properly kept records as well as day to day observations."

10 Is there commitment to dealing speedily with reports of health & safety problems?

11 For multi-site / multi-national organisations, are there central policies and are these reflected at individual sites?

Piper Alpha 'The Public Enquiry into the Piper Alpha Disaster' by The Hon Lord Cullen, published

by HMSO 1990, ISBN 010113102.

Pg 191

'In order to ensure that an effective permit to work system it is essential that operating staff work exactly to the written procedure which has been developed by the company. The Occidental written procedure was contained in their safety procedures manual. The evidence at the inquiry demonstrated that in a number of significant respects this procedure was habitually or frequently departed from… It is not unreasonable to proceed

No Question Incident Ref upon the basis that the Occidental procedure was devised with the intention of achieving the safety objective to which a good permit to work system should be directed. Accordingly each of the departures from the written system represented a departure from safe practice.'

Example

12 How is health & safety represented at the board?

ORGANISING - Control

13 What is the level of health & safety reporting to the board?

14 Are limits of authority stated, accepted and understood?

15 Are people's roles and responsibilities clear, linked to major hazard risk assessments, and understood by the individuals involved?

"

16 Are people's responsibilities realistic or have they been given more to do than they can cope with?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 236

"The reduction of supervision at Longford …… necessarily meant a reduction in the amount & quality of the supervision of operations there. There was a correspondingly greater reliance by Esso on the skill & knowledge of operators…"

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 241

"… (the safety case) would require each employee working in the facility to be competent & to have the necessary skills, training & ability to undertake in both normal & abnormal conditions, including emergency conditions & during changes to the facility, the tasks allocated to that employee & to respond to conditions appropriately..."

17 Have key tasks been allocated e.g. the production of operating procedures, including new procedures or updates

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 234

"Not only was their training inadequate, but there were no current operating procedures to guide them in dealing with the problem which they encountered …"

18 Do people have clear job descriptions? Do managers take full responsibility and are they held accountable for controlling activities that could lead to injury, ill health and loss of containment incidents?

19 Are health & safety responsibilities, for ensuring systems and processes are working effectively, allocated to line managers?

20

21

Are lines of command and control within the management structure clear and understood? Are safety specialists appointed as

22

No Question advisors when necessary? Are contractors used and, if so, what are the criteria for employing them? (Could be because particular specialism not available in-house, to carry out infrequent specific tasks, or simply to try to save money)?

Incident Ref Example

23 Is it clear how contractors are selected and managed?

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 28

"…The number of failures and underlying causes demonstrated a failure in BP's control of contractors & in the management of change in this incident…"

24

25

aims? 26 Are supervisors appointed to help staff

and monitor health and safety standards?

Do people have clear performance standards for measuring their health & safety achievements? Are these standards used in people's performance reviews / appraisal systems? (Measures based solely on avoiding accidents are not recommended, as they tend to lead to under reporting Do the health & safety objectives have the same importance as other business

27 How are employees / contractors consulted about and involved in health and safety issues?

Piper Alpha ORGANISING - Co-operation

'The Public Enquiry into the Piper Alpha Disaster'

Pg 392

"…The regulatory body, operators & contractors should support & encourage the involvement of the offshore workforce in safety. In particular, first line supervisors should involve their workforce teams in everyday safety…"

"…The operator's procedures included in line management of operations which are aimed at involving the workforce in safety should form part of its SMS…"

28

29

30

Are there safety representatives appointed?

Is there a health & safety committee, and if so, how does it operate? How do employees / contractors BP Major Incident Investigation

It has been found that where there is full cooperation and consultation with union representatives and employees, the number of accidents is half that of workplaces where there is no such employee involvement ­See Safety Representatives and Safety Committees Regulations 1977 and Health and Safety (Consultation with Employees) Regulations 1996)

"…lack of organisational

assessments, setting performance standards, maintaining risk control

No Question participate in carrying out risk

Incident Grangemouth

Scotland. 29th May to 10th June 2000.

Ref Report. BP Grangemouth

distribution personnel were not actively involved in the

Example resourcement that power

procedures & instructions and investigating accidents?

measures, devising operating systems,

What role do employees / contractors have in reviewing health & safety

Pg 27 E4 11kV electrical supply project although it had the

planning & execution of the

31

performance? 32

power distribution system for the Complex…."

potential to impact on the

How are employees / contractors encouraged to report hazards?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 221

"…In practice, however, the obligation to report incidents was construed narrowly both by Esso management and by operations personnel. Process upsets were rarely, if ever, the subject of an incident report, unless they were accompanied by injury to persons or damage to property."

How are employees / contractors encouraged to be proactive in improving safety i.e. are they encouraged to suggest improvements and changes to the HSMS?

33

34 What procedures are in place to ensure co-operation between different parts of the organisation?

35 What procedures are in place for resolving disputes?

How does the organisation monitor legal, technical and other health & safety developments to ensure they are aware of the latest requirements, standards & good practice guidance?

36 ORGANISING - Communication

How is the safety policy, and other important health & safety information communicated to people throughout the organisation?

37

38 Do senior managers and other managers & supervisors lead by example by carrying out regular safety tours, chairing H&S committee meetings and being involved in incident investigations? Are there systems to encourage employees / contractors to communicate health & safety information to line managers?

39

40 Are the outcomes of health & safety inspections & investigations communicated to employees / contractors?

41 How does the organisation communicate with regulators and the public? Are key documents such as process & instrumentation diagrams and operating procedures kept up to date?

42

43 How does the organisation ensure that employees / contractors are recruited

ORGANISING - Competence

No Question Incident Ref Example with sufficient skills, knowledge and abilities to do the work expected of them?

44 How are employee / contractor competence needs identified and can they be clearly traced back to the risk assessment process?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 236

"… the ultimate cause of the accident on 25 Sept was the failure of Esso to equip its employees with appropriate knowledge to deal with the events which occurred. Not only did Esso fail to impart that knowledge to its employees, but it failed to make the necessary information available in the form of appropriate operating procedures…."

45 How is employee / contractor competence maintained over time?

Associated Octel

The Chemical Release and Fire at the Associated Octel

Company Limited:

Para 129

Lesson 8 "The competence of process operators should be assessed after initial training & when first put to work on plant & subsequently on a routine basis. The frequency of assessment should be determined at the completion of training & by a number of factors, e.g. the complexity of the task, technical content, & in particular the risks associated with the process…."

46 How does the organisation ensure that training has been successful i.e. that required levels of competence have been achieved and that it is the right training for the hazards present?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 234

"…The lack of knowledge on the part of both operators & supervisors was directly attributable to a deficiency in their initial or subsequent training…."

47 Are there sufficient people with the necessary competences available to meet all of the foreseeable routine and emergency scenarios identified in the operational and emergency procedures?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 209

"…. There were no experienced engineers on site at the time of the accident on 25 Sept 1998. Expert knowledge from that source, of plant operating parameters, of the metallurgical limits of equipment & vessels in GP1 & of the consequences of cold temperatures resulting from loss of lean oil circulation in the ROD/ROD area, were absent…"

Piper Alpha 'The Public Enquiry into the Piper Alpha Disaster'

Pg 353

"The failure of the OIMs to cope with the problems they faced on the night of the disaster clearly demonstrates that conventional selection & training of OIMs is no guarantee of ability to cope if the man himself is not able in the end to take critical decisions & lead those under his command in a time of extreme stress."

48 How are gaps in competence identified and the need for specialist advice

Are all foreseeable operational conditions covered in the competence management system e.g. normal, abnormal/upset, emergency, maintenance, start up / shutdown?

No Question identified?

49

50

Incident Ref Example

Is there a competence management system and, if so, does it include adequate consideration of major hazard control?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 225

"…In order to provide a safe working environment there could and should have been appropriate operating procedures to deal with the loss of lean oil circulation, cold temperatures & the shutdown & start up of the plant. Furthermore, the operators & supervisors could & should have known of & understood the real hazards confronting them on the day…."

identify and prioritise the most significant risks?

51 Are risk assessments carried out that Octel

PLANNING & IMPLEMENTING Associated The Chemical Release and

Fire at the Associated Octel Company Limited:

failure to conduct a fundamental assessment of the inherent risk, insufficient

"…As a direct result of the

Para 123 attention was paid to a range of safety precautions which would have reduced or avoided the risk of a major release or mitigated its effects…"

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 240

"…Esso should also be required to demonstrate that its operating standards, practices & policies are periodically reviewed & that the documentation of each identified procedure includes an explanation of the potential hazards associated with the procedure. The critical procedures include start up, controlled shutdown, emergency shutdown & any other deviation from normal operating conditions…."

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 235

"…. The failure to conduct a HAZOP study or to carry out any other adequate procedures for the identification of hazards in GP1, contributed to the occurrence of the explosion & fire…."

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 217

"…There was no evidence of any system to give priority to important alarms. Good operating practice would have dictated that critical alarms be identified & given priority over other alarms…"

No Question BP

Grangemouth

Incident Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 54

Ref The HSE investigation recommended that improvements be made in "Process safety review - systematic reviews should be initiated at regular intervals to help assure the overall integrity of process units.

Example

52 Have the key risk control systems been identified, e.g. for ensuring initial integrity, maintaining integrity, managing changes, operational control, cessation of operations and emergency response?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 206

"…. Had a HAZOP study of GP1 been conducted, as Esso initially believed it should, Esso would have acquired knowledge of those hazards, which, as it transpired, were critical. In due course, that knowledge would have been disseminated by way of training, the development & use of procedures & the adoption of protective control systems. In short, the failure to conduct a HAZOP study of GP1 contributed to the disaster which occurred on 25 Sept 1998…"

Associated Octel

The Chemical Release and Fire at the Associated Octel Company Limited:

Para 125

"…Maintenance of these components was on a breakdown basis & no written records of the frequency of component failure or replacement were kept…."

53 What arrangements are in place to eliminate or control the identified risks?

54 What performance standards are in place for health & safety?

55 Is there a structured process to identify and manage hazards & risks resulting from human error (e.g. for identified safety critical tasks) and how is this integrated with the main risk assessment process?

Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 238

"…However, the failure to report the incident deprived Esso of an opportunity to alert its employees to the effect of loss of lean oil flow & to instruct them in the proper procedures to be adopted in the event of such a loss…."

56 Are the control measures identified to eliminate or otherwise manage human error selected appropriately for the type of error concerned?

57 How are health & safety targets formulated?

58 To what extent are health & safety plans developed?

MEASURING PERFORMANCE 59 What arrangements are there for actively

measuring performance i.e. measuring performance before something goes wrong? For any given RCS this might include a combination of activities involving different personnel, including workforce and task checking, review of risk assessment activity, reviewing records, audits and follow-up from audit activity, regular site inspections, checking

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Page 68

"…It was recommended that BP consider the period from the Hydro-Cracker Major Accident in 1987 in order to consider similarities between the accidents & establish if safety performance improved after this accident, when it deteriorated, & why the stated continuous

No Question process instrument readings, reviewing shift records, compliance checking for safety critical procedures, corrosion monitoring of plant, completion of safety audits, and checking that reports of health & safety problems have been dealt with?

Incident Ref improvement culture failed to fully materialise…"

Example

60 Longford Explosion

The Esso Longford Gas Plant Accident Report:

Pg 219

"…The lack of plant surveillance activity in GP1 was demonstrated by the lack of use made of process information. Electronically generated process information was automatically retained in the PIDAS database. However, it would seem that it was rarely, if ever, looked at, let alone subjected to any trend analysis…."

61 What arrangements are there for reactively measuring performance i.e. accident & incident investigations, responding to reports of problems?

62 Are there arrangements for receiving and dealing with reports of health & safety concerns from staff?

63 Do performance measures cover major accident hazards as well as lost time accidents?

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 49

This reference directs users to a table of information.

64 Is performance compared against predetermined standards?

65 Is action taken when gaps in performance are identified?

66 How is health & safety performance verified?

AUDITING & REVIEWING PERFORMANCE 67 Are audits of health & safety systems

carried out BP

Grangemouth Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 68

The report recommended that BP "…review the targeting of audits to major hazards".

Piper Alpha 'The Public Enquiry into the Piper Alpha Disaster'

Pg 356

"…Audits need to assume a far higher prominence as a means of checking the ability of the organisation to achieve safe designs, operations practices & systems to interrupt a chain of events leading to a Piper Alpha type accident…"

68

69

Do they assess whether adequate risk control systems exist and are implemented and adequate workplace precautions are in place?

Do the audits examine all aspects of the

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 68

The report recommended that BP "…review procedures for initiating "before the event" task force type audits where evidence exists of deteriorating performance which could lead to a major accident…"

No Question Incident Ref Example health & safety management system?

70 Are the results of the audits (good and bad) communicated to the right people - including senior managers / directors?

Piper Alpha Quote from video of lecture on the disaster

"When we asked senior management why they didn't know about the many failings uncovered by the inquiry one of them said 'I knew everything was alright because I never got any reports of things being wrong'"

71 Are the people carrying out audits independent of the area or system they are auditing?

Piper Alpha 'The Public Enquiry into the Piper Alpha Disaster'

Pg 356

"…This will require more skilled personnel for operations to conduct specialist audits, for third parties to check them & for Govt departments to review their success…"

72 Do the audits involve interviewing people, examining documents and checking physical conditions?

73 Are audits a real challenge to the SMS (i.e. do they examine site conditions or are they focused on system paper compliance)?

74 What arrangements are there for taking account of the results of performance measuring and audits?

75 Is there a prioritised programme of action to deal with the issues from performance measures & audits?

76 Does the programme identify what needs to be done, when and who is responsible for doing it

77 Is the action plan monitored to ensure all actions are implemented? What happens if actions are not completed by specified times?

78 Are regular reviews carried out of safety performance to ensure that the correct procedures are in place and are functioning correctly?

Piper Alpha 'The Public Enquiry into the Piper Alpha Disaster'

Pg 358

"…Common sense & experience of what happened on Piper indicate that it is not enough to set up a systematic approach to safety & put it into operation………It is also necessary to "audit" the extent & quality of adherence to the system & to "verify" that its results are in practice satisfactory…"

79 Do reviews lead to changes to systems, procedures or specific precautions and measures required by law e.g. safety reports?

BP Grangemouth

Major Incident Investigation Report. BP Grangemouth

Scotland. 29th May to 10th June 2000.

Pg 49

"…BP reviewed the FCCU earlier in 2000, partly to try to determine why it was not operating properly….& to compare it with BP FCCU world standards. The review findings were not implemented or communicated properly…"

80 Are there examples of where the review process has lead to the elimination of hazards, significant risk reduction, continuous improvements in control standards or better mitigation measures that demonstrate innovation and awareness of current developments and

No Question Incident Ref Example standards?

KEY REFERENCES Policy

• Leadership leaflet. A free HSE publication identifying the key characteristics of effective leadership in health & safety context. Includes sections on h&s culture, leadership by example, systems & workforce.

• Successful Health & Safety Management (HSG65) 90 page HSE priced publication summarising the key elements of the POPMAR model for managing h&s.

• Managing Health & Safety - An open learning workbook for managers and trainers. 70 pages. A priced HSE publication (1997) giving practical activities on a range of h&s management issues. Useful to recommend to dutyholders as a training guide.

• Major accident prevention policies for lower-tier COMAH establishments - a free HSE leaflet • Directors' responsibilities for health & safety (INDG343). A free HSE leaflet. • A guide to the Control of Major Accident Hazards Regulations 1999. (L111). 120 page priced HSE publication. • Management of Health & Safety at Work - Approved Code of Practice & Guidance (L21). Priced HSE publication.

40 pages.

Organising - Control • Managing contractors - A guide for employers. 45 pages. Priced HSE publication aimed at SME's in the chemical

industry. A useful practical guide to recommend to dutyholders. • Managing contractors - free leaflet.

Organising - Co-operation • Involving employees in health & safety - forming partnerships in the chemical industry (HSG217). 60 page HSE

priced publication designed to help employers increase employees' involvement in all aspects of h&s management. Includes case studies & benchmarking questions.

• A guide to the Health & Safety (Consultation with Employees) Regulations 1996 (L95). HSE priced publication giving guidance on the regulations.

• Consulting employees on health & safety - a guide to the law (INDG232). A free HSE leaflet.

Organising - Communication Nothing identified

Organising - Competence • Reducing error and influencing behavior (HSG48) 1999. 80 page HSE priced publication giving guidance on the

essential role of human factors in effective h&s management. • Developing and maintaining staff competence - Railways Safety Principles & Guidance Part 3 Section A. 70

page HSE priced publication aimed at the railway industry but relevant across all industries (2002) • Effective Health & Safety Training - a trainer's resource pack (2001). (HSG222). A priced HSE publication

designed to help employers & trainers improve h&s performance. Designed for SMEs but useful for all trainers.

Planning & Implementing • Formula for h&s. HSG166 76 pages. HSE priced publication aimed at SMEs in chemical manufacturing.

Identifies main hazards & gives guidance on controls.

Measuring performance • Health and Safety Climate Survey Tool. A computer application on CD ROM with a detailed questionnaire for

dutyholders and means of analysing the results.

Audit & Review Nothing identified

RCS 01 - Examination and Testing of Safety Critical Plant

Introduction Organising - Competence Policy Planning and Implementing Organising - Control Measuring Performance

Organising - Co-operation Auditing

Organising - Communication Current Issues

Example Question Set Appendix

INTRODUCTION

The purpose of an Examination/Test of Plant System is to provide confirmation of initial plant integrity, prior to it being brought in to use, and to confirm continuing integrity/ function by the periodic examination/test at a predetermined frequency throughout the plant life. The examination/test of plant is one of the key risk control systems identified by the analysis of the cause of incidents on major hazard sites (STATAS and Loss of Containment Project findings).

In this guidance plant includes any associated control and instrumentation (C&I) systems, the failure of which will significantly increase the risk of injury or harm to healthof people, or the likelihood of a major accident.

In this guidance, the individual carrying out the examination/test is referred throughout as the Examiner, and the HSE Inspector as the Inspector. This is to avoid confusion over the use of the terms. Examination/test is defined as the act of physically checking plant items and Inspection as the regulatory function.

This guidance should be used in conjunction with the RCS General Introduction and the RCS Generic Guidance that is designed to cover issues common to all risk control system inspections.

Inspectors should examine the management processes and activities associated with examination/test of plant to discover if there is sufficient evidence to indicate that the system:

• Has a clear purpose/objective. • Is suitably organised. • Is planned and implemented to achieve control of the risks. • Ensures that performance is monitored. • Includes a periodic review of design, operation and achievement of objectives • Is verified by someone external to the system to ensure that the system: exists; is properly designed; is

operating; is effective.

LEGAL BASIS

• The Health and Safety at Work etc Act 1974 (HSW Act) • The Management of Health and Safety at Work Regulations 1999 (MHSW) • Comah Regulations 1999 (COMAH) • Pressure Equipment Regulations 1999 (PER) • Pressure Systems Safety Regulations 2000 (PSSR) • The Provision and Use of Work Equipment Regulations 1998 (PUWER) • The Electricity at Work Regulations 1989 (EAWR) • Confined Spaces Regulations 1997 • Safety Case Regulations 1992 (SCR) • Offshore Installations (Prevention of Fire etc) Regulations 1995 (PFEER) • Offshore Installations and Wells (Design etc) Regulations 1995 (DCR)

POPMAR ELEMENT

KEY FEATURE INSPECTION GUIDELINES

POLICY Is there a clear policy for the planned examination/test of plant? Can senior management outline the purpose of the examination/test programme, and the consequences of failure?

Are the arrangements between insurance company examinations/tests and in-house examinations/tests properly understood?

Policy should cover:

• Purpose/ objectives, scope and the consequences of not having a system;

• The legal requirements for examinations/tests e.g. Pressure Systems, Provision and Use of Work Equipment, Lifting Equipment. Be aware that examinations/tests that fall outside of the scope of specific legislation (such as PSSR) are just as important and need to be part of a properly planned programme. Companies may assume that non-PSSR examinations are not as important. They are, and are covered by PUWER Reg 6. For example, periodic proof testing of a safety instrumented system or interlock, to ensure an adequately low probability of failure on demand;

• Any contracting out of examination/test activities; • The assurance of examination/test tasks and systems

against human failure, including the role of human error. • Who does what, and how they ensure that there are no gaps

in coverage.

Verification of Documentation:

• Corporate policies of plant examination/test (Head Office Instructions etc);

• Any contract arrangements with 3rd party examination/test services. Company should understand who covers what. For example, the interval of examination/test of safety relief valves is covered by PSSR, but site is responsible for valve testing;

• Examination/test requirements imposed as part of insurance policies.

ORGANISING CONTROL Is the system for managing the examination/test of safety critical plant adequate? Are responsibilities clearly allocated and accepted? Are people held accountable for managing the system, carrying out the examination/test programme and completing follow-up action? Are changes in the way that the plant is run, that can undermine the examination/test regime, properly controlled? Are the Duty holder's responsibilities regarding operation of plant beyond next examination/test dates absolutely clear?

• Equipment should be examined and tested in accordance with a planned programme. The frequency of examinations/tests should be determined taking into account the likely rate of degradation of the plant/equipment, and the consequences associated with failure. Examination findings should include an estimate of the urgency of any repair.

• Responsibilities should cover oversight, scope, implementation, monitoring, audit and review.

• The programme should be adequately resourced- this will be specific to each plant and depend, for example on its age, history and degradation mechanisms.

• Senior managers should be aware of the status of the planned programme (are examinations/tests being completed on time?) and should take action where issues arise. Overdue examinations/tests should be managed, concentrating on the items of highest criticality. For PSSR written scheme of examination (WSE) equipment you are not allowed overdues unless notified to HSE in advance, and then only one. PSSR Reg 9(7)(b)(c).

• Specific arrangements for in-house (2nd party) and or 3rd party examination/test activity should be clearly understood, with no gaps in coverage. The company should know exactly who provides what. If the in-house activity is not accredited by the United Kingdom Accreditation Service (UKAS) to BS EN ISO/IEC 17020:2004 General criteria for the operation of various types of bodies performing inspection, then it should be able to demonstrate sufficient independence from the operating functions of the company.

• Any difficulties encountered in implementing the programme (for example, timely release of plant or preparation of plant) should be reported. As described in HS (G) 244.

• Where examination and testing schedules cannot be met, the plant should not be operated unless an adequate case for continued operation has been made and signed off by senior management.

• For C&I systems, UKAS accredited certification schemes such as CASS (Conformity Assessment for Safety-Related Systems), when properly applied and as part of a systematic approach, can help duty holders in demonstrating that the arrangements for periodic proof testing are adequate.

Verification of Documentation:

• To show how people are held accountable e.g. performance appraisal;

• To show a clear allocation of responsibilities e.g. contract documents with 3rd party examination/test services;

• To show evidence of adequate resource allocation e.g. budgetary plans/forecasts

• Look for cases justifying continued operation when plant examination/testing schedules have not been met.

ORGANISING COOPERATION Do all personnel cooperate to ensure the successful operation of the System? Is there good cooperation between 3rd party and in-house teams? Is there coordination with other parts of the SMS e.g. plant/equipment design, planned maintenance etc.?

• All parties should show a shared understanding and acceptance of the examination/test programme. There should be good communication between 3rd party and in­house teams, so that no tasks are forgotten.

• Procedures should be in place to overcome any disputes e.g. between production and maintenance departments concerning release of plant for examination/test.

Verification of Documentation: Most evidence will come from interviewing personnel, but the following sources may be useful in some circumstances.

• Look for evidence of failures in cooperation between parties involved in planned examinations/tests e.g. letters to contractors or insurance companies, safety/production committee minutes.

• Documents relating to dispute resolution procedures. • Interrogate scheduling systems (mostly computer software

but can be paper systems) for evidence of overdues. Ask for output reports used at review meetings for demonstration of the performance of the system.

• Check that modifications include involvement with Competent person where necessary. The WSE should be up to date.

ORGANISING COMMUNICATION Are there adequate information • Details of the examination/test programme should be flows into, within and from the communicated to: those undertaking examinations/tests, and organisation to secure the line managers. Visual observation of selected plant should effective operation of the be used to confirm that the identification and tagging system, System? where utilised, is being implemented. Is plant identified or tagged to • Findings should be passed on to plant managers and to ensure that the correct piece of those responsible for taking action. equipment is examined or • Outstanding examinations/tests should be flagged up so that tested? action can be taken.Are there written or verbal • Modifications to recommended examination/test frequencies instructions covering; what plant or methods and performance criteria provided by equipment is to be examined or tested; by manufacturers or suppliers need to be brought to the whom; examination/test attention of examination/test personnel. frequency; examination/test • Imminent danger reporting arrangements should be in place criteria and recording of findings so that all relevant personnel are informed if etc.; follow up action? examinations/tests reveal situations of imminent danger. Are there imminent danger reporting arrangements?

• Where schedules cannot be met, examination/test Are there postponement postponement arrangements should be in place. Overdue reporting arrangements? examinations/tests should be managed concentrating on items of highest criticality. Plant should not be operated unless an adequate case for continued operation has been made and signed off by senior management.

Verification of Documentation: Most evidence will come from interviewing personnel, but the following sources might be useful:

• Examination/test programmes, records procedures/ instructions/ manuals;

• Job requests/ completion notifications; • Internal memos - progress chasing/ overdue

examination/test lists; • Imminent danger reports; • Postponement requests approved/rejected. • Overdue lists

ORGANISING COMPETENCE Are people competent to achieve the system objectives? Is the examination/test body competent?

• People undertaking the actual examinations should be competent, and where necessary, have suitable qualifications. There are a number of these e.g. PCN/GEN/2000 certification by BINDT. S.R.A.G. (Technical Aspects) -Inspection/ Non-Destructive Testing Pages 33-34 for details of the many guides and codes, including personnel qualification, relating to Examination and NDT. For examination/test departments, reference to the adoption of BS EN ISO/IEC 17020:2004 and UKAS accreditation is one means by which competence can be demonstrated. The company should make checks on 3rd party competence and procedures etc. to confirm their adequacy. Action should be taken where issues arise.

• Individuals should know the purpose of examination/test tasks that they perform, and the consequences if the task is not done properly. For example, employees involved in examination of plant pressure systems should be able to describe the criteria against which they are making the examination/test and why those criteria have been chosen. An examination/test engineer should be able to look at corrosion measurements and know what the retirement criterion is. They can then decide if it is safe to continue with the plant in use and what the retest interval should be.

• Plans for the examination/testing of C&I systems should be approved by a person having the relevant competence (see, for example, IEE/BCS Competency guidelines for safety-related system practitioners, Institution of Electrical Engineers).

• There should be realism about which examination/test tasks people can be expected to perform reliably . Competence should be seen as only one means for addressing potential human failure and errors. PM/ENF 11 Human Factors - Inspector Toolkit, Common Topic 2 Maintenance Error for means of addressing human failure/errors.

Inspectors may wish to select a particular examination/test task to check conformity to the procedure outlined in documents or during interviews. Verification of Documentation:

• Examination/test accreditation certificates; • UKAS website lists accredited bodies (and dates) and

names of body leaders. • Training records of examination/ testing body personnel.

PLANNING AND IMPLEMENTING

Has all plant been identified? Have appropriate examination and test techniques been applied at appropriate intervals? Have the requirements of specific legislation been complied with e.g. PSSR, and

• Safety critical plant and equipment should be identified and an examination and test scheme developed based on:

o Legal requirements; o Safety criticality (linked to major accident hazards

scenarios); o Likely failure modes; o Historical data;

PUWER? Is there a system to ensure registration and periodic examination and test of new (or re-reviewed) equipment? Are Examination/Test Bodies trending results?

o Published standards/codes. • Some plant integrity management systems adopt a risk-

based approach. Inappropriate or incorrect application of RBI could lead to an inadequate examination and test system. Further guidance on RBI can be found in SPC/Tech/Gen/32.

• Sample examination and testing can validate judgements and provide assurance. Pipework Example.

• Schemes should adopt examination and test techniques • Does the based on identification of likely failure modes. Identification

Examination/Test of failure modes is not an exact science. System take Human Factors into account?

• S.R.A.G. (TECHNICAL ASPECTS) INSPECTION/NON-DESTRUCTIVE TESTING for details of examination and test

techniques and capabilities and a checklist for the Inspection follow up properly

• Is post examination/test of NDT

planned? Is appropriate • SPC/Tech/Gen/18 for guidance on techniques for detecting action taken on Corrosion under Insulation (CUI) and where checks should examination/test be carried out.findings? • Examination and testing schemes should be comprehensive

- identifying and addressing known problem areas. A Pipework Example.

• Examination/test bodies should trend results over time in order to identify problem areas before incidents occur.

• Links to further guidance: 1. Eutech Report Para 6.3.9. - Suggested Good

Practice for assuring integrity of pipelines 2. Eutech Report Para 7.7 - Causes of loss of

containment in pipework 3. Eutech Report Para 8.3(g) - Recommends the use of

API 570 Piping Inspection Code for the inspection of existing pipework

4. Eutech Report Para 9.3.3- Why in-service examination/test schemes fail

5. SPC/Tech/Gen/33 Paras 87-97 -Information on standards, codes and guidance for examination/test of piping systems.

6. HSE Contract research report CRR 428/2002 Provides principles for proof testing of safety instrumented systems in the chemical industry including proof testing practices, content of procedures, planning and scheduling, proof test records competence, awareness of hazard and risk and management of change. Suggests companies should adopt a more structured and focussed approach to proof testing.

• Those involved in examinations/testing should be able to give details of the tasks they perform and the criteria they use to judge acceptable performance.

• Procedures should describe details of site-specific issues for failure modes and examination and test techniques, acceptance/ rejection criteria, and arrangements for supervision and task checking.

• Those responsible for carrying out the examinations and tests should be closely involved in the task design process.

• Look for evidence of improvements/changes that have been made to make the examination/test task easier. For example, is 'inspectability' (e.g. access) considered in design and modification processes?

• Procedures should include checks for errors at critical stages to allow for error recovery, particularly for complex tasks. For example, checklists can be used for complex series of task steps. Other job aids may be appropriate and used to support and assure safety critical tasks. For example, accurate and easily readable calibration information, key examination/test criteria, and supporting visual aids etc. Staff should find these useful and accurate.

• Critical work shouldn't be planned for the end of long shifts/cross-shift. If such work does cross shifts then extra vigilance and monitoring may be required as well as the usual shift handover arrangements and permit to work issues. HS (G) 48 (pp35-38) gives a summary of the main issues. Fatigue should be managed e.g. overtime monitored individually; clear limits set on hours. There should be evidence of realism about task performance over time, for example on repeated and monotonous tasks.

• Items of plant, especially sensors/alarms and trips taken off­line for examination and testing, should be clearly flagged up to production staff as non-operational.

• Maintenance staff should be given the correct details of faults and repairs required following examination and test.

Repairs should be carried out within the timescales specified in the examination/test report.

• Inspectors can make a judgment on the conditions in which examination and test tasks are carried out (e.g. lighting, access) and if this is likely to lead to poor work, errors and mistakes, and incomplete work.

• It is unlikely that inspectors will be able to observe many (if any) plant examinations/tests during the on-site inspection. Visual observation may be more feasible in the lead up to major plant shutdowns/maintenance programmes.

• Inspectors can check to see if: equipment is properly identified or coded following examination/test; items of plant removed for examination/test have been replaced e.g. sample of latest pressure relief valves; the plates on vessels correspond to information on the examination/test schedule.

Verification of Documentation:

• Check the examination/test records and fitness certificates for a representative sample of critical items of plant e.g. pressure relief valves, alarms and trips, remotely operated safety valves, flexible hoses, pressurised storage vessels etc. Look for discrepancies with written scheme.

• Written schemes of examination (Pressure Systems Regulations, Risk Based Inspection). These should be up to date.

• Lists of safety critical equipment, plant and processes, failure modes and the consequences for other things such as maintenance.

• In-house examination/test standards/ criteria/instructions and plant identification codes etc.

• Work instructions indicating a requirement for plant examination and test. Enough detail and adequate instructions are key features. For example, The Octel Investigation, where maintenance staff were given no instructions on the type of examination to carry out on a critical plant item. As a result, only a cursory visual examination was carried out. SRAG (tech) incident summary.

• Procedure detailing how emergency shutdown equipment capacity is maintained during examination and test.

MEASURING Is the examination/test • Useful feedback can be gained from staff on the operation of PERFORMANCE programme monitored? Is pre- the programme. Management should actively listen to issues

determined action taken when or problems experienced by examination and test staff, as a examinations/tests are overdue? means of early checking for possible system degradation. Is assessment made about • Compliance checking should be carried out. E.g. against whether it is safe to continue examination and test procedures, data entry, quality of using plant or equipment beyond repairs etc.the due examination or test • Poorly performing sites may not carry out examinations/tests date? on time but work from overdue lists. Overdue Are examination findings acted examinations/tests should be managed, concentrating on the upon? items of highest criticality. N.B. for PSSR WSE equipment Are leading and lagging process you are not allowed overdues unless notified to HSE in safety performance measures advance, and then only one. PSSR Reg 9(7)(b) (c). used that reflect the process risk • Are any actions outstanding? profile of the plant? Is leading • Good practice is to communicate the information from the and lagging data used to drive monitoring of the Examination/Test Programme (to take performance improvement? account of early equipment failure or greater than expected

service life) to relevant personnel. • Are incident findings • Examples of Leading Indicators include - % of overdue plant

acted upon? examinations and tests beyond the examination/test interval; % of high hazard pipework where (under lagging) corrosion is greater than acceptable for the safe operation of the plant; the number of examinations and tests completed to plan; the number of reports to timescales; the number of cases of peer

review and oversight of examiner judgment (task checking) where problems have been identified.

• Examples of Lagging Indicators include - The number of incidents involving loss of containment of hazardous materials per 100,000 hours operation; the number of incidents involving loss of containment of hazardous material where corrosion/ wear was found to be a contributory factor; the number of demands placed on a safety instrumented system.

• The data (from measuring process safety performance) should be used to drive performance improvement. For example, a committee of technical and management staff could meet monthly to review process safety measures and agree and steward necessary improvement actions. There is no published guidance on monitoring of plant examination/test systems at present. However, the ABB Ageing Plant Project to be published at the end of 2005 should contain some guidance. Companies should be encouraged to put monitoring/feedback systems in place. OECD Guidance on Safety Performance Indicators. Further guidance on HSE's programme to promote the use of process safety performance indicators can be found in SPC/Enforcement/87.

• Where failures to examine items of plant or equipment, or examination errors were thought to have been a contributory factor - these should be separately identified and addressed.

Verification of Documentation:

• Written instructions covering monitoring of the examination of safety critical plant programme;

• Written guidance on fitness for service assessment; • Workplace examination/test records covering the operation

of the examination of safety critical plant system; • Check records/ computer data systems to find reports on

overdue examinations/repairs (there should be none for PSSR unless postponed)) or on forward planning indicators to operational staff;

• Near miss or incident investigation reports may indicate that a failure to examine or to properly examine, or to examine plant on time may have been a contributory factor.

Is the design and operation of AUDIT AND • The design and operation of the examination/test of plant REVIEW the Examination/Test of Plant system should be subject to an independent audit. LINK TO

System subject to periodic SPC/Tech/Gen/33 Paras 5 and 6 Integrity of Pipework scrutiny and verification by Systems Project - UK Refineries for good practice someone not involved in benchmarks for assuring integrity of pipework systems. planned examination/test at the • The design and operation of the system can be reviewed in workplace under review? respect of: items of plant subject to examination/test; Does the audit determine examination/test frequencies; assessment criteria; whether whether the examination regime the objectives are realistic; examination/test methods and is technically compliant with choice of examiner; use of examination intelligence to review good practice? examination/test frequencies. (Not currently clear on what

constitutes good/best practice.This means that HSE does not have anyone available who can offer further advice on this subject).

• Information can be gathered about the operation of the system from other management activities such as, hazard identification and risk assessment studies and incident/ near miss investigations etc. (Not currently clear on what constitutes good/best practice. This means that HSE does not have anyone available who can offer further advice on this subject).

In larger companies, audits of 2nd party examination/test groups do get undertaken, but in less detail to the above. Larger companies

usually use managers from other sites. If the examination/test department is UKAS accredited they will be subject to an independent audit. You could ask to see the non-compliances from the UKAS Report. In smaller companies, you will be unlikely to find anything, particularly if the bulk of their plant was under PSSR and examination by a 3rd party (insurance company). Verification of Documentation;

• Copies of audit reports (including UKAS non-compliances) covering either the specific operation of the examination system or of more wider aspects of health and safety management which include aspects of the examination/test of plant system;

• Any evidence of reviews of human performance in examination activities;

• Documented reviews of the performance of the system, or other sources of review, HAZOPs, FMEAs, accident or incident reports, plant change procedures etc;

• Reports on performance to senior management, detailing achievement of objectives or explaining why objectives have not been met.

CURRENT ISSUES 1. Industry moves to a Risk Based Inspection (RBI) approach. Further guidance on RBI can be found in SPC/Tech/Gen/32. Issues include:

• Areas excluded from schemes with no inspection evidence to confirm assumptions made at exclusion; • Extending the intervals between examinations/tests; • The reliability of non-invasive examination techniques (see Paragraph 51 SPC/TECH/Gen/32); • RBI methodology relying heavily on the identification of potential degradation mechanisms. Research has

revealed wide discrepancies between the degradation mechanisms identified by different duty holders. There needs to be provision for validating the assumptions made about degradation mechanisms (see Paragraphs 30­35 SPC/TECH/Gen/32);

• Assurance of the competency and suitability of the "expert review team"; • The process can be front end heavy on resources before benefits are achieved. There can be a drive for benefits

at too earlier stage to "sell" RBI projects; • RBI is sometimes used to sort out inadequate examination/test regimes but can take more time than anticipated

to deliver.

2. A lack of experienced examination personnel. 3. 2nd party v 3rd party inspectorates. 2nd party inspectorates (Company employees) use Risk Based Inspection (RBI) to target examination/test resources more effectively across the site and include all plant and equipment (PSSR and everything outside of PSSR included). 3rd party inspectorates (Insurance industry engineers) rarely get involved in RBI and examine/test to fixed intervals, generally on the smaller to medium sized sites. Gaps occur when site maintenance staffs are left to deal with all items outside of PSSR. These items are covered by HSW Act, COMAH or PUWER, but can be seen as less important, and not examined appropriately. 4. Use of generic Written Schemes of Examination (WSE's) for PSSR examinations. HSE challenged the use of generic schemes because they were not bespoke to sites, and type "A" Competent Bodies agreed to stop using them. A scheme should be clear as to what is examined, how, when, and why. Some in-house type "B" Competent Bodies has schemes of examination that are scoped largely at the discretion of the examiner. 5. The implementation of process safety performance measures (leading and lagging indicators). A communities of interest website has been set up. Most sites do not use process safety performance measures at the moment, but it is something that HSE is keen to encourage. It was a key point that came out of both the Longford enquiry after the Esso gas explosion, and the BP Grangemouth Report. The BP Grangemouth Report highlighted weaknesses in safety management systems in that incorrect assumptions about major hazard performance were drawn from measuring lost time accident frequencies. Performance measures for examination/test of plant are important because they provide evidence of how well key risks are being controlled. Safety management systems can then be improved, as employers have reasonable evidence about major hazard performance. 6. OSD KP3 Project on maintenance management. This is aimed at improving installation integrity (with a significant proportion of infrastructure approaching/ exceeding original anticipated life) and securing the future for the UK continental shelf. Bulletin Board for the KP3 Handbook. 7. For safety-related control and instrumentation (C&I) systems - the increasing adoption of risk based approaches such as BS EN 61508 or 61511. Regular proof testing of all elements of C&I systems is an essential part of maintaining safety integrity.

QUESTION SET EXAMINATION/TEST OF PLANT EXAMPLE QUESTIONS FOR INTERVIEW

POLICY

1. Does the organisation have a programme for plant examination/test? 2. What is the purpose of the programme? 3. Does it cover examination/testing as part of plant construction and commissioning? 4. What are the consequences (for health and safety) if critical plant is not routinely examined/tested? 5. What are the legal requirements for examination and testing of plant? 6. What is the policy on contracting out of examination/test activities? 7. How do they ensure that there are no gaps in coverage? 8. Does it cover the assurance of examination/test tasks and systems against human failure, including the role of

human error?

ORGANISING - Control

1. How are responsibilities for the following identified:

• Oversight of the plant examination/test system? • System design and scope:

o Items subject to examination/test? o examination/test criteria? o examination/test frequency? o selection of examiners?

• Implementation of the examination/test programme? • Monitoring of the examination/test programme? • Review of examination/test programme?

2. Do third parties carry out any examinations/tests? (contracted out by the organisation or imposed externally by nd

insurance companies?) Do 2 party bodies carry out any examinations/tests?

3. Who decides what tasks are contracted out?

nd 4. How does the in-house (2 party) body demonstrate independence from the operating functions of the company?

5. How do they demonstrate that the arrangements for periodic proof testing are adequate?

6. Are objectives set for individuals involved within the system?

7. How is achievement of the objectives at this business level monitored and reviewed?

8. What resources are allocated to examination/test objectives?

9. What happens if there is a shortfall in allocation? Who decides what doesn't get done?

10. What is the trend in resource allocation for examination/test tasks for the last 3 years?

11. How is achievement of the overall objectives of the examination/test system reported to more senior management?

12. Were the examination/test targets for last year met?

13. What would be the consequences if the examination/test targets were not met?

14. How do examinations/tests imposed by 3rd parties, e.g. insurance companies, complement the in-house examination/test activity?

15. How much reliance is there on 3rd party bodies?

ORGANISING - Co-operation

1. How is equipment made available for examination/test?

2. Are any difficulties encountered in getting equipment released from production to allow for examination/test?

3. What advance notice is given to production departments to make plant available for examination/test?

4. Are there difficulties in completing examination/test sufficiently promptly to allow equipment to be handed back to production departments?

5. How are conflicts with production departments over release of equipment for examination/test within the prescribed examination/test interval resolved?

6. What sanctions can be applied when or if equipment is not released for examination/test?

7. What is the attitude from production managers if the examination/test programme falls behind schedule so that they are running with plant or equipment significantly overdue for examination/test?

8. Are there any difficulties in getting maintenance personnel to properly prepare equipment or provide access to plant for examination/test?

9. What are relationships like with third party examination/test services, especially those contracted out by the organisation?

ORGANISING - Communication

1. How are details of the examination/test programme communicated to:

• Those undertaking the examinations/tests? • Line managers for the departments in which the plant is situated?

2. How are findings of the examination/test programme passed on to:

• Line managers for the department in which the plant or equipment is situated? • Line managers responsible for maintenance?

3. How are abnormal or unexpected findings passed on to:

• Other examination/test departments/managers within the organisation? • Equipment manufacturers/suppliers? • Those responsible for plant designed commissioning and for equipment purchase?

4. Are there imminent danger reporting arrangements?

5. How are outstanding examinations/tests flagged up to:

• The examiner responsible for the examination/test task? • The production department in which the plant/equipment is situated? • Senior management?

6. How are modifications to recommended examination/test frequencies or methods provided by equipment manufacturers or suppliers brought to the attention of examination personnel?

7. How are requests for delayed examinations/tests handled?

ORGANISING - Competence

It may be appropriate to select a particular examination/test task and explore questions about that role. This examination/test task could be pre-selected during the audit preparation stage by asking what examinations of plant are undertaken in-house.

Safety Managers

1. What are the criteria for selecting a person to undertake the examination/test of [e.g. (safety critical) electrical instrumentation]?

2. What are the qualifications required for that post holder?

3. What previous skills/experience are required before someone is appointed to examine/test [electrical instrumentation]?

4. Do [electrical instrumentation] examiners have to belong to a specified professional body?

5. How are the additional training needs of [electrical instrumentation] examiners identified. For example, familiarisation with particular items of plant; examination/test criteria; examination/test standards for plant

6. How do you satisfy yourself that [electrical instrumentation] examiners are competent to perform their duties?

7. How do you know that [electrical instrumentation] examiners who undertake examinations/tests as part of your service contract with (equipment manufacturers/suppliers/other) are competent?

8. What training is provided in terms of the operation of the examination/test system?

Individuals Involved in Examination/Test (Aimed at verification of claims made by system managers)

1. What qualifications do you hold?

2. Are you a member of ...... [answer to question 4 above]?

3. What is your past experience in examining/testing [electrical instrumentation]?

4. What training have you received from the company to assist you in performance of your examination/testing duties?

5. What training is planned for the future?

6. How do you keep up to date with technological developments and current examination/test practices within the industry?

7. How is your competence assessed?

8. Is this done routinely?

PLANNING and IMPLEMENTING

1. What criteria are used to select items for examination/test?

2. What criteria are used to determine the examination/test frequencies?

3. Are selection and frequency judgements validated by sample examination and testing?

4. Is the examination/test programme comprehensive – does it identify and address known problem areas?

5. What criteria are used to decide who undertakes the examination/test tasks?

6. What standards/codes etc, are used to determine examination/test methods?

7. Are there written instructions covering:

• the operation of the planned examination/test programme? • the individual examination/test procedures?

• acceptance/rejection criteria?

8. How is plant flagged up as requiring examination/test?

9. What prior notice is given to production departments indicating that an examination/test is due?

10. Is the examination/test programme on target?

11. Are examiner’s recommendations for repairs, etc. duly acted upon?

12. What sort of overdue time is permitted and how have these parameters been decided?

13. How is the planned programme adjusted following a plant change?

14. How are new items of plant brought into the system?

15. How are examination/test frequency extensions controlled?

16. How does the system take human factors into account? (e.g. do procedures allow for error recovery)

17. Are examination/test bodies trending results?

MEASURING PERFORMANCE

Questions to both managers of examination/test functions, and managers in production departments.

1. What measures are taken to monitor the implementation of the examination/test programme?

2. How often is the achievement of examination/test targets checked?

3. What actions are taken if the programme is falling behind?

4. Is assessment made about whether it is safe to continue using plant/equipment beyond the due examination/test date?

5. Are regular progress reports on completion of the programme produced throughout the year?

6. What level of (senior) management sees these progress reports?

7. What sanctions are applied if the programme is not being met?

8. Are there any actions outstanding?

9. How do they monitor the implementation of the examination/test programme undertaken by 3rd party bodies?

10. How are outstanding items pursued?

11. Have there been any incidents or near misses in the last 3 years in which failure to properly examine/test plant was thought to have been a contributory factor?

12. Are leading and lagging process safety performance measures used that reflect the process risk profile of the plant? Is leading and lagging data used to drive performance improvement?

REVIEWING PERFORMANCE

1. How is the design and operation of the system reviewed?

2. What changes/improvements have been made to the examination/test system in the last 3 years?

3. What prompted these changes?

4. Have there been any changes to the examination/test programme brought about as a result of the investigation into an accident or incident?

5. Are any difficulties encountered in obtaining sufficient resources to implement changes to the system needed as a result of performance review?

6. Is examination/test intelligence used to determine examination/test frequency?

AUDITING

1. Has the design and operation of the plant examination/test system been subject to an independent audit?

2. What were the findings?

3. Does the audit determine whether the examination/test regime is technically compliant with good practice?

4. How were the findings prioritised and implemented?

5. How are decisions about what to implement and what to disregard taken?

6. Are there any plans to audit the examination/test system in the near future?

Appendix - LEGAL BASIS

The Health and Safety at Work etc Act 1974 (HSW Act)

Sections 2 and 3. The Act contains requirements to the effect that an employer has duties to employees and persons other than their employees to ensure their safety at work so far as is reasonably practicable. This extends to the provision and maintenance of plant and systems of work that are safe and without risks to health, and the provision of information, instruction, training and supervision.

The Management of Health and Safety at Work Regulations 1999 (MHSW)

Regulations 3, 4, and 5. These require employers and self-employed people to assess the risks to workers and any others who may be affected by their work or business, to implement preventive and protective measures and make sure that appropriate arrangements are in place to cover health and safety.

COMAH Regulations 1999 (COMAH)

Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2.

COMAH safety reports, as part of their minimum information, are required to include information on operators' accident identification, risk analysis and prevention methods and an assessment of the extent and severity of the consequences of identified major accidents (see COMAH Schedule 4 Part 2).

Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their consequences to persons and the environment.

Regulation 5(3) requires operators' SMS to identify and evaluate major hazards. There should be documented examination and test procedures to help ensure safe operation of plant, processes, equipment and storage facilities (see COMAH Schedule 2).

Pressure Equipment Regulations 1999 (PER)

These implement the EC Pressure Equipment Directive and provide for free trade in Pressure Equipment across the European Economic Area. Although a free trade directive, it has important implications on the initial integrity of pressure systems covered by the directive/regulations. All pressure equipment within scope, with the exception of some low hazard equipment, is conformity assessed against the Essential Safety Requirements by a recognised third party, a Notified Body. In essence, the conformity assessment ensures that the pressure equipment is safe for its intended use and equipment must bear a CE marking (if within scope).

Some operators take on the responsibility of designing and/or constructing pressure equipment on their site. This is especially true for piping systems and the HSE would expect clear recognition of designer's constructor's duties and a suitable conformity assurance process.

This RCS does not explicitly address PER (see Plant Design RCS), however if issues relating to initial integrity are found on equipment within scope of PER, they should be referred to an appropriate specialist for action.

Pressure Systems Safety Regulations 2000 (PSSR)

These Regulations are only concerned with the danger from steam and stored pressure energy, whereas we are often concerned with the danger from the content on HID sites. So some key items of fixed plant are often not covered with the WSE's required by PSSR, e.g. a lot of pipework and atmospheric storage tanks, but these should still be looked after to a similar standard.

Regulation 8 requires a written scheme of examination for pressure systems containing a relevant fluid, where a defect may give rise to danger (see Schedule 1 for exceptions).

Regulation 9 requires examination in accordance with the written scheme.

The Provision and Use of Work Equipment Regulations 1998

Regulation 6 is the catch all, requiring inspection of all items not covered by WSE's in PSSR, but which can deteriorate and give rise to dangerous situations.

The Electricity at Work Regulations 1989 (EAWR)

Regulations 4, 5, 12 and 13.Regulation 4 requires the testing, commissioning, operation and maintenance of electrical equipment throughout the life of the system. Records of maintenance, including test results should be kept. Every work activity, including maintenance and work near a system should be carried out in a safe manner so as not to give rise to danger.

Regulation 5 requires that electrical equipment should not be put into use where its strength and capability may be exceeded in such a way as may give rise to danger.

Regulation 12 requires the provision of suitable means for cutting off the supply and for isolation.

Regulation 13 requires adequate precautions to be taken for work on equipment made dead, to prevent equipment becoming electrically charged, if this charging would give rise to danger.

Confined Spaces Regulations 1997

Regulations 3, 4, and 5. These place duties on employers and self-employed persons. Where work has to be carried out in a confined space, it should be in accordance with a safe system of work. Emergency arrangements should be in place.

OFFSHORE LEGAL BASIS

Safety Case Regulations 1992,

Regulations 2 and 15. These require a suitable written scheme of verification for Safety Critical Elements to ensure that SCE's remain in good repair and condition. Regulation 15B Schedule 9 lists matters to be included in the verification scheme.

Offshore Installations (Prevention of Fire etc) Regulations 1995,

Regulations 5, 9, and 19. Regulation 5 requires the duty holder to perform an assessment to identify the events which could give rise to 'a major accident involving fire or explosion; or the need for evacuation or rescue to avoid or minimise a major accident; the evaluation of the likelihood and consequences of such events; the establishment of appropriate standards of performance to be attained by anything provided by measures for ensuring effective evacuation, escape, recovery and rescue to avoid or minimise a major accident.' Regulation 19 further requires that a suitable written scheme be prepared for the systematic examination, by an Independent Competent Person, of plant provided under specific PFEER Regulations.

Offshore Installations and Wells (Design etc) Regulations 1995.

Regulation 8 requires duty holders to ensure that suitable arrangements are in place for maintaining the integrity of the installation, including suitable arrangements for periodic assessment of its integrity and carrying out remedial work in the event of damage or deterioration.

POPMAR INSPECTION GUIDELINES

POPMAR INSPECTION GUIDELINES ELEMENT: ORGANISING­CONTROL Responsibilities Scope covers what items are subject to examination/test; location of items; examination/test

criteria/standards against which to judge; examination/test frequency; selection of Examiners. Status of the Are they performing allocated tasks to agreed timescales? programme

Were the examination/test targets met for last year?

What are the consequences if the planned examination/test targets are not met? Verification of Accountability e.g. performance reports to senior management, plans for improvements on Documentation modifications to the system operation, contract reviews with 3rd party inspection services.

Responsibilities e.g. job descriptions, work procedures.

Resource allocation e.g. staffing plans. POPMAR INSPECTION GUIDELINES ELEMENT: ORGANISING- COMMUNICATION Details of Identification and selection of equipment for examination/test, frequencies and priorities. examination/test programme Examination/test Abnormal or unexpected findings (performance data/ early breakdown data) should be passed on to findings others for action. e.g. to examination/test departments/ managers, to equipment manufacturers/

suppliers, and to those responsible for plant design, commissioning and for equipment purchase. POPMAR INSPECTION GUIDELINES ELEMENT: ORGANISING- COMPETENCE

Inspectors could look at United Kingdom Accreditation Service (UKAS) reports for non-conformances, and then concentrate efforts on those areas. UKAS audits accredited companies, to check that they are properly applying examination/test schemes.

POPMAR INSPECTION GUIDELINES ELEMENT-PLANNING AND IMPLEMENTING Pipework Example If pipeline areas have been excluded from a scheme on the basis of low degradation and thus low (This is only an failure probability, there should be examination/test evidence to confirm these assumptions. example. Plant can be excluded for lots of reasons e.g. contents, pressures, temperatures etc) A Pipework Particular problem areas need to be addressed such as dead legs, start-up and shut-down pipes Example that are out of service most of the time, pipework that are out of service most of the time, pipework (Examination/test that is in intermittent use, injection points, and stagnant areas of pipework. There should be a clear schemes) understanding of the deterioration mechanisms associated with contaminants within the process

stream. (Source: Eutech Report) POPMAR INSPECTION GUIDELINES ELEMENT - AUDIT AND REVIEW UKAS Accreditation

Accreditation by UKAS means certification and inspection bodies have been assessed against internationally recognised standards (currently BS EN ISO/IEC 17020:2004) to demonstrate their competence, impartiality and performance capability. Accreditation is on a 4 yearly cycle. There is an initial assessment, where non-conformities found against accreditation requirements will be notified to the company in writing. These have to be cleared before accreditation is granted. Accreditation in confirmed on an annual basis by surveillance visits, with a full assessment every fourth year.

The UKAS team will look at the following topics:

1. Organisation. They will expect to find a named technical manager in overall charge, effective supervision, deputies, job descriptions including requirements for education, training, technical knowledge and experience.

2. Quality systems. They will expect a maintained, audited system for control of all documentation related to its activities, with procedures to deal with feedback.

3. Personnel. Sufficient numbers of competent staff (including relevant knowledge of the defects which may occur during use, and the understanding of the significance of deviations found), documented training system and record keeping.

4. Facilities and Equipment. Should be suitable and adequate, properly identified, maintained and calibrated. There should be procedures for selecting suppliers and inspecting received materials. Data integrity protection procedures should be implemented.

5. Inspection methods and procedures. Will check that the inspection body is using the methods and procedures that are defined in the requirements, against which conformity is to

be determined. Will check that there are documented instructions for carrying out inspection safely.

6. Handling inspection samples and items. Including unique identification of items to be inspected, recording of abnormalities notified or noticed before commencement of inspection.

7. Records. Maintained records system that permits satisfactory evaluation of the inspection. 8. Inspection reports and inspection certificates. Should include all the results of examination

and the determination of conformity made from the results as well as all information needed to understand and interpret them. Subcontractors' results should be clearly identified. Should be signed off by authorized staff.

9. Subcontracting. Inspection body must demonstrate that any subcontractor is competent and complies with the relevant standard of the EN 45000 series. This should be recorded.

10. Complaints and appeals. Should be documented procedures for complaints and appeals. Records should be kept, including actions taken to resolve complaints.

11. Cooperation. Inspection body is expected to participate in an exchange of experience with other inspection bodies and in the standardization processes as appropriate.

Assessing Risk Control Systems

RCS 2 - PERMIT TO WORK

• Policy • Measuring Performance • Organising - Control • Auditing • Organising - Co-operation • Reviewing Performance • Organising - Communication • Example Questions For Interviews • Organising - Competence • References • Planning and Implementing

POLICY

Key Issue:

Is there an effective policy for risk assessment of high hazard operational and maintenance activities, and the control procedures, normally a permit-to-work system?

Key Characteristics:

• Senior management can clearly describe the purpose of their permit-to-work system or justify any alternative system used.

• The permit-to-work system should be adequately resourced to ensure that the system has sufficient capacity (available competent signatories) to cope with peak demands.

Note: The purpose can be described as: a method which ensures that all foreseeable hazards of such activities are identified and appropriate precautions specified to eliminate the hazards or control the risks. Details of the hazards and precautions are effectively communicated to all involved in the work, thereby safeguarding their health and safety.

ORGANISING - Control

Key Issue:

Is there an adequate management system to implement the policy on risk assessment and controls for high hazard operational and maintenance activities?

Key Characteristics:

• Responsibilities for oversight, design, documentation, operation, monitoring and review of system clearly allocated.

• Personal responsibilities in job descriptions or performance standards, with clear objectives, and subject to appraisal.

• Identification of personnel with responsibility for: issuing permits, identifying hazards, making plant safe, checking that plant is safe, supervision of the work and its completion to the required standard. Suitable authorisation of personnel with special responsibilities.

• Acceptance of responsibilities by those involved.

• Performance of those with responsibilities under the permit-to-work system subject to routine appraisal.

ORGANISING - Co-operation

Key Issue:

Are there adequate and appropriate arrangements to secure the trust, participation and involvement of persons involved in high hazard operational and maintenance activities?

Key Characteristics:

• Individuals involved with the permit-to-work system co-operate to ensure that it is appropriately designed, introduced and implemented. This will include: raising awareness of the permit system, access to key persons, and provision of training.

• Arrangements for consulting users during permit design to ensure practicability and useability.

• Arrangements to ensure all relevant personnel, including contractors, are made aware of the permit systems and are trained in their operation.

• Co-ordination between jobs to ensure that unforeseen hazards are not introduced.

• Ready access to the permit authoriser when required.

• Close liaison between the permit authoriser, operations staff, and the person in charge of the work to ensure provision is made for: interactions between jobs, shift changeover and hand-back of the permit.

• Permit recipients sign the permit to indicate they have read, understood and accept the permit conditions.

• Cross-referencing to other relevant certificates e.g. isolation certificates.

• Securement of commitment, ownership, and acceptance of the value of the PTW system.

ORGANISING - Communication

Key Issue:

Are there adequate arrangements to secure information flow between those involved in high hazard operational and maintenance work.

Key Characteristics:

• Formal and thorough communication between all of the parties involved in the work. Permits should never be used as a substitute for full discussion between permit issuers and those in charge of the work.

• Sufficient written instructions to: identify all foreseeable hazards, ensure co-ordination between jobs, highlight the hazards, specify the precautions necessary to control or eliminate the hazard, ensure people new to the job and at shift changeover are made aware of the hazards.

• Information about new activities, changes in legislation or workplace standards, from reviews and audits communicated to the people who need to know.

• Documentation and communication of the rules/standards and control arrangements governing the PTW system.

• A permit form which is clear, easy to follow, and the lay-out follows the sequence of events in its life cycle. The text is legible and the task explicitly and unambiguously described.

• Records of live and suspended permits maintained.

• Clear specification of the location of the work to be controlled by the permit.

• Specification of the hazards, and the precautions required to control them both to people doing the work, those new to the job, and those who might be affected by it.

• A means exists of informing departments that items of plant/equipment will be the subject of a permit-to-work, for how long and the consequences.

• Measures to ensure that the right people, those who may be affected by it, know a permit has been issued and individuals know whether one permit affects another e.g. live and suspended permits displayed at the workplace.

• Mechanisms to alert fitters to particularly high risk tasks.

• Effective communications during shift changeover to ensure that the necessary precautions remain in place, new operational staff are fully aware of work being undertaken, and that new maintenance personnel are briefed on the hazards and precautions required.

• Communication of hand back, plant reinstatement and shift change procedures to all those involved with and affected by permits.

• Liaison, training and supervision arrangements for contractors.

ORGANISING - Competence

Key Issue:

Are there systems and arrangements to secure the competence of those working within high hazard operational and maintenance activities?

Key Characteristics:

• Individuals involved in design, implementation, monitoring and review of the permit-to-work system are competent to achieve the objectives.

• Selection criteria for permit staff including: relevant experience, knowledge of the plant, process/plant hazards, and risk assessment.

• Competencies in terms of: knowledge, skills, and experience are clearly defined and reviewed. These include abilities in methods of identifying and assessing the hazards, processes and plant involved. Formal assessment before appointment of authorised permit signatories and personnel responsible for carrying out isolation.

• Identification of existing skills/knowledge and consequential training programmes.

• Appropriate training allocation; induction training provision for all persons involved in the system, basic training for fitters, with extended provision for authorised permit issuers.

• Training of contractors, usually recent site induction training.

• Site specific workplace training to ensure that it is relevant to the hazards of the industry, plant or processes and appropriate to the site PTW system; production and maintenance teams have a knowledge of each others work requirements.

• Competence routinely assessed by observation and testing of the understanding of hazards, risks and control measures.

• Training records for individuals which are reviewed periodically. Provision of refresher training where necessary.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Are there adequate processes to generate plans and performance standards to implement the policy on high hazard operational and maintenance work?

Key Characteristics:

• Performance standards covering: design of the permit, when permits should be used, how the system should work and appropriate work procedures.

• Production and communication of written performance standards to all.

• Control of permit initiation. Issue of permits only for those jobs for which it is absolute necessary, i.e. there should not be job control systems for routine tasks.

• Issue of a permit by a person to themselves prevented.

• Incorporation of contractors into the system to ensure that the same high standards of control, as applied to the company's own staff, are maintained.

• A clear description of the work to be done specifying unambiguously the plant involved, the job and location.

• Identification of all foreseeable hazards. Hazard identification as a formal written step in the permit initiation process. Requirement for work to be stopped if new hazards arise or recur.

• Clear rules on emergency action.

• Permits which document the precautions, and who is to take them. Clear allocation of responsibility for specific tasks. Specification of precautions with detail appropriate and proportionate to the risk.

• Implementation of permit suspension procedures if the work cannot be done immediately, or dealing with the situation where it is necessary to vary the work from that specified on the permit.

• Checks to ensure that the work equipment/plant is safe to bring on line once the permit-to-work tasks have been completed.

• Documentation of pre-start up procedures.

• Signing off procedures.

• Procedures for identifying jobs which appear routine but which differ slightly but significantly.

• The risk assessment methodology for application and criteria for use of PTWs.

• Procedures for variation from authorised practices.

• Documented isolation procedures for standard activities including; isolation standards related to risk, isolation certificates, leak testing, and security tagging.

MEASURING PERFORMANCE

Key Issue:

Is there adequate and sufficient measurement of performance of high hazard operational and maintenance work both before and after accidents/incidents.

Key Characteristics:

• The operation of the permit-to-work systems and the functioning of the system as a whole closely monitored through active and reactive monitoring.

• Written instructions detailing monitoring procedures for:

i. Routine monitoring to check that: the permit form is being completed accurately, unambiguously and with sufficient detail, permits are being used for appropriate work, the hazards are being properly identified, the precautions stipulated in the permit are appropriate and are being followed, work activities are confined to those authorised by the permit, and hand-back procedures are being followed;

ii. Periodic monitoring of the PTW system documentation and operation, by those not directly involved in the system on a plant, to ensure that: the system is being applied as intended, the right activities are covered, the type of permit e.g. hotwork, confined spaces etc, adequately cover the work activities undertaken.

• Procedures for checking the work site, during permit issue, by permit authoriser/issuer.

• Procedures for checking that the work has been done as specified and the work equipment is safe to bring back on line.

• Independent checking of important actions to be taken under the permit system, and confirmation on the permit.

• Systems to ensure that no one is allowed to carry out permit work without training.

• Checks to ensure that the precautions are executed, and that the work is being done as specified.

• Procedures for reporting any incidents that have arisen during work carried out under a permit, and for reviewing procedures as necessary

AUDITING

The design and operation of the permit-to-work system, should, periodically be subject to a formal audit. The auditor(s) should not be part of the system or have any responsibility for it.

The audit should verify that a permit-to-work system:

• Exists.

• Is properly designed.

• Is implemented.

• Is effective in meeting its objectives.

The audit should check that performance monitoring and reviews are occurring at the correct frequency and are addressing the right issues.

Select and Review HSM Documentation

Copies of audit reports covering either the specific operation of the permit-to-work system or wider aspects of HSM which include the permit-to-work system.

Collect and Evaluate Evidence - Interviews

Managers should be able to explain the findings of audits which have been undertaken or audits planned for the future and their response to the findings.

REVIEWING PERFORMANCE

Key Issue:

Is there adequate and sufficient review of the performance of high hazard operational and maintenance activities to ensure that lessons learned are effectively put into practice to improve performance of the system.

Key Characteristics:

• Periodic review of the achievement of the objectives of the permit-to-work systems in respect of:

o Permit design.

o The relevancy of a permit to control the risks.

o Identifications of hazards prior to work starting.

o Duration of permit.

o Precautions to be taken.

o Permit display.

o Variations from accepted procedures.

o Updating the system in the light of new information about hazards of success/failure of the system.

Information about the operation of the system may arise from other management activities such as, risk assessment, HAZOPs, Failure Mode and Effects Analysis (FMEA), incident/near miss investigations etc.

EXAMPLE QUESTIONS FOR INTERVIEWS

OBJECTIVE

1. Does the organisation have a permit-to-work system?

2. What are the objectives of the permit-to-work system?

3. What are the legal requirements relevant to a permit-to-work system?

4. What could the consequences for health and safety be, should a permit-to-work fail?

ORGANISING - Control

Managers

5. How are the responsibilities for the following made clear:

o Oversight of the permit-to-work system?

o Permit form design and system scope?

o Type of jobs subject to permit?

o Control of contractors?

6. Are objectives set for individuals involved with the system?

7. How is achievement of the objectives monitored and reviewed?

8. What resources are allocated to ensuring effective working?

9. If there is a shortfall in real resources, how are decisions made about what doesn't get done?

10. How is achievement of the overall objectives of the permit-to-work system reported to senior management?

11. What would be the consequences if the objectives were not met?

Individuals Involved in the Permit-to-Work System

12. Who was involved in the design of the permit system and form(s)?

13. Who was consulted?

14. How is the permit system initiated?

15. Is a job request form used and does it have safety information on it?

16. Who decides whether a job needs a permit?

17. Is it clearly laid down who may issue permits?

18. Are there ever any problems in getting a permit issued?

19. Does the permit system extend to contractors and their employees?

20. Who identifies the hazards before work starts?

21. Does someone else double check that all the hazards have been identified before work starts?

22. When the hazards have been identified who does the work to make the plant safe?

23. Does anyone check that this work has been done correctly?

24. If work under a permit gives rise to new work what do you do? Do you, for instance, stop to check whether a new permit is required or do you tend to get on with the job?

25. Who decides when the permit expires?

26. How is the expiry time decided upon?

27. Does the time allowed ever cause problems e.g. rushing to get the job done before the permit expires?

28. When the work is finished, and the permit expires does anyone check that the work has been done correctly?

29. Does anyone check that the item of plant is safe for use?

30. What do you understand should happen in the event of a major general site emergency i.e. how should the job be controlled, should it simply be abandoned?

31. Do the rules allow the issue of a permit by a person to himself?

32. Do permits specify clearly the plant or geographical area to which work must be limited?

33. Does the permit procedure include a hand-over mechanism for work which extends beyond a shift or other work period?

34. Is there a signing off procedure when the job is complete? What does it involve?

35. Have you ever done permit work without a permit being issued? Does it happen often, sometimes, rarely?

36. How do you know that the contractors coming on site today are the same ones that were on site yesterday?

37. Is there a set of properly documented isolation procedures for working on potentially dangerous items of plant and does it provide for long-term isolation?

ORGANISING - Co-operation

Managers and Individuals

38. Is there close liaison between the permit issuer and the person in charge of the work?

39. Are copies of permits issued for the same equipment/area kept and displayed together?

40. Is there a means of coordinating all work activities to ensure potential interactions are identified?

41. Is there provision on the permit form to cross-reference other relevant certificates (e.g. isolation) and permits?

42. Is there a procedure to ensure that the agreement of others who could be affected by the proposed work is obtained before starting the work or preparations for it?

43. Where there are isolations common to more than one permit is there a procedure to prevent the isolation being removed before all the permits have been signed off?

ORGANISING - Communication

Managers

44. How are details of the permit - procedures communicated to:

o permit operators?

o line managers in the department where the work is carried out?

o issuers and receivers of permits?

45. Following monitoring and review of the system, how are any changes communicated to the workforce?

46. Do you know what those receiving the permit think about the system? Do they think the system works?

Individuals involved with Permit Procedures

47. Are you aware that a permit is essential for certain types of work?

48. Who issues permits?

49. How do you obtain a permit?

50. Do permits specify clearly the job to be done?

51. How would you know who a permit had been issued to?

52. Do permits clearly specify the plant or geographical area to which work must be limited?

53. How does the permit issuer know that the recipient has understood the conditions laid down in the permit?

54. How do people know whether one permit affects any other permits?

55. Are there procedures for noting that overlapping jobs are specified on the permits?

56. What happens to permits at shift changeovers?

57. If a permit was unclear in any way what would you do?

58. Do you think managers think the system works?

59. Do you think management are committed to the system?

60. Do you think others see the system in the same way as you or differently?

Process Operating Staff

61. How are you able to readily see and check the plant status?

ORGANISING - Competence

Managers

62. What criteria are used when selecting personnel to authorise and issue permits, and for permit operators?

63. What are the qualifications required for that person?

64. What previous skills/experience are/is required before someone is appointed to carry out permit-to-work tasks?

65. What training is provided in terms of the operation of the permit procedure?

66. Does the system require formal assessment of competence of personnel before they are given responsibilities under the permit procedure?

67. Is a record of training and assessment maintained?

68. Do training and competence requirements include contractors?

69. Are individuals provided with written confirmation of successful completion of relevant training and are these documents checked before appointments are made within the permit-to-work system?

70. Are personnel who issue permits properly authorised and trained to undertake the duties required of them?

Individuals involved in the Permit-to-Work System

71. What qualifications do you hold?

72. What type of training did you have for operating the permit-to-work system?

73. Were you trained before using the permit system or was training on the job?

74. Was the training site specific?

75. Was the permit-to-work system included in your induction training?

76. Was that training taken seriously?

77. Did the training conclude with a formal written test?

78. Did you receive written confirmation of your successful completion of the training?

79. Have you got a training record? If so, have you seen it and do you know where it is kept?

80. Have you had any refresher training since your original training?

81. When the permit system is modified is new training given?

82. Do contractors receive any training?

PLANNING and IMPLEMENTING

Managers

83. How does the company ensure that the permit system is appropriate to the site and hazards it will be used with?

84. Are end users consulted and involved during permit design and system planning to ensure useability and practicability?

85. How is it decided:

o what jobs permits are used for?

o that permits are only used for jobs that need them?

86. Is the work area always clearly identified?

87. Is the plant involved in the permit work always clearly identified, by tagging or some other means?

88. Are the limitations of the work specified?

89. Does each permit state the precautions which have been taken and those needed whilst the work is in progress (e.g. isolations, purging, personal protective equipment)?

90. Are there written instructions covering, for example:

o The system rules (i.e. a description of the operation of the system)?

o Shift change over procedures?

o Recommissioning and hand back procedure?

o Suspension procedures?

o Coordination between jobs?

o How the system is monitored?

91. What standards/codes etc, are used to ensure compliance with specific regulations?

92. How does the company ensure that contractors follow the system rules?

93. What arrangements do you have for your annual shutdown when several hundred contractors may be brought onto the site?

MEASURING PERFORMANCE

Managers

94. How is the permit system monitored in operation?

95. How are permits monitored after issue, i.e. when the work is in progress?

96. Is there a system of spot checks to ensure that permits are being followed?

97. Does someone senior to the authoriser check work descriptions, risk assessments etc?

98. Have there been any incidents or near misses in the last three years in which failure of the permit-to-work system is thought to have been a contributory factor?

AUDITING

Managers

99. Has the design and operation of the permit-to-work system been subject to an independent audit?

100. What were the findings?

101. How were the findings prioritised and implemented?

102. How are decisions about what to implement and what to disregard taken?

103. Are there any plans to audit the permit-to-work system in the near future?

REVIEWING PERFORMANCE

Managers

104. How is the design and operation of the system reviewed?

105. Is the design of the system reviewed, regularly, occasionally, or only after incidents?

106. What changes/improvements have been made to the permit-to-work system in the last three years?

107. Have any changes to the permit-to-work system been brought about as a result of the investigation into an accident or incident?

108. Are any difficulties encountered in obtaining sufficient resources to implement changes to the system needed as a result of performance review?

109. Are there any major obstacles to having the system modified?

110. Who is consulted about changes to the system?

111. Who makes suggestions about how to improve the system?

112. Are there any formal procedures in place to evaluate the effects of change?

REFERENCES

HSE Leaflet IND(G)98(L) - Permit-to-Work System.

Oil Industry Advisory Committee - Guidance on Permit-to-Work Systems in the Petroleum Industry.

CM NIG Book Dangerous Maintenance - A Study of Maintenance Accidents and How to Prevent Them.

Oil Industry Advisory Committee - The Safe Isolation of Plant and Equipment.

RCS 3 - OPERATING PROCEDURES

• Introduction • Planning and Implementing • Policy • Measuring Performance • Organising - Control • Auditing • Organising - Co-operation • Reviewing Performance • Organising - Communication • Example Questions For Interviews • Organising - Competence

INTRODUCTION

This RCS concerns the procedures required to operate the plant. These procedures should have been arrived at by including a consideration of the task and hazard analysis of the process and should identify safety critical operations. Hazards may include chemical reactivity, sampling procedures, inerting requirements for flammable liquid storage tanks, purging procedures such as double block and bleed as well as general process operating hazards. It is expected that there will be documentation to describe the operating procedures. The scope of operating procedures should cover plant start-up, shut-down, normal process operations, loading, purging, inerting and so forth. Consideration should be given to ergonomic principles in the work and to the potential for human error.

POLICY

Key Issue:

Senior management should lay down a clear policy and objectives for operation of the plant to ensure that loss of containment of hazardous substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.

Key Characteristics:

• The overall objective is to operate the plant using experienced and competent staff provided with clear, up to date and useful operating procedures. Operations of the plant should be properly planned and resourced. There is a requirement for operation to fit in with other needs such as maintenance.

• The policy for plant operation should consider:

o level of training/experience needed by operators as a function of the safety critical nature of the task;

o the integration of site policy with head office policy;

o new processes;

o supervision and task checking.

ORGANISING - Control

Key Issue:

Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:

• Overall management of operations on the site.

• The writing of operating procedures including new procedures/updates.

• Supervision of operating work.

• The control of any contractors.

• Resourcing of operations.

Key Characteristics:

• The system for operating the plant should include:

o the allocation of adequate financial and human resources;

o documented procedures;

o personal responsibilities being defined, e.g. in job descriptions which specify position in organisation structure, reporting links, responsibilities and duties;

o the allocation of work between permanent staff and any contractors;

o record keeping and trend monitoring;

o the definition of the checks made before and after maintenance. Examples might include combustible or toxic gas checks carried out, ensuring that the work has been carried out correctly and ensuring that the integrity of the plant after completion of maintenance is satisfactory;

o controls to manage conflict between production/safety;

o critical tasks for safety and control of operators who perform these tasks;

o material data sheets, process information, P&IDs.

ORGANISING - Co-operation

Key Issue:

• Individuals involved with the operation of the plant should cooperate to ensure:

• success, balancing safety, production, maintenance and time pressures;

• plant is made available for maintenance work in a planned way;

• plant is returned to operation in a sound condition.

Key Characteristics:

• The system for operation of the plant should encourage cooperation:

o those involved with operation should ensure priorities are balanced between the requirements to carry out maintenance, production pressures and safety;

o operational procedures should be practical in the context of other demands on personnel

o resources for operating should be adequate, so that all needs within the plant/site are met. For example, the allocation of resources should be robust and allow for:

financial performance of company;

production requirements;

major personnel reductions or increases;

quantity of overtime worked.

• Coordination between control rooms is maintained.

ORGANISING - Communication

Key Issue:

Formal and thorough communication between all parties involved in the operation of the plant.

Written instructions are adequate to ensure information about new activities, changes in legislation or changes to workplace standards from reviews and audits are communicated to the people who need to know.

Key Characteristics:

• The system for operation of the plant should ensure:

o a forum exists for accessing industry guidance and corporate expertise on operating procedures for the plant, control room design, man-machine interface;

o documentation on operational procedures exists which are clear and up to date;

o learning from previous experience, incidents and equipment history;

o Communication to Senior Management about needs for changes to procedures;

o verbal (face to face) discussion and communication is important e.g. between operations and maintenance, between shifts and between control room and plant operators;

o that the results and actions of formal studies such as HAZOP or other safety studies/reviews, are built into operating practices and made known to operating personnel, this may include:

requirements to pass HAZOP worksheets to procedures writers and operations supervisors;

requirement to use HAZOP and the results of other safety studies in the writing of all procedures;

direct briefing of personnel;

memos and special instructions/notices;

plant familiarisation;

special safety training regarding plant hazards and consequences of procedures violations.

ORGANISING - Competence

Key Issue:

Individuals involved in operating the plant are competent. Competencies in terms of knowledge, skills and experience are clearly defined and reviewed. Selection and promotion criteria for staff and any contractors are clearly laid down.

Key Characteristics:

• The system for operating the plant should ensure:

o optimal use of company experience in defining and optimising operation of the plant;

o learning from previous incidents;

o well defined competencies of staff and any contractors;

o training programmes to ensure personnel are familiar with the plant hazards, operating procedures and supervision requirements. This may include:

on-the-job, off-the-job, refresher, management skills;

training needs assessment;

training effectiveness assessment, revision of training.

• Training of operators and supervisors (including contractors) should include:

o process hazards;

o safety interlocks;

o the use of procedures;

o the use of the PTW system;

o the consequences of equipment failure;

o the engineering of plant and processes;

o technical theory on plant and processes;

o the operation of valves, gauges etc.

• The competence of contractors for example using accredited contractors whose employees are familiar with the methods and hazards at the plant.

• Assessment of personnel e.g. involving on-the-job evaluation, trade tests, certification checks, comparing experience with job descriptions, formal written tests and so on.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Up to date, clear, relevant and realistic procedures, should be available for operation of the plant. These should consider the hazards and the risks involved and describe the rules and standards required.

Key Characteristics:

• Procedures should:

o incorporate guidance on hazards/risks; such hazards might include:

hazards arising from other processes and working methods, which will be going on at the same time, such as processing ongoing in vessel connected to the vessel being operated by common pipework;

vehicle impacts;

inadequate inerting;

unsafe operating procedures, such as conducting pressure tests whilst continuing operations in connected pipework;

mixing of incompatible materials/chemicals.

o incorporate existing regulations, industry guidelines, certificators requirements codes of practice, corporate standards and manufacturers requirements;

o consider the ergonomics of operating tasks, control room layout, alarm displays;

o provide for task checking if appropriate;

o define when procedures should be used, process parameter;

o ranges and requirements for isolation, checks etc.

• Indicators of plant status should be clear.

• There should be specific procedures for start-up and shut-down including start-up check lists.

• Methods for developing suitable procedures in various areas may include:

o the writing of technical operating procedures by equipment suppliers, such as the provision of operating procedures for turnkey processes which then need to be tailored for a specific installation;

o the use of techniques such as HAZOP. Attention should be given to whether the conclusions of HAZOP etc, are fed into operating procedures or just used for safety engineering purposes;

o the use of checklists;

o using the results from special chemical reactivity tests regarding the dangers of runaway chemical reactions, spontaneous ignition, chemical stability, mixing of incompatible materials associated with a process etc.

• Standards, rules and criteria for operators may include:

o the degree of isolation applicable to different circumstances e.g. single valve versus double block and bleed;

o two operators for certain tasks;

o isolation requirements;

o purging requirements;

o special precautions;

o toxic or flammable gas tests.

• Operating procedures should specify the need for critical operational tasks to be checked by a competent authority. Particularly critical operations are:

o start-up and shut-down;

o loading/unloading

o breaking of containment.

MEASURING PERFORMANCE

Key Issue:

The operation of the plant should be monitored to measure its performance.

Key Characteristics:

• The collection of incident and near miss data and analysis for possible operational failures e.g. using a root cause analysis.

• Trend analysis for failures.

• Comparison of plant performance with operational standards.

• Records might include shift logs, process status record sheets.

• Methods to check whether unsafe procedural modification or short cuts have been made or have evolved.

• Check to assure key plant status indicators.

AUDITING

Key Issue:

The operation of the plant should be periodically the subject of a formal audit. The auditors should not be part of the system or have responsibility for it, i.e. be independent of the function being audited.

Key Characteristics:

• The audit should check that performance measuring and review are occurring at the correct frequency, are addressing the right issues, appropriate information flows occur at specified periods to senior management. It would be reasonable to expect an annual review.

REVIEWING PERFORMANCE

Key Issue:

Information from operational experience "measuring" and "auditing" is used to make judgements about the performance of the operation of the plant and is used to make decisions about improving performance and updating procedures.

Key Characteristics:

• Periodic reviews of the operation of the plant including such issues as the performance of the plant.

• Learning from experience about the effectiveness of the plant.

• Revision of procedures in the light of experience, standards, codes, manufacturers' requirements etc. For example procedures may only be reviewed after an incident or a continuous review process may exist, including the collection of performance data, perhaps as part of a Quality Control system.

• Revision of operational checking requirements in the light of experience.

• Consideration of the practicality of procedures.

• Revision may cover the preparation of new operations; documentation for new plant or modifications, as well as checks to ensure accuracy of existing documentation and the involvement of different levels of operators in the review process.

EXAMPLE QUESTIONS FOR INTERVIEWS

OBJECTIVE

1. What is the policy on the requirement for technical skills training of operations personnel?

2. How strong an influence does the company head office exert on site policy on staffing levels?

3. What is the company policy towards the process of developing technically safe and valid operating procedures?

4. Has the company developed a clear and thorough policy concerning operations hazard studies and safe operating procedures?

5. Is there a stated policy regarding the conduct of hazard and safety studies, formal or otherwise, for planning operations. Are such studies mandatory, optional, or not mentioned at all?

6. Describe the overall policy towards supervision of operators and plant.

7. Does the checking of completed tasks comply with policy at the corporate level and with industry guidance?

8. Are operational tasks checked in accordance with company policy and procedure? Can you give examples?

ORGANISING - Control

9. Who is responsible for ensuring that operating procedures are comprehensive, unambiguous and easy to use?

10. Who is responsible for ensuring that operating procedures are updated in a consistent and systematic manner?

11. Who is responsible for ensuring that the practicality of plant operation is considered in the design phase and prior to modifications to hazardous plant?

12. How comprehensive are job descriptions?

13. When a new procedure is required for a new operation is it clear who is authorised and responsible for writing it?

14. How is it ensured that all relevant operations personnel are made aware of the applicability and content of new operating procedures?

15. What are the allocations of responsibility for arbitrating between safety and production?

16. What are the controls used to manage conflicts between production and safety?

17. What are the allocations of responsibility for ensuring adequate staffing levels are maintained?

18. What are the allocations of responsibility for ensuring operating procedures are kept up-to-date and are usable and available?

19. What are the allocations of responsibility for ensuring that engineering management are informed of equipment problems identified during operations?

20. What are the allocations of responsibility for identifying and implementing the training needs of operations personnel?

21. What are the allocations of responsibility for developing selection and promotion criteria within operations?

22. What controls are there on the amount of overtime worked?

23. What is the allocation of responsibility for ensuring operational hazard reviews are carried out and safe operating procedures are developed and implemented?

24. Are the responsibilities for developing safe operating procedures noted in job descriptions, policy documents, project engineering plans, etc?

25. Who is responsible for assessing the validity of operation hazard/safety studies, especially after plant modifications?

26. Who is responsible for revising the process of carrying out safety/hazard studies?

27. How rigidly are operating procedures enforced?

28. Given the criticality of certain tasks how is work allocated to operators?

29. What is the allocation of responsibility for revising the rules, standards policy etc, governing operations hazard studies in the light of experience or changes in the regulations etc?

30. Who is responsible for monitoring the implementation of safety standards as they relate to operations?

31. Who is responsible and what are the resources for the review of industrial guidance and corporate standards for their incorporation into company policy on operating hazard assessment and control?

32. What is the allocation of responsibility for ensuring that appropriate resources are allocated to the review of operational hazards and development of operating procedures?

33. What is the allocation of responsibility for managing information required for operations hazard studies?

34. How are responsibilities allocated for:

o ensuring that critical task checking and supervision requirements are written into operating procedures?

o checking that critical operations tasks have been undertaken correctly?

o checking that the process/plant is in a satisfactory state before and after a critical operational task?

35. What details of supervision or checking responsibilities of staff are contained in job descriptions?

36. Who is responsible for monitoring near miss reporting, analysis and implementation of findings?

37. What are your task checking responsibilities?

38. What is the allocation of responsibility for ensuring that site standards on supervision and task checking are consistent with corporate standards and industry guidance?

39. What is the allocation of responsibility for upgrading internal standards in the light of feedback on the effectiveness of current standards?

40. When would you be required to ensure that hazardous tasks you have carried out are checked?

41. Outline the responsibilities for deciding upon levels of supervision required for operational tasks.

42. Who is responsible for ensuring that the checking of operations tasks is covered during training?

ORGANISING - Co-operation

43. What is the control room arrangement at this site?

44. What are the economic, scheduling, production and political pressures acting on the company that impact on the process of managing the potential for operator error?

45. Who is responsible for revising the means of controlling conflicts between production pressures and safety requirements?

46. What methods of communication are used to manage conflicts between production and safety?

47. What is the influence on safety of productivity or promotion schemes?

48. How good is the relationship between operations and the safety department and between operations and maintenance?

49. Is there evidence of operational procedures not complying with the recommendations of hazard/safety reviews?

50. Are the requirements of operating procedures realistic or do they require the operators interpretation?

51. Are there pressures from regulatory authorities, insurance companies, corporate management etc, to review operational hazards and develop operating procedures?

52. Does the company frequently carry out new operations, reactions, processes, treatments which come under time pressure for implementation?

53. Does the scheduling of major projects allow time for adequate operational hazard review and development of operating procedures prior to start-up?

54. Is there a procedure for resolving actual or potential conflicts between, for example, the resource requirement of a procedure of operation and the need for productivity etc?

55. What guidance is available for reconciling conflicts between safe operating procedure requirements and resource and time constraints?

56. Are operating procedures used as the procedure writer intended?

57. What systems are there for verifying that appropriate checks are being carried out on critical operations tasks?

58. How are conflicts between the requirement to supervise and check hazardous work and production needs handled?

59. Are the requirements for checking tasks realistic in the context of operators and supervisors workloads?

60. On complex tasks is it clear at what point the supervisor should be asked to check work done?

ORGANISING - Communication

61. Is there a forum for accessing industry guidance and corporate expertise on managing human error during hazardous operations?

62. What means is there of ensuring that operation procedures are primarily written to aid the operator rather than to insulate management from operator errors?

63. What documentation is available on the training of operations personnel?

64. What documentation is available on operational staffing levels?

65. What documentation is available on the means of input of operations orientated improvements into the plant design process?

66. What are the communication means used during shift and cycle handovers?

67. What communication means are used between operations personnel (management and operators) at all levels, such as memos and job instructions?

68. What forms of feedback between organisational levels are formalised in operational policy?

69. What is the process of communication between the control room and operators on the plant?

70. What is the means by which operations personnel can make suggestions for modifications to control room layout?

71. What is the system of communication with maintenance?

72. How effective are communications between operators in the control room(s) and those on the plant?

73. Are operating procedures always clear and unambiguous? If not, can you give examples of where there are problems?

74. Are the means of communication on operational safety concerns to management effective, and how domanagement respond?

75. Are operating procedures readily available and consistently used?

76. Are you required to carry out any hazardous tasks that are not covered by a procedure?

77. Is there an independent route for the communication of operational safety concerns other than through line management? If so, how useful is it?

78. What documentation is available covering policy on training, selection and promotion, and staffing level requirements?

79. Is there a forum which the company uses to access industry practices such as hazard review techniques?

80. How are the results and actions from safety/hazard studies communicated and who is responsible?

81. Is documentation available describing the procedures for assessing operational hazards and developing appropriate procedures of operation?

82. What is the system for ensuring that account has been taken of safety studies in the development of operating procedures?

83. What is the method for ensuring that the results and actions of formal studies such as HAZOP or other safety studies/reviews, are built into operating practices and made known to operating personnel?

84. What evidence is there that safety studies are used in the development of operating procedures in the way specified by company policy and procedures?

85. What are the means by which persons could report the evolution of unsafe procedures of operation arising from production, economic or schedule pressures?

86. How can concerns regarding safety of established or proposed operating procedures be communicated to management?

87. What is the system for supplying information, such as material hazard data sheets and process and instrumentation diagrams, checklists etc, for the performance of an operations hazard study?

88. What is the forum for ensuring that changes in regulations or industry standards are taken account of in the formulation of site policy as regards the supervision and checking of operational tasks?

89. Describe the systems for the communication of information regarding the status of the plant.

ORGANISING - Competence

90. Who is responsible for ensuring that operators are sufficiently trained and that suitable selection and promotion criteria are applied?

91. What documentation is available on operator competency requirements?

92. How does this site compare with others in the company and/or industry in terms of its production and safety performance?

93. What is the typical response to accidents and incidents in terms of improving training and procedures?

94. How committed are management to safety? Do they share your level of commitment?

95. Are the criteria for the selection and promotion of operators the same as they have always been? If not, what has changed and why?

96. When starting your present job what training did you receive? Have you received any further training since?

97. Have you been required to increase the range of work that you do? If so, what new work do you do and have you received training?

98. What is the level of access to trained and experienced operators and supervisors?

99. What is the system for assessing the competency of employees?

100. Outline the programme of technical skills training for operators.

101. Are there always sufficient experienced operators available to cope with abnormal and emergency events?

102. How was your competence assessed before you were given your current job?

103. How are you introduced to new operating procedures?

104. Do you feel you are familiar with all equipment, piping and vessel interfaces such as gauges, valves and displays that you are required to work with?

105. Have you experience of other plants? If so, how do they compare with your present plant in terms of ease of operation and support available to you to make your job easier?

106. Outline the company's experience of the hazards associated with the operation of this type of plant or process.

107. How does the training of operators incorporate the assessment of hazards?

108. How is the competence of operators for the tasks they are required to perform assessed?

109. Is training provided to those responsible, both project engineers and operations supervisors, for writing procedures and developing operational rules etc, on techniques and scope of operations hazard studies?

110. Are those responsible for reviewing process and operational hazards familiar with the plant and its hazards?

111. Does the content of operator training cover process hazard identification?

112. Have incidents occurred when operation hazard/safety studies have not identified certain hazards due to lack of understanding of the process?

113. What are the criteria for selection and promotion of supervisory staff and those responsible for task checking?

114. To what extent is task checking included in the training of supervisors and operators with particular emphasis on means for identifying an unsuccessfully performed task?

PLANNING and IMPLEMENTING

115. How are operational tasks assessed and the results of such assessments used to alter the way the task is carried out?

116. How comprehensive, clear and unambiguous are operating procedures?

117. Were operability aspects of the control room(s) systematically assessed at the design stage or prior to any layout modification?

118. What features of the control room environment or work scheduling are designed to maximise the likelihood that operators will remain alert at all times?

119. What are the main difficulties that arise in doing your job?

120. Is it easy to identify all items of plant and their status? Can you give any examples of where there have been problems?

121. Does your job involve long periods of work wearing heavy personal protective equipment (PPE)? Does this affect the ease with which you can do your job?

122. Do control room displays represent all critical plant information such as status of valves? To what extent must the operator make a judgement of plant status from process parameters?

123. Are control room alarms clearly prioritised? Is there a permanently displayed alarm summary?

124. What industry guidance, regulations, codes of practice and corporate standards are relevant to the development of criteria for the management of human error in operations?

125. How are external standards and regulations and corporate codes of practice relevant to the management of operator error integrated into local standards and codes of practice?

126. What is the means of ensuring that operating procedures are consistent with standards on the management of operator error?

127. To whom are operations standards/rules distributed?

128. What operations standards and codes of practice are you required to work to?

129. Are the standards and rules you are required to work to always realistic in relation to the demands of the tasks you are required to carry out?

130. Do you think those that set the standards and rules you are required to work to reflect a full understanding of the demands of your job?

131. Do you feel that the available operational standards and rules give sufficient guidance on the hazardous tasks you are required to carry out?

132. Describe the system for planning the provision of personnel for operations.

133. What resources are allocated for developing and reviewing written information for operations?

134. How is cover provided for personnel shortages?

135. What resources are available for assessing the quality of operator- hardware interfaces and making suggestions for improvement to engineering management?

136. How are staffing shortages overcome?

137. What is the scope and depth of safety/hazard reviews for modifications during the operation of the plant?

138. What are the requirements for carrying out safety/hazard studies of operating methods, reactions, sampling procedures, inerting systems, purging procedures, equipment testing procedures etc?

139. Are changes to operating methods only permitted after a hazard study has been undertaken?

140. What are the methods for developing suitable procedures in various areas?

141. What are the major hazards commonly assessed during safety/hazard reviews?

142. Are there specific procedures for start-up and shut-down and have they had hazard reviews?

143. Are operating procedures used as specified/written?

144. What regulations, industrial guidelines, codes of practices or corporate standards have been used in the development of an operations hazard assessment policy?

145. Are company rules/criteria available which are implemented within safe operating procedures and practices?

146. What standards/rules are available to enable development of operating practices/procedures?

147. What tools are available to operators for assessing hazards in the operating environment?

148. What is the process by which resources (time, budget and personnel) are allocated to the performance of safety reviews and the development of safe operating procedures?

149. What is the process for deciding the staffing level for operators?

150. What aides are provided to support the conduct of operational hazard reviews and development of safe operating procedures, such as hazard checklists, HAZOP software, procedure writing manuals, MSDSs etc?

151. How can changes be made to the resources available for reviewing operational hazards and developing safe procedures if there were problems with competence or workload?

152. Is the staffing level in the plant sufficient to cover the requirements of procedures?

153. Do operating procedures specify the need for critical operational tasks to be checked by a competent authority?

154. Are there specific checklists to be followed prior to start up?

155. What industry standards, regulations and corporate standards are used for setting the criteria for the supervision of operations and the checking of critical tasks?

156. Is there a clear specification of the site standards regarding the checking of complete tasks?

157. How is the criticality of tasks assessed with a view to specifying which tasks require checking?

158. Describe the system for assessing the comprehensiveness of operational procedures in terms of their task checking and supervision components.

159. How is it ensured that staffing levels are sufficient to cope safely with abnormal and emergency operational events?

160. What is the status of checking requirements, i.e, mandatory or guidance only?

161. Is there a means of assessing whether the levels of supervision and checking of critical tasks are adequate?

162. Have there been changes in staffing levels that have made the carrying out of task checking and supervision requirements difficult?

163. Is the level of access to personnel and technical resources sufficient to ensure adequate supervision of operations?

164. What level of detail is specified in procedures referring to critical task checking?

MEASURING PERFORMANCE

165. What guidance is given on the analysis of incidents and near misses from a human error perspective?

166. What records such as shift logs or process status record sheets are produced as part of the communication process?

167. How are the root causes of operational incidents and accidents determined?

168. What is the system for monitoring progress in implementing changes to operating procedures?

169. How are internal standards and codes relevant to the management of operator error audited and assessed?

170. How does the company head office monitor production and safety performance and the relationship between the two?

171. Are there periodic assessments of the adequacy of methods for developing and reviewing procedures?

172. What checks are carried out to ensure that operating procedures are in accordance with company policy?

173. How are historical records and operator feedback analysed to review and monitor and pursuance of unsafe operating practices?

174. Is there analysis of incidents which have resulted in subsequent changes to either operating procedures or the requirement for safety reviews?

175. What methods are used, such as routine plant audits, to check whether unsafe procedural modifications and short cuts are made or have evolved over time?

176. Are checks carried out on operational hazard reviews in order to verify that such studies are correct and are being carried out by competent persons?

177. How can management be assured that checks are carried out where specified?

178. Describe the system for reporting near misses.

179. What indications are there on equipment to show current state?

180. Are there ever plant identification problems that make it difficult to check work done?

REVIEWING PERFORMANCE

181. How are the policies on analysing incidents and near misses for operational errors revised in the light of industry guidance changes or practical experience?

182. How are the policies on maintaining unambiguous operating procedures revised in the light of industry guidance changes or practical experience?

183. How are the policies on the training of operations personnel revised in the light of industry guidance changes or practical experience?

184. How are the policies on ensuring good operator-hardware interfaces revised in the light of industry guidance changes or practical experience?

185. What is the process of reviewing operating procedures and how are changes to procedures communicated to all concerned?

186. How are production communication processes reviewed?

187. Is there a clear means by which you can make suggestions for changes in the way you are required to carry out tasks or for modifications that might make your job easier?

188. What are the means for operations personnel to express opinions on standards/rules and their application?

189. What feedback is used to assess the success of controls on pressures?

190. Is there a backlog of required modifications to operating procedures?

191. What is the typical response from management when safety problems are reported?

192. Are the written operating procedures regularly reviewed and updated, and how are you informed of changes?

193. What is the process by which the method for developing operating procedures would be revised in the light of experience or regulatory/policy change?

194. What is the process of revising company policy in the light of changes in industrial practice, corporate policy or required changes due to experience?

195. Have changes been made in the operating procedures in the light of experience?

196. Are procedures reviewed on a regular basis?

197. Is there a method for reviewing the policy on operating safety in the light of practical experience?

198. Are operators involved in reviewing incidents or making recommendations for improvement?

199. Are operators involved in review of operations procedures?

200. Which personnel are available and/or required to carry out independent (independent from the relevant project team or operations department) checks on the technical safety of operating procedures and the adherence to safe operating practices on plant?

201. Is there a formal and mandatory system, such as requiring approval from a safety officer, for assessing procedural revisions for their impact on safety prior to their implementation?

202. What is the process by which unsafe operating procedures, either proposed or actual, may be revised?

203. Are safety reviews carried out where specified?

204. What are the criteria, formal or otherwise, for determining who may carry out reviews and checks on the safety of operations, such as chemical process background or operational experience?

205. Outline how the system of supervision of plant and personnel is revised in the light of experience and/or policy change.

206. What is the process of changing procedures for supervision and task checking of operations to take account of operational errors and how are any changes communicated?

207. What is the method of revising site standards in the light of external events such as new legislation and codes of practice?

208. Outline the method for reviewing the effectiveness of training for task checking and assessing the need for further training.

RCS 4 - PLANNED MAINTENANCE PROCEDURES

• Introduction • Planning and Implementing • Policy • Measuring Performance • Organising - Control • Auditing • Organising - Co-operation • Reviewing Performance • Organising - Communication • Example Questions For Interviews • Organising - Competence

INTRODUCTION

This RCS concerns the procedures required to define maintenance work including the (task) analysis of the maintenance process. It is expected that there will be documentation to describe the maintenance procedures. Consideration should be given to ergonomic principles in maintenance work and to the potential for human error. Maintenance planning should cover what equipment is to be maintained and when to carry out the maintenance. The supervision and checking of routine maintenance tasks should be considered.

POLICY

Key Issue:

Senior management should lay down a clear policy and objectives for planned maintenance procedures to ensure that loss of containment of hazardous substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.

Key Characteristics:

• The overall objective is to maintain the plant using experienced and competent staff provided with clear and useful maintenance procedures. Maintenance should be properly planned and resourced to fit in with production.

ORGANISING - Control

Key Issue:

• Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:

o Overall management of maintenance on the site.

o Assessment of maintenance performance compared to standards.

o The writing of maintenance procedures.

o The provision of maintenance job aids.

o Supervision of maintenance work.

o The control of maintenance contractors.

o The control of spares used in maintenance.

o Maintenance fault trend monitoring.

o Resourcing of maintenance work.

Key Characteristics:

• The system for planned maintenance should include:

o The allocation of adequate financial and human resources for maintenance;

o Documented support for maintenance work for example, up to date P&IDs, maintenance schedules, records and up to date procedures;

o Documented maintenance procedures;

o Personal responsibilities being defined, e.g. in job descriptions which specify: position in organisation structure reporting links, responsibilities and duties;

o The allocation of work between permanent staff and contractors;

o The definition of maintenance standards;

o The control of spares by a quality system;

o Record keeping and fault trend monitoring;

o The definition of the checks made during and after maintenance. Examples might include:

combustible or toxic gas checks carried out periodically or at particular junctures in the work;

ensuring that the work has been carried out correctly and the integrity of the plant after completion is satisfactory. e.g. who checks that the correct couplings, pipe materials, pressure tests, welding technique etc, have been used?

who checks that the flanges are correctly tightened?

ORGANISING - Co-operation

Key Issue:

Plant is made available for maintenance work in a planned way and work is carried out safely. Plant is returned to operation in a sound condition. Individuals involved with the planned maintenance process should cooperate to ensure successful maintenance of the plant, balancing safety, production and time pressures.

Key Characteristics:

• The system for planned maintenance should encourage cooperation:

• Those involved with maintenance should ensure priorities are balanced between the requirements to carry out maintenance and production pressures. For example, is the conduct of safety checks before, during and after maintenance work mandatory or optional and thereby at the discretion of, for example, the issuer of the permit-to-work?

• Maintenance procedures should be practical in the context of other demands on personnel time and pressures to minimise down time and ensure co-operation between different needs.

• Resources for maintenance should be adequate, so that all needs within the system are met. For example, how is the maintenance budget related to and affected by:

o financial performance of company;

o maintenance priorities;

o production requirements;

o major personnel reductions or increases;

o quantity of overtime worked;

o amount of maintenance work contracted.

• Ownership of maintenance activities by front line maintenance staff, including contractors, is important. Involvement of staff in safety committees and other health & safety related issues.

ORGANISING - Communication

Key Issue:

Formal and thorough communication between all of the parties involved in the planned maintenance process.

Written instructions are adequate to ensure information about new activities, changes in legislation or workplace standards from reviews and audits are communicated to the people who need to know.

Key Characteristics:

• The system for planned maintenance should ensure:

o A forum exists for accessing industry guidance and corporate expertise on maintenance procedures for the plant.

o Documentation on maintenance procedures exists which is clear, up to date and covers

application of condition monitoring;

preventative maintenance;

criteria for overhaul;

criticality assessment;

special requirements for critical equipment;

tasks for which procedures should be developed;

plant engineering requirements for ease of maintenance.

o Maintenance standards should cover:

standards set for the provision of information on the status of equipment, such as pressure gauges on pipe runs;

standards set for the labelling of equipment to be maintained, including labelling of valves and pipes;

sampling methods employed in checking inspection, testing and maintenance (e.g. for inspection of welding);

minimum time intervals between tests for hazardous environment during the course of maintenance;

minimum checks on the integrity of plant needed before plant can be restarted.

o learning from previous experience, incidents and equipment history.

o Communication to Senior Management about needs for changes to maintenance procedures.

o Verbal (face to face) discussion and communication is important e.g. between operations and maintenance.

ORGANISING - Competence

Key Issue:

Individuals involved in planned maintenance are competent to achieve the objectives. Competencies in terms of knowledge, skills and experience are clearly defined and reviewed. Selection criteria for staff and any contractors are clearly laid down.

Key Characteristics:

• The system for planned maintenance should ensure:

o optimal use of company experience in defining and optimising routine maintenance frequencies and techniques for the plant;

o well defined competencies of staff and contractors;

o training programmes to ensure personnel are familiar with the plant hazards, maintenance procedures and supervision requirements;

o well written, clear and up to date maintenance procedures exist including details of the checks carried out during and after maintenance;

o the control of contractors, e.g. using accredited contractors whose employees are familiar with the methods and hazards at the plant.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Up to date, clear, relevant and realistic procedures, should be available for maintenance tasks.

Aides and equipment for maintenance.

Frequency and scheduling of maintenance including shutdown.

Criticality of plant items should be considered so that work is done and not postponed due to time or production pressures.

Key Characteristics:

• Maintenance procedures should be available which are clear, easy to follow and used for all work. These may include:

o procedures for removing bonnets/gauges from valves;

o procedures for isolating components, purging lines and vessels;

o welding procedures in areas with flammable materials;

o which materials should be used in flushing lines.

• Maintenance procedures should:

o incorporate guidance on hazards;

o incorporate existing regulations, industry guidelines, certificators requirements, codes of practice, corporate standards and manufacturers requirements;

o consider the ergonomics of maintenance tasks;

o provide labelling and easy identification of equipment;

o provide for task checking during and after maintenance. Checks may include:

gas tests;

weld inspections;

isolation checks;

purging checks;

pressure tests;

checks on integrity of plant before authorisation back into operation.

o specify equipment requirements;

o consider special requirements for critical safety equipment e.g. ESDS, flares, PRVS and interlocks.

• Maintenance work should be planned by the criticality of the plant items and scheduled to provide plant shut downs which dovetail with production needs. A good system maximises up time and minimises intervention, particularly unplanned maintenance. Frequency may originally be specified by suppliers and adapted to practical experience in the plant. The system may include the following:

o reactive/breakdown maintenance only in response to maintenance requests from operations;

o referencing manufacturers guidelines;

o predictive, for example by measuring rate of corrosion/erosion in pipes and vessels;

o preventative, for example on electrical or instrumentation components which give little warning prior to failure;

o raising periodic maintenance work orders for different types of equipment such as static versus rotating equipment;

o scheduling of routine maintenance;

o maintaining a record system;

o devising and implementing methods of monitoring plant for corrosion etc.

• Attention should be paid to systems that may not be normally used such as emergency systems. A component may be inoperative, but the condition may go undetected until the component is required to operate.

• Maintenance priorities during plant down times should be specified.

MEASURING PERFORMANCE

Key Issue:

The planned maintenance system should be monitored to measure its performance e.g. whether plant or equipment failures occur at unacceptable intervals.

Key Characteristics:

• The collection of incident and near miss data and analysis for possible maintenance failures e.g. using a root cause analysis system.

• Trend analysis for maintenance failures.

• Determination of maintenance needs for all plant items.

• Control of outstanding maintenance work based on criticality of plant items. Backlog should be measured.

• Monitoring of checking of maintenance tasks for example, is information collated on the frequency of authorising equipment back into operation which subsequently fails due to poor repair, perhaps as part of a quality control system or site incident reporting system, or the frequency of weld failures after maintenance or actually while in service.

• Monitoring of unplanned stoppages.

• A system for checking the adequacy of maintenance work, e.g. spot checks. Frequency/depth based on criticality of plant items.

• System for checking that correct materials/replacement parts have been used.

AUDITING

Key Issue:

The planned maintenance system should be periodically the subject of a formal audit. The auditors should not be part of the system or have responsibility for it, i.e. be independent of the maintenance function being audited.

Key Characteristics:

• The audit should check that performance measuring and review are occurring at the correct frequency, are addressing the right issues, appropriate information flows occur at specified periods to senior management. It would be reasonable to expect an annual review.

REVIEWING PERFORMANCE

Key Issue:

Information from "measuring" and "auditing" is used to make judgements about the performance of the operation of the planned maintenance system and is used to make decisions about improving performance.

Key Characteristics:

• Periodic reviews of the planned maintenance system including such issues as the performance and frequency of condition monitoring, periodic overhaul of PRVs etc, for example:

o is there a policy of periodic internal auditing of plant maintenance;

o is the performance of the procedure for issuing correct replacement parts formally and periodically reviewed;

o is the performance of inspection and test procedures formally and periodically reviewed.

• Learning from experience about the effectiveness of the system.

• Revision of procedures in the light of experiences, standards, codes, manufacturers requirements etc. For example are procedures only reviewed after an incident or is there a constant review process, including the collection of performance data, perhaps as part of a Quality Control system?

• Revision of maintenance checking requirements in the light of experience.

• Revision of technical support and aids to maintenance.

• Consideration of the practicality of procedures.

EXAMPLE QUESTIONS FOR INTERVIEWS

OBJECTIVE

1. What is the policy on managing maintenance on the site and how is it developed?

2. What is the policy for assessment of maintenance performance?

3. What is the policy for providing job aids, for example, pipework layout diagrams to maintenance fitters?

4. Are there particular safety issues associated with the process used in the plant which influence the approach to maintenance?

5. Describe the policy and approach to checking maintenance work.

6. Describe the process for incorporating corporate standards, regulations etc, on safety checks for maintenance into site policy, site codes of practice and procedures.

7. What is the policy for selecting contractors with regard to their technical competence and quality of work and safety performance?

8. What is the policy regarding resourcing of competent maintenance personnel?

9. What is the policy for maintenance planning, including shutdowns, minimisation of interruptions and balancing safety with production pressures?

10. How is resourcing for maintenance managed?

ORGANISING - Control

11. What is the responsibility for managing maintenance on the site?

12. What is the responsibility for assessment of maintenance performance?

13. What is the responsibility for writing maintenance procedures?

14. What is the responsibility for the provision of job aides, for example, pipework layout diagrams to maintenance fitters?

15. What documentation, such as job description on the site safety manual is available specifying the roles and responsibilities of personnel involved in managing maintenance?

16. Describe maintenance supervisory responsibilities particularly in relation to contractors.

17. To what extent do the company's maintenance standards apply to contractors?

18. What are the allocation of responsibilities for setting and revising maintenance standards aimed at reducing the likelihood of maintenance error?

19. Where outside contractors are used for maintenance, how is their activity controlled?

20. What are the allocation of responsibilities for developing, integrating and compiling maintenance standards?

21. What is the allocation of roles and responsibilities for checking that site maintenance standards abide by company standards or codes of practice?

22. Are the spares and replacement parts controlled through a quality control process?

23. What is the allocation of roles and responsibilities for monitoring trends and faults detected in routine maintenance?

24. What checks are used that maintenance work is completed satisfactorily and the plant has been returned to a safe operating condition - who is responsible?

25. What checks might be carried out during maintenance and who is responsible?

26. What is the allocation of responsibility for ensuring that an adequate budget is available for maintenance?

27. Outline the allocation of responsibility for ensuring that competence/skill levels are maintained for both employees and contractors.

28. Outline the allocation of responsibility for reviews and checking whether the designated resourcing for maintenance is adequate.

29. Outline the allocation of responsibility for ensuring adequate information is displayed on equipment and the necessary tools and information are available to allow easy monitoring of conditions.

ORGANISING - Cooperation

30. What is the impact of costs, schedules and other pressures on maintenance?

31. How are priorities balanced between the requirements to carry out maintenance to agreed procedures and production pressures?

32. Outline the responsibilities for checking practicality and useability of maintenance procedures in the context of other demands on personnel time and pressures to minimise downtime etc.

33. Is maintenance or checking of maintenance ever omitted due to unavailability of personnel, cuts in budget or production schedules?

34. Are there sufficient maintenance personnel to cover for absentees?

ORGANISING - Communication

35. Is there a forum for accessing industry guidance and corporate expertise on managing human error during the maintenance of hazardous plant?

36. What documentation is available for regarding the site's maintenance policy?

37. What is the means for ensuring previous maintenance history of equipment is available?

38. What is the process of reporting progress for maintenance to senior management?

39. What are the channels for communicating the need for changes to maintenance requirements?

40. What is the mechanism of reporting contravention of maintenance procedures to management?

41. What is the process of communicating changes to maintenance standards to maintenance personnel?

42. What documentation is available on the site on the company's standards for maintenance task checking?

43. What is the means of communication of standards on the supervision and checking requirements on maintenance?

ORGANISING - Competence

44. What experience does the company have in defining and optimising routine maintenance requirements for this type of plant?

45. What is the required level of competence for maintenance fitters and how is this assessed?

46. Where outside contractors are used for maintenance how is their competency assessed?

47. What training is given to contractors as regards the hazards in the plant?

48. Outline the company's experience of developing procedures for checking prior to and during maintenance and in the hand-over phase following the completion of maintenance.

49. What changes have occurred in the manning levels of the maintenance department recently?

50. Has there been an increasing trend recently to move more towards maintenance following breakdown?

51. What is the means of assessing and meeting maintenance training and supervision needs? Is there an adequate level of expertise for maintenance within the site?

52. What proportion of maintenance is carried out by contractors?

53. Outline the system of training for maintenance staff, including the training of existing staff on new or unfamiliar parts of plant.

54. What emphasis is placed on the technical training of maintenance staff in comparison with general safety training?

55. What are the certification, competence and training requirements for employees and contractors?

56. What is the process of assessing competence of staff who check maintenance work and those responsible for developing safe maintenance procedures?

57. What is the means determining the competence of maintenance supervisors prior to appointment to ensure that they have an adequate understanding of plant hazards, safety equipment, pressure gauges, isolation equipment and safety procedures?

PLANNING AND IMPLEMENTING

58. Describe the procedures available for maintenance tasks.

59. What means is there to ensure that items of plant are clearly labelled to allow easy and accurate identification by maintenance fitters?

60. If PPE is required for maintenance tasks is this well enough resigned to allow the fitter to work in it without excessive restriction?

61. Are maintenance procedures clear and easy to follow and used for all work?

62. Do maintenance procedures give guidance on hazards and issues such as spade locations?

63. What are the existing regulations, industry guidelines, codes of practice and corporate standards relevant to the management of maintenance errors?

64. Are the standards and rules for maintenance procedures realistic in relation to the demands of the work?

65. What access does the company have to the latest industry guidelines on techniques and methods for maintenance?

66. How is the criticality of equipment determined?

67. What is the means used for assessing frequency requirements of maintenance?

68. How are external standards and guidelines on maintenance integrated into internal standards?

69. What documentation is available on maintenance codes of practice, standards and requirements?

70. What documentation is available regarding the roles and responsibilities of persons involved in checking maintenance work?

71. Are there procedures available for carrying out checks before, during and after maintenance work?

72. What is the procedure for scheduling plant shutdowns and duration of shutdowns?

73. What procedural guidance is available for calibrating and validating test equipment?

74. How are maintenance requirements prioritised within a shutdown period?

MEASURING PERFORMANCE

75. Who is responsible for collecting incident and near miss data and analysing it for possible maintenance failures?

76. How are the causes of maintenance failure assessed?

77. How are trends in maintenance incidents measured and communicated?

78. How are maintenance requirements and results for each item of plant recorded?

79. How is the criticality of outstanding maintenance work controlled, prioritised and reviewed?

80. How is effectiveness of the planned maintenance programme measured?

81. How is the success of maintenance task checking assessed?

82. What are the responsibilities for monitoring the implementation of site maintenance requirements?

AUDITING

83. What is the level of availability of independent personnel to monitor the conduct of maintenance including task checking and pressures to cut time and cost?

RCS 5 - MANAGEMENT OF PLANT AND PROCESS CHANGE

o Introduction • Organising - Communication o Policy • Organising - Competence o Organising - Control • Measuring performance o Organising - Co-operation • Audit and review

INTRODUCTION

Plant, process and organisational change, and how organisational change is integrated into operations management, are often an underlying cause of failure. In particular, many of the catastrophic events that have occurred on Major Hazard sites/installations are attributable to such changes. All levels of change - small or large - are capable of affecting the safety of the site/installation.

This guidance is aimed primarily at plant and process change.

For organisational change, guidance on implementation can be found by clicking on the linked guidance at the start of the Organising section. This linked guidance broadly follows the HS(G)65 POPMAR framework. Inspectors need to be aware that organisational and plant change can, and do, overlap.

Assessment by Inspectors should ensure that an effective management system is in place for the identification, control, implementation, monitoring, audit and review of change within the organisation. This will include planning the change, hazard identification, and risk assessment, commissioning and, where relevant, safety report/case review. Inspectors should expect to see changes contribute to a policy of continuous improvement in terms of health and safety. Each stage should embody the principles of risk assessments and measures taken to reduce risks to as low as is reasonably practicable (ALARP).

This guidance should be used in conjunction with the RCS General Introduction and the RCS Generic Guidance that is designed to cover issues common to all risk control system inspections. Inspectors should also refer to the RCS guidance on Hazard Identification and Risk Assessment (HIRA).

• Legal Basis • Examples of Change • An example assessment procedure • Guidance available • Codes of Practice relating to plant modification - from Tech SRAG • Major accident case studies illustrating the importance of plant modification/change procedures - from Tech

SRAG

RCS 5 - MANAGEMENT OF PLANT AND PROCESS CHANGE - LINKS PAGE

• Legal basis • Guidance available • Offshore legal basis • Codes of practice relating to plant modification • Examples of change • Further reading materiall • An example assessment procedure would include: • Case studies illustrating the importance of plant • Decommissioning procedures modification / change procedures

LEGAL BASIS

COMAH REGULATIONS 1999

Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their consequences to persons and the environment.

Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2.

COMAH safety reports, as part of their minimum information, are required to include information on the operators' management system and on the organisation of the establishment with a view to major accident prevention. (see COMAH Schedule 4 Part 2, paragraph 393, L111).

Regulation 5(3) requires the operators' MAPP to include sufficient particulars to demonstrate that the operator has established a SMS. The SMS should take account of the principles specified in paragraphs 3&4 of Schedule 2. Schedule 2 requires the adoption and implementation of procedures for planning modifications to, or the design of new installations, processes or storage facilities. Although Schedule 2 isn't explicit on organisational change, the guidance to Schedule 2 is (see paragraph 368, L111).

Also see HS (G) 190 Preparing Safety Reports, pages 45-6, for further guidance.

Safety Reports must be reviewed and if necessary revised whenever changes are made to the organisation that could significantly impact on the control of major accidents (COMAH Reg 8(c)).

THE HEALTH AND SAFETY AT WORK ETC ACT 1974

Sections 2(1), 2(2)(a) and 3(1). Section 2(1) requires the employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees. Section 2(2)(a) requires the provision and maintenance of plant and safe systems of work that are,…. safe and without risks to health. Section 3(1) requires employers to ensure,…. that persons not in his employment…. are not…. exposed to risks to their health and safety.

THE MANAGEMENT OF HEALTH AND SAFETY AT WORK REGULATIONS 1999

Regulations 3, 4 and 5. These require employers and self-employed people to assess the risks to workers and any others who may be affected by their work or business, to implement preventive and protective measures and make sure that appropriate arrangements are in place to cover health and safety.

OFFSHORE LEGAL BASIS

SAFETY CASE REGULATIONS 1992

Regulation 9(1) requires the revision of the contents of the SC as often as may be appropriate. Regulation 9(2)(a)&(b) requires the operator to send a revised SC to HSE where revision will render the SC materially different. This will include any amendments to the key operating parameters relating to the installation (e.g. designed capacity, operating pressures, composition changes etc). A description of the SMS for control and implementation of the changes from conceptual design to commissioning should also be given. This will include details of the hazard identification reviews and risk assessments carried out to ensure that the changes are safe and that the existing facilities are not compromised. Regulation 9(4) (regular resubmission of a SC) requires a description of how smaller changes are monitored for their effect on the validity of the current SC and the mechanisms and criteria whereby 'material change' is determined. Regulation 15C&D requires the operator to review and, where necessary revise the verification scheme, and to ensure the continuing effect of the verification scheme.

OFFSHORE INSTALLATIONS (PREVENTION OF FIRE ETC) REGULATIONS 1995

Regulations 5(1) and 19(1), (2), and (3). Regulation 5(1) requires an assessment to be performed and repeated as often as may be appropriate. Regulation 19(2)&(3) requires the operation of a suitable written scheme of examination.

EXAMPLES OF CHANGE

Change can be addition, replacement, removal or modification, covering:

a. Plant and equipment, changes in: • Design; • Equipment; • Software; • Layout/location; • Instrumentation; • Set points of critical alarms/relief systems or trip settings; • Materials; • Specifications; and • Status (for example bringing "mothballed" plant and equipment back into use).

b. Process, changes in: • Raw materials: • Suppliers; • Mode of raw material delivery; • Process steps; • Process parameters (for example temperature, pressure, flow, etc); • Scale; • Waste disposal and disposal agent; and • Packaging/format of final product.

c. Procedures, changes in: • Operational procedural steps; • Computer controlled software; • Maintenance procedures; and • Style (for example from step-by-step flow diagrams)

d. Organisational, changes: • People coming within "operating envelope"; • Staffing levels and "delayering"; • People within the management of change system; • People's responsibilities; • People's span of responsibility; • Competence; • Methods of work e.g.teamwork/multi-skilling; • Contracting out; and • Work shift patterns.

e. External circumstances which are capable of affecting the control of major accident hazards, where appropriate.

FOR EXAMPLE: AN ASSESSMENT PROCEDURE WOULD INCLUDE:

• A safety, engineering and technical review should be undertaken prior to change. This review should be traceable and identify changes proposed to the following factors: Process conditions; Operating methods; Engineering methods; Human Factors (tasks and personnel); Safety; Environmental conditions; Engineering hardware and design. All parts of the plant should be considered, as change may affect parts that are quite remote from the source of change. All human factors changes should be considered, as they could have an impact on MH prevention, even if a small change.

• Consideration of the depth of risk assessment required by reference to a written procedure. (e.g. whether the change requires a team or individual assessment and whether more detailed assessment such as Scenario Assessment or HAZOP is appropriate.) The procedure should take account of: the degree of hazard and extent of the change, including a full, realistic account of the range of human reliability; the worst case accident likely to arise as a result of the modification; previous risk assessments relating to the item/issue; the appointment of a competent person (excluding the HAZOP chairman) to decide the requirements for HAZOPs or other studies; and facilitation of the assessment process by well trained persons independent of the facility being assessed. If hazards cannot be eliminated by actions placed during the HAZOP, hazard analysis should be employed to determine the likelihood of an incident occurring and if the risk is acceptable.

• Consideration of evidence from previous incidents - their cause and means of preventing them to minimise risks.

• Consideration of available options in the design of safety measures (preventative and protective) where necessary.

• Identification and mapping of all changes to both tasks and personnel that could have an impact on MHprevention, no matter how small the change.

• Consideration of assessments of the organisations handling of a range of crisis scenarios post-change, including upsets, escalating incidents and emergencies.

• Identification and recording of conclusions and control requirements. • Resultant actions prioritised

a. the change is authorised subject to particular requirements; b. the results of any review and authorisation requirements are actioned; c. the change is implemented; d. a check is made to ensure the change has been completed according to the review and authorisation

requirements, examined and tested, and that plant is safe to bring into operation; e. other actions required as a result of the change, for example, amendments to records and piping and

instrumentation diagrams, maintenance procedures, standard operating procedures, training/competence issues etc, are carried out.

• Plans record change by implementation steps and dates and responsibilities for actions. In the case of major changes this may be best done through formal project management techniques.

• Procedures cover temporary changes and criteria for implementing changes in exceptional circumstances where "normal" management of change procedure is not possible.

• Adequate and comprehensive performance standards are in place to enable the management of change process to be effectively measured and reviewed, well beyond the end of transition.

DECOMMISSIONING PROCEDURES General measures that should be adopted for a common approach to decommissioning include:

• Establish communication with plant personnel to ensure surrounding plant areas are prepared for decommissioning activity;

• Undertake removal of hazardous substance via a cleaning procedure to ensure plant item is clean and empty with particular consideration where there may be dead-legs where material may be trapped;

• Consideration of the disposal of items which may be contaminated by absorption of hazardous substances and chemical change;

• Mechanically isolate plant item from other surrounding plant items by physical disconnection or fitting of blanks; • Electrically isolate plant item from power sources by physical disconnection.

GUIDANCE AVAILABLE Chemical information Sheet No CH IS7 provides guidance on how to manage the impact of organisational change on the control of major accident hazards. PM/ENF/10 Human Factors Inspectors Toolkit includes useful question sets on organisational change and transition management, and maintenance error. It also contains an extremely useful guidance list, sorted by topic. There is no guidance available that specifically covers plant modification. Most companies usually adopt internally generated plant modification procedures that have been developed through:

• Corporate history and experience; • Good industry practice; • Input from Safety, health and Environment department; • Input from Operations dept; • Input from Technical dept; • Input from Engineering dept.

Related Technical Measures Documents include Plant Layout, Design Codes - Plant, Design Codes - Pipework and Maintenance Procedures.The relevant Level 2 Criteria are: 5.2.1.4 (34) c, 5.2.1.6 (38) h, i, 5.2.2.1 and 5.2.5.1.CODES OF PRACTICE RELATING TO PLANT MODIFICATION

• CISHEC/8906/1000, CIA, Guide to Hazard and Operability Studies. • Kletz T.A., 'HAZOP and HAZAN: Identifying and Assessing Process Industry Hazards', 3rd Edition, IChemE,

1992. • HS(G)176 The storage of flammable liquids in tanks, HSE, 1998.

Paragraph 23 to 27 give guidance on the requirements for HAZOP and Risk Assessment. Paragraph 26 requires that risk assessments are carried out for modifications and demolishing. Paragraphs 158 to 161 give guidance on testing and commissioning. Paragraphs 201 to 205 give guidance on decommissioning.

• HS(G)28 Safety advice for bulk chlorine installations, HSE, 1999. Paragraph 210 requires that modifications are only carried out after conducting a risk assessment (possibly HAZOP) and discussions with the chlorine supplier.

• HS(G)30 Storage of anhydrous ammonia under pressure in the UK : spherical and cylindrical vessels, HSE, 1986. Paragraphs 98 to 117 give guidance on commissioning and decommissioning. Paragraph 121 requires that a competent person authorise returning the plant to service after modification.

• LPGA Code of Practice 1, Bulk LPG Storage at Fixed Installations ( Part 1, Part 2, Part 3 and Part 4), LP Gas Association. Supersedes HS(G)34, The Storage of LPG at Fixed Installations. 1987, HSE. Part 3, Section 2.6 requires that modification or repairs for whatever purpose, including change of duty shall comply with the design codes in Parts 1 and 2.

• HS(G)34 Storage of LPG at fixed installations, HSE, 1987. Superseded by the above. Paragraphs 172 to 191 give guidance on commissioning, decommissioning and maintenance, including that a competent person should certify modifications.

FURTHER READING MATERIAL • ILO, Major hazard control: A practical manual, 1988. • Section 3.3.5 provides guidance on procedures for carrying out repair work (e.g. welding of components

containing flammable substances). • European Federation of Chemical Engineering, EFCE Publication Series No. 59, Hazards from Pressure:

Exothermic Reactions, Unstable Substances, Pressure Relief and Atmospheric Discharge, The Institution of Chemical Engineers, 1987.

• Knowlton, R.E., An Introduction to Hazard and Operability Studies, Chemetics International, Vancouver, 1981. • Coulson, J.M., & Richardson J.F., Chemical Engineering Volume 6, Pergamon Press, Third Edition, 1983. • Lees, F.P., Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control, 1996,

Second Edition. CASE STUDIES ILLUSTRATING THE IMPORTANCE OF PLANT MODIFICATION / CHANGE PROCEDURES

• Allied Colloids Limited (21/7/1992) • Bhopal - Union Carbide (3/12/1984) • BP Oil (Grangemouth) Refinery Ltd (22/3/1987) • Dow Chemical Factory Explosion (27/6/1976) • Flixborough (Nypro UK) Explosion (1/6/1974) • Texaco Refinery - Milford Haven - Explosion and Fires (24/7/1994)

POPMAR ELEMENT

KEY FEATURE INSPECTION GUIDELINES

POLICY Is there a clear policy for the management of change (plant and organisational)?

Does the policy commit to proportionate consideration of all organisational changes, large and small?

Policy should cover:

• Purpose/objectives, scope of where and what the system applies to, and consequences of not having a system. Recognition that change has been associated with major accidents. Commitment to analyse and control organisational change as thoroughly as plant change. Consideration of all changes, whether permanent or temporary. Those not at first connected to safety need to be scrutinised to confirm whether or not they may have indirect impacts on safety. E.g. impact to facilities beyond the installation offshore should be identified where applicable. Definition of terms, e.g. what is meant by temporary change, emergency change, modification? Examples of change, and typical change control problems.

Verification of Documentation:

• Management of change policy

ORGANISING CONTROL Are you inspecting organisational change? Is there an adequate management structure to manage the change effectively?

• For organisational change, follow the guidelines in PM/Enf 11 Human Factors - Inspector Toolkit ,and CHIS 7 for guidance on risk assessment for organisational change. See SPC/Enf/70 for practical operational information to help make a judgement on the adequacy and robustness of Duty holders' change management arrangements with respect to organisational changes.

• Further useful publications : Improving Maintenance. A guide to reducing human error. ISBN 0-7176-1818-8. Reducing error and influencing behaviour HS(G)48.

Is there clear leadership from senior management? Are responsibilities clearly allocated and accepted? Are people held accountable for managing the system?

• There should be visible, clear leadership from senior management. • Thorough, consistent and well documented procedures should identify

who is responsible for the following key tasks: o Overall responsibility for the management of change system; o Defining any plant changes; o Designing plant; o Reviewing the original design intent, effects on plant integrity,

process operating parameters, safety and control systems; o Document management; o Initiating change; o Hazard and risk analysis requirements; o Authorising change (including levels of authorisation

relative to the potential hazards associated with the change);

o Implementing change (including the provision of relevant competencies appropriate to the task and examination/test of plant / equipment modifications before commissioning to ensure that work is complete and in accordance with the design intent);

o Monitoring, reviewing and auditing. (Limits of authority for individuals/posts within the management of change system should be defined).

Are there clear • Change should be subject to documented and structured management procedures for of change procedures. What is meant by change should be clearly initiating, assessing, stated, so that it is obvious when management of change procedures authorising and should be followed. Procedures should demonstrate how details of implementing change? proposed modifications are developed, checked and distribution

controlled. For example, is there a drawing change note system for notifying change? Even replacement of equipment with non-identical parts should trigger a review to see if improved technology is available to ensure ALARP. Procedures should cover each element of management of change. Decommissioning Procedures should be subject to hazard review and risk assessment in the same way as for commissioning. The minimum requirements for approving a modification should be clearly indicated.

• Temporary changes e.g. use of an override or inhibit on a safety related system, will normally be put into effect through a separate procedure for control of overrides/inhibits. The use of overrides/inhibits needs to be kept under review, and any changes e.g. to modify or design out a trip function, should be handled through the change control procedure.

• Consistent procedures and recording systems should be applied across departments e.g. Maintenance and Engineering Design. The process between the initial raising of a change to its final implementation should be capable of being followed from beginning to end through proper referencing.

Are potential problem • Procedure should draw reference to evidence from previous incidents areas specific to the - their cause and means of preventing them. They should identify the plant identified and required steps to ensure that all potential hazards arising as a result of considered on a risk- the modification are properly identified, with associated risks based principle? minimised and recorded, before implementation of the change. E.g. is

the design basis of the modification compatible with existing plant? If not, interfaces need to be managed to avoid operational difficulties after commissioning. If relevant, Inspectors can question why modifications are being undertaken on live plant. The procedure should also list the options that are available in the design of safety measures, preventive measures (process control, instrumentation etc), and protective measures (containment, reactor venting, quenching, reaction inhibition).

• It is good practice to maintain a register of individuals and their tasks, roles and responsibilities related to the major hazard.

• The opportunity for initiating changes should be widely available to people associated with process systems.

• A clear description of the scope of the proposed change, the date of the proposal, and the need for change, including health and safety and welfare issues, should be recorded on a purpose-designed document.

• The team/individuals responsible for hazard reviews/assessments and authorisation of change should have the appropriate level of authority/competence.

• The constitution and role of the hazard review/assessment team should be defined. It should involve personnel with the background and experience to ensure that changes will not result in operations outside established safe limits. With offshore there is a need to involve onshore support for the more significant changes. It should always include technical assessment personnel, a safety advisor (for legal compliance overview) and safety rep/process operators. Process and maintenance operatives should be involved at an early stage in the modification process to ensure their practical contribution to the commissioning phase. This also provides them with experience and training, and the taking of ownership of new equipment and/or technology, ensuring a smooth transfer that is beneficial in risk terms. A senior, highly influential manager should be the designated sponsor/ champion.

• LINK to RCS Hazard Identification and Risk Assessment for further Inspection guidelines. (put in link once published)

Is there adequate control of operating procedures during change? Is documentation affected by the change systematically updated and issued to personnel? Are outdated drawings withdrawn?

• Procedures describing the document up-dating mechanism should be defined. How and when documents are raised to "as built" status should be clear. Originators of "redline drawings" showing changes should be informed when changes have been made to as-built drawings. All affected documents such as P&I Diagrams, s.o.p's, maintenance procedures and training schedules and all associated documentation e.g. panel mimics, alarm lists, should be updated in a timely manner to reflect any recent changes to plant. How all affected documents are identified is an important consideration.

• Any change to the operating conditions (e.g. pressures and temperatures, levels, flow rates) must be understood by the operators and documented. There should be traceable recording of changes on master control record prints between document up-dates. The date, source, status etc. of the revision should be clearly marked up. If not, the documents should be regarded as unreliable. It should be clear how this is managed both onshore and offshore. The document control system should ensure that outdated documents are withdrawn from circulation, and that non-controlled versions are not used.

• Only authorised personnel should amend existing operational procedures or issue temporary operating instructions during changes. It is good practice for the operating procedures to be authorised by representatives from several different departments.

• Modifications should not take place at night-time unless suitable expertise is available to consider the full implications of the change, and do a risk assessment.

• Major accident prevention must be regarded as 'core business', not a side issue.

• Useful links: • RCS 3 Operating Procedures • Human Factors website Information sheet on Procedures (available

late 05 - put in link when published) • Improving Maintenance. A guide to reducing human error pp30-35 for

information on contents of procedures.

Verification

• Should show how people are held accountable e.g. performance appraisal.

• To show a clear allocation of responsibility. • To show evidence of adequate resource allocation. • Look for non-compliances against procedures e.g. outdated

documents still in use, documents not all available, verbal communication used instead of formal written requests, use of non­standard format for risk-assessment.

ORGANISING COOPERATION Do all personnel cooperate to ensure the successful operation of the system? Is there good cooperation between contractors and in­house teams? Is there coordination with other parts of the Safety Management System e.g.HIRA?

• All parties should show a shared understanding and acceptance of the management of change procedures. They should cooperate to ensure that any changes are properly identified, communicated, assessed, planned, controlled and executed to the specified standard.

• There should be procedures to ensure that any conflicting engineering objectives are identified and resolved.

• There should be arrangements to ensure that all stakeholders are consulted and involved in any proposed changes to plant and processes.

• There should be a dispute resolution procedure. • Tasks should be coordinated. Each individual element of the change

should be completed to the required standard before the next is started,

Verification

• Dispute resolution procedure.

• Documentary evidence of consultation.

ORGANISING COMMUNICATION Are there adequate information flows into, within and from the organisation to secure the effective operation of the system? Is there a clearly written management of change procedure covering definitions, roles and responsibilities, operation and monitoring of the management of change system? Is documentation affected by the change systematically updated and issued to personnel? Are outdated drawings withdrawn?

• Formal and effective communication should take place between all parties involved in the change procedure. This should occur at all different stages of the process. Written records should be kept.

• There should be clear management of change forms and links with other documentation, e.g. work orders.

• Any plant changes to be affected should be clearly specified. • There should be structured meetings to carry out RA as a formal step

in any change initiation process. • Documentation of the design specification for any plant changes

should include relevant engineering design codes, design procedures, quality standards etc.

• Authorisation of any plant changes should be done using forms that are clear, unambiguous and easy to use.

• Good practice is the provision of encouragement and feedback, from monitoring data on positive achievement and on reasons why proposals have or have not been approved.

Verification

• Meeting minutes/records. • Design specification documentation. • Documentation associated with reviews/ disputes etc. • Feedback documentation.

ORGANISING COMPETENCE Are people competent to achieve the system objectives?

• There should be defined competence levels for team leaders, team members, and assessment facilitators. People undertaking the hazard studies should have adequate training in and experience of HI&RA techniques to include where appropriate HAZOP, QRA, and FTA. HAZOP team leaders should have gained a lot of experience as team members, and have attended additional team leadership training.

• There should be an overall view of site or business-wide requirements for the core technical competencies required to keep risks 'ALARP', including capacity for engineering, risk assessment (so that change is not delayed), and adequate intelligent supervision of contractors. This includes strategic planning using mapping techniques to ensure adequate deputies for key strategic roles.

• The need for specialist advice should be identified and ensured. The procedure should ensure that comments from the ICP (offshore) are taken into account.

• There should be arrangements to educate people of the dangers that might arise from uncontrolled change.

• Competence should be assured and ensured during transition and following any changes. This should include identification of training needs for changed or additional roles in relation to major hazards/process safety (bearing in mind that some key knowledge may well not be documented), and adequate planning for competent cover during the training period. There should be ample support and/or supervision by competent people for all staff with new safety-sensitive work e.g. contractor-based production operator fulfilling the new role of control room operator may require further emergency response training. Competence should be seen as only one means of addressing potential human failure and errors. For other means, LINK TO PM/ENF 11 Human Factors - Inspector Toolkit, Common Topic 2 Maintenance Error -put in link

• See also RCS 12-Assessing Competence.

Verification

• Strategic planning documents e.g. mapping records.

PLANNING AND IMPLEMENTING

Are all changes and all e involvedpeopl

The system should be able to cope with the number and type of changes. The number of change requests may need to be controlled to ensure that the

identified, and the need system isn't overloaded. for change The system should be clear and logical. There should be criteria to define the communicated as part of a managed system?

types of change subject to the change procedures, performance standards for operating the procedures and a formal system for ensuring that the system is followed and changes documented. An example of an assessment procedure for change.

Is there adequate assessment of the change? Is outsourcing, where used, adequately managed? Are risk reduction options weighed up in terms of ALARP and reasonably practicability?

Changes should be categorised, with greater importance attached to, and a higher level of management approval for, more safety-significant categories. The scope and detail of the risk assessment should be proportionate to the criticality of the change. There should be clear guidance on when a significant risk assessment is required. (The system should not heavily rely on individual judgment). Guidance on appropriate risk assessment qualitative and quantitative techniques should be available. For most plant change control applications, risk will be evaluated qualitatively using some sort of risk matrix. If the risks are found to be intolerable and cannot be reduced, then the change must not be implemented. Prompts should be used to get teams to think about using techniques other than HAZOPs. There should be evidence of the application of the principles of inherently safer design (see Assessment Principles for Offshore Safety Cases (APOSC) para.96). The effects of the change on the original design intent, plant integrity, process operating parameters, safety and control systems, any other affected facilities (including plant which may be quite remote from the source of the change), and human factors - should be assessed. Due account should be taken of the impact of change at each of the plant/installations life-cycle stages. If a change has the potential to affect facilities beyond the immediate boundaries of the affected installation, appropriate consideration should be taken of this impact and necessary consultation with affected parties undertaken. All assessments should be fully participative, ensuring that the knowledge (including informally held knowledge) and views of people involved is gathered and given dispassionate consideration. If outsourcing is used, major accident prevention should be accepted as core business. There should be arrangements to continue and resource, effective control of outsourced major accident risks. Appropriate performance indicators should have been selected for signs of degradation of performance.

Is there a clear implementation process to ensure that actions identified during RA are implemented, tracked and closed out? Is ALARP attained/demonstrated?

After modifications have been carried out, the work should be inspected, and the documents signed off only if the plant is safe to operate. Any non-critical outstanding items should be listed on a Reservations sheet, and completed in a timely manner. Where documents are signed off electronically, they should be password protected on a protected field. ALARP should be ensured even if it is simply replacement in kind. The general rule is that measures must be put in place unless the test of gross disproportion is met. Any previous cost benefit analyses, which discounted improvements on the grounds of limited installation life, should be revisited if the proposed modification results in an extended life. Indeed, the weighting given to remedial actions and their priorities may change as a result of the modification. Actions from hazard studies should be summarized for tracking implementation in the as-built modification. There should be adequate cover to allow necessary extra work such as training and writing new procedures.

Are changes to the SR/SC identified and initiated?

To meet the requirements of the SR/SC regime, the duty holder's method of evaluating the impact of change on the current SR/SC should be demonstrated. Even apparently minor changes to the SR/C should be assessed and logged, and all relevant documents updated. This is to help identify at what point between formally required SR/SC updates, amendment to the SR/SC may be required. The SR/C should be revised periodically to incorporate relevant changes. Material changes to the SR/C require submission to HSE before the modification comes into effect.

Are potential changes The duty holder should repeat PFEER risk assessments as appropriate. to the PFEER Assessment (offshore) considered? Is the ICP notified of changes to SCE's and are these examined/verified by the ICP? Are potential changes to the plant examination and test scheme considered? Is the scheme Competent Person (CP) notified of changes to plant and equipment and are these examined by the CP?

• Written schemes of examination and verification should be updated. For Offshore, see SPC/Enf/80. This advises inspectors that before a SCE is changed, or its maintenance regime is modified, then it may be necessary for the verification scheme to be reviewed and, where necessary, revised or replaced by or in consultation with an ICP. The nature of the change will determine whether a review etc. is appropriate.

• Inspectors should examine the outputs of the safety management system (SMS), ensuring the enactment of protective systems and that the implementation of risk control measures are effective, conform with the SR/SC, relevant legislation and good health and safety practice.

• Offshore, for a design S.C., the key area of concern will centre around the control of change during the design process after the issue of Approved for Design (AFD) documentation.

• Links to other guidance:

1. Hydrocarbon leak reduction offshore. Report on the findings of HSE's Process Integrity National Inspection Project 2000-2004. Link to be put in when published.

2. SPC/TECH/OSD/13, para 4.4.1. This details change control problems specific to Offshore.

Verification

• Inspectors could select and follow through a change example to verify that procedures are followed and records accurately kept.

• Check for status of outstanding items on Reservations sheets.

MEASURING PERFORMANCE

Is the management of change system monitored?

• Active monitoring should take place of risks during change. Change should be reversed if necessary.

• Compliance checking should be carried out at all stages to assure that:

• Appropriate risk assessments have been carried out properly and the results implemented.

• Risk assessments are revisited if change results in an extended installation life.

• Change requests, studies and follow-up actions are completed to reasonable timescales.

• Changes have not taken place without going through the appropriate system (check against the work order request or maintenance shift logs etc).

• There is selective investigation of sub-standard performance. • Modifications meet the design spec.

• Useful feedback can be gained from staff on the operation of the programme. Management should actively listen to issues or problems experienced by operators and other staff, as a means of early checking for possible system degradation.

Are leading and lagging process safety performance measures used that reflect the process risk profile of the plant? Is leading and lagging data used to drive performance improvement?

• Examples of leading indicators include: % of HAZOP actions not closed out; % of plant change authorisations completed retrospectively.

• Examples of lagging indicators include: Number of incidents where non-conformance to intended design was a contributory factor; number of incidents where inadequate plant/personnel change/modification was a causal factor.

• The data (from measuring process safety performance) should be used to drive performance improvement. For example, a committee of technical and management staff could meet monthly to review process safety measures and agree and steward necessary improvement actions.

• Further guidance on HSE's programme to promote the use of process safety performance measures can be found in SPC/Enforcement/87.

• The results of monitoring should be analysed and acted upon. • The accident and incident investigation system should recognise the

management of change as a potential important underlying cause. Where failures in the management of change system were thought to be a contributory failure to an incident - these should be separately identified and addressed.

Verification

• Written instructions covering monitoring of the management of change programme.

• Near miss or incident investigation reports may indicate failures with the management of change process.

• Check changes have gone through the appropriate management system e.g. check computerised maintenance logs, and change requests against risk assessment records. Records should be thorough and complete.

AUDIT AND REVIEW

Is the design and operation of the management of change system subject to periodic scrutiny and verification by someone not involved in the

• The design and operation of the management of change system should be subject to an independent audit. Performance measures should be used to measure the effectiveness of procedures and assess performance. Procedures should be in place to implement and review audit findings.

management of change at the workplace under review? Is there an effective Verification review of the System to ensure continuing improvement and effectiveness?

• Audit reports and reports on progress with audit actions. • Investigate how senior management is informed of the results.

RCS 6 - OCCUPATIONAL HEALTH - DERMATITIS

• Introduction • Planning and Implementing • Policy • Measuring Performance - Active Monitoring • Organising - Control • Measuring Performance - Reactive Monitoring • Organising - Co-operation • Auditing • Organising - Communication • Reviewing Performance • Organising - Competence

INTRODUCTION

This key issue has been developed to assist inspectors to assess the management of an occupational health issue. Occupational dermatitis is used as an example but many of the issues and characteristics could be applied to other occupational health risk control systems.

POLICY

Key Issue:

Is there an effective policy for the prevention of occupational ill health (and in particular for the prevention of occupational dermatitis) and is there an effective management system to ensure protection?

Key Characteristics:

• Senior management are committed to the prevention of occupational dermatitis and to compliance with COSHH (this includes a commitment to control the risk of dermatitis caused by substances not covered by COSHH).

• There is a clear policy on the use of an appropriate control hierarchy, e.g. substitution, containment, hygiene measures, personal protective equipment.

• Health surveillance is used appropriately.

• The prevention and control of occupational ill-health is adequately resourced, i.e, money and resources should be sufficient to develop and maintain the appropriate control measures.

ORGANISING - Control

Key Issue:

Is there an adequate management structure to effectively prevent occupational dermatitis?

Key Characteristics:

• There should be clear allocation of responsibilities for:

o developing and implementing the assessment programme;

o implementing and maintaining control measures;

o assessing the need for health surveillance/pre-employment screening;

o undertaking appropriate health surveillance and keeping health records;

o reviewing the adequacy of risk assessment and updating controls.

• Those with responsibilities for the control of dermatitis should be clear on what is expected of them.

• The responsibilities outlined to control dermatitis and the actions needed to control risks should be reflected in individual's personal objectives.

• Completion of personal objectives and the discharge of responsibilities relating to the prevention of dermatitis should be included in procedures for reviewing the performance of managers, supervisors and specialists.

ORGANISING - Co-operation

Key Issue:

Are there adequate and appropriate arrangements to secure the trust, participation and involvement of all employees in the prevention of occupational dermatitis?

Key Characteristics:

• Front line managers and supervisors should give the control of occupational dermatitis the appropriate degree of priority. Preventative measures should be followed at all times not just when it is expedient in terms of production priorities.

• Employees should be involved in the assessment process and in devising, implementing and reviewing control measures. There should also be employee involvement in the investigation of incidents and work practices which give rise to occupational dermatitis providing that this does not lead to disclosure of confidential medical information.

ORGANISING - Communication

Key Issue:

Are there adequate arrangements to secure information on the risks and control of dermatitis and to ensure that this information is given to employees?

Key Characteristics:

• Adequate and relevant information on the risks of dermatitis should be acquired by the organisation. This will cover gaining information from suppliers on the hazardous properties of their materials by data sheets and product labels. This information should be kept up to date and there should be controls over the acquisition of products and substances without the appropriate health data first being obtained and assessed.

• Arrangements should be in place for providing and updating of information to managers and employers who are involved in work processes where there is a risk of dermatitis. This information should be in a style and language appropriate to the users and should in sufficient detail be relevant to the risk and circumstances.

• Arrangements should be in place for communicating the findings of assessments and of the appropriate control measures to those at risk and those responsible for managing the risk.

• Systems should be in place to provide information on the risk of dermatitis from products manufactured and supplied by the organisation. This will include correct categorisation and labelling and data sheets produced under CHIP as well as the provision and maintenance of information to customers.

• Poster campaigns, tool box talks and safety tours should be used to inform employees of the risks of dermatitis in the workplace and to keep them up to date on any changes in standards or risks. Information on the incidence of dermatitis and the success or otherwise of the control strategies should be made available to employees and their representatives.

• Information on the risks of dermatitis and of the appropriate control measures should be made available to contractors and peripatetic workers e.g, cleaners.

• There should be appropriate systems in place to keep and update health records where appropriate and ensure security and confidentiality of this information.

• Arrangements should be in place to inform employees' GPs of symptoms exhibited by their patients and where relevant of treatment given in-house for dermatitis and of referrals to specialists and consultants directly by the company physician.

ORGANISING - Competence

Key Issue:

Are there systems and arrangements to secure the competence of those assessing the risks of dermatitis, those involved in devising, implementing and reviewing the adequacy of control measures, and of those working with harmful agents?

Key Characteristics:

• Managers and employees should recognise the potential for occupational dermatitis arising from the work activities of the business, i.e, they should know there is a risk of dermatitis from specific substances and work tasks.

• Those involved in undertaking COSHH and other assessments should be adequately trained and competent to perform these tasks. Competencies would include:

o ability to recognise substances and tasks which give rise to the potential to cause dermatitis or skin irritation or the manner in which the risk may occur;

o ability to review the workplace and activities and to identify the opportunities which give rise to exposure and to decide on the significance of such exposure;

o awareness of appropriate control measures and the ability to judge the suitability of alternative substances/work methods, engineering or hygiene controls and selection and use of PPE.

• There should be a suitable degree of competence by those involved in pre-employment screening and in undertaking health surveillance where appropriate. Occupational health specialists (physicians, nurses etc) should be familiar with the products in use in the workplace which give rise to a risk of dermatitis and with the work activities and processes which may lead to exposure.

• Those involved in work involving a risk of dermatitis should be aware of the risks and of the symptoms. They should be trained in the appropriate control measures and the action to take if they suffer from dermatitis. Instruction and training should be provided on induction, job change, change in responsibility and refresher training.

• There should be adequate specialist advice available on occupational health and occupational hygiene issues.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Are there adequate processes to generate plans and performance standards to prevent dermatitis?

Key Characteristics:

• There should be performance standards covering COSHH and other assessments, workplace control measures, acquisition and updating information, pre-employment screening and health surveillance, maintaining compliance with controls and review of performance.

• Performance standards should specify who does, what, when and with what result.

• There should be performance standards detailing procedures for:

o identification of product hazards, particularly those with the potential to cause dermatitis or irritation and for keeping up to date on new information on products, safer alternatives, changes in guidance and legal standards, e.g. EH 40 revisions;

o task analysis aimed at identifying jobs/tasks which may lead to exposure to hazardous substances or give rise to risk of dermatitis;

o risk evaluation including making decisions on acceptability of risk;

o devising control measures detailing substitution, engineering controls, systems of work and hygiene measures, and selection and maintenance of PPE etc.

• Assessments should be prioritised according to the tasks or substances which present the greatest danger in terms of the potency of the hazard and the frequency of exposure.

• Remedies for weaknesses in control measures identified in assessments should be developed and formulated into plans. Areas for improvements should be prioritised and where protective equipment or hygiene measures are used as an interim measure instead of engineering controls, containment or substitution then improvements in the hierarchy of control should be included in medium and long-term improvement plans.

• Work involving a risk of dermatitis should be undertaken in accordance with the designed performance standards. This includes the use of the correct protective equipment.

MEASURING PERFORMANCE - Active Monitoring

Key Issue:

Are there adequate and sufficient checks on the operation and effectiveness of the measures taken to protect against occupational dermatitis before the occurrence of any cases?

Key Characteristics:

• Monitoring regarded as a line management function.

• Progress in completing the assessment programme should be regularly monitored including revisions following changes in substances or work practices.

• Routine checks made on compliance with workplace precautions, systems of work, correct selection and use of PPE etc.

• Regular checks on the operation of any health surveillance programme and completion of health records.

• Regular checks on workplace monitoring (where appropriate).

• Investigation of sub-standard performance particularly where the incident may reveal weaknesses in management.

• Remedial measures prioritised and common trends analysed and investigated.

MEASURING PERFORMANCE - Reactive Monitoring

Key Issue:

Is there effective investigation of cases of dermatitis or incidents which give rise to risk of dermatitis?

Key Characteristics:

• Reactive system owned and operated by line management.

• Adequate reporting of cases of dermatitis and of incidents and hazards with the potential to give rise to dermatitis.

• An effective investigation system to examine immediate and underlying causes of incidents and propose remedial action. Investigation selective based upon incidents with serious potential as well as serious consequences.

• Adequate occupational health treatment or referral for medical advice for cases of dermatitis. Suitable transfer or placement in cases of sensitisation.

• Analysis of data on cases/incidents to identify common failures, features or trends.

AUDITING

Key Issue:

Is the management of occupational dermatitis independently reviewed either separately or as part of audits of the whole health and safety management system?

Key Characteristics:

• Control of dermatitis reviewed alongside reviews of occupational health management as other management systems.

• Adequate procedures in place to review and implement audit findings.

REVIEWING PERFORMANCE

Key Issue:

Is there adequate and sufficient review of the success and failures of the measures in place to prevent occupational dermatitis?

Key Characteristics:

• Appropriate prioritised actions taken to remedy defects and weaknesses in workplace precautions, risk assessments, monitoring and surveillance.

• Effective follow-up systems to ensure remedial actions are carried out and remedial actions not allowed to backlog.

• Review of performance on control of dermatitis fed up to senior management.

• Performance indicators used to assess performance.

RCS 7 - SELECTION AND MANAGEMENT OF CONTRACTORS

• Introduction • Planning and Implementing • Policy • Measuring Performance • Organising - Control • Auditing • Organising - Co-operation • Reviewing Performance • Organising - Communication • Appendix - Review of Client's HSM Documentation • Organising - Competence

INTRODUCTION

Because this agenda has to cover sometimes complicated relationships with second parties, it is structured differently to other systems.

• Apart from POLICY each element is considered under the subheadings of within client and client/contractor interface.

• Within client means arrangements within the client company to ensure high H&S standards.

• Client/contractor interface means arrangements at the interface between the client and contractor to ensure high H&S standards.

• This agenda covers the two main areas of selection and management on site.

• Selection is the management process by which the client uses relevant findings from enquiries and any previous reviews to decide which contractors should be invited to tender. It also involves assessing their:

o technical competence;

o health and safety management system (HSMS) - including knowledge of hazards and their safe systems of work;

o previous experience of similar work.

• Management on site is the activity required to ensure that the way that the contractors work and the technical adequacy of the completed job meet the performance standards agreed during selection.

• The appendix lists the type of documents which should provide supporting evidence.

POLICY

Key Issue:

Is there an effective H&S policy for the selection and management on site of contractors together with the necessary provision of resources to make it work?

Key Characteristics:

• Successful policies are clear in their objective i.e., the need to select and manage contractors and to comply at least with minimum legal requirements.

• The different needs of client/contractor employees and the public are covered.

Facet to explore ­

• The business policy on the balance of core/non-core activities and any H&S implications of this e.g. is there a business policy on out-sourcing? (NB - HSE should take a neutral stance).

• Whether the client's H&S policy covers the H&S at work of contractors' employees (whether on their sites or not) and adequately identifies and addresses the risks created by the contractors' work activities.

• Whether the lowest tender is accepted regardless of H&S standards (can be legal problem for LAs and other public bodies).

• Interactions between multiple contractors and sub-contractors on site.

ORGANISING - Control

Key Issue:

Is there an adequate management structure to implement the policy on contractors?

Key Characteristics (within client):

• Successful systems typically incorporate:

o Clear allocation of H&S responsibilities for selection and management of contractors on site to individuals and teams and their acceptance;

o A contract which is comprehensive and unambiguous;

o A structured and comprehensive approach to using contractors covering planning, operation, monitoring and review;

o Sub-contractors covered within the same system.

Key Characteristics (client/contractor interface):

• The contractor's arrangements align with to those of the client e.g. agreement over the degree of segregation of work areas.

ORGANISING - Co-operation

Key Issue:

Are there arrangements to secure effective working together of client and contractors?

Key Characteristics (within client):

• Successful systems typically incorporate:

o Co-operation between different parts of the client organisation (selectors- users-monitors) to ensure consistent standards for contractor working, e.g. regular inter-departmental meetings to include employee representatives where necessary.

Key Characteristics (client/contractor interface):

• Effective co-ordination between the client, their contractors and sub- contractors in terms of who has the knowledge, who does what, when and how, i.e., the contractor may take the lead in certain operations where they have the expertise but rely on the client's expertise in other areas:

o e.g. specialist analysis offshore where the contractor has the expertise on the activity but relies on the client's expertise for safety while on the installation;

o e.g. trackside safety on railways;

o roofing work on a nuclear power station;

o e.g. movements on a stretch of road or rail may be restricted to allow maintenance activities;

o e.g. a nuclear plant may be shut down for overhaul.

• Direct involvement of the contractor's management/supervision in the client's management H&S meetings, H&S workplace tours/inspections and investigations where appropriate (nature and scale of activity very relevant).

• Involvement of contractor's workforce in site H&S meetings, H&S campaigns etc. (This may not be appropriate for one-off short term contracts).

ORGANISING - Communication

Key Issue:

Are there arrangements to ensure that sufficient information flows within the client, within the contractor and between client and contractor?

Key Characteristics (within client):

• Successful systems typically incorporate:

o Information on contractor selection and control passing within and between departments of the client including feedback on any interventions;

o Information as above to and from senior managers at all levels.

Key Characteristics (client/contractor interface):

• Information (both positive and negative) passing from client to contractor (and vice versa) and between both of these parties and the sub-contractors including regular meetings and opportunities for dialogue at all levels between all parties e.g. progress briefings, snagging meetings, tool box talks.

Facets to explore ­

• Communication is important at all key stages i.e. pre-tender, tender, start-up, during the work and after as part of particular review of that job or general regular review of ongoing performance.

• Are there means of informing other parties that contractors are on site and what they are doing together with the likely effects?

• Is there a 'no blame' culture which encourages reporting and discussion of incidents and other problems arising?

ORGANISING - Competence

Key Issue:

Are there systems and arrangements to ensure that all people working on site (client, employees, contractors, sub­contractors) are competent?

Key Characteristics (within client):

• Successful systems typically incorporate:

o Clearly stated necessary skills, knowledge and experience (including the identification and fulfilment of training needs) for client employees involved in selection, control, monitoring and review of contractors and sub-contractors;

o A mechanism for ensuring that client employees actually possess them.

Key Characteristics (client/contractor interface):

• The client having a system to ensure that the contractor employs competent people.

• The same for sub-contractors.

• A preferred list of contractors and sub-contractors (if used) derived systematically against set H&S standards.

• A successful selection system typically takes account of:

o history, particularly experience of similar work in the same industry;

o H&S documentation (policy, plans, method statements, risk assessments);

o accident/enforcement history (to be used with care);

o training records;

o supervision arrangements;

o references.

• There is an effective review of all the above facets with appropriate weight given to H&S performance compared with other selection criteria e.g. financial considerations.

• Client and contractor HSMS should be compatible and complementary.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Are there adequate processes to generate plans and performance standards to implement the policy on contractors?

Key Characteristics (within client):

• Successful systems typically incorporate:

o Performance standards for hardware, people and systems;

o An assessment of any hazards introduced onto the site by contractors which may affect the client's employees and others;

o The client carrying out adequate risk assessments to both inform the selection process and provide the outline for the contractor's H&S plan, taking account of multiple working e.g. at major shutdowns;

o Risk based prioritisation of management resource between concurrent projects;

o Risk assessments and method statements produced by the client for his own employees affected by contractor working.

Key Characteristics (client/contractor interface):

• Risk assessments carried out by the client to cover hazards which contractors will be exposed to on-site - this being done prior to work commencing.

• A H&S plan produced by the contractor and based on adequate risk assessments which has been checked by the client.

• Adequate risk assessments and method statements produced by contractors and sub-contractors for their own and other employees/visitors/members of the public which have been checked by the client.

• Adequate performance standards set by the client.

• Site induction carried out by client and contractor as appropriate covering the setting and explanation of site rules, the highlighting of hazards and emergency arrangements.

• Adequate arrangements for controlling access to the site by contractors' personnel.

• Adequate arrangements for controlling contractors' plant and equipment brought on site.

• An appropriate level of segregation between client and contractor based on risk assessment.

MEASURING PERFORMANCE

Key Issue 1:

Is there adequate and sufficient measurement of performance before incidents happen?

Key Characteristics (within client):

• Successful systems typically incorporate:

o an effective measuring system which enables the client to assess its own compliance with performance standards - i.e. is its selection and management of contractors adequate?

Key Characteristics (client/contractor interface):

• The client measures contractor performance in doing the job in terms of milestones, H&S plans, quantity and quality of risk assessments, method statements and working practices and implementation of these.

• The client has a clearly defined procedure for taking action if the contractor's performance falls below the set minimum standard.

• Adequate safety of the completed job e.g. clearance certificates following asbestos stripping, quality checks on structural integrity.

• An effective measure by the client of the contractor's own measuring systems e.g. shadow tours/audits to ensure key risks covered and prioritised.

Key Issue 2:

Is there adequate and sufficient measurement of performance following incidents?

Key Characteristics (within client):

• Successful systems typically incorporate:

o an effective measuring system enabling the client to record and measure accidents, incidents and near misses resulting from contractor activity.

Key Characteristics (client/contractor interface):

• The client either investigates contractor incidents itself or requires the contractor to do so, and is actively involved in this process (particularly the results).

• The client monitors contractor reporting and investigation procedures with particular emphasis on establishing root causes, with a view to the contractor improving where necessary.

• The client compiles contractor incident statistics and monitors trends.

AUDITING

Key Issue:

Is there adequate auditing of this system as part of the overall HSMS?

Key Characteristics (within client):

• Successful systems typically incorporate:

• auditing targeted at specific risks.

Key Characteristics (client/contractor interface):

• Any audits carried out of the contractors (by themselves or the client) are made available to the client and findings integrated into this system.

REVIEWING PERFORMANCE

Key Issue:

Is there adequate and sufficient review of performance to ensure that lessons learnt are effectively put into practice and disseminated throughout the organisation?

Key Characteristics (within client):

• Successful systems typically incorporate:

• the review process (using information from 'measuring' and 'audit') being used to improve the operation of the contractor selection and management system and driven by senior management;

• the review process ensures that the system delivers the stated policy on contractors.

Key Characteristics (client/contractor interface):

• Client review of contractor and sub-contractor H&S performance which is fed back up to the 'level 1' elements of its HSMS.

• Adequate feedback to the contractor selection process to ensure that poor performers are not re-selected (at least without effective intervention).

• Feedback to the contractor to effect improvements.

APPENDIX - Review of Client's HSM Documentation

Documentary evidence which may be reviewed includes:

• H&S Policy - parts covering selection and control of contractors;

• Any other policy documents referring to this;

• Relevant sections of any statutory safety case;

• Company organisation charts for those involved with contractors;

• Contractor selection procedure;

• List of preferred contractors;

• Contractor control procedure;

• Pre-tender documentation;

• Tender documentation from a contractor;

• Contractor selection checklist;

• Copies of any appraisals/audits of contractors carried out by client at this stage;

• Evidence of references having been checked;

• The contract (excluding irrelevant financial information);

• Minutes of liaison meetings where H&S areas discussed;

• Risk assessments - prepared by client and contractors;

• Method statements - prepared by client and contractors;

• Criteria to which these are compared (performance standards);

• Signing in/out log books;

• Completed checklists used to monitor contractors;

• Evidence of other active and reactive measuring processes (client and contractor) with examples;

• Accident/incident reports involving contractors;

• Accident/incident investigations involving contractors;

• Evidence of contractors having been removed from a preferred list;

• Audit reports by client or contractor.

RCS 8 - GUIDANCE: ON-SITE EMERGENCY RESPONSE INSPECTION

• Introduction • Organising - Co-operation • Policy / Objectives • Planning & Implementing • Organisation - Control • Measuring Performance • Organising - Competence • Audit & Review • Organising - Communication

Introduction

This guidance has been prepared to help inspectors assess & audit on-site emergency response arrangements. It is aimed primarily at top tier COMAH establishments but the principles can be applied to other establishments.

This guidance is not intended to address off-site emergency plans (although many of the issues are similar) and it will allow inspectors to explore the key interfaces between on- and off-site plans.

On-site emergency response arrangements form part of an establishment's health and safety management system (HSMS) for preventing and limiting the consequences of major accidents. They are, in effect, an establishment's system for managing emergencies and should not be treated as a 'bolt on' and something different from other company systems and arrangements. Therefore, this guidance is structured in line with HSE's guidance on "Successful safety management systems" described in HS/G 65 and looks at emergency management in line with the POPMAR model (Policy, Organisation, Planning, Measuring, Auditing and Review) for HSMSs.

Many of the questions will be answered by reviewing the operator's written plan and this is the best starting point. The guidance could also be used selectively to assess written on-site emergency plans independently from site inspection. If significant shortcomings are identified then it may be worthwhile ensuring these have been resolved before proceeding further.

The on-site emergency plan is the framework for an establishment's emergency response. It should cover the objectives and information required by COMAH Schedule 5 Parts 1 & 2 respectively. If inspectors intend to assess on-site emergency plans, then the objectives and minimum information should be addressed and this guidance indicates points to be considered on these matters as well as other features to be included in an on-site plan.

Whilst COMAH creates specific requirements dealing with defined industrial major accidents involving dangerous substances there is also a wider emergency-planning field. The responsibility for this area of activity rests with the Cabinet Office Civil Contingencies Secretariat, which has published draft guidance on emergency planning and response in connection with the Civil Contingencies Act 2004. This guidance ("Preparing for Emergencies" and "Responding to Emergencies") and related material can be found at http://www.ukresilience.info/ccact/index.htm. That guidance adopts a different structure from the guidance presented in this document and focuses more on emergency preparedness by the "external" (off-site) emergency services, however it contains much useful information. It recognises 6 key stages:

• Anticipation • Assessment • Prevention • Preparedness • Response • Recovery

The first four stages are covered in "Preparing for Emergencies" and the final two in "Responding to Emergencies". Another way of looking at the key issues involved in a good emergency response could be to check that the following features exist:

• Clear aims and objectives • Clear and well rehearsed procedures • An effective organisational structure • Efficient means of information handling • Required technical knowledge • Necessary resources, based on testing and experience • Planned and rehearsed interfaces between the various responders.

Policy / Objectives Key Issues

The overall aim of the emergency response is to ensure that appropriate response measures will be implemented when and where needed to protect/minimise the harmful effects on people and the environment from major accidents.

Inspectors should be satisfied that

• The plan has clear aims, objectives and information meeting the requirements for on-site emergency plans detailed in COMAH Schedule 5 and

• There is evidence that it is systematic in its approach and in how it has been devised.

In achieving this, there should have been appropriate consultation with those who have a part to play in the plan and account taken of review and testing.

1. Does an "on-site emergency" plan exist? 2. Are the purpose and objectives of the plan clear? In particular with respect to:

• Containing and controlling incidents so as to minimise the effects, and to limit damage to people, the environment and property.

• Implementing the response measures (procedures, roles and resources) necessary to protect people and the environment.

• Communicating the necessary information to the public, emergency services and authorities concerned in the area.

• Providing for the restoration and clean up of the environment following a major accident. For some foreseeable scenarios, e.g. oil spills, it may be relatively simple to include quite detailed clean up arrangements. But in other cases the information may relate to indicative arrangements only, e.g. with information about expertise to call upon and where resources could be found to assess and implement appropriate measures under the actual circumstances.

Question 2 covers the high level objectives set out in COMAH Schedule 5 Part 1 and required by Regulation 9(1). These are top-level questions and the final answer may only be apparent once the emergency plan and response arrangements have been considered as a whole. The questions outlined in the remainder of this guidance will help to answer whether these objectives have been met.

The objectives of the emergency response should be stated as clearly as possible (and appropriate training should reinforce this). For example it should be clearly stated that the primary purpose is to protect people, followed by protecting the environment, protecting property, preserving the company's reputation etc. This might be achieved primarily by training, but the written plan should include important strategic considerations. Examples might include whether, in the event of a fire, incoming and outgoing pipelines should be isolated, whether certain vessels take priority re protection by water curtains or cooling, in the event of a release of a toxic gas cloud explaining that the approach is to get people to safe muster point upwind or to reach havens for awaiting further instructions.

3. Do the arrangements in place reflect a systematic approach to planning for emergencies based on the major accident hazard scenarios?

The on-site plan should deal with the full range of events identified in the establishment's COMAH safety report. The level of planning can be proportionate to the probability of the accident occur although consideration should also be give focusing on those events most likely to occur. It is important for the inspector to be familiar with the representative set of major accident scenarios for that establishment.

4. Is there evidence that the statutory consultees, both internally and externally, are involved in devising the plan?

It should be clear, e.g. from the safety report, what consultation has taken place. COMAH Reg. 9(3) requires consultation for the on-site plan to include employees; EA/SEPA; emergency services; health authority and local authority[1]

5. Is a formal review process in place that evaluates the effectiveness of the approach taken to emergency planning and to the suitability and effectiveness of the arrangements?

Setting response objectives in relation to the identified major accident scenarios (e.g. Time to shut down & evacuate affected plant; onsite fire team and fire brigade response times) will help both in the preparation and any subsequent review of emergency response.

Organisation - Control Key Issues

Maintaining control in emergency situations is very complex and the allocation of responsibilities to key people with appropriate accountability and job descriptions is important.

Inspectors should be satisfied:

• that there is an effective organisational structure with suitable deputising and back up when required and

• that the roles and responsibilities are clear for those who play a part in the plan.

A plan will normally identify a Site Main Controller and Incident Controller.

Command & control structure

6. Does the plan clearly identify who should assume responsibility in an emergency? 7. Is the command and control structure clearly defined and does it identify who responds to whom in the event of

an emergency? 8. Are the levels of authority assigned within the command structure such that they allow decisions to be taken at

the lowest level commensurate with the urgency of the situation?

An important example of this is whether people have authority to shut down processes or await authorisation e.g. outside working hours.

It should be clear at what point or degree of loss of control the arrangements should come into effect.

9. Is there a logical sequence of actions for key personnel that are identified and given a role in the emergency plan?

10. Are overview charts showing the emergency command and control structure available?

Such charts provide a useful summary for staff and external bodies.

A relatively flat emergency management structure helps to allow rapid flow of essential information.

11. Does the emergency plan show how on-site command and control arrangements interface with external bodies? 12. How will emergency responders be readily identifiable; where will they rendezvous and how will they

communicate?

Much time can be wasted if external services cannot find the right person at the scene. Distinctive tabards, flashing lights on vehicle and coloured helmet are commonly used. Tabards are probably the most explicit but often not effective in the dark.

Roles and Responsibilities

13. Are the roles and responsibilities clear, concise and unambiguous, with the decision-making boundaries clearly defined?

This question can be best answered after considering the more detailed questions below.

14. Does the emergency response plan identify key emergency responders (including those who will initiate/activate the on-site emergency response, take control and alert the external emergency services) and contain a statement of authority (mandates and roles of all concerned)?

15. Is there a designated person (usually called the Site Main Controller) who has overall responsibility during an emergency?

N.B. Except at the incident scene where the Incident Controller has responsibilities when called, the Fire Brigade senior officer will assume control at the incident scene and this is confirmed by statute when fighting fires. However the police will still retain responsibility for co-ordinating the off-site response and operators will retain responsibility for their employees including HSWA duties.

16. Has the Site Main Controller got a deputy?

The position of site main controller is much strengthened by the addition of a deputy). The inclusion of a deputy role recognises the need to distance the Site Main Controller from the detail (e.g. Routine communications and detailed work).

17. Are appropriate measures in place to ensure 24-hour cover, 7 days a week (including sickness and holiday cover)?

18. Are the duties of the Site Main Controller specified?

The duties should include:

• Being on site at the time of the incident or to be quickly available. • Going to and remaining at the designated control centre for the duration of the incident -

unless the location becomes untenable. • Taking an overview of the incident and making sure certain resources are provided and

steps taken to ensure the safety of others who may be affected. • Directing any operation from the control centre and ensuring liaison with public

emergency services regarding developments and possible off-site effects. • Arranging for an incident log to be maintained. • Having the authority to make decisions on behalf of the site and to ensure correct liaison

with media. • Arranging where necessary for off-site and environmental monitoring.

19. Are the duties of the Incident Controller specified?

The duties should include the following:

• Being on site at the time of the incident.

[Inspectors should give particular attention to unmanned sites and how the plan deals with situations where the emergency services arrive first].

• Being generally aware of the overall site situation and having detailed knowledge of the incident area.

• Staying at or near the incident and directing the efforts of the site emergency team to control the situation at the scene of the incident - distinctive clothing recognisable by all concerned is recommended.

• Overseeing all responsibilities pending arrival of the Site Main Controller. • Ensuring Liaison with public emergency services at the scene. • Communicating progress of the incident to the control centre. • Accounting for personnel located near the incident scene. • Initiating search and rescue, where necessary, usually jointly with the fire brigade. • Initiating arrangements for casualty treatment.

20. Is there adequate technical expertise available to support the Site Main Controller and the Site Incident Controller?

Generally the Site Incident Controller should be separate from the Site Main Controller.

21. Has more than one senior management team been trained to deal with emergency situations? 22. Are the duties of the emergency response teams clear, concise and unambiguous?

These should include those of the response team, fire, security and medical services.

23. Are the team skills and experience appropriate for the identified major accident scenarios identified? 24. Are team roles clearly defined?

However, there still needs to be sufficient flexibility to adapt to specific emergencies.

25. Is there evidence of a broad understanding of peer roles?

This is important that individuals understand how their role integrates with that of others.

26. Can an appropriate distribution of workload across the team be shown?

This may be difficult to demonstrate other than by verifying through practical drills and exercises.

27. What consultation has there been with employees during the preparation of the plan?

Consultation with those that have a role in the plan is clearly important, however it is important that all employees have an opportunity to give an input, e.g. via the safety representative or TU representative.

Organising - Competence Key Issues

Thorough pre-planning is vital for competence. Competence in the area of emergency response can generally only be achieved via testing, training and learning from the lessons and experience of others. These considerations define the nature of the training needed. Elements of required training for inspectors to check knowledge is given.

Inspectors should be satisfied that:

• There are arrangements in place to ensure all involved have the necessary skills and knowledge required and that

• Those involved in the plan have the required technical knowledge relating to the foreseeable major accident scenarios.

28. Are the required competence criteria (i.e. Knowledge & skills) defined for all personnel on site?

This should include staff, contractors, visitors, etc and is concerned with staff with emergency duties.

29. Is the defined essential knowledge based on risk?

This might include; site geography; knowledge of plant operation; familiarity with key information; physical properties & access to detailed information; fire-fighting strategy for different chemical hazards; emergency procedures; etc

30. Is there a training programme established for on-site personnel?

This should include contractors. Key external responders will also need familiarisation with relevant aspects of on-site circumstances and procedures - see 33 below.

Any assessment of competencies should not be based on a 'snap-shot' 'one-off' performance.

31. Are training programmes and exercises aimed at meeting the defined competency levels?

Minor exercises should be conducted to hone certain skills/competencies.

32. Are arrangements in place for visitors?

Both staff and visitors should be aware of these arrangements.

33. Is there evidence that training covers co-ordination with outside bodies, for example, the emergency services?

Knowledge of Key Scenarios

34. Can the emergency response team demonstrate a detailed knowledge of significant hazards & potential incidents?

Team members should be able to show they know what foreseeable scenarios they are likely to encounter and what actions are required to bring the incident under control.

35. Is the Site Main Controller able to proactively manage the incident and take a strategic view of events?

This question will involve subjective judgement. For example, the SMC should not need to refer any issues elsewhere before coming to a decision. However it should be clear whether there are any issues that the SMC feels the need to refer elsewhere for a decision e.g. closing down plant, pipeline feeds etc. The SMC should also be able to think 'outside the box'. In doing this SMCs will need to understand what the key objectives of the emergency plan are (see earlier). They should be clear about the bases for making decisions such as:

• Understanding priorities e.g. protection of people, environment, property, good name of company

• Strategy for handling foreseeable scenarios

• Importance of protecting the majority when considering the safety of individuals.

36. Are members of the emergency team sufficiently well trained and briefed to be able to respond appropriately without having to constantly refer back to the incident controller regarding predictable developments?

The 'emergency team' includes all those who have roles and responsibilities during an emergency response. For example it will include the incident team and senior management. Elements of training that are relevant include:

• Relevant legal requirements • Emergency planning principles • Knowledge of the companies emergency plan procedures, including how to recognise

and respond to a major emergency on site • Appreciation of different types of major accidents • The nature of the hazards and how to prevent harm being realised e.g. fire prevention. • Technical capability. This should include the different ways (organisational & physical) of

mitigating the effects of major accidents. The following categories of incident, and the associated relevant action, should be identified:

o Gas clouds - flammable / explosive / toxic o Fire / explosion o Spillage of toxic liquids and solids o Spillage of flammable liquids and solids o Domino effects - how an incident on-site impacts on other sites and the

consequent impact for the site of such domino effects o Natural incident e.g. floods if site is close to a river etc.

• Appreciation of the roles and limitation of the various emergency response organisations • Having been involved in exercises to develop both skills and knowledge • Required casualty care and appreciation of the concerns of the public • Knowledge of ranks of emergency services

The level of detail will vary for different groups of staff. Specialist staff will require additional training egg:

• Command and control (site main & incident controllers & deputies) • Fire fighting • First aid • Handling the media

And training for use of specialist equipment egg:

• BA • Hoses • PPE • Fire extinguishers

37. Are the emergency team members familiar with the plan and do they have detailed knowledge of those aspects relating to their involvement?

Organising - Communication Key Issues

Communication during an emergency is vital and "lessons learned" studies have shown that communication between the operator and the emergency services is the most critical factor in determining the success or not of an emergency response. Speed of communication is a key factor here, as every incident will develop rapidly in the early stages. The effects of poor decisions made in these early stages will be compounded as the incident develops. Inter­organisational communication "networks" need to be established and are very complex. In addition, emergency services will each establish their own complex communication networks.

Inspectors should be satisfied that:

• There are planned interfaces between the operators and emergency responders (including alert/call-out and liaison during a response) and

• There are efficient means of information handling between all parties.

These are essential elements for ensuring the necessary interface between on- and off-site emergency plans. Focusing on arrangements during the early stages of an incident is key.

Inspectors should also be satisfied that the plan and associated documentation contain the required information and are appropriate for their purpose.

38. Have information requirements been identified as far as possible prior to an incident?

These relate to the type and nature of information, which is likely to be required during an emergency either by staff or by external organisations.

38. Have communication flows been defined for staff that are involved in undertaking emergency duties?

For each staff role this is likely to involve identifying the following:

• What information persons require to perform their tasks • What information they need to supply to others • What communication media are necessary to supply this information • When and how the communications will take place.

40. Is there a strategy in place to promote a shared team understanding during incident?

Although the skills of the team leader are important here, there are approaches that will help shared understanding. For example:

• Logging of information by the emergency response team as it is received is essential. The log should be regularly reviewed as the incident progresses and actions followed through

• The emergency response team (considering tactical issues) might call 'Time Outs' to enable members of the team to say what they understand is happening and for all to get an overall view of the incident. 'Time Outs' will include taking phones off the hook for a short period; however phone contact should be retained with the incident control team at least.

Liaison with Offsite Bodies

41. Has the company consulted with and provided information to relevant statutory consultees?

Under COMAH, relevant statutory consultees are local authorities, the Agencies, emergency services (police, fire & ambulance plus HM Coastguard where appropriate) and the local health authority? Consultation is required to enable development of the interfaces between the off-site and on-site plans.

Information needs for the emergency services are outlined in Appendix 2 of HS/G 191 'Emergency planning for major accidents'.

42. Does the emergency plan identify what information needs to be given to emergency services during an incident?

There should, as far as possible, be a clear interface between the on- and off-site emergency plans. The provision of information is key to this.

For example, establishments should ensure that they are able to supply the emergency services with information on the location of people across site and the details of any missing personnel.

All those involved in providing assistance in the event of an emergency should have identified the information they need to assist their response and the plan should be clear how to access the information quickly during the actual incident. This should also cover organisations other than statutory consultees who may require further information.

43. Are there arrangements in place for the company to provide information on hazardous chemicals to the emergency services (before an incident to facilitate preparation of external ("off-site") emergency plans and during/after an incident, to inform the external response and subsequent clean up)?

This should be planned for and provided in advance of an incident. However operators may need to be adaptable. An operator does not need to give details of every possible chemical and its products of combustion but does need to give an indication of the type of harm to health and the environment based on categories of chemicals liable to be on site to enable a planned response. Products of combustion for example should at least be treated as toxic and steps taken accordingly. Certain products or mixtures of chemicals may give off particularly noxious fumes in the event of a fire and may require additional personal protective measures and specific treatment if people are exposed. These should be identified in advance and emergency services and hospitals advised.

44. Are arrangements in place to ensure that the Site Main and Incident Controllers and team share a common picture of the emergency in terms of what has happened, what is the current situation and a forward plan of what needs to be done?

The use of aids such as white boards should be considered as a means to promote this shared understanding.

45. Are arrangements in place for giving advice and necessary information to relevant bodies and the public? 46. Does the statutory off-site emergency plans state clearly:

• what immediate actions are needed to prevent and mitigate environmental contamination during or after a major accident?

• Who has responsibility for undertaking them?

47. Has the company provided up to date information to the public?

Information should be provided in accordance with Regulation 14(1) of COMAH. The company and local authority should also consider what information is required to people beyond the area that is designated under COMAH (i.e. the PIZ) before and during the incident. This will help allay the anxieties and concerns of those who are not at risk but may hear the alarm siren.

Documentation presentation & layout of emergency procedures

48. Is the content of the emergency response procedures adequate?

This should include location of individuals; means of identification; main duties, equipment and information provided / needed; aide memoir of key prompts.

The emergency plan documentation should cover:

• Introduction • Installation details

• Hazard data (including chemical properties). Only the relevant properties should be given e.g. boiling point, storage temperature and pressure, reaction with air/moisture, behavior of gas cloud or evaporating liquid in various air conditions.

• Chemical effects on people; needs to be specific regarding effects of increasing concentration; length of exposure; effects on vulnerable people; food safety implications.

Potential major accidents

• Emergency plan activation arrangements • Organisation • Control centres & communication arrangements (both physical (egg telephones) & lines

of communications) • Support services • Medical response • Public protection • Information management / press / media / arrangements • Domino effects

49. Does the plan show where communications may need to be established?

For example between:

• Emergency response team at the scene • Emergency response team in the dedicated control centre • All other parts of the site • Fire / police / ambulance / service from the emergency response teams • Media • Water companies • Local Authority • Competent Authority • DEFRA (& equivalents in Wales and Scotland) especially for off-site • Adjacent premises

See also Organisational - Control

50. Do team members consider the procedures usable?

The procedures should be succinct (no more than two pages per role) and to the point. As a rule the key elements of the procedures should be capable of assimilation in about 1 minute.

51. Are 'aide memoirs' such as charts, maps, and flow charts used where appropriate to remind staff of key information?

Possible examples include: a scheme for warning and communication, telephone calls, lists of personnel, services, authorities etc, organisation charts, chart for emergency assistance and command.

52. Is information well structured in order to enhance communication & training?

Information Provision for External Organisations

53. Has (where appropriate) advanced information (e.g. site plans, inventories, shelter points and muster points etc) been provided to external organisations?

54. Has chemical information been provided to the Ambulance service and hospitals e.g. MSDS sheets?

It is good practice for local hospitals to be briefed in advance about practical implications when dealing with affected casualties i.e. pre- and during-incident exchanges between site and hospital medics.

55. Can incident specific information be easily provided during the incident itself?

For example:

• Confined space information, or details of particular processes in the area of the incident • Details of fire fighting strategy for specific plant areas;

Which are tailored to local conditions

Organising - Co-operation Key Issues

Emergency response arrangements should encourage co-operation. A successful response will need full co-operation between all the parties involved; the site, the emergency services and so forth.

Inspectors should be able to determine this from feedback from earlier tests, which test the interface between on, and off-site emergency plans. Observation of such a test will provide a direct indication.

56. Do emergency response arrangements encourage co-operation between all parties?

The following are external agencies that may be involved:

• The police, fire and ambulance services • HM Coastguard • Local authorities • Adjacent LA and emergency services • Environment agency • Health and Safety Executive • Health Authority • Water Company and other Utilities • Media • Voluntary organisations • Adjacent major hazard sites (e.g. domino effect & sharing resources) • Contacts and arrangements for obtaining further advice and assistance e.g. technical

advice • Meteorological e.g. wind direction and strength and forecast changes.

Planning & Implementing Key Issues

Methods need to be in place for developing the emergency response arrangements and the procedures contained within or referred to within those arrangements. The operator should also be able to demonstrate that adequate resources are in place to implement the plan. Inspectors should be satisfied that there are:

• Clear site-specific procedures

Particular procedures include the setting up and use of the Emergency Control Centre (ECC), muster & evacuation, decontamination, fire fighting, shut down, PPE, gas monitoring, first aid & medical support

• Planned interfaces between emergency responders • Efficient means of information handling.

Tailored to Local Requirements

57. Is the plan tailored to reflect the site / location?

The plan should not simply be a generic company document.

58. Is information about the specific site adequate and readily available?

Information that should be included (where appropriate):

• The company products and personnel • The locality (egg residential population, industrial installations, prevailing winds, etc) • Site plans (including drains) and neighbourhood maps • Processes carried out • Hazardous materials used, stored and manufactured • Classification of hazardous areas • Equipment, buildings, storage • Transport (including vehicle access routes) • Special hazards • External risks (off-site) • Safety / emergency organisation • Fire-fighting materials, extinguishing equipment & water supplies

Information on the main buildings, plant/equipment and control rooms including (whereappropriate):

• Substances, properties, hazards • Hazardous areas classification • Equipment containing hazardous materials • Stores • Numbers of people • Local organisation

Alert and Communication Facilities

59. Are the criteria for calling the internal/external emergency services unambiguous?

There should not be any doubt about what these are. Discussions on previous incidents and what happened may help to clarify issues.

For some sites, an emergency will be declared in such a way that the emergency services do not await confirmation but respond with an appropriate predetermined response for a major accident.

60. Has a site-wide warning system been provided to enable everyone on site to be alerted to a major emergency? 61. Are site alarms clear and unambiguous?

Hazards requiring a specific, different response should be assigned a discrete alarm. N.B. The number of distinct alarms should be manageable preferably no more than three).

62. Are communications facilities and information management systems tested regularly and realistically?

More than one telephone technology is desirable along with a back-up system in case of power failure.

63. Can radio systems use alternative frequencies?

The communication system should not solely rely on radios as they have high failure rates and are not reliable in high noise areas.

64. Are the communication facilities adequate once people are mustered?

For example PA system with plant radios as backup.

65. Is a list of phone numbers of services, staff, external bodies, etc readily available? 66. Can it be demonstrated that the initial response team is able to cope for as long as it has to during out of hours

or at times when others have to be called in?

Demonstration will be required by showing the required training has been provided supported by testing. This should cover all shift teams for example and for each type of hazard that is relevant.

67. Are effective arrangements in place for contacting and calling in staff during low manning periods (e.g. night shifts, weekends, etc)?

These should be tested to ensure an appropriate speed and rate of response (for example testing how quickly staff respond to pagers during out of hours periods).

68. Are there clear arrangements for alerting the public?

At major hazard sites equipped with public warning sirens, agreement should be reached between the company and the external emergency services on the circumstances in which the alarm can be sounded and who can order its sounding. This procedure should also be written into the off-site emergency plan.

69. Can the company demonstrate that means of public warning (sirens etc) are effective and reliable?

Evidence is required of how this is tested and feedback recorded and acted on. Back-up power supplies should be provided where necessary.

Emergency Control Centre

70. Is there an Emergency Control Centre, with sufficient resources to manage the emergency?

This will normally be the location occupied by the site main controller and others e.g. senior officers of the external emergency services in attendance for tactical and operational command & control.

Guidance can be found re the resources required by the ECC in HS/G 191 at Para 87 onwards. 3 main categories are required (HS/G 191 para 90).

• Equipment for external off-site communications • Equipment for internal (on-site) communications • Site plans & maps to show clearly the current incident situation

71. Can non-permanent facilities be set up very quickly?

This will require clear instructions to be given, all equipment (telephones, fax machines, PCs, etc) to be stored in an orderly way and on-site people trained to deploy efficiently.

72. Does the emergency control centre have a means of collating a record of who is on site and their location?

This information will be required by the emergency services upon arrival on site.

73. Can an alternative emergency control centre with the required resources be made available if the main one is liable to be incapacitated during an emergency?

A means of moving from one to another needs to be established and practiced.

Muster and Evacuation

74. Can the company show that there is a sufficient number of muster points to allow those not involved in emergency duties to gather?

This should include provision for contractors and visitors as well as for all company staff.

75. Has the location of muster points been carefully assessed?

There should be sufficient muster points to ensure safety, depending on wind direction. Hazards such as blast (over pressure & flying debris) smoke, hazardous fumes etc should be considered as part of this assessment. Muster points will generally be at safe locations outside, but a number of companies identify havens located in buildings for people to resort to in the event of a toxic release.

Guidance on havens can be found in the CIA's Guidance 'Safety in the design and location of Occupied Buildings at hazardous installations'.

76. Are procedures in place to ensure that the number and identity of people at each muster point is noted, reported to the emergency control centre and acted upon?

There must be practical arrangements in place to account for personnel and to identify any that might be missing. Good practice is for central control to ring refuge rooms. Multiple telephones trying to contact one point such as central control are likely to block lines. There should be appropriate communication points at each muster point.

77. Does the muster point roll call include the assessment of potential casualties, and their location, as well the factual roll-call information?

Casualties should be identified as a priority. The casualty identification system should operate more quickly than the roll-call system, especially on larger sites.

78. Are appropriate arrangements in place to deal with emergencies of long duration?

This is a consideration for all major accident scenarios but is key for dealing with those people who have traveled to a 'haven'. It may be preferable to move people from muster points to alternative safe locations in such circumstances. There should be an appropriate contingency plan in place to evacuate people from havens, where necessary.

79. Does the site have several evacuation routes?

This will make it possible to evacuate upwind of an incident. Criteria for deciding when and how evacuation is appropriate should be established.

Decontamination procedures

80. Are decontamination facilities available and are staff trained in its use?

Chemical or radioactive contamination must be cleaned away before PPE is removed. Also casualties need to be decontaminated before loading into ambulances.

81. Can the decontamination facilities be put into effect without delay? 82. Is there a policy to cope with casualties who are too ill or injured to be fully decontaminated?

This relates to how such casualties are handled. Protective arrangements for first aid/medical staff, early warning to ambulance service/hospitals are issues to be covered.

On-site Fire Fighting

83. Is the overall fire fighting strategy clearly defined?

The fire-fighting strategies should address the range of on-site hazards, appropriate actions to take, and means of preventing escalation. This should include any 'let burn' decisions, which should be discussed with the fire service.

84. 84. Does the emergency plan include details of on-site fire-fighting expertise?

Site personnel should have expertise in chemical fire-fighting and gas-cloud handling. Managers should be properly trained if they are to direct fire teams because this requires a high level of fire-fighting competence.

85. Does the emergency plan include details of fire fighting facilities including materials, equipment and water supplies?

86. Does the range the capability of fire fighting equipment match the on-site demand or can it be supplied in a timely way by external fire service?

87. Is the location of fixed and mobile fire-extinguishing systems clearly indicated in procedures/maps/plans? 88. Is the location of fixed and mobile fire-extinguishing systems clearly marked?

These should be in line with the Safety Signs and Signals Regulations

89. Is a testing and maintenance regime in place for the materials and fire fighting equipment to ensure that it is fit for purpose?

Documentary evidence is required that the regime is in place and actions taken on findings. The frequency of equipment testing and maintenance should be regularly reviewed.

Safe Isolation & Shutdown

90. Is there a defined process in place for managing the isolation and shutdown of plant, processes and equipment during the emergency?

91. Are there arrangements to check and test the integrity of isolations?

This should include provision of sufficient staff to keep essential services such as water available during the emergency itself.

Personal Protective Equipment (PPE)

93. Is there sufficient PPE available to protect all personnel who may be at risk including staff, contractors and visitors?

It may be useful if on-site breathing apparatus is compatible with that used by the Fire Brigade. Often site personnel with local knowledge need to assist the Fire Brigade. Logistics are eased if similar systems of the same duration are used. For example it is good practice for operator's staff to work from the same BA control board as the Fire Brigade. This is a matter for discussion with the Fire Brigade at the planning stage and then supported by the required training.

94. Has the location of PPE storage points been carefully considered?

For example, does it take into account the location of site hazards, evacuation routes etc?

95. Are the PPE storage points clearly marked?

These should be in line with the Safety Signs and Signals Regulations

96. Is there a testing and maintenance regime in place to ensure that the PPE is fit for purpose?

Documentary evidence is required that the regime is in place and actions taken on findings. The frequency of equipment testing and maintenance should be regularly reviewed.

Gas monitoring

97. Are gas monitoring facilities and procedures in place?

There is usually a need to determine gas concentrations at key positions such as the site boundary. Adequate resources and reliable equipment must be available to do this, but off-site monitoring may not be reasonably practicable. Mobile monitoring may be used where this is not likely to put people at risk in setting it up.

Medical

This should cover medical treatment, triage and casualty handling procedure - linking with the ambulance service for casualty labeling and tracking.

99. Are first aid/medical facilities provided suitable (in so far as is reasonably practicable) to deal with immediate effects of the emergency e.g. gas inhalation; burns?

100. Are personal records (e.g. next of kin, relatives, etc) readily available? 101. Is there a planned approach for accounting for casualties and evacuating them?

Resourcing

102. Can the operator demonstrate that it has provided sufficient resources to enable appropriate development and testing of the emergency plan relative to the foreseeable major accident scenarios identified in the COMAH Safety Report?

103. Can the operator demonstrate that it has provided sufficient resources, so far as is reasonably practicable, to contain the major accidents identified in the safety report until the emergency services arrive? [See also COMAH Safety Report].

'Resources' refer to both manning levels and equipment.

Inspectors should have considered this demonstration as part of the COMAH safety report assessment. The operator should be able to support the demonstration by giving information about the results of testing the emergency plan.

The adequacy of manning levels should be assessed by considering:

• The worst foreseeable major accident scenario, identified as foreseeable in the COMAH safety report;

• Including periods where the manning levels are lowest such as 'out-of-hours' or 'call-in' situations.

When deciding on the manning levels required to deal with emergencies, it is preferable to initially 'man-up' beyond perceived requirement, and then 'man-down' later.

104. Are arrangements in place for individuals to take responsibility on behalf of others in order to cope with the full range of possible circumstances?

This includes coping out-of-hours and with the absence of personnel.

105. What resources are available on site and what additional resources could be quickly obtained?

The following are examples that would normally be expected to be available where relevant for the identified major accident scenarios:

• Fire and toxic gas alarms • Fire-fighting equipment, e.g. assured water supply, hose reels, etc • First aid facilities • Sandbags or other absorbent materials • Windsock or flag (illuminated at night) • Radiophone or telephone backup

The following additional resources may be on-site or there should be arrangements to make them available, where necessary. Details of where the resources are to be obtained from should be readily available during an emergency. Performance measures for obtaining these should also be available i.e. clear timescales. These should be consistent with the major accident scenarios and the risk assessments argued in the COMAH safety report.

• Heavy lifting gear • Bulldozers and other transport facilities for movement of equipment • Specialised fire-fighting equipment • Extra communications equipment e.g. loudhailers, two-way radio • Water spray or curtains • Standby water supplies e.g. pump out of Local River • Specialised protective clothing • Atmospheric monitoring equipment • Gas dispersion expertise • Emergency engineering work, egg provision of emergency lighting, temporary

modifications, oxy-acetylene cutting equipment, ladders or scaffold etc• Medical facilities, including specific antidotes where necessary • Extra breathing apparatus • Specific neutralising agents, antidotes or absorbent materials • Access to firms or individuals with specialised chemical knowledge, laboratory facilities,

computing expertise, etc • Containment equipment for materials that get into waterways, e.g. strategically placed

boom • Early warning devices, e.g. smoke detectors.

Additional resources can often be obtained from nearby sites. Where these are to be relied upon, then there should be formal agreements in place.

Measuring Performance Key Issues

The emergency response arrangements need to be thoroughly tested. Testing is essential to make sure that the arrangements are suitable, accurate and capable as working as intended. Inspectors should be satisfied that there are:

Well-rehearsed procedures.

Rehearsed interfaces within on-site teams and between those teams and various responders.

And that these are tested by those who have the skills and knowledge to do so.

106. Is there a testing programme in place to regularly test and improve the effectiveness of emergency arrangements?

The testing programme should include drills and exercises to test a range of scenarios.

107. Who conducts and evaluates these tests?

For the test to be worthwhile, the person running the test should have the skills and knowledge in the emergency response matters being tested, the necessary technical knowledge and be able to understand and evaluate what is happening during the test.

108. Do the scenarios selected, test across a wide range of the worst foreseeable and lesser, more realistic events?

109. Do the scenarios respond to actions taken by the emergency team, rather than leading them through the exercises?

This question is aimed at developing the scenario in response to the actions of the emergency team. This would require some skill by the 'tester' and would need some planning in setting up the test to develop the scenario, depending on the actions of the team. Computer based tests, which are often aimed at command and control skills can be programmed to respond to actions being taken place by the team.

110. Is the testing scenario ever moved beyond the procedural envelope, so that the flexibility of thearrangements can be tested?

For example, are there scenarios, which have been discounted by the safety report because they were not considered foreseeable, but could be used to test how well the arrangements work beyond their original scope.

111. For each exercise, are there clearly defined exercise objectives?

The objectives of the exercise need to be met. However, if the scenarios change sufficiently, as discussed above, then the exercise may never get to the part that is to be tested.

112. Are appropriate types of exercise selected?

The purpose of an exercise with its objectives should be clear. Some examples of tests and their value are outlined below.

• Drills - testing a specific and relatively simple aspect of the emergency plan in isolation. Examples are fire drills; roll call and searching; cascade telephone calls; spillage control and recovery;

• Seminar exercises - training of staff and developing emergency plans. The facilitate discussion about different organisations responses in particular circumstances during an emergency.

• Walk through exercises - training staff or developing emergency plans. The emergency response is "walked through", including visiting appropriate facilities such as Emergency Control Centres;

• Tabletop exercises - allowing information exchange and dissemination between organisations at the emergency control centre, together with decision making to be tested. They are carried out in relation to a model, plans or photograph to depict the establishment. They could involve using information technology or virtual reality systems;

• Control post exercises - testing the communication arrangements during an emergency, with participating organisations located where they would be during an emergency;

• Live exercises - fully testing some or all aspects of the emergency plan for the on-site and off-site response. These exercises will be costly.

113. Do the emergency exercises used simulate so as possible a real emergency and do they keep to a realistic time-line?

114. Is an adequate range of staff involved in the exercises?

This should include practising taking on other roles, for example, covering for the absence of colleagues.

115. Does the testing programme incorporate some exercises that involve collaborating with off-site services? 116. Is there careful observation of the response of key players during an exercise?

This can be used to study the effectiveness of training of the decision makers and their suitability for involvement in emergency response.

Audit & Review Key Issues

Audit and review is essential to the effective development of the emergency response arrangements. It is only by reviewing the emergency response arrangements (e.g. by means of post exercise de-brief) can the emergency response be amended and adapted to address the shortcomings identified by the emergency response exercises. Review of the emergency response arrangements should also take place after changes on site.

117. Is information from the testing programme used as the basis for evaluating and improving the emergency plan?

For example, the command and control structure and interfaces should be reviewed on a regular basis.

It would be valuable to know what information is recorded and collated from testing to inform any such review.

Evaluation of adequate resources is a key element of a review and should inform any changes proposed to the procedures.

118. Is the frequency and nature of the testing programme itself periodically reviewed?119. 119. Is there a process in place for evaluating team performance?

This should address issues such as whether the team brought the emergency under control, saved life, whether the team performed well together, where were the weaknesses.

120. Can it be shown that the plan reflects lessons learned from previous incidents/exercises?

Management of Change

121. Is there a formal review process in place that is initiated following any significant changes to plant/ process/ location/ personnel or after a defined period?

The review process should consider the impact of change to plant/ process/ location and personnel COMAH at Regulation 8 requires a review and also revision of the safety report where there are changes that have significant repercussions with respect to the prevention of major accidents or the limitation of consequences of major accidents to persons and the environment.

A management of change system should include confirmation as to whether a Regulation 8 review is required and a record of the conclusions. As a result the safety report and the on-site emergency plan may require amendment. Where possible, the operator should attempt to maintain the continuity of key personnel in emergency roles. Where this is not possible, an emergency response review process should be triggered.

[1] Except where the LA has been exempted from preparing an off-site emergency plan

RCS 9 - PLANT COMMISSIONING

• Introduction • Planning and Implementing • Policy • Measuring Performance • Organising - Control • Auditing • Organising - Co-operation • Reviewing Performance • Organising - Communication • Example Questions For Interviews • Organising - Competence

INTRODUCTION

This risk control system relates to the inspection and testing of constructed plant prior to commissioning and to commissioning procedures. It includes the systems in place to ensure that inspection and testing work is carried out correctly and to standard. The RCS covers all construction projects as well as all installations of new equipment to existing plant. Examples of failures that comprehensive construction work inspection should detect are the installation of wrong equipment; installing equipment at the wrong location; incorrect installation of equipment and the likelihood of damage from dropped objects during construction projects. Other failures should be picked up using specialist inspection and testing techniques, such as NDT. Plant commissioning failures may relate to the leak testing of as built plant, mechanical breakdown of new and unused parts or to software problems with plant control software.

POLICY

Key Issue:

Senior management should lay down a clear policy and objectives for the inspection and testing of constructed plant prior to commissioning and to plant commissioning procedures to ensure that loss of containment of hazardous substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.

Key Characteristics:

• The overall objective is to construct, check and test a plant according to the best worldwide and industry practice and to commission the plant and assess its safety performance, so as to bring the plant to a safe normal operational state.

ORGANISING - Control

Key Issue:

Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:

o overall management of a construction/commission project;

o overall management of an inspection/testing programme during construction and commissioning.

Key Characteristics:

• The system should be adequately resourced in terms of time and money. The system for inspection and testing during construction and commissioning should include specification of roles and responsibilities for:

o specifying which inspections and tests are required;

o integrating all functions into the construction process (builders and managements, site engineers and management, inspection and testing people, operations etc);

o the scheduling of the inspection and testing throughout construction projects;

o overseeing the handover of the plant to operations personnel, and ensuring that plant is in a safe state to operate and all checks have been completed;

o provision of aids e.g drawings/diagrams.

• Details of job descriptions should be given and may include lines of reporting, roles and responsibilities, skill requirements and liaison lines.

• Specific hazards such as lifting over live plant should be controlled by relevant plans.

ORGANISING - Co-operation

Key Issue:

Individuals involved with the construction and commissioning of plant should cooperate to ensure a successful outcome. Inspection and testing during construction and commissioning should be built into the time schedules and the plant brought safely up to normal operational conditions.

Key Characteristics:

• The system for plant construction and commissioning should provide procedures for dealing with problems identified by construction, inspection and testing.

• Procedures for hand-over from construction to commissioning to normal operations.

• Recognition of schedule and cost pressures and procedures for the resolution of conflicts.

• The inclusion of checking of construction and commissioning in critical path analyses of the project. Attention should be given to how allowance is made for implementing the results of checks on construction work, such as building a buffer into the project schedule to take account of rework.

ORGANISING - Communication

Key Issue:

Formal and thorough communication between all parties involved in construction/commissioning.

Written instructions are adequate concerning construction/commissioning of the plant type based on worldwide/industry standards.

Key Characteristics:

• The system for plant construction/commissioning should ensure a forum exists for accessing industry guidance and corporate expertise on plant construction and commissioning.

• Documentation is available on construction/commissioning tests and inspection requirements. Guidance may include:

o the criteria with which to determine inspection and testing requirements for different categories of construction work, such as pressure tests for pipes carrying hazardous materials;

o the types of test to be carried out for different types of equipment;

o quality requirements for inspection and testing of equipment e.g for various categories and kinds of weld.

• A method of document control for P&IDs.

• Oral communication e.g about hazards of adjacent live plant.

• Learning from previous construction experience/incidents.

• A system of communicating problems in executing the construction/inspection and testing programme to senior management.

ORGANISING - Competence

Key Issue:

Individuals involved in plant construction/commissioning are competent to achieve the objectives. Competencies in terms of knowledge, skills and experience are clearly defined and reviewed. Selective criteria for staff and constructions are clearly laid down.

Key Characteristics:

• The system for inspection and testing during construction and commissioning should ensure:

o optimal use of company experience on large scale construction projects and experience of installation sections of new or modified plant;

o access to competent and experienced construction inspectors;

o access to adequate equipment and information for construction/- commissioning;

o well defined competencies of staff and contractors;

o the control of contractors for example using accredited contractors whose employees are familiar with the plant type;

o training programmes to ensure personnel have the correct qualifications and knowledge.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Methods for developing inspection and testing requirements for construction and commissioning.

Procedures for inspection, testing and commissioning standards, including mandatory requirements for inspection and testing.

Support such as equipment, checklists, diagrams etc, for inspection and testing of construction and commissioning.

Key Characteristics:

• There should be a process hazard analysis performed using one or more established methodologies to identify, evaluate and control the hazards involved in the process.

• The hazard analysis should address:

o the hazard of the process;

o engineering and administrative controls applicable to the hazards and other inter-relations;

o consequences of failure of these controls.

• Procedures should be available which are clear, easy to follow and used to cover inspection, testing and commissioning of new plant.

• Procedures should be developed to incorporate industry standards, codes and mandatory requirements.

• There should be a safety review and an inspection prior to commissioning. The pre-start up safety review should confirm that prior to the introduction of highly hazardous chemicals to a process:

o construction is in accordance with design specifications;

o safety, operating, maintenance and emergency procedures are in place and are adequate;

o process hazard analysis recommendations have been addressed and actions necessary for start-up have been completed;

o operating procedures are in place and training of each operating employee has been completed.

• Support should be available in terms of safety equipment, equipment, checklists etc, for construction testing and inspection and for commissioning.

• Checks are required for newly constructed plant, for modified plant and plant additions. These may cover:

o improper welds;

o installing bursting discs upside down;

o failing to connect pipes to connections, or failing to fully engage valves to pipes etc;

o use of wrong materials (such as carbon steel instead of stainless steel, or use of titanium flanges in lines with dry chloride);

o flanges mounted under tension;

o packing of pipes;

o cracks in welds;

o siting of bellows in wrong place on pipe (causing lateral thrust on bellows);

o failure to connect all instrumentation and controls (such as level gauges to alarms);

o the checks may also include a pre-planned set of pressure tests, leak tests and electrical tests.

• Plant commissioning may cover:

o leak tests for all equipment probably using nitrogen;

o controlled introduction of process fluids, checking temperatures, pressures, flows and so on;

o control loop tuning to adjust the plant process conditions;

o establishing the correct trip conditions;

o consideration of plant control software reliability.

MEASURING PERFORMANCE

Key Issue:

The plant construction/commissioning testing and inspection system should be monitored to measure its performance.

Key Characteristics:

• Inspection and testing results should be reported to plant management and engineering personnel.

• Active monitoring of the construction/commissioning inspection and testing programme, for each phase of the process.

AUDITING

Key Issue:

The plant construction/commissioning system should be periodically the subject of a formal audit. The auditors should not be part of the system or have responsibility for it, i.e they should be independent of the function being audited.

Key Characteristics:

• The audit should check that performance measuring and review are occurring at the correct frequency, are addressing the right issues, appropriate information flows occur at specified periods to senior management. It would be reasonable to expect an annual review.

REVIEWING PERFORMANCE

Key Issue:

Information from 'measuring' and 'auditing' is used to make judgements about the performance of the plant construction/commissioning system and is used to make decisions about improving performance.

Key Characteristics:

• Periodic reviews of the plant construction/commissioning system.

• Revision of the system in the light of data collection and incident analysis - learning from experience.

• Scope to review and revise the system during construction.

• Identification of problems and follow-up as a result of construction inspection and testing.

• Updates of standards of inspection and testing.

• Use of incident analysis to revise procedures.

EXAMPLE QUESTIONS FOR INTERVIEWS

OBJECTIVE

1. What is the policy regarding the conduct of systematic checks on the adequacy of inspections and testing during construction?

2. What is the policy on the use and control of construction contractors?

3. What is the policy regarding the priority given to inspection and testing within construction projects in relation to, say, the close out of projects and the start up of plant?

4. What is the policy for commissioning new plant?

ORGANISING - Control

5. What is the allocation of responsibility for arranging inspection and testing of all equipment at each stage of the construction process?

6. For whom are job descriptions available within construction project teams, including contractors and what details do those job descriptions provide?

7. What specific controls are in place on the hazards of lifting equipment over live plant during construction or installation work?

8. What specific controls are in place for installation work that involves hot tops into 'live' pipelines?

9. What is the allocation of responsibility for matching appropriate checking, inspection and testing standards to items of plant?

10. How are responsibilities allocated for scheduling construction inspection and testing?

11. What is the allocation of responsibility for assessing and meeting resource demands of checking and testing construction and installation work?

12. What is the allocation of responsibility for producing and supplying construction inspection and testing aids such as diagrams and drawings?

13. What documentation is available on the responsibilities of persons in control of resources for construction inspection and testing such as job descriptions?

ORGANISING - Co-operation

14. What are the procedures for dealing with problems identified by construction, inspection and testing?

15. What is the means of handover from construction to operations?

16. Are inspections and tests regarded as an integral part of the construction process or as an additional requirement?

17. Which are the schedule and cost pressures upon the construction, inspection and test programme?

18. What is the procedure for resolving conflicts between time needed to conduct construction inspection and testing and completion schedules?

19. What is the process for allocating time and budget to the checking of construction work and installation work?

20. What is procedure for reorganising construction inspection and testing in the light of experiencing conflicting pressures?

21. Do time or schedule pressures ever severely restrict the amount of inspection and testing of construction work?

ORGANISING - Communication

22. What means is there for accessing regulations and industry guidance on the inspection and testing of construction work prior to commissioning?

23. What documentation is available on construction tests and inspection requirements?

24. When design changes are made during the construction phase, what are the communication requirements between design and construction personnel?

25. What are the procedures for communicating between personnel with regard to commissioning requirements and procedures?

26. What is the process of communicating problems in executing the construction, inspection and testing programme to senior management?

27. What documentation is available on inspection and testing of construction and installation procedures and standards to be followed?

28. What documentation is available on the procedures for resolving conflicts between construction inspection and testing and project close-out schedules?

29. What is the system for documentation control such as P&IDs and equipment specifications, for use in construction, inspection and testing?

30. Are construction personnel made aware of the hazards of live plant adjacent to the construction area?

ORGANISING - Competence

31. What experience does the company have of checking inspections and controlling construction projects and installation work?

32. What is the level of access to competent construction inspectors?

33. What is the level of access to information and equipment used in carrying out construction inspection?

34. What is the level of access to experienced construction contractors?

35. What is the allocation of responsibility for ensuring that inspectors, including contractors are competent?

36. What is the method for ensuring that those responsible for checking the adequacy of construction work are fully and adequately competent?

37. What is the method for taking into account a contractors track record in the contractor selection process?

PLANNING and IMPLEMENTING

38. What are the methods for developing inspection and test requirements for specific construction projects?

39. What are the systems for ensuring that all required tests and checks on newly constructed or modified plant have been carried out?

40. Does the level of inspection and testing vary with size of construction/- installation job? If so, who assesses the requirements?

41. What is the applicability of codes, regulations, corporate standards, insurance requirements, etc, for governing checks on adequacy of construction and installation work?

42. How are construction inspection and testing requirements integrated into internal codes and standards?

43. What are the mandatory requirements in force regarding the performance of construction checks on safety critical items?

44. What is the procedure for producing a detailed list of checks to be conducted throughout the construction process?

45. Are checklists/diagrams/written procedures provided for construction work inspection?

46. Is there a procedure for ensuring appropriate equipment is available for carrying out inspections/tests, such as NDT equipment?

47. Is there a procedure for selecting and preparing necessary safety equipment required during construction work checks or commissioning activities?

48. Is there evidence of insufficient procedural or checklist type guidance being given to construction inspectors?

49. How have commissioning procedures been developed?

50. Does commissioning cover:

• leak testing of all equipment?

• progressive introduction of process fluids?

• control loop tuning to obtain the required operational conditions?

• consideration of safety trips?

• consideration of control software reliability?

MEASURING PERFORMANCE

51. What checks are required for newly constructed plant, for modified plant and plant additions?

52. What is the procedure for reporting results of inspection and testing from construction inspectors, to plant management and engineering personnel?

53. What is the method of monitoring progress of the construction inspection and testing programme?

54. What is the allocation of responsibility for monitoring and auditing the performance of the construction inspection and testing programme?

55. What is the system used to monitor and review effectiveness of procedures used for construction and installation work?

56. What is the procedure for carrying out audits of each phase of the construction, inspection and testing programme?

57. What records are kept on problems or faults identified during the inspection and testing of newly constructed or installed plant?

58. Are aides, such as log books, supplied for recording data and information arising from checks on construction work?

AUDITING

59. Are independent personnel available to carry out checks on the adequacy of construction work?

REVIEWING PERFORMANCE

60. What is the means of revising the system of construction management?

61. Describe the method for reviewing inspection and test procedures during a construction project?

62. How is it ensured that follow-up requirements for problems identified by construction inspection and testing are carried out as specified?

63. What is the system for learning lessons from previous construction inspection and testing programmes?

64. What is the evidence that construction inspection and testing procedures have been revised in the light of indication of construction faults?

65. Has incident analysis identified insufficient checking of construction work?

66. What is the allocation of responsibility for reviewing the performance and appropriateness of the organisational systems for managing resources for inspection and testing of construction work? Is there a procedure by which lessons learnt are recorded and conveyed to construction inspection and testing personnel?

RCS 10 - PLANT AND PROCESS DESIGN

• Introduction • Organising - Competence • Policy • Planning and Implementing • Organising - Control • Measuring Performance • Organising - Co-operation • Auditing • Organising - Communication • Reviewing Performance

INTRODUCTION

This RCS concerns the development, implementation and application of safety engineering codes, standards and procedures to the design of new plant. It covers both the design of safety devices, such as PRVs and emergency shutdown systems, and the correct design of piping and vessels in terms of materials, process parameters and control systems to prevent and control hazards such as overpressure, corrosion and erosion.

POLICY

Key Issue:

Is there a clear policy covering the design of new plant and processes to ensure that loss of containment of hazardous substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.

Key Characteristics:

• Plant and processes which have been designed by competent and experienced people according to the best standards available, on an industry-wide or world-wide design basis.

• The design process should be adequately resourced to ensure that sufficient time is allowed for the proper design and evaluation plant and processes and that sufficient competence people are deployed on the tasks.

ORGANISING - Control Key Issue: Is there an adequate management structure to implement the policy on plant and process design? Key Characteristics:

• Responsibilities for the following: o Overall design safety; o Control of contracted out design; o Risk assessment of proposals - HAZOP etc; o Design acceptance; o Division of design responsibilities e.g mechanical, instrumentation; o Quality Assurance of plant process design; o Control of design changes; o Record keeping for design specification and P & I Diagrams etc.

• Clearly allocated and accepted by the individuals and teams: o Personal responsibilities in job descriptions, performance standards or recorded elsewhere; o Objectives set for individuals with key tasks in the design process; o Performance of those with responsibilities for design processes subject to routine appraisal.

ORGANISING - Co-operation Key Issue: Are there adequate and appropriate arrangements to secure the trust, participation and involvement of persons included in plant and process design? Key Characteristics:

• Individuals, including specialist contractors, involved with the design process should cooperate to ensure a successful outcome, balancing safety, production and time pressures.

• Conflicting project engineering goals should be successfully managed, e.g the need to get new plant operational and the need to complete safety reviews.

• The role of external specialist contractors should be explicitly integrated into the design process.

• Arrangements for consultation between designers and also with construction, production and maintenance personnel should be in place.

ORGANISING - Communication Key Issue: Are there adequate arrangements to secure information flow to, from and between those involved in plant and process design. Key Characteristics:

• Formal and thorough communication between all the parties involved in the design processes, including external contractors. Consideration should be given to flows of information both verbal and written and to forums to allow communication to take place.

• Information about new activities, changes in legislation or workplace controls from reviews and audits effectively communicated to people involved in plant and process design.

• Adequate systems to provide information on design specifications, tolerances and parameters to those involved in plant commissioning.

• Adequate systems for drawing up and communicating operational and maintaining instructions from design specifications.

• Adequate systems to provide information on the pilot or trial operations and subsequent scale up. • The company should maintain an up to date knowledge of industry standards and guidelines via meetings,

documentation etc. • Documentation should describe safety engineering codes, policy, design procedures, HAZOP procedures etc. • Design procedures to include information on the risks arising in plant construction, operation and maintenance

and decommissioning of plant and equipment. • Adequate records kept of design specifications, results of HAZOPS, P & I Diagrams etc. • Modern standards, regulations, codes of practice and corporate design standards should be available on safety

engineering and process safety.

ORGANISING - Competence Key Issue: Are there systems and arrangements to secure the competence of those working on plant and process design? Key Characteristics:

• Individuals involved in design are competent to achieve the design objectives. • Competencies in terms of knowledge, skills and experience are clearly defined and regularly reviewed. • Selection criteria for staff and contractors clearly defined. • Design personnel familiar with the hazards associated with plant and processes and information provided to

them from operational experience following commissioning. • Adequate training of design personnel. • Training programmes for formal methods: HAZOP, QRA, FTA. • Selection of a design team of the appropriate composition including, where appropriate, operators. • Training records kept outlining qualifications and skills of design personnel.

(See also RCS 12 'Assessing Competence' in this Chapter). PLANNING and IMPLEMENTING Key Issue: Are there adequate processes to generate plant and performance standards to implement the policy on plant and process design? Key Characteristics:

• Criteria on when formal design procedures are to be used should be clearly defined. • Performance standards developed for the design procedures detailing the key stages in the process, who and

what disciplines are involved, what safety reviews should be undertaken and how decisions on the final design specifications are made and recorded.

• Industry norms should be included in standards, hazard analysis procedures and design codes. • Information sources from both within and outside of the company on the hazards associated with the plant and

the appropriate measures to be taken should be used. • Safety of software should be considered. • Ergonomics principles should be applied. • Formal methods; HAZOP, QRA, FTA should be used in the design process. World-wide experience of hazards

and incidents on the plant-type should be incorporated in the design. • Safety analyses and risk assessments should cover all possible causes of component failure, examples might

be: o adequacy of pressure relief arrangements under normal and extreme conditions; o checking line connections do not allow entry of incompatible materials or contaminants;

o selection of correct construction materials; o adequate inerting capacity; o venting is to safe environment; o adequacy of specifications for likely operation pressure levels; o load capacity of welds, supports etc; o valve blockage hazards; o ignition source hazards, such as static electricity; o protection against corrosion and allowance for erosion; o pipeline specification allows maximization of flow; o vibration from nearby equipment.

MEASURING PERFORMANCE Key Issue: Is there adequate and sufficient measurement of the performance of the plant and process design system? Key Characteristics:

• The plant/process design system monitored to measure its performance. • Failures and problems within the plant/company associated with design should be recorded and made available

to designers. • Measures of performance may include compliance with design procedures, and the adequacy of transfer of

information to those involved in subsequent stages e.g construction, commissioning, operational maintenance etc.

• Measurement of performance may be undertaken as part of quality assurance systems. • Some degree of independence of those involved in measuring from those involved in design is advantageous e.g

a mixture of self checking and independent checks.

AUDITING Key Issue: The plant and process design system should be subject to formal audit by people who are independent of the system or element being audited. Key Characteristics: The audit should examine the effectiveness and reliability of the whole of the plant and process design system and produce plans for corrective action where necessary. REVIEWING PERFORMANCE Key Issue: Is there adequate and sufficient review of the performance of the plant and process design system? Key Characteristics:

• Information from "measuring and auditing" is used to make judgements about performance of the design process and to make decisions about improvements.

• The plant/process design system should be reviewed periodically e.g. old HAZOP's may be reviewed. • Lessons learnt from previous safety studies are used in the current design. • Information about problems, hazard and risks of plant and processes used to improve the design process.

RCS 11 - ASSESSING AUDITING

• Introduction • Organising - Competence • Policy • Planning and Implementing • Organising - Control • Measuring Performance • Organising - Co-operation • Auditing • Organising - Communication • Reviewing Performance

INTRODUCTION

This section deals with the management arrangements for the independent assessment of the validity, reliability and effectiveness of the health and safety management system. (NB - independent means independent of line management normally in control).

Key Issue:

Are there effective audit arrangements for the Health and Safety Management System (HSMS)?

POLICY

Key Issue:

Are the purpose, scope and limitations of the audit arrangements adequate and clear?

Key Characteristics:

• Recognition of the importance and role of auditing within the health and safety management system.

• Clear understanding throughout the organisation of the purpose of auditing.

• Recognition that auditing has limits, is an integrated part of the HSMS, and is not isolated, standalone or self perpetuating.

• Scope covers all levels of the HSMS i.e the management arrangements, risk control systems and workplace precautions.

• Commitment at all levels to auditing.

• Commitment to act on results of auditing.

• Recognition of the need to allocate appropriate resources for both undertaking auditing and carrying out any remedial actions.

• Principles upon which audit is to be applied, for example, audit seen as a tool for improvement rather than "fault finding".

• Recognition that different types of audit may have different objectives, for example, self assessment compared with external assessment or technical audits.

ORGANISING - Control

Key Issue:

Is there clear and effective allocation of audit responsibilities and are arrangements in place for holding individuals accountable?

Key Characteristics:

• Appointment of a coordinator, custodian or champion of the audit process.

• Roles and responsibilities of the audit team are clear to both team members and others within the organisation who need to know. For example, the distinction between corporate and local auditing functions; and the role health and safety managers/advisors play.

• Auditors have degree of independence.

• No conflict between audit responsibilities and other job demands.

• Personal performance standards for auditors exist, for example, auditor is required to undertake x audits, to y procedure, according to z programme.

• Auditors are held accountable for their performance.

ORGANISING - Co-operation

Key Issue:

Are there adequate arrangements to secure the trust, participation and involvement of everyone undertaking and affected by the auditing activity?

Key Characteristics:

• Audit programmes and sampling are discussed and determined both within the audit team and with others affected (for example, audited system managers) by the audit activity.

• Employees are encouraged to take part and provide input to the audits.

• Employees are involved in planning and monitoring remedial actions.

• Arrangements to resolve disputes and conflicts with audit findings.

ORGANISING - Communication

Key Issue:

Are there adequate arrangements to secure the information needs of everyone involved or affected by the audit process?

Key Characteristics:

• Those who need to know are aware of the audit purpose, scope and training requirements.

• Judgement criteria are transparent.

• Communication needs during preparation, on site and follow-up phases of the audit process have been identified and catered for.

• Audit findings are reported and communicated to those who need to know.

• Audit best practice (both from internal and external sources) have been identified and used to inform and develop the audit process.

ORGANISING - Competence

Key Issue:

Are there systems and arrangements to secure the competence of everyone involved in auditing?

Key Characteristics:

• Auditor selection criteria are used.

• Auditors have appropriate training and experience.

• Lead auditors have additional and appropriate skills, knowledge and experience.

• Auditor competence may include:

o planning and organising skills;

o interpersonal skills;

o communication skills;

o respect and authority relative to people being audited;

o awareness of company or industry best practice.

• Arrangements to assess and monitor auditors competence.

• Arrangements to update and refresh auditors/lead auditors.

(See also RCS 12 'Assessing Competence' in this Chapter).

PLANNING and IMPLEMENTING

Key Issue:

Are audit plans, procedures and performance standards generated from a planning process which is based upon the hazard profile and/or legal requirements of the area being audited?

Key Characteristics:

• All levels of the HSMS are subject periodically to auditing i.e the management arrangements, risk controls systems and workplace precautions.

• Criteria for drawing up the audit programme (i.e to determine where to go and what to look at) for example:

o the relative significance of hazards present (both on and between sites);

o accident and ill health history;

o health and safety policy requirements and current means of implementation;

o inspection and other active monitoring and risk information;

o results of previous audits;

o a significant change has occurred.

• Procedures for audit planning and the audit process.

• The audit process requires:

o objectives and terms of reference of each audit to be clearly identified;

o an emphasis on improvement;

o recognition of good as well as poor performance;

o looking to test whether system(s) is in place, adequate, implemented and effective;

o the use of 3 sources of information i.e documentation, interviews and observation.

• The audit methodology ensures consistency and reliability throughout, for example, ensuring during:

Preparation that:

o Adequate steps and controls are in place to ensure the audit process will meet its objectives;

o The composition of the audit team is adequate for the task;

o The right sampling, decisions (depth, time and numbers) have been made to properly explore the issues being examined;

o Adequate and objective criteria and standards have been used to make judgements against;

o Auditors arrive on site properly briefed and prepared;

o Full and appropriate use has been made of the information sources available. For example, the nature and depth of prepared questions are proportional to the significance of the issues to be explored.

On site activity that:

o There is an initial briefing to inform everyone who needs to know of the audit process and outputs;

o Interviews are structured to ensure that the information is collected in an effective and painless way;

o Verification is determined and undertaken;

o Initial feedback on the audit findings is provided, for example, at a wash up meeting;

o Full and appropriate use has been made of the information sources available.

Follow-up that:

o Audit findings are reported;

o The organisation being audited is required to take remedial action in relation to the audit findings, for example, to produce an action plan;

o Audit findings are recorded.

o Adequate and comprehensive performance standards established to enable the audit process to be effectively measured and reviewed, for example, audit reports must be submitted within x days of completing the on-site activity.

MEASURING PERFORMANCE

Key Issue:

Are there adequate arrangements to measure the performance of the auditing system and investigate sub-standard performance?

Key Characteristics:

• Information is routinely collected which compares audit performance at each phase with predetermined standards.

• Sub-standard performance and complaints are investigated.

• Periodic 3rd part verification of audits is undertaken where required, for example, for self assessment audits (NB - 3rd party does not necessarily mean from outside the organisation).

• Findings are analysed to identify common trends.

AUDITING

This section has not yet been drafted.

REVIEWING PERFORMANCE

Key Issue:

Is there an effective review of the audit system to ensure continuing improvement and effectiveness?

Key Characteristics:

• Audit programmes are assessed against performance indicators, for example, plans and % recommendations closed out.

• Assessment of the influence auditing is having on the overall improvement process.

• The effectiveness of the audit process is examined, for example, the suitability of the sampling decisions.

• The audit process and performance is compared with external benchmarks, for example, other organisation's audit arrangements.

RCS 12 - ASSESSING COMPETENCE

• Introduction • Organising - Competence • Policy • Planning and Implementing • Organising - Control • Measuring Performance • Organising - Co-operation • Auditing • Organising - Communication • Reviewing Performance

INTRODUCTION

This agenda deals only with health and safety training development and competence. It does not deal with the assessment of the adequacy of professional health and safety advice or the adequacy of health and safety departments. Training in this context includes formal off-the-job training, instructions to individuals and groups and on the job coaching and counselling.

POLICY

Key Issue:

Is there an effective recruitment, training and development (RTD) policy to secure competence in Health and Safety?

Key Characteristics:

• Good practice suggests effective RTD policies for health and safety are:

o overseen by a senior manager and adequately resourced;

o competence-based and where appropriate relate to relevant NVQ, SVQ or other Lead Body standards (sometimes NVQ, SVQ etc may not specify in detail the appropriate health and safety precautions etc. They will often need complementing with organisation specific information to ensure adequate coverage of health and safety);

integrated with other business training and development;

clear as to purpose and comprehensive - covering the health and safety needs of all levels of employee - including management.

ORGANISING - Control

Key Issue:

Is there an adequate management structure to implement the policy?

Key Characteristics:

• Responsibilities are assigned for:

o supervision of the overall system to secure competence so that it remains effective in changing times e.g a custodian or "champion";

o assessing health and safety aspects of potential recruits against job specifications;

o identifying training and development needs and developing training and development plans (for individuals or groups);

o delivering appropriate training or learning activities (except where outside organisations are used);

o providing coaching, counselling and instruction;

o supervising 'trainees' who are not yet fully competent;

o evaluating the standard and effectiveness of training and development (provided by the internal and external providers) which should include the senior manager responsible;

o assessing competence;

o monitoring and maintenance of the overall system and securing any necessary improvements in the system or the type and standard of training provided.

ORGANISING - Co-operation

Key Issue:

Are there adequate arrangements to secure involvement in health and safety training and development?

Key Characteristics:

• Health and safety training and development plans and evaluations are presented and discussed at health and safety committees.

• Individuals and/or groups are consulted in identifying training and development needs and choosing appropriate learning methods.

• Suitably capable employees have opportunity of involvement in delivery of training and development activities.

ORGANISING - Communication

Key Issue:

Is there adequate information to support the policy?

Key Characteristics:

• Recruitment forms covering health and safety aspects.

• Job specifications detailing physical and mental ability, appropriate medical screening and competence requirements relevant to health and safety (for all levels).

• Records of training needs analysis.

• Training plans and records.

• Training materials; lesson plans, handouts, OHPs.

• Training evaluations and records of assessment of competence.

ORGANISING - Competence

Key Issue:

Are those recruiting, training, developing and assessing competence themselves competent in implementing the policy?

Key Characteristics:

• Personnel and training specialists have achieved competence by experience and/or qualification e.g Institute of Personnel and Development Membership, Meeting Training and Development Lead Body Standards.

• Those in management and supervisory jobs undertaking training needs analysis, training and coaching, have received training and/or have access to appropriate support and advice.

• Those assessing competence (including external assessors) take due account of health and safety requirements - especially where competencies are assessed against NVQs, SVQs or similar standards.

PLANNING and IMPLEMENTING

Key Issue:

Are there adequate procedures and standards to implement the policy?

Key Characteristics:

• Recruitment procedures and job specifications which include health and safety requirements.

• Systematic identification of health and safety training and development needs which:

o correctly identify training and development as an appropriate solution (training in particular should not be used to compensate for inadequacies in other aspects of health and safety e.g poorly designed or inadequately protected plant, work stations not designed to sound ergonomic principles);

o systematically examines the requirements of the job e.g by looking at accident and ill-health records, observing jobs and discussing with employees working practices and the tools and equipment used;

o correctly identifies jobs with a safety critical content e.g safety critical work on railways, those who have key posts in emergency procedures;

o establishes job requirements/competence statements identifying the essential knowledge and skills;

o prioritises training and development needs using risk assessment principles.

• Identification of knowledge requirements for health and safety including:

o general organisational knowledge for all e.g:

details of the health and safety policy and the philosophy underlying it;

an overview of health and safety principles;

overview of the structure and operation of the health and safety arrangements such as planning and measuring health and safety performance;

any general health and safety rules.

• Identification of job specific knowledge for managers including:

o details of the hazards and risks in area of responsibility and the necessary precautions;

o the health and safety principles which underline their control and relevant legislation;

o detailed knowledge of health and safety arrangements such as risk assessment, inspection, accident investigation systems.

• Identification of job specific knowledge for non-managers including:

o health and safety principles relevant to job;

o detailed knowledge of relevant standards, systems procedures and rules intended to control the risks of the job.

• Identification of skill requirements for those directing health and safety including:

o devising health and safety policy;

o establishing and maintaining an effective organisation for health and safety;

o devising health and safety plans;

o measuring health and safety performance;

o reviewing performance;

o communication, coaching, health and safety problem solving.

• Identification of skill requirements for those managing health and safety including the skills ofestablishing/operating systems to:

o promote an organisational climate for promoting a positive health and safety culture;

o devise plans, risk assessments and performance standards;

o measure health and safety performance;

o audit and review health and safety performance;

o communicate, train, inspect and save health and safety problems.

• Identification of skill requirements for those supervising health and safety including:

o operating the arrangements and systems for organising, planning, measuring (including inspection and accident investigation) and reviewing health and safety performance;

o communication, training, instruction and health and safety problem solving.

• Identification of skill requirements for those in non-management position including:

o applying the systems, rules, procedures forming the workplace precautions;

o communication and health and safety problem solving;

o risk assessment, inspection and accident investigation.

• Preparation of training and development plans;

• Procedures/arrangements which secure appropriate training, re-training etc:

o at induction;

o when persons change jobs or stand in for others;

o where there is a process or other operational or method change;

o where there is a need for update or refresher training.

• Adequate supervision of 'new' workers (e.g on recruitment or transfer) following training but before competence is achieved.

• Procedures and succession plans exist to provide adequate cover for jobs, with critical health and safety duties, arising from sickness/- absence/transfer/major process change.

MEASURING PERFORMANCE

Key Issue:

Are there adequate arrangements to assess the effectiveness of training and the achievement and maintenance of competence?

Key Characteristics

• Monitoring of delivery of training and development plan.

• Systematic assessment/evaluation of training and assessment of competence in post after initial training and development.

• Identification of deficiencies in knowledge and skill from active and reactive monitoring.

AUDITING

Key Issue:

Is there adequate auditing of the recruitment, training and development process?

Key Characteristics:

• Auditing covers an assessment of the whole recruitment, training development system.

• Auditing evaluates the outcomes of the system for all levels of employee.

REVIEWING PERFORMANCE

Key Issue:

Is there effective review to ensure that lessons learned are put into practice to improve the recruitment, training and competence development process and policy?

Key Characteristics:

• Deficiencies identified have resulted in improvements.

• Suitable performance indicators are identified.

• Analysis of trends/patterns in overall training and development activity for health and safety.

• Overall review involves senior manager(s).

RCS 13 - HAZARD IDENTIFICATION AND RISK ASSESSMENT (HIRA)

• Introduction • Further work • Common HIRA methods • Legal basis • HIRA Systems and management of change • Process of carrying out hazard identification and • Published standards risk assessment study

INTRODUCTION

Hazard Identification and risk assessment are essential for ensuring safe plant and safe methods of work in the chemical industry. Hazards should be identified and risks assessed throughout the plant life cycle. Different techniques may be appropriate, depending on the stage of this lifecycle.

Some companies, especially if American owned, may use the terms Process Hazard Review/Analysis (PHR/A) instead of Hazard Identification and Risk Assessment (HIRA). PHA generally refers to an initial analysis e.g. when new plant is being designed; PHR generally refers to periodic reviews of plant and processes over time. However, because of its wider application, H.S.E. prefers to use the term Hazard Identification and Risk Assessment (HIRA) rather than PHR/A.

The purpose of HIRA is the systematic evaluation of a process, leading to improvements in safety (plant, processes and human factors). The aim is to ensure that risks are reduced as low as is reasonably practicable (ALARP). The system should consider the usual hierarchy of risk reduction measures i.e. hazard elimination (for example by the use of inherently safer design), risk control and mitigation. Hazard identification and risk assessment is essential for major hazard plant; duty holders must assess the risks from their operations before they can decide what action they need to take to control them.

Human Factors (HF) should be taken into account by HIRA systems. However, the methodologies may or may not be sufficient to do this, because the focus for HF is tasks and activities, rather than plant and processes. The HID S14A Human Factors team are currently actively working on this area.

COMMON HIRA METHODS

The HIRA can take many forms. Industry typically use one or more of the following methodologies to carry out the HIRA: What if; Checklist; What if/Checklist; Hazard and Operability Studies (HAZOPs); Failure Modes and Effects Analysis; Fault Tree Analysis; or their own equivalent in house version. The HIRA Leader, in conjunction with the team will decide the scope and methodologies to be used: these will vary depending on the process that is being reviewed, as well as company policy and culture, but need to be proportionate to the hazards and risks involved. British companies are more likely to use HAZOP methodology.

The '6 Stage Approach', also known as the 'Plant Life Cycle', has six stages (Initial Integrity, Control of Production, Maintaining Integrity, Management of Change, Cessation of Operation, and Emergency Response) and deals with HI&RA throughout the lifecycle of a plant.

Traditionally the term HAZOP is associated with the original part of the HAZOP procedures (now HAZOP3 stage). This relates to the systematic review of P&I diagrams by a team of experts (e.g. engineering, process, operators) who use key words to identify whether there are risks and the measures to control them. Because this is relatively late in the design process, the outcomes tend to be procedures, alarms etc.

HIRA SYSTEMS AND MANAGEMENT OF CHANGE

HIRA Systems and management of change are closely related areas of risk management and reduction. The main difference between the two is that change management procedures are reactive - they are required in response to specific plant/ process/ personnel etc changes; whereas HIRAs are periodic and proactive.

A company's management of change procedure should be able to identify if a HIRA study is needed for that change. A series of changes might be made that, on their own, would not warrant the full rigour of a HIRA study. But, over time they may have cumulative effects on plant safety. Therefore, the HIRA system should have scope for review where the effects of a number of changes can be assessed. Thus, paperwork needed for a cyclical HIRA would include the management of change requests, assessments for that part of the plant since the last HIRA study as well as, updated P&ID's.

PUBLISHED STANDARDS

Techniques for HIRA originated in America, and the only published standard is the U.S. Department of Labour Occupational Safety and Health Administration (O.S.H.A.): Process safety management of highly hazardous chemicals -1910.119. This requires companies to carry out process hazard reviews at least every 5 years, after the initial analysis has been carried out. As a result, in the U.K., Inspectors may be more likely to find HIRA complying with the OSHA standard at American owned companies. Companies such as ICI (and successor companies) have been doing HIRA for many years. These studies have been refined and now include environmental hazards amongst other things (PHR3 is latest version).

The OSHA Links in the Inspection Guidelines section of this document are provided to give Inspectors additional useful information and should only be used as guidance. The OSHA Standard is an American Standard and cannot be enforced (see information on Further Research below). However, every chemical operator should be able to describe the HIRA techniques they use for the design, modification and review of their processes. These will vary and should be proportionate based on factors such as the hazards, complexity of process, competences of staff etc. For many businesses, consultants are used for their expertise in the HIRA techniques. Input from company personnel about how individual processes are operated is essential.

FURTHER WORK

HID HQ is planning to gather further information on current practices re Hazard Identification and Risk Assessment Systems in the UK. Chemical Industry. We will then be able to either establish existing good practice or consider whether this should be further developed e.g. more closely following the O.S.H.A. standard. If Inspectors have done any work in this area e.g. enforcement, audits, and think it would be helpful to other Inspectors, please can you contact Cath Cottam, HQ1E, 513 2850. Any feedback would be most welcome, and will be used to develop the guidance further.

HIRA LEGAL BASIS

COMAH REGULATIONS 1999: TOP TIER DUTIES

Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident prevention policy and a safety management system for implementing it have been put into effect in accordance with the information set out in Schedule 2.

COMAH safety reports, as part of their minimum information, are required to include information on operators' accident identification, risk analysis and prevention methods and an assessment of the extent and severity of the consequences of identified major accidents (see COMAH Schedule 4 Part 2).

COMAH REGULATIONS 1999: GENERAL DUTIES

Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their consequences to persons and the environment.

Regulation 5(3) requires operators' SMS to identify and evaluate major hazards (see COMAH Schedule 2).

Regulation 15 requires every operator, when requested to do so, to provide sufficient information to the competent authority to demonstrate that he has taken all measures necessary to comply with COMAH.

Carrying out a HIRA to ensure that plant and procedures are of a standard to ensure risks are acceptably low can be interpreted as demonstrating that the operator is "taking all measures necessary" and reducing risk to a level as low as is reasonably practicable (ALARP).

THE MANAGEMENT OF HEALTH AND SAFETY AT WORK REGULATIONS 1999

The Management of Health and Safety at Work Regulations 1999 Regulations 3,4, and 5 are relevant to non-COMAH sites or hazards other than 'major hazards'. These require employers and self-employed people to assess the risks to workers and any others who may be affected by their work or business, to implement preventive and protective measures and make sure that appropriate arrangements are in place to cover health and safety.

OFFSHORE SAFETY CASE REGULATIONS 1992

SC Regulations 1992 Regulation 8 requires operators or owners to include in safety cases enough information to demonstrate that 'all hazards with the potential to cause a major accident have been identified; and risks have been evaluated and measures have been, or will be taken to reduce the risks to persons affected by those hazards to the lowest level that is reasonably practicable'. Schedules 1-5 of the Regulations detail the particulars, which should be included in the safety case.

PFEER 1995 Regulation 5 requires the duty holder to perform an assessment to identify the events which could give rise to 'a major accident involving fire or explosion; or the need for evacuation or rescue to avoid or minimise a major accident; the evaluation of the likelihood and consequences of such events; the establishment of appropriate standards of performance to be attained by anything provided by measures for ensuring effective evacuation, escape, recovery and rescue to avoid or minimise a major accident.' Regulation 19 further requires the duty holder to ensure that all plant on the installation provided in compliance with the Regulations 'is so constructed or adapted as to be suitable for the purposes for which it is used or provided…'

DCR 1996 Regulation 13 stipulates that the 'well operator shall ensure that a well is so designed, modified, commissioned, constructed, equipped, operated, maintained, suspended and abandoned that - so far as is reasonably practicable, there can be no unplanned escape of fluids from the well; and risks to health and safety of persons from it or anything in it, or in strata to which it is connected, are as low as is reasonably practicable'. In these Regulations, Regulation 4 is the general duty whereby the duty holder 'shall ensure that an installation at all times possesses such integrity as is reasonably practicable'.

POPMAR ELEMENT KEY FEATURE INSPECTION GUIDELINES

POLICY Is a policy in place, which recognises that Hazard Identification and Risk Assessment (HIRA) are fundamental to control of major accidents and that hazards change over time, and therefore need to be reviewed on a regular basis?

Does the policy include a stated commitment to provide adequate resources, to ALARP risk reduction and to continuous improvement including the use of techniques of inherently safer design?

Do procedures make clear that HIRA refers to technical, human factor issues and procedural hazards, and is a method of doing this described?

The policy should cover:

• Why a system for HIRA is needed. • Methodologies used. •

•

What HIRA applies to (i.e. what plant, what processes, what human factors e.g. structured identification and assessment of human error potential etc)? HIRA Frequencies. [OSHA 1910.119(e)(6)].

• How the company achieves ALARP risk reduction. • How the policy has been communicated and understanding checked.

Verification - Company should be able to provide:

• Policy document. • Details of scope and limits of system. These should be clearly defined

and understood by those involved. They should tie in with COMAH requirements (all sites), but particularly at Top Tier sites with regards to safety reports.

ORGANISING CONTROL

Is the management structure to implement and manage the HIRA system adequate? Are responsibilities clearly allocated and accepted? Are people held accountable for managing the system, carrying out the HIRA programme and completing follow-up action?

• A HIRA should be carried out for all major accident scenarios/hazardous processes.

• The limits of authority should be clear. For example, the HIRA Leader can discuss and try and resolve any issues or disputes associated with the HIRA Actions report with the relevant staff, but the Site Manager has the final say where necessary.

• The performance standards for the system (Who, what, when, expected results) should be recorded, clearly understood, and people held accountable.

Verification of Documentation:

• To show where a HIRA has been carried out. • To include clear responsibilities etc. (who, what and when). • To show how people are held accountable e.g. performance appraisal.

ORGANISING CO-OPERATION

Do all personnel cooperate to ensure the successful operation of the

• All parties should show a shared understanding and acceptance of the HIRA system.

• There should be a dispute resolution procedure e.g. over resources, including who has the final say if agreement cannot be reached.

system? Is there a clear procedure for resolving disputes? (E.g. over resources, availability of plant, over acceptance and priority of recommendations)

• Adequate notice should be given prior to HIRA studies to ensure that relevant personnel can attend.

• The stages of HIRA study should be arranged to ensure that all relevant personnel can attend.

• Recommendations relating to other parts of the site should be discussed with and referred to relevant management.

Verification of Documentation:

• Should provide clear information on consultation. • Should provide clear dispute resolution procedures.

ORGANISING COMMUNICATION

Are there adequate information flows into, within and from the organisation to ensure the effective operation of the system? Are changes to plant documentation carried out when required (P&IDS and Operating Procedures)? Management of Change Are records of reviews, disputes, decisions and actions available? Are there procedures in place to ensure that changes to the system and findings of HIRA are communicated to all relevant personnel?

• Pre-HIRA information packs should be available to team members at the start of a HIRA. Packs should include for example, team composition; expected duration; methodology to be used; scope; P&ID's; operating instructions; calculations; worksheets and checklists.

• Changes to the system should be communicated to all relevant personnel. For example, the person who takes the lead on HIRA issues could produce and send out information sheets and/or could give a presentation at the start of the HIRA study.

• If there are a number of shifts, operator views from all shifts should be taken in to account.

• Recommendations should be fed back to plant documentation (P&IDs and Plant Operating Procedures) to ensure that they are kept up to date.

• Records should be kept of reviews and disputes. • Changes which may impact on control of major accidents should be

identified. • Study findings should be communicated to all relevant personnel. For

example, you could find a copy of the outcome events table,(detailing an action number, what is required, by whom, timescale and completed date) that is produced at the end of the HIRA, circulated or formal presentations of the report.

• Outstanding actions/ reservations should be flagged up to relevant personnel.

• Changes to HIRA frequencies should be communicated; • Good practice is to review findings of different studies to identify

interactions and safety critical issues.

Verification of Documentation:

• Pre-HIRA packs. • Check that changes are recorded in plant documentation. • Documentation associated with reviews, disputes etc. • Details of communication of changes (memos, training pack updates

etc).

ORGANISING COMPETENCE

Are there systems and arrangements in place to develop and maintain the competence of everyone involved in the HIRA system and subsequently affected by the outcome of the HIRA?

•

•

•

· People undertaking the HIRA should have suitable training and experience in HIRA procedures; OSHA 1910.119 Appendix C, point 4, paras 3 and 4.

• · The HIRA team should know what specialist advice is available. • · The need for specialist advice should be identified and ensured.

· Continuing competence and knowledge of specialists should be assured. · Competence should be ensured following plant changes. Competence should be seen as only one means for addressing potential human failure and errors. PM/ENF 11 Human Factors - Inspector Toolkit, Common Topic 2 Maintenance Error.

Verification of Documentation:

• Policy for succession management that recognises that competence can be a safety critical issue. Having adequately trained deputies is necessary for studies, as cover is required for sick leave, holiday absences, people leaving etc.

PLANNING AND IMPLEMENTI NG

Are HIRA studies carried out and the identified control measures implemented as part of a managed programme? Are risk reduction options weighed up in terms of ALARP and reasonably practicability? Do the operators evaluate consequences of changes since previous HIRA Studies? Are there people on the HIRA team with the right mix of skills and knowledge i.e. engineers, operators, and safety specialists?

•

•

•

•

•

•

•

• •

Studies should have been carried out for all areas of plant and process(es) that will have an influence on safe operation. HIRA methodology should be described. [OSHA 1910.119(e)(2)]; & Appendix C point 4, paras 2, 5, 6 & 7and 9. The team composition should be described. [OSHA 1910.119(e)(4)] & Appendix C, point 4, para 3 The HIRA should address [OSHA 1910.119(e)(3)]. the following areas:Operating and inspection (integrity) histories; the validity of previous risk assessments (hazops etc); hardware and software changes (including organisational); significant incidents and near misses (internal and external to site); audits; measurement against current standards and legislation (Regulatory Good Practice); opportunities to reduce the hazard associated with the process by the use of inherently safer design techniques; and relate to major accident hazards identified in safety reports (Taken from the BP cat cracker investigation report). If plant is prioritised into HHP (high hazard plant) and LHP (low hazard plant), personnel should be able to describe. how this is done, and who does this. [OSHA 1910.119(e)(1)] & Appendix C point 4, para 8.

• Study frequencies should be defined and adhered to. There should be rules for agreeing to dispensations for postponement of HIRA studies. There should also be rules for plant division, to avoid it being used as an excuse to postpone a HIRA.

• Information should be available on plant operation and any gaps in information filled in.

• Any serious deficiencies should be dealt with immediately; The company should be able to describe the standards that are used to check against during a HIRA and how they are decided upon. Best practice should be studied. Any circumstances when deviation from applicable codes and standards is allowed, including who decides, should be clearly spelt out in the company HIRA procedures. Recommendations should be prioritised with reference to standards and best practice. [OSHA 1910.119(e)(5)]; Risk reduction options should be weighed up in terms of ALARP and reasonably practicability. General rule is that measures must be put in place unless the test of gross disproportion is met.

• The safety report should be reviewed and revised as a result of the HIRA Study.

Verification of Documentation:

• Examination and assessment of pre-HIRA information packs. • Evidence of HIRA frequency assessment.

Evidence of significant deviations from applicable standards. Evidence of HIRA Reports. [OSHA 1910.119(e)(7)].

MEASURING PERFORMAN CE

Is there active and reactive monitoring of the operation of the HIRA system to check that: activities within the SMS are being conducted; the elements of the SMS are delivering; and the companies own

• There should be adequate and sufficient checks on the operation of the HIRA system.

• Information should be routinely collected to allow comparison of performance of the system against predetermined standards e.g. number of studies completed, progress with recommendations, prioritisaton of remedial action. Study progress should be monitored prior to completion to flag up delays. Action should then be taken before the deadline for HIRA completion.

• Remedial action should be prioritised and monitored to ensure that it is complete.

• There should not be any outstanding HIRAs or actions from recommendations. Any changes to study recommendations should be

documented and recorded. performance standards (who, what, where, Verification of Documentation:when) are being achieved? • Review lists of recommendations and actions against priorities and

timescales. • Review study files to verify contents.

Is there an AUDIT AND • The design and operation of the system should be subject to an independent REVIEW independent audit. Performance measures should be used to measure assessment of the the effectiveness of procedures and assess performance. Procedures entire HIRA should be in place to implement and review audit findings. system?

Verification of Documentation:

• Audit reports and reports on progress with audit actions; • Investigate how senior management is informed of the results.

Recording Major Hazard Intervention Information On CIS

• Introduction • Information areas • Principles and features of the new • CIS major hazard report

o arrangements

Aim of information recording • •

Implementation of the new arrangements Annex 1

o Overview of how information is to be recorded

o CIS data fields o Linked documents o The 4 new major hazard document

templates

INTRODUCTION

Purpose of this guidance

1. The aim of this guidance is to enable users to efficiently transfer from the form HI 251 for recording major hazard establishment information to the new CIS based arrangements.

2. The guidance provides details of how to record major hazard information in CIS data fields and linked documents and how structured Major Hazard reports can be obtained.

3. If you have any queries on the new arrangements or use of the new document templates which are not answered by the help text in the templates, this guide or your local systems administrator please contact HIDHELP (VPN 523 4194 or e mail HIDHELP) for technical queries or LD6 (VPN 523 5789) for all other queries concerning these arrangements.

Background

4. The HI251 system for recording major hazard intervention information has been in use since early CIMAH days. Since then several significant changes have taken place notably;

• the move towards predominately IT based information storage and retrieval systems (FOCUS/CIS); and

• the introduction the COMAH Regulations placing specific inspection duties on HSE.

5. During 1999-2000 the HI 251 system was reviewed, in consultation with HID LD and CD, to assess how well it met with current information needs for recording of major hazard intervention work.

6. The outcome of the review identified improvements that would:

• Be more compatible with the COMAH regulations and associated processes;

• Make full use of the facilities offered by CIS; and

• Offer efficiency savings over the existing HI 251 system

7. New recording arrangements were drawn up and piloted across HID CI, SI during summer 2001 prior to final agreement by LD management and formal rollout in April 2002.

PRINCIPLES AND FEATURES OF THE NEW ARRANGEMENTS

Aim of information recording

8. The aim of the major hazard information system is to record sufficient (but not excessive) details to enable both field and central units to carry out their functions effectively and efficiently; to eliminate or minimise duplicate recording; and be IT based and user friendly within the constraints of HID’s IT systems.

Overview of how information is to be recorded

9. The arrangements for recording major hazard intervention information are based on the following:

• The HI 251 document is replaced by information stored solely on CIS.

• Information is incumbent based and structured between 3 information areas, namely:

i. basic establishment details;

ii. major hazard information; and

iii. intervention information.

• The diagram at annex 1 shows how the information for each area is made up.

• Information is stored in a combination of data fields (and associated linked documents) and 4 newly developed linked documents.

• The 4 new documents record information on: basic establishment details; major accident scenario details (for LT establishments only); management performance overview; and intervention planning.

• CIS report No. 38 (COMAH incumbent briefing) provides selectable major hazard establishment briefing information and is available from the CIS Reports Module.

CIS data fields

10. Details of the key data fields for each of the 3 information areas (basic establishment details, major hazard and intervention information) are set out in the section on "Information Areas”.

11. The CIS data fields are an integral part of the major hazard information recording system and it is vital that they are fully populated and kept up to date.

Linked documents

12. Detailed information relevant to a major hazard incumbent will be held in a range of documents linked to CIS. Some document templates have been in use since the start of CIS e.g. Safety Report Assessment Manual (SRAM) templates, inspection and investigation reports, major accident report to EU templates etc. These should be created, completed and linked on CIS as per current instructions.

The 4 new major hazard document templates

13. Four new document templates have been created for recording major hazard information i.e., the Basic Establishment Details, LT Major Accident Scenarios, Management Performance Overview, and Intervention Plan templates. The templates can be found in Microsoft word in the HIDLD MH templates folder installed on PCs.

14. Documents created from the 4 new templates differ from other CIS linked documents in that they are designed to be updated from within the CIS system, as new information is available.

Common front page

15. Each of the four documents has a common front cover page to record basic incumbent and document related information, input via an opening dialogue box. See Fig 3.

On-screen help comments and tips

16. On-screen help comments and tips have been included in the templates to provide guidance on the completion and use of the documents. These are highlighted in yellow and are activated by hovering the mouse over the highlighted area.

Template automatic function buttons

17. Three of the new templates have automatic function buttons to enable you to add new parts/tables, topic keywords or organograms to the documents.

18. The function buttons are located on a toolbar created by the templates.

Figure 1 Automatic function buttons as they appear on the major accident scenarios template toolbar.

19. The template toolbars are accessed via the View menu or right clicking the toolbar area of the document and selecting the appropriate toolbar.

Use of Microsoft Word 2000 versions facility

20. Documents created from the templates are designed to be updated from within CIS without the need to create and link further revised copies. Word 2000 offers the facility to save versions of a document within the one file. Earlier versions of the document can therefore be opened and read even though the document has subsequently changed.

21. To save a version of a document:

Click on the

Click OK

Select ‘versions….’ from the File function on the menu bar. The ‘versions’ screen will then appear.

save now button and enter brief details of why the version is being saved in the comments dialogue box.

and the version is saved with the details of the time and date entered automatically.

22. To view earlier versions of the document, enter the version facility via the File function on the menu bar, highlight the version you wish to read and click on ‘open’. Note: you cannot make changes to earlier versions.

23. It is recommended that use of the version save facility is restricted to ‘freezing’ versions of the document at key development stages when significant changes are made to a document.

24. Users are requested not to deploy the ‘automatic save a version on close’ facility. Use of this feature can result in large numbers of versions being saved where minor or even no changes to the document have been made, leading to document management difficulties.

Hypertext links

25. Hypertext links can be created from any text or object from within a Word 2000 document to other documents accessible to your PC, i.e. documents on your c, h or i drives, the HSE intranet or internet. This enables links to be made to relevant HSE / industry guidance, company web sites etc.

26. Note: hypertext links to documents on your c,h,& i drives will only be accessible by users with access to these drives. All HSE users have access to intranet and Internet links.

27. To create a hypertext link:

Highlight the word or object the link is to be made from and Right click with mouse button,

Select hyperlink from the menu that appears. The insert hyperlink screen should appear as in Fig.2.

l

Select what you want to link to e.g. "existing file or web page".

Select the file/web page you wish to link to. These can be se ected either from those listed, by browsing for files/web pages/bookmarks or by directly typing in the full file or web page name.

If using the browse route for files select the file to be linked to, click OK and the file name will be automatically inserted in the correct place in the "insert hyperlink" screen.

If using the browse route for web pages this will take you directly to the intranet/internet, from which you go to the page you wish to link to and then either minimise internet explorer or close it down. The web address will then be automatically inserted in the correct place in the "insert hyperlink" screen.

Click OK in the "insert hyperlink" screen and the link is made.

Figure 2 The insert hyperlink screen.

Creating a document from the templates.

28. To create a new document from the templates:

Click OK

Launch Microsoft Word 2000 and select "new…" from the file menu.

Select the template tab page "HIDLD_MH templates" and select the document template you require.

Complete the dialogue box information.

Save the document on your c,h or I drive until you are ready to link it to the CIS Incumbent record.

Complete the document.

Attach the document to the CIS incumbent record

29. When a new document is created from the template an opening dialogue box appears (see Fig 3) and prompts you for a number of details about the establishment or installation. Once input, you will not be required to enter these details again. Any future editing of the front-page incumbent details will also update the information held in the document page headers.

30. Labelling of documents is dealt with by CIS and Word2000 applications and you do not have to provide a title for the documents in the front page. The optional field for a title has been included for local use e.g. to label an installation-specific plan for a COMAH multi-installation establishment.

31. An optional field has also been included to record the name &/or number of the unit if an installation specific document is to be created. Unit names &/or numbers should be consistent with the naming conventions adopted in the Unit module on CIS (to align with the safety report assessment process).

Figure 3 The opening dialogue box which appears on creating a new document from the templates.

Linking to CIS

32. The documents should be attached to the relevant incumbent record of CIS in the normal way and updated using the edit document facility from within CIS.

33. To link a document to the incumbent record on CIS:

Launch CIS and go into the incumbent module.

Find the relevant incumbent record.

Attach the document to the incumbent via the documents tab page.

Provide a title and ownership details for the document.

Select the CIS document category for the document from:

• MH Basic Establishment Details;

• MH Management Overview;

• MH LT Major Accident Scenarios; or

• Intervention Plan.

Provide a comment for the attached document.

Ensure that the ‘approved ‘ flag is not checked.

Save.

34. You are required to provide a title for the documents (up to 30 characters). Simple reference to e.g. ‘establishment’ will suffice for most cases. However, the installation name should be included in the title if the document is installation specific at a COMAH multi-installation establishment. Be consistent with the naming conventions for installations as in the unit module on CIS and as adopted for the safety report assessment process.

INFORMATION AREAS

Basic establishment information area

35. The purpose of having good basic establishment information is to provide a brief overview of the establishment to enable anyone unfamiliar with, or needing to refresh their memory about, the establishment to gain an understanding of:

• the business conducted at the establishment:

• the major hazard processes undertaken;

• the key personnel involved;

• significant environmental and offsite feature; and

• the key guidance/information relevant to the establishment.

36. This information is recorded in the CIS data fields identified below and the new Major Hazard Basic Establishment details CIS linked document .

Key CIS basic establishment data fields

37. The table below identifies the key CIS data fields that need to be completed and kept up to date to provide good quality basic establishment information.

Module Tab Page Data Field(s)

Client Client details Client ID

Client name

Client type

Main address all fields

Management group

Note - any appropriate information.

LU check box

Client Reps All fields for all representatives

Departments All fields for all departments

Incumbent None

PKA/SKA All (list any PKAs & SKAs)

Duties All (list all identified duties)

Alias All (list any aliases)

Location Locn details Location ID

Location name

Address all fields

Map reference

Note

Units All fields for all COMAH installation units. Naming conventions should match safety report submissions.

All fields for other units

Locn Reps All fields for all representatives

Incumbent None

Add’tnl Details Consultation distance

Domino effect applies

Other Enf’ing Auth All fields for other Authorities. For HID enclave sites, the primary enforcing authority should be set to ‘FOD’ and the other enforcing authority set to ‘HID’.

Hazardous Subs All fields for all substances

Incumbent Representatives All fields for all representatives

Duties All fields for all duties especially major hazard duties e.g. COMAH TT or LT operator.

CIS major hazard_basic establishment details document

38. The purpose of this document is to provide a structured format in which to record basic establishment information that is not held within the CIS data fields.

39. A basic establishment details document is required for both top and lower tier establishments. Individual documents should not be created for units/installations within an establishment.

40. The document is created from the MH_Basic Establishment Details template located in the HIDLD MH template folder. See section: Creating a document from the templates.

Template structure

41. The template is divided into two sections

• The front cover (see Fig 3)

• A structured section to record brief details of key establishment information as set out below. Guidance on what to record is provided within the template in the highlighted help comments.

Section What to record

Nature of Business Brief outline of the business conducted at the establishment, e.g. storage, distribution and cylinder filling of LPG

Safety Management System structure

Brief outline of ownership, management and control arrangements for the establishment. If helpful, organograms can be included here or at the end of the document. (See section on organogram template function button)

Multi installation information For multi installation establishments a brief description of how the establishment has been unitised. It is not necessary to list all the units as this information is provided on the CIS unit tab sheet in the location module.

Primary Major Hazard processes under taken

Outline details of the key processes operated at the establishment. Tie in with units if multi-installation.

Location Information on the location of the establishment e.g. Map reference, directions to the site, hypertext link to a map of the site from internet map provider such as multimap.com, www.ordsvy.gov.uk

Significant environmental information

Brief details of any sensitive features of the environment in the vicinity of the establishment, e.g. SSSI's etc

Significant offsite information Brief details of any vulnerable offsite populations in the vicinity of the establishment e.g. schools, hospitals etc.

Pre CIS major incidents Brief details of any major incidents at the establishment not recorded on CIS

Relevant standards/guidance

References to key information documents specifically relevant to the major hazard processes of the establishment. Examples include: GHIAs, significant British Standards or industry guidance. Hypertext links can be created to any such guidance on the HSE intranet or the Internet.

Relevant documents held on file References to key documents held on file that are relevant to the major hazard aspects of the establishment.

Other information/issues to note Any other information that may be of use to regulating the establishment, e.g. links to company web site H&S information.

42. The template features an automatic function button to enable an organogram to be created and pasted within the document. The button is located on the template toolbar, see Fig 4. To access the toolbar, right click in the toolbar area of the document and select the organogram toolbar.

43. To create an organogram place the cursor where the organogram is required and then click the create organogram button. This will open the Microsoft organization chart program from which organograms can be created.

Figure 4 – Function button to create an organogram

44. Once you have created the organogram it should be saved and the application closed. The organogram will appear within the document. To edit the organogram double click on it and the chart will open up for editing.

45. The document should be linked to the relevant incumbent record on CIS. See section on linking to CIS for further details.

46. The document can be updated from within CIS using the edit document facility. It is recommended that the Microsoft Word version-save facility be used to ‘freeze’ a version of the document when it is first completed and following subsequent significant changes.

Major hazard information area

47. The major hazard information area holds data on the major accident hazards present at an establishment and an analysis of the relevant prevention, control and mitigation measures.

48. For COMAH TT establishments this information is contained in the COMAH safety report, which undergoes detailed assessment by the CA. On CIS, each safety report is assigned a safety report assessment job via the CIS job module and key assessment documents are linked.

49. Major hazard information for COMAH LT establishments is recorded in a new CIS linked document created from the Major Hazard_LT Major Accident Scenarios template.

Key CIS major hazard data fields

50. The table below identifies the key CIS data fields that need to be completed and kept up to date for COMAH TT establishments.

Module Tab Page Data Field(s)

Job Job details for: Job type, Manager postholder, title, outline, status, outcome, job id number.

• all safety report assessment job types (Full, Part and completion check)

• Limitation of information in safety reports job.

Tasks Title, Outline, Status.

(Note specific guidance exists for setting up a safety report assessment job.)

CIS major hazard_ LT major accident scenarios document

51. The purpose of this document is to provide for COMAH LT establishments a record of the major accident hazard scenarios, associated prevention, control and mitigation measures and HSE’s assessment/ inspection of them.

52. The document is only required for COMAH LT sites but can be used for non-COMAH sites at local discretion.

53. The document can be used to record major accident scenario information for the establishment as a whole or can be installation specific.

54. The document is created from the MH_Major Accident Scenarios template located in the HIDLD MH template folder. See Creating a document from the templates.

Template structure.

55. The template is divided into two sections,

• The front cover (see Fig 3); and

• A structured section to record the major accident scenarios, associated potential initiating events, prevention, control and mitigation measures and HSE’s assessment of them. See Fig 5.

56. A major accident scenario is the set of circumstances which could lead to a major accident and the potential consequences should it arise e.g. fire in chemical store leading to toxic plume, loss of containment from bulk storage leading to ignition. Potential initiating events are the conditions and events considered significant in bringing about a major accident scenario. Guidance on what to record is also provided within the template in the highlighted help comments.

57. Note: For many sites the identification of the scenarios is aided by the GHIA guidance series.

Figure 5 Screenshot of the major accident scenarios page.

58. The document allows for an indefinite number of accident scenarios to be created to match the complexity of the establishment/ installation.

59. The major accident scenario table is divided vertically into two parts to record:

• a breakdown of the potential initiating events and the prevention/ control measures claimed to be in place; and

• the claimed mitigation measures.

60. Text fields are provided against both parts of the table to record:

• the conclusions of HSE’s assessment of the suitability and effectiveness of the measures claimed to be in place or any other comments arising from HSE intervention (opinion may be derived from desk top assessment of information or from an intervention at the establishment)

• the proposed HSE action from a choice of five options:

to be assessed;

no further action;

inspect;

verify; or

refer to EA/SEPA.

• any link(s) to a planned intervention item; and

• an optional field to reference key relevant documents such as inspection reports etc.

Template function buttons

61. The template features three automatic function buttons to enable customisation of the document with the appropriate number of major accident scenarios and related information. The buttons are located on a template toolbar, accessed by right clicking the toolbar area of the document and selecting the MAS toolbar.

Figure 6 Screenshot showing automatic function buttons on the major accident scenarios template.

62. The Insert new scenario button adds new scenario tables sequentially to the document. Each scenario table begins on a new page.

63. The Insert HSE action button generates a dialogue box from which one of five proposed actions (for the control or mitigation measure being assessed) is selected. Note: HSE actions can also be selected by double clicking on the blue text in the HSE action column.

64. The Insert new row button will insert a new row to the part of the table in which the cursor is placed.

65. The document should be linked to the relevant incumbent record on CIS. See section on linking to CIS for further details.

66. The document should be updated from within CIS using the edit document facility. It is recommended that the Microsoft Word version-save facility be used to ‘freeze’ a version of the document when it is first completed and following subsequent significant changes or review.

Intervention information area

67. The intervention information area contains the major hazard inspection and investigation information relevant to the establishment.

68. Information is recorded in the CIS data fields identified below (and supporting intervention documentation) together with two new CIS documents created from the MH_Management Performance Overview and Intervention Plan Templates.

Key CIS intervention data fields

69. The table below identifies the key CIS data fields that need to be completed and kept up to date to provide good quality intervention information.

Module Tab Page Data Field(s)

Notifications Notification details

Accidents Notification ID, type, date, kind, process, cause, investigated.

D/Os Notification ID, type, date, process, investigated

Ill health Notification ID, disease, date, investigated.

Complaints Notification ID, nature of complaint, date reported to HSE, investigated, complaint justified.

Other Notification ID, type (ie. COMAH major accident), management group, date reported to HSE, date occurred/identified, summary, investigated date, investigated, associated incident.

Notification Incident details Incident ID, incident title, date, associated notifications of incidents

Enforcement Details ID number, type, issue date, level of compliance, note. notices

Breaches Act, section, sub section or Regulation, number, paragraph

Enforcement Details ID number, offence start date, costs (total and hearing), fine prosecution

Breaches Act, section, sub section or Regulation, number, paragraph

Jobs Details (for type audit inspection, Job ID number, type, title, status, status date, associations, documents. local project)

Linked documents

70. Relevant linked documents providing intervention information are:

i. Investigation reports

ii. Reports of major accidents to EU

iii. Prosecution reports

iv. Intervention reports, specialist inspector reports etc.

v. Intervention plan Document(s)

vi. MH_Management Performance Overview document

CIS Intervention Plan document

71. Specific guidance on creating and completing the intervention plan document is given in Appendix 5 of Chapter 3 (Intervention Plans) of the HID LD Inspection Manual.

CIS major hazard_management performance overview document.

72. The purpose of the management performance overview document is to provide a brief overview of HSE’s assessment of current health and safety management performance at the establishment against the eight safety management system elements set out in schedule 2 (Para. 4) of the COMAH Regulations. The overview should be based on a digest of HSE’s findings from interventions at the establishment and limited to key issues and comments.

73. A detailed account of the management arrangements or their assessment is not required. This data will be set out in safety reports, MAPPs etc., with analysis through the inspection programme and recorded in report documentation.

74. A management performance overview document is required for both COMAH TT and LT establishments but can also used for non-COMAH companies at local discretion. Note individual documents should not be created for units/installations within an establishment.

75. The document is created from the MH_Management Performance Overview template located in the HIDLD MH template folder. See Creating a document from the templates.

Template structure

76. The template is divided into two sections comprising:

• The front cover; and

• A structured information table to record key performance issues/ comments, with provision made for recording references to an intervention plan or relevant key documents such as inspection reports.

77. The table below identifies what to record against each of the eight elements. This guidance is also provided within the template in the highlighted help comments.

COMAH Schedule 2 management Elements What to record

Major Accident Prevention Policy (MAPP)

Key performance issues/ comments and comments on the overall aims and principles of action with respect to the control of major accident hazards.

Organisation and Personnel

Key performance issues/ comments on the roles and responsibilities of personnel involved in the management of major hazards at all levels in the organisation; the provision and maintenance of appropriate levels of management and employee competence and the involvement of employees and other personnel in the control of major accident hazards (COMAH Schedule 2, Para 4a).

Identification & Evaluation of Major Hazards

Key performance issues/ comments on the adoption and implementation of arrangements for systematically identifying major hazards; assessing the risks arising from normal and abnormal operations and determining necessary control measures (COMAH Schedule 2, Para 4b).

Operational Control Key performance issues/ comments on the adoption and implementation of procedures and instructions for safe operation, including maintenance of plant, processes, equipment and temporary stoppages (COMAH Schedule 2, Para 4c)

Management of Change Key performance issues/ comments on the adoption and implementation of procedures for planning modifications to, or the design of new installations, processes or storage facilities (COMAH Schedule 2, Para 4d).

Planning for Emergencies Key performance issues/ comments on the adoption and implementation of procedures to identify foreseeable emergencies and the preparation testing & review of emergency plans (COMAH Schedule 2, Para 4e).

Monitoring Performance

Key performance issues/ comments on the adoption and implementation of procedures for the ongoing assessment of compliance with objectives set by the MAPP and safety management system; the mechanisms for investigating and taking corrective action in the case of non-compliance; system for reporting major accidents or near misses and their investigation and follow up on the basis of lessons learnt (COMAH Schedule 2, Para 4f).

Audit and Review

Key performance issues/ comments on the adoption and implementation of procedures for periodic assessment of the MAPP and the effectiveness and suitability of the safety management system; the documented review of performance of the policy and safety management system and its updating by senior management (COMAH Schedule 2, Para 4g).

78. The management performance overview document should be linked to the relevant incumbent record on CIS. See section on linking to CIS above for further details.

79. The document is designed to be updated from within CIS using the edit document facility. It is recommended that the Microsoft Word version-save facility is used to ‘freeze’ a version of the document when it is first completed and following subsequent significant review e.g. following a major period of intervention or review of management at the site.

CIS major hazard report

80. The nature of the CIS structure means that the required information on Major Hazard sites is held in a range of modules and linked documents. To provide easy access to a complete picture of information on a Major Hazard establishment a standard CIS report can be obtained from the CIS Reports module (Report number 38: COMAH Incumbent Briefing).

81. The diagram in annex 1 sets out the information that will feed into the report.

Implementation of the new arrangements

Timing

82. The new arrangements for recording major hazard information took effect from April 2002.

83. For COMAH TT establishments the new arrangements should be applied at the time of completion of the safety report assessment process and/ or preparation of the 5 year intervention plan and for COMAH LT establishments, at the time of the next significant planned intervention. It is accepted that full implementation of the new arrangements, particularly for LT sites, will take a number of years.

Existing HI 251 documents

84. Existing electronic versions of HI251s should be saved in Microsoft Word format and linked to the relevant incumbent record against the MH HI251 CIS document category.

Annex 1