HID CI / SI Inspection Manual

Open Gov. Status: Fully Open Issued: 11/04/2001 Review:

11/04/2003
HID CI, SI Inspection Manual
Introduction Audits
Major Hazard Intervention Policy Operation of the Lead Unit System
Major Hazard Intervention Plans Assessing Risk Control Systems
Incumbents Ratings System Recording Major Hazard Intervention Information on
Inspection Techniques CIS
Introduction
1. The Hazardous Installations Directorate is part of the Operations Group. Core processes, including inspection,
are controlled by agreements reached by the Operations Management Team (OMT). The OMT sets broad
standards that HID needs to operate within, including the OG wide inspection procedure.
2. HID needs to provide information to its staff and have written procedures to ensure that inspectors carry out the
inspection process in the most effective way, drawing on the best practice that has been developed over time. It
also aids consistency across all Units and between inspectors irrespective of their grade and experience.
3. This manual is targetted at the Chemical Industries and Specialist Industries divisions in HID. A separate OSD
inspection manual is provided for staff in HID's Offshore Division. This manual should be read in conjunction with
other guidance, which is linked by the hypertext. It will be updated and reviewed on an annual basis.
4. A major review of this manual is now underway following introduction of the OG wide investigation procedure.
Until this review is complete, discrepencies between this manual and the OG wide inspection procedure may
exist. Staff should note that the OG wide procedure sets the minimum standard, whilst any more onerous HID
specific standards imposed by this manual will remain valid unless formally withdrawn.
5. A hard copy of the manual will not be produced (although sections can be printed by staff who require it), as it is
more efficient to present the manual on the INTRANET, and make updates and amendments to it in this way.
Definition
6. Inspection is the process carried out by HSE warranted inspectors which involves assessing relevant documents
held by the duty holder, interviewing people and observing site conditions, standards and practices where work
activities are carried out under the dutyholder's control. It's purpose is to secure compliance with legal
requirements for which HSE is the enforcing authority and to promote improving standards of health and safety
in organisations
Contact
HID HQ 1D
St Anne's House
VPN : 523 3939
Major Hazard Intervention Policy
Introduction LD Industry Groups
Priorities Enforcement
Non-MH Health & Safety Work Appendix 1 - Summary
Contractors Appendix 2 - COMAH Installation Prioritisation
Intervention Approaches Table
Appendix 3 - The Intervention Process
INTRODUCTION
1. This Chapter provides guiding principles for inspectors on interventions at LD premises. It covers:
Aims and objectives;
Prioritising sites;
Role of sectors;
Intervention approaches.
Scope
2. This guidance applies to LD1, 2 (except explosives sites), 3 and 4. LD2 have separate arrangements in place for
explosives sites to meet HID's intervention policy.
Policy
3. LD's intervention policy is to
Give priority to those premises that have the greatest hazards and risks;
Eliminate or reduce risks of major accidents;
Meet operational priorities;
Adopt intervention approaches that are proportionate to the size, complexity, hazards and risks
at those premises;
Ensure that all COMAH installations are inspected at least once every five years.
A summary of this policy is at Appendix 1.
Aims and objectives
4. The aim of all interventions is to prevent injuries and ill health. Within this broad aim:
All interventions aim to fulfil HSE's Mission and to deliver the HSC enforcement policy;
Interventions are consistent with current HSC continuing aims, strategic themes and objectives;
Intervention activity is targeted according to hazard, risk and operational priorities;
Interventions are conducted consistently across the duty holders subject to inspection by the
Division;
There is an appropriate use of a range of intervention techniques.
5. The objective(s) of particular interventions will depend on the intervention topic(s) selected. At a TT COMAH
establishment, for example, an objective may be to reduce the risk of a release of chlorine. At other premises an
intervention may be carried out as part of LD's Priority Programme and seek, for example, to prevent falls from
road tankers.
Principles of intervention
6. Inspectors should apply the following hierarchy, to ensure that duty holders:
1. Eliminate hazards and reduce risks at source where reasonably practicable e.g.
by reducing inventories of dangerous substances or designing processes to
minimise loss of containment;
2. Control risks by e.g. employing management systems for maintaining plant
integrity;
3. Minimise the effects of any incidents by suitable mitigation measures.
INTERVENTION PRIORITIES
LD Intervention priorities at major hazard installations Planned interventions at:
existing COMAH establishments
existing non-COMAH premises
new premises
Identification of new premises
7. Inspectors should use the screening methods below to prioritise installations / sites for interventions.
LD Intervention priorities at major hazard installations
8. As a first screen, LD's intervention priorities are (in order):
1. Top-tier COMAH establishments;
2. Lower-tier COMAH establishments;
3. Sub-COMAH premises e.g. premises that are outside the scope of COMAH but
which have dangerous substances with MH potential such as those subject to
the Planning (Hazardous Substances Consent) Regulations 1992.
9. Units should plan annually to deploy resources proportionately against each of these categories.
10. Screening solely according to hazard based on COMAH thresholds fails to take into account several other
important factors, such as the population at risk and the type of installation. A risk calculation tool, ARICOMAH
(an acronym for Approximate Risk Integral for COMAH sites) has been developed and applied to a number of TT
establishments to produce an indication of the magnitude of the societal risks they present. As more ARICOMAH
values are calculated over the next couple of years, the intention is to use them as the main screening tool for
COMAH installations.
11. In the meantime, units should use the two tools described below to provide a further screening:
For COMAH installations the installation prioritisation table at Appendix 2 should be used.
Inspectors may also use this table for sub-COMAH sites when there are significant hazards
present and they wish to rank these sites against COMAH installations;
For other sites the HID rating system (Incumbents Ratings System) should be used.
12. Neither of these two tools is sophisticated enough to give absolute measures but both provide a broad indication
of relative site / installation intervention priorities.
Planned interventions at existing COMAH establishments
13. All planned major hazard interventions at these establishments are required to be recorded on an intervention
plan (see Major Hazard Intervention Plans).
14. All sites should be inspected during the work year that their installation score exceeds 50. This will ensure that all
COMAH installations are inspected at least every five years. Installations with the highest scores should be
considered for interventions first.
Planned interventions at existing non-COMAH premises
15. The relative priority for interventions at fixed premises that are known to LD is initially determined by either the
prioritisation table at Appendix 2 (for sub-COMAH sites with significant hazards) or the rating system (see
Incumbents Ratings System) for others. Premises where the prioritisation table is used should be inspected at
least once every five years i.e. when the score reaches 50. Premises with the highest scores / ratings should be
targeted first.
Planned interventions at new premises
16. All new premises should be contacted within two months of coming to our attention. This may be a telephone
contact to establish, for example, the size, complexity and hazards at the premises. Inspectors will need to
compare this information with their knowledge of existing premises to determine whether an inspection should be
carried out and its priority, using the screening methods described under LD Intervention priorities at MH
installations as a guide. Where the decision whether to inspect is marginal it is better to inspect.
17. The primary purposes of initial inspections of COMAH sites are to:
Assess whether operators have in place management systems for the prevention and mitigation
of major accidents;
Identify issues to include in the intervention plan for the establishment;
Bring the establishment into the planning system by giving an inspection rating using the
prioritisation table.
18. The purposes of inspections at non-COMAH premises that LD has not previously visited are to:
Identify any serious risks and take appropriate action;
Bring the establishment into the planning system by giving an inspection rating, using either the
prioritisation table or inspection rating system.
Identification of new premises
19. LD will identify new premises from a number of sources. They include:
Receipt of notifications e.g. COMAH, Factories Act and RIDDOR from duty holders;
Information from the public e.g. complaints;
Information from other HSE directorates;
National and local initiatives focusing on specific sectors and issues, e.g. warehousing, that
requires the Division to identify previously unknown premises.
20. New premises identified by RIDDOR notifications or complaints may need to be visited urgently depending on
the nature of the incident (see SPC/Enforcement/04).
NON-MAJOR HAZARD HEALTH AND SAFETY WORK
21. Selecting non-MH premises for interventions is based on three criteria:
LD's rating system (for those we know of) and the need to give priority to those not previously
visited;
LD's Programmes, which will target particular industry groups and issues;
A means of developing less experienced inspectors.
INTERVENTIONS WITH CONTRACTORS
22. Our intervention strategy is based primarily on contacts with duty holders at fixed LD-registered sites. However,
there are other duty holders such as contractors, whose activities can significantly affect health and safety at LD
sites. Our approach here is twofold:
a. To continue to focus regulatory effort on the operators of fixed sites who engage contractors and
seek to ensure that they have adequate arrangements for selecting and controlling contractors.
This will usually entail some direct contact with contractors on site to assess standards and
verify that operators' arrangements are effective;
b. Where appropriate to intervene directly with contractors' senior management centrally, possibly
jointly with other directorates / divisions. The criteria below provide a guide for when this
approach may be appropriate:
Contractors who are engaged to carry out safety critical work, including
designing plant / equipment;
Major contractors e.g. who work across a number of sectors (and D/Ds);
Contractors who are identified as having poor safety performance.
INTERVENTION APPROACHES
23. Table 1 indicates the normal intervention approaches and inspector experience required for different types of
premises. All interventions require a balance of observing workplace standards, verifying hardware and software risk
control measures, examining documents and interviewing personnel. As the hazards increase and management
structure becomes more sophisticated the scope of the intervention approach will continue to involve inspection of
workplace precautions and controls and extend to examining management systems and senior management influence
such as leadership.
Table 1: Intervention approaches for different types of LD premises.
Premises Normal intervention approach
1. Small firm (<5 employees). No MHs. 1 or 2
management levels i.e. self-employed or
director and employees only.
Primarily observation of workplace precautions. Select sample topic(s).
Implicitly inspect against POPMAR to identify underlying causes of
defects found e.g. inadequate risk assessments; failure to monitor
preventive measures. Intervention by Band 4 inspector or above.
2. SME (>5;<50 employees). No MHs. Basic
management structure i.e. director plus
manager(s) / supervisor(s) and employees.
As 1 above but with explicit inspection against POPMAR to identify
underlying causes of defects found. Intervention by Band 4 inspector or
above.
3. Simple site with MHs but below COMAH
thresholds e.g. storage of dangerous
substances and / or simple processing
activities.
As 1 or 2 above depending on size and sophistication of management
structure. Intervention by Band 3 inspector or above.
4. Complex site with MHs but below COMAH
thresholds e.g. complex processes with
potential for latent defects.
Inspection of key risk controls in place for preventing / mitigating major
accidents. Intervention by Band 3 inspector or above with at least 1
year's experience at Band 3.
5. COMAH installation with only storage /
simple processing activities.
Inspection of key risk controls in place for preventing / mitigating MAs.
Intervention plan required to ensure that technical and SMS aspects
addressed, including verification of risk control measures in safety
reports and other documents, over period of plan. Intervention by Band
3 inspector or above with at least 1 year's experience at Band 3.
6. Complex COMAH installation. Inspection of key risk controls for preventing / mitigating MAs and
verification of risk control measures in safety reports and other
documents. Intervention by Band 3 inspector or above with at least 3
years' experience at Band 3. Intervention plan required.
LD INDUSTRY GROUPS
24. LD 1,3,4 & 6 have identified 6 industry groups. One of the objectives of these groups is to target key hazards and
risk control systems to direct HSE's resources to areas of greatest need within their group.
25. The 6 groups are:
Chemical manufacture and storage (including waste);
Paints and coatings (including glues & sealants);
Health and hygiene products (including pharmaceuticals);
Carriage of dangerous goods;
LPG and other industrial gases;
Oil refining & associated industries.
26. As intelligence regarding these groups is developed HID will identify the most important intervention issues and
provide benchmarks for appropriate intervention resources for types of premises. Inspectors should contact LD6
for more information about this work.
27. LD6 also develop and publish annually national operational priorities that address major hazard and conventional
occupational health and safety issues.
ENFORCEMENT ACTION
28. Inspectors should use the Enforcement Management Model (EMM) and relevant operational guidance such as
SPCs to inform decisions on enforcement action.
THE INTERVENTION PROCESS
29. All interventions follow a common process. This is described in more detail in Appendix 3 but the elements are
listed below:
Planning and preparation;
Carrying out the contact;
Recording the outcome;
Monitoring action and progress;
Reviewing the intervention.
APPENDIX 1: SUMMARY OF INTERVENTION POLICY
Selecting for
intervention: first
1. TT COMAH Installations 2. LT COMAH Establishments/
Installations
3. Non-COMAH Premises
screen
Second screen Prioritisation table (Appendix 2).
Select installations with highest
Prioritisation table (Appendix 2).
Select establishments /
Prioritisation table for sub-
COMAH sites with significant
scores first installations with highest scores hazards. Rating system
first (Incumbents Ratings System) for
others. Select premises with
highest scores / ratings first
Intervention Safety management system Safety management system Depends on size, complexity,
approach inspection for MH controls (see inspection for MH controls (see hazards & risks. See Table 1 for
Table 1) Table 1) guidance
Operational
priorities
Published annually by LD6 Published annually by LD6 Published annually by LD6
APPENDIX 2: COMAH INSTALLATION PRIORITISATION TABLE
Installation type Score Population at
Risk
HID
Intervention
Information &
Performance
Overall Score
TOXIC Alkylation unit 10 Large
Site in built-up
area. Large Nos
in most parts of
CD and/or large
nos of people on
site i.e. >100.
Score 4
Add 10 for each
year that there
has been no
COMAH site visit
by an HID
inspector
(regulatory or
discipline
specialist).
The years are
counted from the
start of the
1999/00 work
year i.e. 1 April
1999 when
COMAH came
into force.
This is an
optional column
to adjust scores
to take account
of factors listed
in Major Hazard
Intervention
Plans.
Inspectors
should
summarise the
reasons for
adjustments (+
or -) and indicate
the adjustment
score.
Any reduction
must be limited
to ensure that
the score after
5 years is at
least 50 so that
all installations
are inspected at
least once
every five
Installation Type
score x
Population at
risk score +HID
Intervention
score, modified
as described
under
Information &
Performance =
the Overall
score.
Manf. Liquefied toxic gases 10
Chem manf. Sites with bulk
storage of liquefied toxic
gases.
8
Ammonium Nitrate Manf. 7
Water treatment using bulk
chlorine
6
Water treatment using
chlorine drums
4
Bulk storage of toxic
chemicals
5
Chemical user. Toxics in
drums
3 Medium
Some local pop
Large parts of
CD with low nos
and/or significant
on site
population
i.e.>50. Score 2
Packaged goods chemical
warehouse
3
FLAMMABLE Petrochemical processing,
including Refineries
8
Gas terminal 6
LOX manf. 6
years.
U/ground cavity storage LNG 5
LNG Storage 5
HP Gas storage 4 Small
Low pop density
in all parts of
CD. Few people
on site i.e.<10.
Score 1
Chemical Manf. Sites with
flamm liquids in process
4
Chem. manf. Sites withbulk
flamm liquids in storage
3
Peroxide Manf. 3
LPG bottling 4
LPG Bulk vessels and 3
distribution
LPG cylinder storage 1
Spirit bottling 1
How to Use the COMAH Installation Prioritisation Table
1. The table provides a means of scoring all COMAH installations. Those installations with the highest scores
should be selected for intervention first.
Installation type
2. Use the list provided to identify the type of installation and take the corresponding score. For example if the
installation is a packaged goods chemical warehouse the score will be 3. In cases where installations have both
toxic and flammable substances, select the option that gives the highest score. For example if an installation
stores both flammable and toxic substances select score 5 for the toxics rather than 3 for the flammables.
Population at risk
3. COMAH defines an installation as a unit in which dangerous substances are, or are intended to be produced,
used, handled or stored. Most establishments will comprise a single installation but some refineries will have a
number of installations. Inspectors can divide establishments into installations as they see fit. Installations may
be set based on e.g. processes, site layout, safety report submissions or size.
4. Select the most appropriate category for the installation in question and take the corresponding score. The
population at risk is the highest population in the vicinity of the installation and should include people on site, at
neighbouring workplaces and, for example, houses, schools, shops etc.
5. Multiply the installation type and population at risk scores. For example, an ammonium nitrate manufacturing
installation (score 7 for installation type) with a medium population at risk (score 2) would score 14.
Regulatory intervention
6. Identify the relevant score from the HID Intervention column. For example, if the installation has not received a
COMAH intervention, i.e. an intervention that addresses major hazard issues, for 3 years enter 30 (10 for each
year).
7. Add the regulatory intervention score to the product of the installation type and location scores.
Information and Performance
8. This column takes account of other factors that may affect inspection priorities and frequencies. The factors are
listed in Major Hazard Intervention Plans paragraph 19. Inspectors should record any relevant factors and how
they affect the score. The score may be increased or decreased depending on the factors. For example, an
installation that has very high standards of control of hazards may have its score reduced. However, the
minimum inspection frequency of once every five years should be maintained.
9. The installation's overall score is the product of the installation type and location scores plus the regulatory
intervention score, modified by information and performance factors.
APPENDIX 3: THE INTERVENTION PROCESS
Interventions
1. Interventions are planned processes designed to secure compliance with the law and include:
Inspections and audits - including verification to test conformity with information contained in
safety reports and to monitor duty holders' implementation of stated prevention, control and
mitigatory measures;
Other methods of contact such as projects;
Interventions do not include incident and complaint investigations.
2. The Intervention Process section lists the five elements of the intervention process. This Appendix provides more
detail on what each element involves. Where appropriate it provides further information on issues or refers to
other sources.
Planning and preparation
Intervention priorities;
Deciding which topic(s) to address (see also Major Hazard Intervention Plans);
Deciding on an intervention approach to use (Table 1);
Identifying experience required for interventions (Table 1);
Informing the duty holder (unless an unannounced visit is proposed - see below).
3. HID LD policy is to allow local inspectors a choice of whether or not to pre-arrange visits. There are advantages
and disadvantages of unannounced visiting.
4. Advantages:
Conditions found reflect the normal state of affairs;
Can be more efficient use of inspectors' time because they can go directly from one site to
another with no wasted time between appointments.
5. Disadvantages:
In practice the ability to significantly improve conditions before an inspector's visit is very limited
- companies whose health and safety performance is poor often do not know what standards
apply and inspectors will readily identify duty holders' hasty attempts;
Inspections at larger and more complex sites include a greater scrutiny of safety management
issues and the systems for controlling health and safety. This involves examining documents
and interviewing people in addition to observing workplace conditions. It is more effective to pre-
arrange these visits so that inspectors see the right people who are properly prepared with the
relevant documents available.
6. In general, unannounced visits are appropriate at smaller, less complex sites when a relatively short, ie less than
half a day's, inspection is proposed.
Carrying out the contact
Explain inspector's role and powers (leaflet HSC14 - see below);
Explain purpose of the intervention;
Gain an understanding of the management structure and interview the right people, examine
documents and observe workplace conditions;
Use the appropriate intervention approach to ensure that duty holders have SMS in place for
maintaining plant integrity (see below);
Inform personnel of the outcome of the intervention; in particular any enforcement action
proposed.
7. Inspectors should ensure that duty holders and their employees whom we contact for the first time are given a
copy of leaflet HSC14 What to expect when a health and safety inspector calls.
8. A suggested process safety management system-based intervention approach for major hazard issues is shown
in Figure 1. In this example the process is preventing loss of containment from bulk storage of flammables. The
process on which to focus at any particular intervention will be informed by whatever the most significant major
accident scenario is at the installation under consideration.
9. The smaller solid circles around the perimeter of the central circle represent primary risk control systems (RCS)
that are relevant to controlling the process. Inspectors should examine these RCS to the extent that they feel
necessary to be confident that each is adequate. For example, confirmation of adequate plant design for existing
plant may require little more than confirming vessel design standards. Planned plant inspection, on the other
hand, particularly for older vessels, may need to be examined in much greater detail.
10. The dotted circles represent secondary (in that they are subsets of the primary RCS but no less important in
terms of control measures) RCS that are likely to be relevant. Figure 1 shows two examples linked to the
maintenance RCS, though they may also be relevant to other primary RCS.
11. This inspection model is currently being developed and more detailed information will be provided in other
chapters of this manual in due course.
Figure 1 - Example of a Process Safety Management System Based Intervention Approach for the Inspection of
Bulk Storage of Flammables Showing Primary & Secondary RCS
Recording outcomes
Confirm matters in writing;
Complete CIS records;
Update intervention plans.
12. The EMM provides guidance on when inspectors should send letters to duty holders. Inspectors may choose to
confirm matters outside the EMM criteria at their discretion.
13. A timeline and inspection report should be completed on CIS following an inspection.
14. For interventions carried out based on intervention plans the plans should be updated following visits eg to
confirm that the visit has been carried out.
Monitoring progress
Check duty holder's progress with action required.
15. Inspectors are required to check compliance with all enforcement notices that they issue. Improvement notices
should be checked as soon as possible after the date specified on the notice for compliance and in any case
within 10 days of it. The expectation is that compliance will be checked by site visit except when sufficient
confirmation can be achieved by other means.
16. Audits describes the requirements for audit follow up reports.
17. Inspectors should usually seek confirmation that duty holders have complied with legal requirements and
inspectors' recommendations in letters. The expectation is that this would be achieved by eg seeking written
confirmation from duty holders or by telephone.
Review
Assess effectiveness of intervention.
18. Inspectors may find it useful to review some of their interventions, perhaps using the five elements listed here as
a guide, to consider whether alternative approaches could have been more effective. For trainee inspectors this
will be a more formal process carried out with line managers and / or more senior colleagues.
Major Hazard Intervention Plans
Introduction Format of Intervention Plans
Aim & Objectives Managing Resources
Timing of Preparation & Review Informing Duty Holders & Employees
Identification of Intervention Issues Appendix 1 - Summary of Process for TT COMAH
Roles & Responsibilities Appendix 2 - Summary of Process for LT COMAH
Links with the Environment Agencies
INTRODUCTION
1. COMAH regulation 19 places a specific duty on the competent authority (CA) to have in place a system of
inspection for COMAH establishments. HID policy is to implement this requirement by following the principles set
down in the European Commission's Guidance on Inspections Required by the Seveso II Directive. This
guidance pragmatically implements relevant parts of the EC guidance through preparation of intervention plans.
2. Arrangements for ensuring that intervention plans are fit for purpose are described throughout this guidance.
They ensure that more rigorous quality assurance is applied at those establishments where hazards and risks
are greatest. In addition, CIU will periodically audit the intervention planning procedures.
Scope
3. This guidance applies to intervention plans for establishments within HID LD Units 1, 3 and 4. LD2 have
separate planning arrangements for gas, explosives and pipeline installations.
4. It applies to major hazard interventions at all COMAH sites. Interventions are planned processes to secure
compliance and include:
Inspections - including verification to test conformity with information contained in safety reports
and to monitor duty holders' implementation of stated prevention, control and mitigatory
measures;
Other methods of contact such as projects.
5. Interventions do not include incident and complaint investigations.
AIM AND OBJECTIVES
6. The aim of intervention planning is to produce a programme of interventions to periodically check, by examining
operators' technical, organisational and managerial systems, that a high level of protection for man and the
environment is being achieved and capable of being maintained. The objectives of the intervention planning
process are to:
Identify and prioritise intervention issues, focusing on ensuring that the key risk control
measures for preventing and mitigating major accidents are maintained;
Match interventions with available resources;
Show the rationale for intervention issues;
Show how interventions are closed-out.
Quality factors
7. Preparing plans for complex sites can be time consuming but is essential to meet COMAH requirements and is
an important element in demonstrating that HID meets the HSC enforcement policy principles of Proportionality,
Consistency, Transparency, Targeting and Accountability (PCTTA) and the HSE enforcement statement quality
management principles.
Contents of plans
8. All plans should contain details of proposed major hazard interventions (including estimated resources) for at
least the period between preparing the plan and the start of the next planning year. The basic major hazard
planning templates on CIS default to a five-year plan for TT sites. Inspectors may, at their discretion, identify
future years' work in the plans. This information need not be so detailed and may, for example, simply identify
proposed intervention topics with more detail added nearer to the intervention.
9. Individual plans may also, at inspectors' discretion, include a statement of the aim(s) of the programme of
interventions. Stating the aim(s) of the plan will help inspectors to assess at the end of the plan's duration
whether the programme of interventions have been effective in meeting the aim(s). For example, a core aim
might be to ensure that operators have in place adequate controls to prevent major accident scenarios being
realised.
TIMING OF PREPARATION AND REVIEW OF INTERVENTION PLANS
10. The planning process comprises two main stages:
the initial planning event; and
annual reviews and agreement of annual plans.
The initial planning event for COMAH TT installations
11. The initial planning event is the stage when the intervention plan is first prepared. This is crucial because it
identifies the key intervention issues that, based on verifying the control measures for preventing/mitigating
major accident scenarios described in the safety report, will form a rolling programme of interventions over time.
It therefore sets the framework for all future interventions.
12. The initial plan should ideally be agreed during safety report assessment outcome meetings (see COMAH Safety
Report Assessment Manual, Part 1 Chapter 4), when all those with a role in identifying topics for the plan should
be present.
13. Planning at this stage ensures that the conclusions from safety report assessments can inform future
interventions. However, the plan should not be dependent on the completion of the safety report assessment
process and interventions can take place at any time irrespective of whether they are included in the plan. This
includes during the safety report assessment phase, for example to verify information in the safety report or to
meet existing intervention commitments. Inspections at top-tier installations should not be postponed or
cancelled due to the need to resolve any outstanding safety report assessment issues.
14. If there is no outcome meeting or it is not practicable to agree the plan at the meeting the assessment team
should agree alternative arrangements for preparing the plan.
The initial planning event for COMAH LT establishments
15. Plans for lower-tier COMAH establishments should be based on the LD intervention policy in Major Hazard
Intervention Policy and developed as part of pre-visit preparation. As with plans for TT sites, the initial plan sets
the framework for all other interventions. They should cover the period that is appropriate for the issues involved,
which will usually be between one and five years. Local arrangements should be made to ensure that the plans
are developed in consultation with EA/SEPA and HID discipline specialist teams and agreed with them.
Annual Reviews and agreement of annual plans
16. All plans should be reviewed at least annually as part of the annual work planning process. The purposes of the
annual review are to:
check that the previous year's plan was implemented and deal with outstanding work;
assess progress with achieving the aim(s) of the plan (where an aim is specified);
identify / confirm proposed intervention topics from the rolling programme and/or add new ones
and add details to the plan for the next year i.e. resources and dates.
Intervention plans for lead unit companies
17. Lead unit co-ordinating inspectors are responsible for preparing and managing a single intervention plan for each
lead unit company. Lead unit co-ordinators should inform relevant regulatory inspectors when company-wide
intervention plans have been developed. This does not extend to agreeing specific local issues, nor does the
lead unit co-ordinator have authority to prescribe intervention issues for specific sites (see Lead Unit System for
Multi - Establishment Companies).
IDENTIFICATION OF INTERVENTION ISSUES
18. Intervention plans should take into account two main issues:
Hazards and risks at establishments
Plans should include verification of the key control measures for preventing/mitigating major
accident scenarios, starting with the worst-case scenarios. A rolling programme of interventions
will be required to ensure that operators continue to manage these key measures over time;
National / sector priority programmes that address major hazard topics e.g. the occupied
buildings and plant integrity projects;
Topics identified as requiring improvements based on the assessment of COMAH safety reports
or by other means.
Information about and performance of establishments
19. Factors related to major accident hazards that may affect inspection topics and their priorities and/or
frequencies, are listed below. Not all of these factors will be relevant at all sites.
Outcomes of previous
interventions.
Inspectors should set a time for re-examining the control measures based on the
standards found at the original intervention. Sites that do not comply with legal
requirements or relevant good practice are likely to require more frequent inspection
and be a higher inspection priority.
Size and complexity Large and complex sites are likely to require more frequent inspection. This is to
ensure that a representative set of major accident scenarios are inspected; and
because sites with large quantities of dangerous substances, complex processes
and processes that operate at high temperatures and pressures tend to have
greater risks - making them a higher inspection priority.
Reports of major accidents and
other accidents, incidents and near
misses.
All reports of COMAH major accidents should be investigated promptly. Sites that
have poor incident history are likely to require more frequent inspection and be a
higher inspection priority.
Complaints. All complaints alleging breaches that could lead to a major accident should be
investigated promptly.
Receipt of revised safety reports. Plans should be reviewed and, where necessary, revised to take account of new
information when revised safety reports are assessed.
Changes of site ownership. Sites should be contacted within one month of HSE being notified of changes. The
purpose of the contact is to establish the significance of the change and determine
when an intervention is necessary.
New knowledge about scientific or
technical matters.
When inspectors receive new intelligence that could have significant impact on
existing major hazard controls they should contact relevant sites promptly and in
any case within one month. The purpose of the contact is to alert duty holders to the
new information and determine when an intervention is necessary.
Reports of modifications,
rebuilding, plant extensions etc.
where there are significant
repercussions for major accidents.
Sites should be contacted promptly and in any case within one month of HSE being
informed of developments. The CA will normally receive notification of such
modifications under regulation 8 of COMAH.
Frequent process chemistry
changes.
Sites which are subject to frequent process changes need to have robust change
management systems which need to be checked/verified during each five year
period.
Major changes in staffing levels. Sites should be contacted within one month of HSE being notified of changes. The
purpose of the contact is to assess the impact of the changes and determine when
an intervention is required.
Lead unit intervention plans. Certain sites which are part of a lead unit company may receive less frequent visits
when they share common processes and management arrangements with others
and HSE can be confident that intervention findings at one site will be disseminated
and acted upon by others within the company.
20. Plans should identify, in order of priority, all major hazard work that is considered necessary at a site over the
period of the plan. Priorities will be determined by the major accident potential of a failure of risk control
measures: the greater the potential, the higher the priority. For TT COMAH sites the information in safety reports
and advice from predictive and discipline specialists will inform priorities. For LT COMAH sites regulatory
inspectors will need to seek information from operators about major accident scenarios and key control
measures, seeking advice from predictive and discipline specialists as necessary.
21. Inspectors may also include other, non-major hazard work in plans at the discretion of those preparing the plan.
ROLES AND RESPONSIBILITIES
22. We adopt a team approach to planning and carrying out interventions and follow the principles below:
Regulatory and discipline inspectors should jointly develop, agree and review intervention plans;
Regulatory inspectors manage the intervention programme and all HSE staff visiting installations
should agree the purpose of their visit with the site regulatory inspector before visiting;
Units should plan to deploy regulatory and discipline inspectors where their respective skills and
knowledge are most appropriate to address intervention topics.
23. In most cases the site inspector i.e. the Band 3 regulatory inspector will be responsible for preparing the
intervention plan, communicating it to EA/SEPA staff and completing the CIS planning templates. Discipline
specialists, EA/SEPA staff and line managers are responsible for contributing topics for inclusion, providing
details of their available resources for implementing plans and recording information on the CIS templates. For
TT COMAH establishments the safety report assessment team is responsible for agreeing the post-assessment
intervention plan. Appendices 1 (TT) and 2 (LT) summarise the roles and responsibilities of those involved in the
planning process.
24. The Band 3 regulatory inspector should liaise with discipline specialists, EA/SEPA and others as necessary
when carrying out reviews.
25. The Head of Land Division is ultimately responsibility for ensuring that the intervention planning process and
procedures are implemented and that available resources are deployed such that field teams are able to
implement the procedures.
LINKS WITH THE ENVIRONMENT AGENCIES
26. Chapter 11 of the COMAH Manual (SIP Products 2(b) and 2(c)) explains the agreed intervention planning
arrangements between HSE and the agencies. In summary, Band 3 regulatory inspectors should include
planned agency major hazard interventions at COMAH establishments on CIS. Inspectors have discretion to
determine how much detail to include but should at least identify the intervention topic and record when the work
has been completed. EA and SEPA officers should inform HSE of work they have done at COMAH
establishments.
27. COMAH also requires the CA to communicate to operators of TT establishments the conclusions of its
examination of safety reports. This includes informing operators which topics from the assessment process will
be carried forward into the intervention plan for the period of the plan. See the COMAH Safety Report
Assessment Manual, Part 1 Chapter 4 for more information.
FORMAT OF INTERVENTION PLANS
28. A format for intervention plans can be found as a template on the HID Templates tab in Microsoft Word and
should be linked to the incumbent record on CIS when completed. LD will review the recording arrangements
because inspectors have sometimes found the template difficult to use for preparing a single establishment plan
at large complex establishments with several COMAH installations.
29. The plans should identify any follow-up interventions necessary to check that duty holders have complied with
requirements. For COMAH establishments this will help meet the requirement in regulation 19(3)(d) to pursue
matters where necessary within a reasonable period following inspections.
MANAGING RESOURCES
30. Major Hazard Intervention Policy provides information on inspection policy and identifies factors to consider
when prioritising interventions at LD premises. Plans should be realistic and be based on the resources that are
available. However, Band 1 Heads of Unit should be informed of work that inspectors consider necessary but
which cannot be resourced. Band 1s are responsible for deploying resources across their units to ensure that
necessary major hazard work is done. Decisions to re-prioritise planned work in intervention plans due to
resource issues should be explained and recorded on the CIS intervention planning template.
INFORMING DUTY HOLDERS AND EMPLOYEES
31. Duty holders and their employees should be informed of the contents of intervention plans, both for individual
sites and, where relevant, for lead unit companies. It is not necessary to provide a copy of the plan itself. This
helps meet HSE's statutory duty under Section 28(8) of the Health and Safety at Work Act and can help
establish ownership of plans by duty holders and employees. It can be used to confirm that the correct issues
have been identified, particularly if duty holders and employees are given the opportunity to discuss the plans
and influence priorities. However, whilst these views should be taken into account, responsibility for the plan
rests with the regulator and inspectors have the final say over its content.
32. It is good practice to meet with duty holders' directors/senior managers to discuss plans. This ensures that the
controlling minds of duty holders are aware of priority issues. Note that plans should only be released to duty
holders and their employees once resource issues have been resolved. For establishments subject to charging
the plans will also assist duty holders' budgeting. It is not necessary to provide full details of proposed work and
inspectors should retain the option of carrying out unannounced visits.
Appendix 1
SUMMARY OF INTERVENTION PLANNING PROCESS FOR TT COMAH ESTABLISHMENTS
WHO WHAT WHEN NOTES
Safety report
assessment team
Agree intervention plan. Plan
should as minimum include
At safety report assessment
outcome meetings; or 5 years after
This is the initial plan &
framework for future
verification of control measures for receipt of an operator's first safety interventions
major accidents. Topics will be re- report
visited on rolling programme,
frequency depending on
information / performance factors
Line manager (usually Agree resources for plans. Resolve At safety report assessment
Band 2 site regulatory any disagreements outcome meetings; or 5 years after
inspector) of person receipt of an operator's first safety
preparing plan report
Line manager (usually Refer any outstanding issues, Soon after SR assessment
Band 2 site regulatory especially resource problems, to outcome meeting
inspector) of person Band 1
preparing plan
Person preparing plan Prepare intervention plan and When the plan has been agreed by
(usually Band 3 site complete CIS template the assessment team
regulatory inspector)
Line manager of person Complete 'Band 2 endorsement' When the plan has been agreed by
preparing plan section of CIS template the assessment team
Band 1 Head of LD Take decisions on any outstanding Soon after safety report This action is only
field unit issues referred by the Band 2 and assessment outcome meeting required by Band 1s
record the decisions on the CIS when issues are
planning template referred to them
Band 1 Head of LD
field unit
Consider plan and complete Band 1
endorsement section of CIS
template
Soon after safety report
assessment outcome meeting for
initial plan and annually as part of
annual work planning cycle; and at
other times as necessary
COMAH TT only
Person responsible for Monitor implementation of the plan Throughout each year of the plan
preparing plan
Person leading specific Record outcome of intervention Soon after each intervention
interventions
Person responsible for Record outcome of agency-only Soon after each intervention
preparing plan interventions
All those identified in Implement their part of the plan As specified in the plan
the plan
All those identified in Inform Band 3 site regulatory As soon as possible
the plan inspector if unable to fulfil
commitments
Band 3 site regulatory
inspectors and their line
Review implementation of previous
year's plan and identify
Annually as part of annual work
planning cycle; and at other times
Need to liaise with
others identified in plan
managers resources/dates for next year's as necessary e.g. when revised to confirm their
plan. Information / performance safety reports are submitted availability
factors will influence priorities &
frequencies
Appendix 2
SUMMARY OF INTERVENTION PLANNING PROCESS FOR LT COMAH ESTABLISHMENTS
WHO WHAT WHEN NOTES
Site regulatory Agree intervention plan. Plan Following appropriate This is the initial plan &
inspector, their line should as minimum include contact/consideration of MAPP framework for future
manager, discipline verification of control measures for interventions
specialist inspector(s) major accidents. Topics will be re-
and agency officer visited on rolling programme,
frequency depending on
information / performance factors
Line manager of person Agree resources for plans. Resolve Following appropriate
preparing plan (usually any disagreements contact/consideration of MAPP
Band 2 site regulatory
inspector)
Line manager of person Refer any outstanding issues, When necessary
preparing plan (usually especially resource problems, to
Band 2 site regulatory Band 1
inspector)
Person preparing plan Prepare intervention plan and When the plan has been agreed
(usually Band 3 site complete CIS template
regulatory inspector)
Line manager of person Complete 'Band 2 endorsement' When the plan has been agreed
preparing plan section of CIS template
Band 1 Head of LD Take decisions on any outstanding Soon after referral This action is only
field unit issues referred to them. Record the required by Band 1s
decisions on the CIS planning when issues are
template referred to them
Person responsible for Monitor implementation of the plan Throughout each year of the plan
preparing plan
Person leading specific Record outcome of intervention Soon after each intervention
interventions
Person responsible for Record outcome of agency-only Soon after each intervention
preparing plan interventions
All those identified in Implement their part of the plan. As specified in the plan.
the plan
All those identified in Inform Band 3 site regulatory As soon as possible
the plan inspector if unable to fulfil
commitments
Band 3 site regulatory Review implementation of previous Annually as part of annual work Need to liaise with
inspectors and their line year's plan and identify planning cycle; and at other times others identified in plan
managers resources/dates for next year's plan
Information / performance factors
as necessary to confirm their
availability
will influence priorities &
frequencies
Incumbent Ratings System
Introduction Rating file note
Application Further information
Description of the rating system Annex 1 - Application of the HID (LD) Rating
How to allocate rating to incumbents System
When to rate incumbents Annex 2 - Rating Criteria
Flexibility Annex 3 - Background Information
How the rating system is to be used Annex 4 - Example Input Screen
Entry to the rating input screen Annex 5 - CIS Ratings Profile
INTRODUCTION
1. This Chapter provides guidance to enable inspectors to understand and use the rating system and Annex 3
provides more general background information.
2. The aim of the rating system is to prioritise incumbents for inspection in a consistent, logical and defensible way.
It is a facility that can be used flexibly by management to design inspection programmes and is not intended to
be a constraint over professional judgement.
3. The new HID (LD Units 1-4) CIS incumbent rating system replaces the FOCUS rating system that was designed
for the wider range of FOD incumbents. This system is very much simpler but retains the necessary elements to
ensure that incumbents are inspected on a priority based on risk.
APPLICATION
4. The rating system applies to most incumbents that are inspected by HID LD. The exceptions are where the
rating would not serve a useful purpose or where we use an alternative system to select incumbents or clients for
inspection. The application to particular activities is described below and summarised in Annex 1.
5. COMAH TT establishments
Regulation 19 requires "a programme of inspections for all establishments". For Top Tier establishments there
should be an inspection by the competent authority at least once in 12 months unless the programme is based
on a systematic appraisal of major accident hazards. This is described more fully in Major Hazard Intervention
Plans. Because there is a presumption of annual inspection and an annual review of the inspection plan for each
TT establishment based on a consideration of the risks, the assessment of the safety report and the inspection
history, there is nothing to be gained by including a rating. Therefore, TT establishments are not rated.
6. Non Major Hazard aspects of TT establishments
These can be dealt with by creating, using and rating a separate unit or units for these topics and considered
independently of the TT work.
7. Explosives
For explosives COMAH sites the approach identified in para 5 will form the basis of the inspection programme.
For explosives non-COMAH sites the current explosives rating system will continue as it provides a structured
means of identifying the essential criteria pertinent to explosives eg. sensitiveness, quantities, quantity distance
relationships and others in determining the risk level and prioritising an inspection programme. This explosives
rating system links into the HID LD rating system at the "initial rating" stage.
8. Pipelines
Inspection priorities are determined by inspectors' knowledge of operators and their professional judgement
drawing on information from Pipelines Notifications, Offshore and Onshore Safety Cases (eg. GSMR). This is a
matter for Unit 2 and the establishment of client based inspection programmes.
9. CDG
The principle intervention is by roadside checks with reactive visits to head offices. This can be managed by
preparing inspection plans for individual clients rather than incumbents. If the head office is associated with an
establishment inspected by HID then that incumbent would be rated.
10. Section 6
Supply issues should be dealt with by both reactive and proactive visits and these are described in, "FOD Guide
to the inspection of manufacture and supply of products and substances". This does not suit a rating system and
a programme of client based inspection should be applied.
11. Other cases
There may be some dutyholders for whom inspection is planned and conducted using a strategic company
specific approach. The current example is Transco where the Gas Safety Lead Team, under the management of
HID LD 2, have prepared and agreed a three year rolling programme with the industry and provided this
information to inspectors. Any additional examples will need to be dealt with on a company basis, be subject to
review and supported by HID MB.
DESCRIPTION OF THE RATING SYSTEM
12. The rating system provides a consistent and auditable way of prioritising the inspection of incumbents.
13. It does not propose frequencies of visits or targets but can be used to direct resources where they are most likely
to be needed.
14. The rating system enables this resource to be used to the best effect by identifying those incumbents with the
highest overall rating. The rating is derived by inspectors considering the intrinsic "hazard" of the activity and the
adequacy of "control" of the risks leading to an "initial rating". An "elapsed years" factor is added automatically
to give an "overall rating".
HOW TO ALLOCATE RATINGS TO INCUMBENTS
15.
a. Hazard. (See Annex 2, Table 1) relates to the hazard inherent in the processes carried out by the
incumbent. It is not concerned with generic hazards such as the use of fork lift trucks, working from
heights or provision of welfare facilities. The incumbent needs to be put into one of the categories
according to the table which will produce a score from 1-7.
Note:
i. Where an irregular site specific Consultation Distance (CD) has been established take the
furthest distance for categorisation.
ii. If the "consent" Regulations have resulted in an artificially high CD based on the maximum
possible inventory that has been applied for then although a CD for the actually quantity held is
more appropriate for rating purposes the issue is not of sufficient concern to be taken into
account. Use the CD applied for planning purposes.
iii. The table illustrates how types of incumbents may be rated but any particular incumbent may
actually be more appropriately placed in a different category from that suggested. That is a
matter of judgement (See also para 19).
b. Control. (See Annex 2, Table 2). This is a measure of the duty holders performance in controlling the
risks and is linked to the actions that an inspector considers appropriate after the visit. Inspectors'
actions should be based on the application of the Enforcement Management Model. This means that this
judgement of control is a fair reflection of the risk . Having established the broad band of control ie good,
medium or poor, inspector's can select an appropriate score, taking their confidence in management into
account.
These two elements are combined simply to produce an initial rating by averaging. A copy of the input
screen is included in Annex 4 .
Note: The input of the Hazard and Control are not for explosives incumbents but a figure will be added
directly to the "initial rating "box. For other inspections this box does not require an entry as it is
calculated by CIS automatically from the Hazard and Control figures.
c. Elapsed Years. The elapsed years is derived from the time since the last rating. An entry is
required in the "Date of Rating" box. There is no input required for elapsed years - it is
automatically added to the rating when an entry is made. The elapsed years are measured from
the year of the last inspection and this element does not take account of investigations and other
interventions.
WHEN TO RATE INCUMBENTS
16. The aim of the rating system is to provide a means to prioritise the future inspection of the incumbent. Therefore,
a rating should be applied after each inspection. It flows naturally from asking the question - "What should the
future inspection approach be?"
17. However, there may be other interventions such as the investigation of complaints, accidents or dangerous
occurrences which provide information about the control standards that ought to be reflected in the rating. For
example a previous perception of good control may be undermined when information comes to light during an
accident investigation and this should be reflected by increasing the control element of the rating. If such an
amendment is made then it should be recorded in the Rating File Note (see para 25.)
18. If this amendment is made then it is still necessary, because of the built in CIS validation system, to change the
"Date of Rating". However, to retain the existing elapsed years it is suggested that the consecutive rather than
actual date be added. eg from 03.07.97 to 04.07.97. (A fudge that may be eliminated with updates of the CIS
programme.)
FLEXIBILITY
19. The rating is dependent on the inspector's judgement and whilst the guidelines should be followed for the scoring
system there may be some particular issue which suggests an alternative score be given.
20. This is acceptable provided a reason for the change from the guidance is recorded on the Rating File Note (see
para 25.)
21. As an example, some inspectors have devised their own criteria for the prioritisation of visits based on such
issues as inventory coupled with proximity to sensitive areas ie. a larger Chlorine storage facility close to housing
will require prioritisation over a facility in a rural location. These local issues can be taken into account in
modifying the hazard element.
HOW THE RATING SYSTEM IS TO BE USED
22. The rating system will primarily provide a means to prioritise inspections. The outputs from CIS can be used to
draw up a profile of ratings for each Field Management Unit (Group), LD Unit or for all of HID LD.
23. Each management unit will then be able to select establishments for inclusion in an inspection programme for
the year. A detailed method for doing this is provided as Annex 5. The process will be as follows:
a. Estimate the resources available for non Top Tier work,
b. Derive from National figures the number of incumbents that can be inspected with that resource.
(Approximately one contact per available day).
c. Select a corresponding rating to produce that number of incumbents.
d. Input to CIS which will produce a list that can be saved ,stored, ordered, updated etc.
ENTRY TO THE RATING INPUT SCREEN
24. When reporting on an intervention the Rating Input Screen should be opened and the Hazard and Control ratings
selected from the drop down menu. The "Date of Rating" should be entered in the form dd/mm/ yyyy. ie
05/07/2001.
RATING FILE NOTE
25. The Rating File Note can be located at the Issue Screen and has been specifically provided to enable any
comments of references to the rating system to be recorded. For example, when amending the rating after an
investigation (see para 17) or when making an amendment tot he rating because of local factors (see para 20) it
is necessary to record the action taken. This information will be necessary to enable a following inspector to see
why a particular rating has been given.
26. In addition the Rating File Notes can be analysed centrally to enable consistencies or trends to be identified and
to support any audit of the system.
FURTHER INFORMATION
ISSUE CONTACT
Operation and Implementation of Incumbent Rating System David Kyle, LD CSSU
HID Rating System Policy and Procedures Neil Rothwell, HID OPU2
CIS HIDHelp, via Lotus Notes or VPN 523 4194
Annex 1
APPLICATION OF THE HID (LD) RATING SYSTEM
The use of Ratings or alternatives for preparing HID inspection programmes
Topic Application of rating system
Major Hazard work
COMAH TT A rating system will not be used.
See Major Hazard Intervention Plans for inspection plans for these establishments.
COMAH LT Rating system applies.
NIHHS As above.
Non Major Hazard issues at MH The expectation is that where there are significant Non MH issues at MH premises
premises (and this is likely to be for the majority) then one or more separate inspection Units
will be created or designated and rated.
Explosives Note that some explosives sites will be subject to COMAH (TT).
For COMAH (LT) explosives inspectors will retain their own rating system but link
this to the rating system.
Pipelines Rating is not appropriate and reliance is placed on a system of centrally co-
ordinated client based inspection programmes.
Carriage of Dangerous Goods. The rating of premises is not representative of the CDG risks and reliance is placed
(CDG) on a system of client based inspection programmes.
Section 6 and supply issues. A system of reactive and proactive visits is described in the FOD Guide and the
inspections should be largely reactive based on specific client information.
Non MH premises. Rating system applies.
Annex 2
Table 1
RATING CRITERIA
Table to determine the appropriate Hazard category
Hazard
Description
Indicators Examples Score
High Incumbents subject to COMAH LT with a CD
>/=to 250m.
LPG Bulk storage, 7
Chlorine storage in drums.
Incumbents subject to COMAH LT with a CD < LPG smaller bulk storage. LPG gas cylinder 6
250m. (Extending off site) storage.
Chlorine in cylinders.
Incumbents where there is a potential risk to Incumbents that store/use large quantities of 5
the public and multiple fatality to employees toxic gas or LPG but are below the COMAH LT
inherent in the process. threshold.
Medium Incumbents subject to COMAH LT with a zero
CD or CD entirely within the site boundary.
Premises where COMAH applies due to the
environmental risk.
4
Some gas holders and storage of flammable
liquids sites.
There is potential for fatalities or multiple Paint manufacturers not subject to COMAH. 3
serious injuries to employees from the process.
Most pharmaceutical companies.
or
There are large quantities of toxic or harmful
substances in use.
Low No potential for fatality or serious injury from
the process.
Production of toiletries. 2
Limited or no use of toxic or flammable
substances.
Most Laboratory work where chemicals are
used on a small scale.
No foreseeable risks from the process. Small scale repackaging. 1
Annex 2
Table 2
TABLE TO DETERMINE THE APPROPRIATE CONTROL CATEGORY
Control
Description
Action Taken (Based on the EMM) Confidence in Management Score
Good Provision of advice or confirmatory letter only
with no plans for follow up.
All the evidence shows that the company is self
regulating and standards are likely to be
maintained.
1
The high standards may not be maintained. 2
Medium Letter requiring action to be taken of sufficient
concern to plan a follow up visit or seek
Standards are likely to be improved. 3
confirmation that action has been taken.
Standards are likely to be maintained. 4
The standards may deteriorate. 5
Poor Formal enforcement action taken or proposed. Standards may improve. 6
There is no evidence indicating that the
standards will improve.
7
Annex 3
BACKGROUND INFORMATION
Validation
28. In designing the new rating system account was taken of the views of inspectors and their experience of the
previous FOCUS system. The key elements required by inspectors were:
a. simplicity;
b. clarity;
c. no hidden calculations and adding of weightings;
d. relevance, such that inspectors had confidence that the rating was meaningful.
29. An early draft of the proposal was put to a number of inspectors and a pilot exercise run with a favourable
response. The only real concern being that some less experienced inspectors thought that they may have
difficulty in making a judgement of the hazard and control elements. The guidance has been expanded following
the pilot and this issue should be resolved.
30. It is important that any difficulties in understanding what is required or the use of the system is reported to OPPG
so that modifications can be made to achieve continuous improvement.
31. The information on CIS will be analysed by OPPG and useful information produced to help direct future priorities
and particularly to provide evidence of the balance between COMAH and non major hazard work.
Advantages of the new system
32. HID is not driven by the rating system but can use it to prioritise inspection using the available resources.
33. The rating system is sufficiently flexible to enable inspection cut off points to be specific to groups depending on
other demands.
34. It is easy to see what the cut off overall rating (OR) means in practice. For example an OR of 7 means that
medium hazard/ medium control incumbents are inspected with 3 elapsed years.
35. The system demonstrates equivalencies. That is incumbents with the same OR might either be high hazard/low
control with no elapsed years or low hazard/high control and many elapsed years or any combination of these
factors. As a Division we will be able to judge whether the inspection programme looks balanced and the
inspection resource sufficient to include appropriate establishments in the programme.
36. The system sets parameters in that high hazard incumbents cannot have an inspection rating of less than 4 and
a low hazard premises cannot have an inspection rating of more than 4.
Limitations
37. The system does not distinguish between health and safety. Experience suggests that this is not necessary and
inspectors should rate on the basis of what they see, evaluate and take action on - whatever the topic.
38. The system will not hold historical data of rating. Whilst this might be considered a lost opportunity to analyse
trends etc in practice the present system cannot be used for this purpose. To design a system with this capability
would require a much more complex equation and substantial time to complete at each visit. The gains in
simplicity and clarity outweigh the monitoring option.
Annex 4
EXAMPLE INPUT SCREEN
Annex 5
CIS RATINGS PROFILE
Purpose
The CIS Rating System provides a consistent and auditable way of prioritising the inspection of incumbents. It does not
propose frequency of visits or targets but can be used to direct resources where they are most likely to be needed.
The outputs from CIS can be used to draw up an:
Overall Ratings Profile; or
Inspection Programme;
Each Management Group will be able to select incumbents for inclusion in an inspection programme for the year. This
annex explains how to do this.
HOW TO CREATE AN OVERALL RATINGS PROFILE
Each management group will be able to select establishments for inclusion in an inspection programme for the year.
To create the Overall Ratings Profile, take the following steps in CIS:
1. Log into CIS.
2. Click on Reports at top of screen.
3. Highlight Reports List.
4. Click on 23 (incumbents rating by overall band).
Click next
Click find management group (eg LD3D) (NB. Search in present year).
Click next
Click finish
The information will be displayed in a similar format as at Annex 1 and can be copied/pasted into a word
processing file or can be printed from the screen.
HOW TO COPY/PASTE INTO A .doc OR .lwp FILE
1. Right-mouse click " properties " remove P from 'display only' " ok. Highlight all text. Right-mouse click " copy.
2. Open up Microsoft word/lotus word and create a new document and paste the information into the new
document. (Some adjustments may need to be made to the presentation of the table)
HOW TO CREATE AN INSPECTION PROGRAMME
Firstly, you will need to create an Overall Ratings Profile as above (an example is shown below).
An Overall Ratings Profile for a Management Group
Rating 1 2 3 4 5 6 7 8 9 10 >10 Total
Incumbents 0 0 9 120 97 58 23 12 6 0 1 326
Units 0 0 0 0 0 0 0 0 0 0 0 0
Total 0 0 9 120 97 58 23 12 6 0 1 326
You will need to identify the resource available for inspection of non TT COMAH establishments for the year (e.g. 42 staff
days). Because approximately one inspection can be completed for each available staff day you need to search for 42
establishments. From the profile it can be seen that 42 establishments can be identified from a rating of 7.
From this profile you can select the highest rated incumbents for inclusion in the inspection programme.
To create a programme for inspection, take the following steps in CIS:
1. Log onto CIS
2. Click on incumbents icon at top of screen.
3. Click on the Ratings tab.
4. Right-mouse click " find " advanced " add. In the field box select management group name from the drop down
menu. In the condition box select is exactly to Type in the management group name (eg LD3D) (all search
entries are case sensitive) In the logical box select and In the field box select overall rating from the drop down
menu. In the condition box select (is after or equal to) and type in value eg.(7)
5. Click Start Search (42 rows retrieved) This is the priority list of establishments for inspection. To sort the list
alphabetically, double click on the grey area of Client Name at the top of the list. This will sort the list in
ascending or descending order as required. You can print the entire list at this point if you wish (Step 7).
To find out which of these 42 sites are COMAH LT, steps 1-5 will need to be repeated and the following step included:
6. In the logical box select and In the field box select hazard rating from the drop down menu. In the condition box
select (is after or equal to) and type in value 6 (a hazard rating of 6 or more are COMAH LT). Click Start
Search (11 rows retrieved) This is the priority list of COMAH LT establishments taken from the priority list of
establishments for inspection.
7. File "print data list " ok. (The information will be displayed in a list format containing client and location details).
Inspection Techniques
Introduction Follow-up
The Inspection Process Techniques Applied Across the HID sector
Inspection Techniques Available Mailshots and Seminars
Application and Appraisal of Techniques Inspection tools
TORCH (Transferring Ownership Responsibility and Management Oversight and Risk Tree (MORT)
Commitment for Hazard control) Analysis; Investigative Methods
Audit Producing Inspection Plans
TRAM (Technical Risk Audit Method) Appendix 1 - Inspection Plan
INTRODUCTION
Purpose of the chapter
1. The purpose of this chapter is to provide a guide to inspectors on the aims of inspection, the techniques of
inspection available, their resource implications and benefits, and how they link to inspection plans The guidance
is based on the 4 high level principles agreed by the DMB under the Inspection Strategy Project in 1998. They
are set out below.
a. A range of techniques should be selected with the aim of obtaining greatest effectiveness for the input of
resource;
b. Methods for assessing the effectiveness of intervention need to be built into the inspection plan;
c. HID should operate longer term inspection plans with some occupiers;
d. Longer term inspection plans should take account of company health and safety plans as well as
business changes.
2. The chapter covers 3 areas - the inspection process, inspection techniques and inspection plans
Definition
3. The term 'inspection' covers the wide range of intervention activities from preventive inspections through to
audits and specifically includes investigation. In particular the integration of investigation and inspection is
covered.
THE INSPECTION PROCESS
The aims of inspection and investigation
4. From the paper by PJ C Scott (FOD) on The Practice of Inspection the FOD IN code and the HSE framework
for investigations the following aims of inspections and investigations can be derived.
5. The aims of inspection are:
a. To satisfy HSE and other stakeholders that those with duties are complying with their legal
responsibilities;
b. To make an assessment of the adequacy of control of risk posed by the work activities to employees and
others, and any measures required to ensure adequate control;
c. To persuade, and if necessary enforce, businesses to take action to achieve compliance with the legal
minimum standards, such action being commensurate with the risk;
d. To encourage businesses actively to manage health and safety as an integral part of their business,
thereby reducing accidents and ill-health through the application of cost-effective controls;
e. To disseminate information and guidance about how to comply with legal requirements;
f. To encourage employees and their representatives to co-operate and play their part in achieving
appropriate standards of health and safety controls;
g. To collect information, for distribution as appropriate, as a means for developing legislation, policy and
guidance on health and safety at work.
6. The aims of investigation are to:
a. Identify the immediate and underlying causes and consequences of the event;
b. Rectify conditions giving rise to the particular accident;
c. Identify any breaches of the law and the appropriate action to be taken in the circumstances;
d. Ensure that similar conditions are not repeated in other parts of the same premises;
e. Satisfy the expectations of the public, the media and pressure groups who expect action from HSE when
a serious accident occurs;
f. Act as a starting point for the analytical assessment of management's ability - a starting point as effective
as a basic inspection in some places;
g. To contribute to HSE's knowledge of the causes of incident;
h. Identify any shortcomings in policy, guidance or legislation and any consequential research;
i. Help HSE evaluate the effectiveness of inspection activity; inform duty holders and the public about the
causes of incidents and any relevant findings from investigations and;
j. Meet the reasonable expectations of relevant stakeholders in line with Open Government Commitments.
7. These aims should be kept in mind and used to guide inspections and investigations.
The integration of investigation and inspection
8. From the above it can be seen that inspection and investigation have much in common and could both be
defined as : "a process for independent assessment of the adequacy of control of work risks, within a legal
framework of duties, standards and sanctions".
9. The list below draws together the key aims of inspection and investigation:
a. to make an assessment of the adequacy of risk control measures;
b. to persuade, and if necessary enforce, businesses to take action to achieve compliance with the legal
minimum standards;
c. to encourage businesses to manage health and safety;
d. to disseminate information and guidance about how to comply with legal requirements;
e. to encourage the involvement of employees and their representatives in achieving and maintaining
standards of workplace health and safety.
10. Investigative work has, in the past, been seen as distinct from inspection, and time spent on the two activities is
(and will continue to be) recorded separately. These factors have contributed to the perception that the activities
are entirely separate, which in practice is not the case. Inspection and investigation both require the inspector to
use the techniques of observation, document review, questioning, reviewing evidence etc. - the significant
difference lies in the event which triggers the inspection activity. Inspection and investigative activity both
contribute to HSC/E Continuing Aim 2 - to secure compliance with the law in line with the principles of
transparency, proportionality, consistency and targeting (TPCT) on a risk-related basis.
11. The IN Code also refers to links between inspection and investigation: 'The investigation of an accident can be
used as a starting point for basic inspection,.... Accident investigation can in these cases and in others effectively
form part of the basic inspection. It enables both the inspector and management to discuss gaps in
management's arrangements for complying with HSWA section 2.'
12. Since the publication of HSG 65, inspectors in FOD, HID and ODDs have targeted their attention on the
management issues underlying workplace health and safety - and investigative work should be no different.
Investigative techniques such as MORT, Events and causal factors analysis and Root cause analysis all link the
investigation of technically complex incidents back to initiating events including health and safety management
failings. The conclusions from such an investigation can add significantly to HID's intelligence about a site and
make a major contribution to the inspection plan.
13. The activities of investigation and inspection are closely linked, and should inform each other e.g. the findings of
an investigation should shape the inspection plan, or may indicate that there would be value in applying a
particular inspection technique and the conclusions of an inspection may suggest that particular types of
accident should be investigated. The two techniques have common purposes, and in order to achieve the most
effective use of HID's interventions, investigation should not be seen as separate from inspection, but in effect as
reactive inspection. The boundaries between inspection and investigative activity are not, and should not be,
rigidly defined.
14. HID must make the best use of interventions - whether recorded as inspection or investigation. The existence of
an inspection plan for a site will facilitate this, by identifying topics for inspection, suggesting effective techniques,
and indicating the inspection frequency. The inspection plan must cover both proactive and reactive inspection.
There are two main factors which determine the effectiveness of investigation within an inspection plan:
a. Selection of the appropriate incidents for investigation;
b. Using the findings of investigations to amend the inspection plan.
15. The topic of inspection plans is discussed more fully later in this chapter (para 93)
16. The OMF (Operations Management Forum) paper (OMF 97/1/6) 'A study of the Application of Quality Assurance
Techniques to the Regulatory Activity of FOD and non-HSE Regulators' considers the role of investigation within
inspection, including the extent to which accident notifications should prompt and inform inspections. The paper
concludes that as a source of information on risk, accident notifications are arguably more reliable (if only
because they are in 'real-time') than historical data, such as inspection ratings. They also allow for more sharply
targeted inspections.
17. The appropriate selection of accidents for investigation is vital. The HSE Enforcement Statement quality
standard document for investigation lists the following selection criteria:
a. actual and potential severity;
b. seriousness of potential breach;
c. track record of duty-holder;
d. enforcement priorities;
e. practicality of achieving results;
f. relevance of event to wider range of premises;
g. political factors and public expectations;
h. legal factors.
i. short term resource constraints.
18. Other relevant factors to be input to the criteria could include HID objectives, companies' approach to the
problem and the number and frequency of accidents.
INSPECTION TECHNIQUES AVAILABLE
19. This section sets out the techniques commonly used across HID to influence standards of workplace health and
safety. They can be divided into three main groups, depending on who uses them, and how they are applied.
Although some techniques are more commonly used than others each technique has circumstances where its
use will be appropriate.
20. Techniques applied to specific sites;
a. To assess and influence the adequacy of risk control measures:
i. Inspection - Proactive and reactive
ii. TORCH
iii. Audit
iv. TRAM
b. To assess the adequacy of response to HID's contact:
i. Follow up
21. Techniques applied across the HID sector;
a. To assess and influence the adequacy of risk control measures:
i. Projects
ii. Seminars and mailshots
b. To assess the adequacy of response to HID's contact:
i. Follow up
22. Techniques applied by industry;
a. Benchmarking
b. Self assessment
23. The relationship between these techniques is shown diagrammatically below.
24. Note: An important and integral part of all inspections, regardless of the technique used, is contact with
employees and safety representatives, whether appointed under The Safety Representatives and Safety
Committees Regulations 1977 or elected under The Health and Safety (Consultation with Employees)
Regulations 1996. HID needs to continue to ensure that contacts are made and that employees have the
opportunity to raise concerns.
25. Inspectors use various 'tools' to carry out the techniques listed above. Some of these form part of the core
competencies for HID inspectors, e.g. legal and technical training, project management, negotiating,
presentation skills etc. But in addition there are some recently developed tools which may be used to
complement/add value to the inspection process. These tools do not stand alone as the techniques listed above
do, but are used to carry out the inspection technique.
26. These inspection tools include:
a. Climate survey tool;
b. MORT analysis;
c. Events and causal factors analysis;
d. Root cause analysis.
27. Further details of the inspection tools are provided later in this chapter (para 81)
APPLICATION AND APPRAISAL OF TECHNIQUES
Preventative Inspection
Background
28. Preventive inspection is the most widely used technique by which HID, in common with HSE's other operational
directorates and divisions, assesses standards of control of workplace risks and compliance with legal
requirements, leading to regulation. It tends to be process-orientated and can be either hardware or
management systems led. In its application, inspectors draw on visual observation, discussion with management
and employees, and review of relevant documentation. Visits may be unannounced, or carried out by
appointment. The technique may be performed by one inspector, or a multi-disciplinary team.
29. The application of inspection is discussed in Section 2.2 of the 'FOD Guide to the inspection of health and safety
management' (the 'FOD Guide'), but this section does not apply the term in the broadest sense of the use
suggested in this chapter
How applied
30. Inspection is a flexible technique which can be adapted to a wide range of circumstances. For example, it can be
applied across a whole workplace, or to selected parts of it in unitised premises. It can also be used to assess
discrete activities or processes, in which case the term 'topic' inspection is commonly used. In all cases, the
purpose of the inspection is to assess the adequacy of control of workplace risks.
31. For the purposes of work recording and planning various parts of inspection activity (investigations and
enforcement) are separated, and will continue to be so. The recording arrangements are for administrative and
political reasons, and should not be taken as implying any difference in application. Inspection can be either
proactive or reactive. The technique applied is the same in both cases - the triggering event differentiates
between them. Reactive inspection i.e. investigation will be prompted by a report of an accident, complaint,
occupational ill-health or as a result of allegations of breaches of the law (e.g; from local authorities, fire
authorities, insurance companies).
Resource requirements
32. Inspection is generally regarded as a relatively quick process and between 0.5 and 1 day of site time is used as
an estimate, but there can be variation from this. Large premises are commonly unitised, with each unit
traditionally representing about half a day's inspection. The time required for FOCUS data entry, the production
of letters and the initiation of follow up action are in addition to site time. The 'office' time is recorded on FOCUS
as non-contact time. A 1:1 ratio of site time to office time is typical.
Appraisal of Application by HID
33. Inspection is perceived by HSE as effective because it produces change - immediately if necessary. However
little has been done in the way of formal evaluation of inspection. It also provides a quick assessment of the level
of risk in a company, informs the HID inspection strategy - the most suitable inspection technique and the
relevant topics. The process of preventive inspection is subject to line management review. The technique is
flexible - inspectors can modify their approach and priorities during an inspection as circumstances require. The
technique is equally valid in large complex workplaces as it is in roadside inspections of the carriage of
dangerous goods by road.
Other issues
34. Team working is being used by HID 1, with inspectors acquiring topic specialisms to be applied as needed. The
Railway Inspectorate are currently increasing their use of team working, to make the best use of inspectors'
experience and expertise. This team working is not always formal (although teams are formally set up for work
such as major investigations), but are created to meet the needs of an inspection or investigation.
35. OSD inspectors end all inspections with a close-out meeting with management - a debriefing with the offshore
installation manager followed by a management meeting on shore. Typically HID's practice is for all visits to end
with a summary discussion to give priorities, direction and timescales etc to the occupier.
TORCH (Transferring Ownership Responsibility and Commitment for Hazard control)
Background
36. The principles and application of the TORCH technique are outlined in Section 2.3 of the 'FOD Guide'. TORCH
provides a method of assessing the health and safety management issues in a way which informs HSE but
which aims to help employers understand health and safety management as applied to their workplace. It aims
to involve the employer in identifying the main risks, controls and management actions required. The 'FOD
Guide' contains an outline of the technique, and full details are in the 'TORCH pack' produced by the Operations
Unit.
How applied
37. TORCH is mainly based on interviews, with an element of workplace inspection. The technique can be applied to
organisations of all sizes. It is best suited to SMEs which have defined management structure, but where
auditing by HID is not appropriate. It can be administered at a single site or to representatives from a number of
sites at a workshop.
Resource requirements
38. The resources required for a TORCH inspection are variable. The application of TORCH at a single site is likely
to require one day on site, with minimal office time, but several brief follow-up contacts, which may not
necessitate a site visit. Carrying out a TORCH workshop for up to 30 occupiers lasting half a day will typically
require about 2 days of Band 6 time to organise it, and five Band 3 staff to deliver the workshop. A half day visit
is made to all the sites, and follow-up is important to monitor progress. Office time is generally less than for
preventive inspection - of the order of a 2:1 ratio of site (including workshop) time to office time.
39. TORCH inspections may require a team approach, involving two or three inspectors, and may require input from
other divisional specialists depending on the nature of the risks involved.
Appraisal of Application by HID
40. Within HID most use of this technique has been made by the Explosives Unit. They have carried out several
workshops targeted at small to medium sized companies. The technique is considered worthwhile, with many
companies producing action plans which have subsequently been followed up by inspectors. The key to the
success of the technique is this follow up action.
41. Operations Unit are currently reviewing the application and effectiveness of TORCH across the Operations
Group, as there is a perception that the application of the technique has moved away from that in the 'FOD
Guide'. The outcome of the review is to be considered by the Operations Management Forum.
Application by FOD
42. TORCH is regarded by many FOD inspectors as a useful technique because it permits management issues to
be assessed and encourages managers to become involved and take ownership of the management of health
and safety. The experience of FOD suggests that it can be applied successfully and efficiently in place of audit at
SMEs.
43. TORCH can usefully be applied at a relatively early stage in the inspection plan for a company, but is likely to be
best used after an initial preventive inspection has assessed the suitability of a company for the application of
TORCH.
AUDIT
Background
44. The audit process as used by HID is defined in HID circular CC/INSPECTION/1rev as: 'a systematic,
documented, verification process of objectively evaluating evidence to determine whether an employer has
developed a management system and implemented the arrangements necessary to meet its legal obligations in
respect of health and safety and the control of risks and whether the system and arrangements are effectively
implemented'.
45. The circular defines management systems audit as: 'the audit of a company at a defined level of management.'
This may be directed at the corporate level, the divisional level or at the level of the management of a single site.
HID applies the following definition of risk control systems audit: ' the audit of a defined and restricted risk control
system. It includes both auditing the level of compliance with legal requirements and the audit of the
management of that risk'.
46. The STATAS audit methodology (described in section 2.5 of the 'FOD Guide') was developed from an HSL
research project to provide a way of assessing loss of containment of hazardous substances from process plant
and vessels. The research findings showed that loss of containment could be attributed to one, or a combination,
of 10 direct causes and that these in turn could be attributed to one or a combination of eight origins of failure.
The audit protocol produced by the researchers did not follow the HSG65 model, so the STATAS 'origins of
failure' audit questions were mapped across to the Risk Control Systems questions (or key issues) described in
the 'FOD Guide'. The STATAS methodology is now the same as the methodology described in the 'FOD
Guide', and is no longer used as a 'stand-alone' technique.
How applied
47. HID has built up much experience and expertise of auditing. HID's plan of work includes a commitment to audit
all top-tier CIMAH sites.
48. The 'FOD Guide' includes criteria for selecting sites for audit. These include major hazard sites, multi-
establishment companies, employers with well developed management systems which employ more than 200
people or where there are significant hazards. These selection criteria and HSE's application of the audit
technique have moved on since the 'FOD Guide' was published, and in its present form it does not reflect HID's
use of auditing. Possible additional criteria for selecting companies in the HID sector for audit could include
companies changing status under COMAH (i.e. moving into LT from non-COMAH or from LT to TT), companies
undergoing major structural change to their management or organisational structure (including large shifts in the
use of contractor organisations for hazardous operations) or performing extensive downsizing; company
mergers; any other major change events; poor hazardous event record.
Resource requirements
49. Auditing is a resource-intensive technique. For the 1997/98 work year HID audits of management systems
accompanied by one or more risk control systems required an average of 46 hours non-contact time and 35
hours contact time, and risk control system audits required an average of 41 hours non-contact time and 25
hours contact time. Site audits are normally carried out by at least two inspectors, with a larger team for audits at
divisional and corporate levels. Depending on the issues involved, staff from RSG, DST or other DDs may be
part of the audit team. The ratio of site time to office time may approach 1:2.
Appraisal of Application by HID
50. In November 1996 the DMB considered a paper (DMB/96/59) which presented the work of the Audit and Lead PI
Working Group. The DMB endorsed the use of audits as part of a continuing strategy to gain information about
employer's management arrangements and systems. Additionally, the DMB agreed that it was desirable for an
audit to be completed for each major hazard employer as a starting point and reviewed at the beginning of each
safety report update cycle. These recommendations are still in place.
51. The effectiveness of HSE's use of auditing was evaluated by a project commissioned by the OMF in 1996/97,
reported as 'The effectiveness of HSE's audit approach'. The project was based on corporate level audits carried
out by FOD, HID and OSD. The review concluded that employers and most inspectors strongly support HSE's
use of auditing and that the technique is appropriate in the present regulatory climate. Further conclusions were
that HSE generally carries out corporate audits well, and such audits usually influence health and safety
management as they raise significant issues with senior managers. These topics do not arise during other HSE
interventions. But the review said that HSE does not benefit from the use of auditing to the greatest extent
possible, as post-audit action i.e. follow-up is not well executed and there is an apparent lack of use made of
audit conclusions to inform and direct subsequent inspections.
52. In 1997, the CIA were involved in a survey to evaluate the effectiveness of audits done by HID (CC/ADMIN/8).
The report generally supported HID's current practice and made several suggestions for improvement, but did
not address follow-up work.
53. Because the conduct of audits is a major, resource intensive technique carried out by HID the inspection strategy
project team identified a need to provide very clear policy and guidance on the use of audits. The first stage in
preparing such policy and guidance was a workshop held in J uly 99 to identify the issues involved and the best
way forward.
54. The outcome of the workshop was a report to DMB with recommendations on further action required. The
recommendations are now being taken forward as a project by HID OPPG Inspection Section. The project
outcome will be the provision of clear guidance on the policy and practice of auditing by HID.
TRAM (Technical Risk Audit Method)
Background
55. This technique has been developed jointly by HSE and AEA Technology. It is a computer-based system for the
assessment of technical aspects of process safety at major hazard sites. It involves the identification and
evaluation of the number of 'lines of defence' i.e. control, protection and mitigation measures, needed to reduce
overall risks.
How applied
56. TRAM is still undergoing development, but has been trialed at several HID premises. It has been developed for
the storage of LPG, but there are plans to develop it for application to activities where well-documented
standards exist e.g. bulk chlorine storage and ammonium nitrate stores. It is designed for use by all HID
inspectors.
57. TRAM is being developed to complement the findings of audit or TORCH, and to provide information which will
be useful for the completion of HI 251s.
Resource requirements
58. The site visit should take up to a day, with a further day of associated office time.
Appraisal of Application by HID
59. The technique is currently in the final stages of its development, and needs to be applied at more sites to
complete this process. As yet, the technique is fully understood only by those who are developing it, and it's
potential for informing issues for inspection has not yet been evaluated. TRAM is envisaged to be a fairly rapid
assessment method which will assist in prioritising issues for inspection. As such, it will be suitable for
application at an early stage in the inspection cycle of a company, and possibly after the assessment of COMAH
safety reports.
FOLLOW-UP
Background
60. The purpose of follow-up is to assess the adequacy of response to HID's contact. Follow-up contacts are by
definition targeted, and always follow another contact.
How applied
61. Follow-up can be carried out in a variety of ways, as considered applicable to the particular circumstances. The
'traditional' follow-up technique is a visit to verify some required action, but it may also take the form of
information from the firm, such as a letter, action plan, telephone call, discussions at a meeting etc. Continued
failure to implement legal requirements should lead to a consideration of formal enforcement. .
Resource requirements
62. The resources employed in follow-up are variable, but should be in proportion to the scale of the risk involved.
Where follow-up takes the form of a site visit to check on specific (usually hardware-related) matters, the visit will
typically be short - less than half a day. Inspectors from RSG (or other specialisms) may be involved in follow-up
visits.
Appraisal of Application by HID
63. All inspections (and initiatives applied as alternative to inspection) need appropriate follow-up for two purposes;
to check on action on issues identified at previous inspection, or to provide information on the effect and value of
the original intervention.
64. Follow up action is an essential, and integral, component of HID's inspection activity. It is an effective technique
which emphasises priorities and encourages firms to take action. Information from follow-up visits should inform
the inspection plan, and the consideration of the appropriate means of follow-up should be built in to all
inspections. There will be circumstances where no follow-up is required, but these are likely to be in a minority.
TECHNIQUES APPLIED ACROSS THE HID SECTOR
Projects
Background
65. Projects are usually focused on a sector of HID's responsibility. They aim to make comparison across this sector
and are seldom site-specific. The project methodology is applied to a particular process, topic, risk control
system etc., so that site visits and other contacts relate to a facet of the activity on site. The information collected
from the project visits can be analysed and disseminated to other relevant recipients.
How applied
66. HID has moved away from the traditional SPN approach and now carries out national projects which are planned
to meet an identified need and require DMB approval. National HID projects are generally run under project
management protocols. National projects are not restricted to being completed in one workyear and can be
carried out over whatever timescale is required. All inspectors involved in national projects receive training or
detailed guidance to enable them to carry out the work for specific projects. Local projects can be carried out to
meet local needs and do not require DMB approval. They are usually implemented by a team of inspectors.
Resource requirements
67. The resources required for projects are variable, depending on the scale of project. The need for, and number of,
site visits will vary depending on the project. The requirement to provide specific training will require a
considerable input of resources.
Appraisal of Application by HID
68. The project methodology can be adapted to meet a wide range of needs, and can involve whatever techniques
are suitable, whether inspection or some other method. All projects will be different, and the scale and scope can
vary considerably. An example of a small scale project is a series of visits to several examples of a process or
sector of industry, designed to provide inspectors new to HID with familiarisation and the opportunity for
comparison. At the other end of the scale, the 'Exothermic reactions' project involves most of HID's operational
staff, with a substantial training requirement, and documented project planning protocols.
69. Project management techniques are applied to the extent required by the scale and complexity of the project.
This imposes a structure, accountability, requirement for evaluation etc. Project working promotes teamworking
and involvement of appropriate sources expertise.
70. It is not possible to specify a particular stage in the inspection history of a company when projects should be
carried out, as this will depend on the aims and subject of the project. Projects may be the first contact, or may
follow a series of inspection contacts.
MAILSHOTS AND SEMINARS
How applied
71. Mailshots and seminars have been used extensively by FOD to reach more firms in the SME sector than was
possible through conventional interventions.
72. HID's use of mailshots has been restricted to distributing information before particular interventions, for example
as preparation for the 'Exothermic reaction hazards' project.
73. Seminars have been organised by FOD and other DDs for many reasons - including raising awareness,
introducing new initiatives, to target poor performers and to carry out TORCH initiatives. FOD's 'Small firms
breakfasts' were particularly valuable. In 1997/8, HID organised seminars on CHIP, and on health risk
management. There are plans to organise more seminars in the future, possibly organised jointly with
intermediaries.
74. Seminars are used to communicate information. They aim to influence behaviour and provide neutral ground for
discussion. They are not a replacement for inspection, but are complementary to it. The HID 2 'CHIP 97'
breakfast seminars and the HID 3 'Health risk management' seminar were run as PRINCE projects. DMB/98/13
discusses the HID 2 initiative, and copies of the HID 3 Seminar Toolkit will be distributed to HID Units 1 - 5, to
form a model for other seminars.
Resource requirements
75. Both techniques are time consuming, due to the requirement for detailed planning and administration, although
this will be borne by HID staff from several grades, in contrast to other techniques, which are applied mainly by
Bands 2 and 3. The four CHIP seminars run by HID 2 required approximately 35 days per team, targeted at a
delegate list of 50 at each seminar. The HID 3 'Health risk management' seminar took 33 staff days to organise
and run for 43 delegates.
Appraisal of Application by HID
76. Between 1995 and 1997 an SPN was set up to evaluate the effectiveness of mailshots, seminars and
conventional inspections to SMEs. The work confirmed that inspections and seminars produce more action than
mail shots but there are differences depending on the business sector. The work confirmed the previously
expressed view of inspectors that organising mail shots is extremely time consuming. The study showed that
'force feeding' information to companies is of limited benefit because often the information will be received by the
wrong person at the wrong time. The use of search facilities such as the HSE Internet home page may prove
more beneficial and will also allow HSE to monitor demands for information.
77. Seminars and mailshots are valuable techniques, by which HID communicates with a specific audience.
Seminars allow firms to meet HSE under 'non-threatening' circumstances, which can promote more open
discussion. Both techniques have their place in an inspection programme, to be used as circumstances dictate.
The techniques do not replace inspection but are best used to supplement and support, or as a means of
reaching SMEs.
78. There has been a perception that seminars only ever 'preach to the converted' and that no action is taken in
respect of firms who choose not to attend. But in addition to following-up non-attenders, the correct initial
selection of participants is vitally important.
79. It is not possible to specify a particular time when seminars or mailshots are best carried out, as this will depend
on the subject and objective of the intervention.
INSPECTION TOOLS
Climate Survey Tool
Introduction
80. This is a software-based tool that uses a set of structured questions to examine the health and safety culture
within an organisation. It is intended that firms will buy it and administer it, although HSE has found it useful to
apply it to establish a baseline before an audit. It is used to promote employee involvement in health and safety
by seeking anonymous views on aspects of health and safety, including reasons underlying safety-related
behaviours at work. The software allows the results of the questionnaires to be analysed in a way that suits the
needs of the organisation. The manual gives outline guidance on possible ways in which the findings can be
taken forward, although the needs and structure of the organisation will to a large extent determine this. The tool
aims to provide information which can then form the basis for discussion and involvement of all levels of the
workforce in developing a way forward. The tool does not deal with 'hardware' issues and does not measure
compliance with legal requirements.
How applied
81. The survey tool is available commercially for firms to buy and use. It can be used by inspectors. In this case, it
would be necessary to agree funding for the data entry.
82. HID has a limited amount of experience of using the survey tool, and in carrying out interventions at firms that
have used it. The HID Gas team have applied it, as have HID 5.
Resource requirements
83. None, if firms administer the survey tool. If HSE administers it, site time is about one day initially, plus further
time to give feedback. In addition to time on site, further time is needed to input the questionnaire results onto
the database: but past practice has been to contract this out. Experience of using this technique suggests that
the analysis of the results is very time-consuming.
Appraisal of Application
84. The Mines Inspectorate were involved in trialing the climate survey tool, at three companies which HSE was
auditing. The survey tool was found to be useful in persuading people that safety performance depends on
cultural issues, and the results were useful in airing difficulties and in producing an agenda for action.
85. The HID gas team used the survey tool just prior to an audit of BG storage in autumn 1997. The tool was felt to
give a good guide to how people are thinking, but that the results can be difficult to interpret, and need in-depth
study. The tool can probably only be used in co-operative companies, and HSE cannot require a company to use
it. It is of questionable value in smaller companies.
86. The survey tool does not replace any of HSE's inspection activities, but can usefully complement them,
especially auditing.
87. Inspectors who have used the tool have commented that the success is to a large part influenced by HSE's
follow-up to monitor progress with actions identified. But at another level, the success of its use will be measured
not just by the follow-up to the specific use/visit but by the integration of the gained understanding of an
organisation's culture into more directed future intervention plans such as audit, inspection etc.
88. The climate survey tool is not intended to be used as the first contact with a firm, as depth of knowledge about
management practice, risk control measures, accident/incident history are needed to inform its use. But it can be
used effectively to gain some early intelligence on the culture in a company which will enable the more directed
application of other interventions such as audits, etc.
89. HID inspectors need to be aware of the climate survey tool, its purpose and application.
MANAGEMENT OVERSIGHT AND RISK TREE (MORT) ANALYSIS; INVESTIGATIVE METHODS
Introduction and application
90. These are investigative methods, used in accident investigation. All three have been developed recently. Root
cause analysis is being developed specifically for HSE by WS Atkins. The three tools are basically similar in that
they offer a structured way of approaching an investigation, but Root cause analysis links the causal factors back
to HSG 65 issues. They are particularly suited to complex investigations where there are likely to be a number of
threads to the investigation.
Resource requirements
91. Variable, depending on the complexity of the investigation.
Appraisal of application by HID
92. These techniques will be valuable in complex investigations. Training in the application of MORT, Events and
causal factors analysis and Root cause analysis is now part of the Aston training for Band 4 inspectors. It is
unlikely that many experienced HID inspectors have not received this training. Recently developed investigation
techniques are part of the Investigating Serious Accidents course (details in the FOD/HID technical training
prospectus) available to inspectors via DCT procedures.
INSPECTION PLANS
Principles
93. The high level principles in the inspection strategy project, agreed by the DMB, requires the integration of
inspection techniques into a long term inspection plan for large employers.
94. The High Level Principles amplify this by defining 'long term' as five years, and that inspection plans should not
be confined to Major Hazard establishments. The plans should identify the priorities, when they will be achieved
and by whom and how their effectiveness can be assessed. HID's inspection plans should be flexible so that
they can cope with changing priorities, resource availability and the effectiveness of the inspection plan.
Introduction
95. HID needs to demonstrate adherence to the principles of TPCT as applied to the division's inspection activities.
This part of the chapter introduces a style sheet for an inspection plan to be used across HID at premises which
meet the selection criteria.
Background
96. FOCUS (/CIS) ratings influence the frequency of inspection for all premises except top tier establishments. [Note
a new HID rating system is to be introduced in April 2000] Section 4 of the HI 251 requires the identification of
topics which need to be addressed at future visits.
97. COMAH requires the production of inspection plans for all establishments which are subject to the Regulations.
The Lead Unit approach also requires inspection plans as a basis for co-ordinating HID's activities with multi-
establishment companies.
98. HID applies national priorities to proactive inspection, e.g. Legionella, exothermic reactions, GHGB topics, etc.
These could equally be applied to reactive inspection, with the addition of local concerns and findings identified
from sources including the incident history, findings of inspections, projects, training needs and local pressures
etc. These local priorities could be recorded in the inspection plan to assist in the future selection of incidents for
investigation. Such notes would not be mandatory or to detract from the application of judgement and discretion.
Definition of inspection plan
99. A structured, rolling plan covering up to 5 years to record all HID's planned inspection activity at a site, to include
details of inspection techniques, resources and planned dates. Plans should be produced to a common format,
and to be reviewed (and revised if necessary) after all significant interventions.
100. A blank inspection plan is provided at the end of this chapter. This has been developed from the
inspection plan in the FOD Guide to the inspection of health and safety management, modified to incorporate
features of inspection plans in use by operational HID groups. The plan has been considered by the inspection
strategy project team considering inspection for COMAH, and have advised that it meets their requirements at
this stage. [Note: The arrangements for recording major hazard inspections will be subject to review as a priority
after the introduction of the CIS. Guidance on the current use of the HI 251 can be found in chapter 9 of the
COMAH Manual.
Application
101. The need for HID to have inspection plans to structure inspection activity depends on the risk and
complexity of the site. At the 'highest risk' end of the spectrum, COMAH requires inspection activity to be subject
to inspection plans. The production of an inspection plan is central to the proposed Lead Unit approach for multi-
establishment companies. At the other end of the risk/complexity scale are single site companies for which there
is limited value in preparing an inspection plan, as the activities are straightforward, the site can be inspected in
a day and for which preventive inspection, at the frequency specified by the FOCUS (or CIS) rating is
appropriate. This is shown diagramatically below.
Production of an inspection plan
102. There are two overriding principles which should apply to all inspection plans:
a. Each inspection revealing changes that are required should have appropriate follow-up; and
b. the plan should be reviewed, and if necessary revised, after each significant inspection.
103. The inspection plan will need to be initially informed by a preventive inspection of the site if HID has no
history of the firm's organisational structure, activities, incident history, response to inspections.
104. A copy of the plan should be kept on file. When the CIS is introduced, it will be possible to link an
inspection plan to the Client record. There will be a marker to indicate the existence of an inspection plan.
105. It may be appropriate to replace section 4 of HI 251 with the proposed inspection plan.
APPENDIX 1 - INSPECTION PLAN
Audits
Introduction Appendix 1 - Definition
Policy Appendix 2 - Summary of the Audit Methodology
Roles and Responsibilities Appendix 3 - Quality Standards
Competencies for Auditors Appendix 4 - Further Information
Planning Appendix 5 - Report Structure
Monitoring Appendix 6 - Follow-up Report Structure
INTRODUCTION
1. This Chapter derives from recommendations by field staff at a workshop on auditing by HID inspectors in J uly
1999. It explains HID CI, SI's policy and procedures for auditing and provides guidance to staff who carry out
audits. LD5 have a separate policy, procedures and guidance document dealing with the application of audits
within the mining sector.
2. Auditing is an inspection technique the main purposes of which are to:
a. assess duty holders' compliance with relevant statutory provisions and take appropriate action; and
b. prevent injuries, ill-health and dangerous occurrences.
3. Inspectors should select the audit approach when they wish to employ a structured, rigorous method to:
a. focus on the detailed assessment of the health and safety management arrangements and safety culture
of duty holders; and
b. identify underlying management issues and deficiencies;
in a targeted, transparent, consistent and proportionate way.
4. The terms used to describe audits are listed and explained in Appendix 1. The term 'management systems audit'
is a collective name for: corporate audit; divisional audit; and site audit. They are all characterised by the auditing
of management arrangements and a selection of risk control systems and associated workplace inspections.
Auditing as part of HSE's intervention strategy
5. HSE Enforcement Statement: Continuing Aim 2, Conduct intervention (defined as a process carried out to
secure compliance before an incident) specifies auditing, amongst other approaches, as a means to secure
compliance before any accident or incident. Audits can also be prompted by incidents where, for example,
investigation findings can be used to target audit topics.
6. Auditing requires a balance between interviewing people, examining documents and observation, usually with
more time on interviewing and examining documents than observation. It should be considered as an element of
a broader intervention strategy for establishments (Major Hazard Intervention Plans).
Legal basis
7. Auditing enables the COMAH competent authority to comply with the Seveso II Directive and inspectors to
assess duty holders' compliance with relevant statutory provisions requiring health and safety management
arrangements. These are:
8. Regulation 5 of the Management of Health and safety at Work Regulations 1999 (MHSWR) requires employers
to make appropriate health and safety arrangements. Further guidance on this duty can be found in HSC
publication L21: Management of health and safety at work, Approved Code of Practice and Guidance.
9. HSWA S2 requires employers to prepare a written statement of policy with respect to the health and safety at
work of their employees and the organisation and arrangements in force for carrying out the policy.
10. For establishments subject to the Control of Major Accident Hazards (COMAH) Regulations the Competent
Authority (CA) is obliged to carry out inspections under regulation 19. Such inspections should be sufficient for a
planned and systematic examination of the technical, organisational and management systems employed at
establishments.
POLICY
11. It is HID LD policy to carry out audits, where appropriate, as part of a range of complementary approaches to
duty holders to secure compliance with relevant statutory provisions.
ROLES AND RESPONSIBILITIES
12. This section explains the roles and responsibilities of HSE staff involved in auditing. Only staff who meet the
criteria under `competencies for auditors' below should lead or assist in audits.
13. The resources put into an audit should be proportional to the scope of the audit (see paragraph 37 and Major
Hazard Intervention Plans ) and apply all necessary expertise (see paragraph 21). Audits are usually therefore
carried out by small teams. An audit leader should be appointed with responsibility to:
a. manage the elements of the audit methodology as summarised in Appendix 2;
b. identify other appropriate auditors and administrative support, ensure their roles are clear and manage
their involvement. Note that it is good practice to involve others at an early stage;
c. identify any relevant lead unit involvement and liaise with the co-ordinating inspector where appropriate
to ensure that the audit scope is consistent with relevant corporate intervention plans (see also
paragraphs 14 and 34 below);
d. for COMAH establishments, inform and, if appropriate, manage the involvement of EA/SEPA in audits
(see also Single Implementation Project (SIP) Product 2(g) - policy and procedures for carrying out
management system audits (to be prepared and added to Chapter 11 of the COMAH Manual));
e. ensure that audit reports and audit follow-up reports are completed within the time limits in paragraphs
62 and 65 below and Appendix 3.
Lead unit approach and auditing
14. Information on the roles and responsibilities of lead units and co-ordinating inspectors is contained in Lead Unit
System for Multi - Establishment Companies of this manual. The lead unit system is designed to ensure a co-
ordinated central approach to appropriate multi-establishment companies. The lead unit co-ordinating inspector
is responsible for ensuring consistency and efficiency in approaches to duty holders. This includes co-ordinating
audit approaches at premises and sharing information about past and proposed interventions. This information
will help to inform and influence the audit agenda and scope. For COMAH establishments this includes audit
approaches by HSE and EA/SEPA (see also SIP Product 2(d) - policy for lead unit and industry sector regimes
(COMAH Manual Chapter 11 Section B) and Product 2(e) - guidance to staff on the lead unit and industry sector
regime (to be prepared).
15. The lead unit co-ordinating inspector should also ensure that the results of audits are available to other
inspectors and, where relevant, COMAH CA staff who deal with relevant organisations. Staff should use these
results to inform their subsequent approaches to lead unit organisations.
16. The lead unit co-ordinating inspector may also be the audit leader where appropriate, for example when
corporate audits are carried out. The responsibility for elements of the audits, such as much of the on-site activity
and report preparation, may be delegated by co-ordinating inspectors. But the co-ordinating inspector is
responsible for communicating with the company's central health and safety contact on where and how the audit
fits in with the agreed intervention plan and ensuring that audit reports are received by the central contact.
17. Audit leaders should usually lead the presentation of audit findings to duty holders. However, it will sometimes be
appropriate for staff at higher grades to do this. One of the aims of auditing is to try to influence the most senior
level of management of the duty holder relevant to the nature and scope of the audit. Level 1 audits (see
paragraph 37) have most potential to achieve this but in some cases further influence can be applied by fielding
senior HID personnel e.g. Band 1 and above. Audit leaders should consider and discuss with their line managers
the appropriate level of HSE representation at the presentation based on the level of the relevant duty holder's
management present and significance of the audit findings.
18. The relevant lead unit co-ordinating inspector should be informed and, where appropriate, involved when HSE
senior managers are invited to provide pre-audit briefings and/or presentations of audit findings.
19. Band 2 heads of FMUs are responsible for ensuring that:
a. staff with the necessary competencies lead and assist in audits;
b. that there is justification for any significant differences in resources when audits of similar scope are
carried out at different establishments, or at the same establishment over time;
c. they lead the presentation of audit findings to duty holders where appropriate (see paragraph 17 above).
20. Band 1 heads of field units are responsible for ensuring that the policy, procedures and guidance in this Chapter
are implemented.
COMPETENCIES FOR AUDITORS
21. Competencies for regulatory inspectors to undertake effective audits are contained in the document:
Competencies for HID regulatory inspectors (HID Circular CC/Personnel/3). In addition to the skills required for
other field work, auditors need to be able to derive findings based on the evidence they obtain from interviews,
documents and observation and link these findings to HSG65 POPMAR elements. Further details of HSG65 and
other sources of information are given in Appendix 4.
22. Before leading an audit, HSE staff should as a minimum:
a. be at Band 3 or above; and
b. have attended the ASSMAN training course and assisted in at least one audit (inspectors who are
inexperienced in auditing are likely to benefit from assisting in more than one audit to help develop their
skills before leading), or have led audits prior to the publication of this guidance; and
c. be familiar with this guidance.
23. Before assisting in an audit staff should have:
a. read HSG65 and be familiar with the POPMAR management model and relevant legal requirements
(see paragraph 8 above); and
b. b) be familiar with this guidance.
Deployment of specialist resources
24. Specialists should be involved in audits when their skills are required by the audit leader to ensure that all
necessary expertise is applied. The view was expressed at the audit workshop that specialists should contribute
to safety management issues at level 2 (audits of RCSs) as well as their technical speciality. Human factors
specialists may also be involved in level 1 management systems audits. A report produced for HSE (details in
Appendix 4) explored how to derive priority issues for inspection and broad guidelines for the deployment of
specialist resources.
25. The report identified that approximately 25% of loss of containment failures occurred in normal operations, 30%
in maintenance and a further 30% were due to failures and defects in design or construction. The report
suggests that an equivalent proportion of available audit resources should be devoted to examining each activity.
The remaining 15% could not be attributed to a particular activity and the report suggests that the equivalent
resources could be devoted to auditing mitigation and emergency response measures.
26. The table below uses information from the report and the FOD Guide (see Appendix 4) to derive an audit
strategy based on broad issues and links these issues to relevant risk control systems (RCSs). Please note that
the information needs to be used with caution. It is derived from averaging the respective contributions of each
cause of loss of containment over a range of industries worldwide and may not always be appropriate for a
specific industry sector, or specific site. However, it can help inspectors to identify RCSs to audit when site
specific information is lacking; and to identify which RCSs to focus on to explore the issues listed.
Issue RCS
Design and Modification of Plant Plant Design
Plant Change
Control of Contractors
Construction of Plant Plant Commissioning
Control of Contractors
Normal Operations Operating Procedures
Human Factors of Operations
Maintenance of Plant Permit to Work
Control of Contractors
Planned Maintenance Procedures
Planned Plant Inspection
Mitigation Emergency Response
27. The choice of specialist disciplines to be deployed will be determined by a combination of the RCS selected and
the nature of the plant or process and controls in place. For example, one would usually expect specialist input to
plant design / change issues. Where issues involving reliability of human components of systems are anticipated
such as management culture or the operator/process interface, human factors specialists may be required.
28. The report also uses statistics to rank RCSs in order of their contribution to failure rates. This information can be
used to assist audit leaders to prioritise RCSs audits. For further details please see the section on selection of
risk control systems (see para 48).
29. Specialists should have similar competencies as others who assist in audits (see paragraph 23 above).
30. Staff may also be present during audits as part of their training. In these cases there are no specific
competencies required.
PLANNING
31. Inspectors should prepare a 5 year intervention plan for all COMAH establishments. Further information on this
is provided in Major Hazard Intervention Plans and Inspection Techniques of this manual. The plan should
identify planned interventions including audits.
32. When planning an audit inspectors may find it helpful to consider the suggested summary of audit methodology
in Appendix 2.
Selection of establishments to audit
33. Major Hazard Intervention Policy explains HID CI, SI's inspection policy and criteria for planning its inspection
programmes. Inspectors should refer to this when selecting establishments/premises to audit. Paragraph 3
provides criteria on when to select the audit approach.
34. Audits of establishments may not be appropriate when:
a. they have only a rudimentary safety management system and where the hazards are so few as to make
the approach a disproportional use of resources;
b. the establishment / premises are part of a multi-establishment company where there is central
intervention and the audit is planned to contact some, but not necessarily all, the company's
establishments (see also paragraph 41);
c. the duty holder has a poor attitude or does not have the competence to respond to the audit process, an
alternative approach such as conventional inspection may be more appropriate (see also section on
hostility - para 59).
35. Some establishments may be audited relatively frequently where there are many issues / RCSs which need to
be audited to ensure that the duty holder has adequate control over hazards across the establishment.
Timing of audits
36. The timing of the audit, within the 5 year intervention plan, is at the discretion of the person responsible for
preparing the plan. It will depend upon a number of factors including:
a. date of safety report submission and assessment. The outcome of safety report assessment will help
inform issues to audit and the resources required for assessment may reduce those available for audit. It
may not, therefore, be appropriate to audit during a work year when assessment is carried out;
b. date of any previous audit and follow-up work. Inspectors may wish to leave sufficient time between
audits to allow the effects of previous audits to be realised;
c. other planned work at an establishment. Auditing is one of a range of approaches to duty holders. It is
good practice to vary the inspection approach over time;
d. duty holders' circumstances e.g. change of management / ownership. Depending on circumstances
inspectors may wish to delay planned audits until soon after such changes to assess the new
management's ability to manage health and safety;
e. reactive work required e.g. investigation of a major accident. This can disrupt plans and reduce available
resources for audits. It can also help identify key audit topics which may be different from any already
planned and which could prompt an urgent need to address them.
f. resources available and the number of audits carried out by individual inspectors. There may be other
demands on inspectors' resources e.g. (e) above. Also, audits can be psychologically demanding
particularly for audit leaders and individuals should not be required to carry out more than they can cope
with.
Audit scope
37. For COMAH establishments, COMAH regulation 19 (2) specifies that inspections should not be dependent on
the receipt of a safety report (see also COMAH Safety Report Assessment Manual Chapter 4). However, safety
reports provide essential information about how operators seek to prevent, control and mitigate major accidents.
Where safety reports have been submitted, assessed and the conclusions identified, the outcome should be
used to identify topics for inclusion in any audit programme and included in the 5 year intervention plan. Other
sources of information include CIS, FOCUS, office files, previous inspection plans, HI251s and audit reports.
38. There are three levels at which safety management systems operate:
a. level 1 - management arrangements;
b. level 2 - risk control systems; and
c. level 3 - workplace precautions.
39. A balanced audit approach should incorporate all three levels. The preferred option is that audits should assess
all the POPMAR elements at level 1 and all the POPMAR elements of at least two risk control systems. This
should enable auditors to adequately assess duty holders' safety management systems.
40. Issues should be pursued to the point where auditors are either satisfied that duty holders have adequate
arrangements in place or can identify that improvements are required. Auditors should record findings which
indicate areas where duty holders perform well in addition to identifying areas where improvements are required.
41. For some operators / organisations, however, it may not be appropriate to carry out a level 1 audit of their
individual establishments / premises because, for example:
d. they operate a number of establishments / premises with similar hazards and management systems and
carrying out level 1 audits of them all would be duplicating work;
e. they are within scope of the lead unit system and a co-ordinated corporate or divisional audit, the
findings of which can be applied to the individual establishments, has been carried out or is planned;
f. the establishments do not have a sufficiently sophisticated management structure to warrant a level 1
approach;
g. they have been previously audited at level 1 and their arrangements are known based on the previous
audit.
42. In these cases audits at individual establishments / premises may be restricted to level 2, which focuses on
specific risk control systems. Where previous level 1 audits have been carried out, level 2 audits can be used to
monitor duty holders' ability to maintain adequate standards and draw inferences about their current
management arrangements. At establishments where there are few hazards / activities e.g. some warehouse
operations, the audit may be of more limited scope than suggested in paragraph 39. Observation of workplace
precautions should form a part of both level 1 and level 2 audits.
43. In all cases and at whichever level it is undertaken, the scope of the audit should usually be sufficient to identify
at least one finding against each element of the POPMAR framework.
44. Audits can be used to check that duty holders are doing what they say e.g. to verify information in safety reports
and other documents; and to check that their arrangements are adequate to comply with legal and other
standards.
45. For duty holders who operate a number of establishments / premises level 1 audits should be applied at the most
senior level of management control of the relevant group of establishments. For companies within the lead unit
system the relevant lead unit co-ordinator's role is described at paragraph 14.
Audit on-site activity
46. Audits should be carried out as a single event i.e. completed within a short time span, and should lead to a report
as described in paragraph 62 and Appendix 5. For the purposes of the quality standards in these procedures
(para 74), audit on-site activity is taken to be the period between the initial interview/inspection and on-site
closing meeting (see Appendix 2).
47. If a lack of resources prevents the on-site activity being completed within a reasonable time i.e. within one
month, then the scope of the audit should be reduced to allow it to be completed within this period. In exceptional
cases the audit may need to be postponed until resources become available.
Selection of risk control systems
48. The FOD Guide (see Appendix 4) Section 4 identifies a range of risk control systems (RCSs) with associated
assessment procedures and examples of issues / questions for interviews. Auditors should consider the
following criteria when selecting RCSs:
a. particular aspects of the duty holder's operation or specific items of plant which are critical for safety i.e.
the most significant hazards/risks. For top-tier COMAH establishments auditors should consider RCSs
which form part of operators' key measures for preventing / mitigating major accidents identified in safety
reports;
b. issues identified as requiring improvements based on the assessment of COMAH safety reports,
previous incidents and intelligence gathered from other interventions at the establishment to be audited;
c. issues which are known to be important in the type of industry / establishment / process to be audited
and about which assessment is required to establish the adequacy of control at a particular
establishment;
d. RCSs which have not previously been assessed at a particular establishment or others under the same
duty holder's control.
49. Staff should be cautious about re-examining RCSs which have been previously audited, although this should not
prevent re-examination where, for example, sufficient time has elapsed since the initial audit or when it fits in to
part of an intervention plan for an establishment. However, one of the benefits of auditing is to achieve long-term
improvements and, when there are reasons to suspect that control of previously audited RCSs is inadequate,
staff will need to consider why this is so and whether to employ an alternative approach to secure adequate
standards.
50. A report produced for HSE identified a rough ranking of RCSs based on their contribution to failure rates and the
relevance of preventive and recovery mechanisms. (Details of the report can be found in Appendix 4). The table
below shows this ranking. It may assist auditors in targeting RCSs.
Rough Ranking of Risk Control Systems
1 Control of Contractors
2= Plant Process Design
2= Plant Process Change
4 Operating Procedures
5 Assessing Competence
6= Permit to Work
6= Planned Maintenance
8 Planned Inspection
9 Commissioning
10 Site Transport
51. A subsequent report from the US Environmental Protection Agency Chemical Emergency Preparedness and
Prevention Office identified inadequate process hazard analysis as a significant cause of accidents. Specific
issues identified were failures to:
a. address known equipment failure scenarios;
b. adequately consider hazards of exothermic reactions; and
c. identify all process hazards.
52. These issues are required to be addressed in safety reports for TT COMAH establishments and inadequacies
will usually be identified as part of the safety report assessment process. For other premises, however,
inspectors will wish to be aware of this cause of accidents and consider it as an audit topic.
Employer involvement and participation
53. In addition to the traditional audit approach i.e. where the regulator carries out the audit, the audit workshop
considered two other approaches:
a. audits are carried out jointly with duty holders; and
b. duty holders carry out their own audits and the regulator checks the outcome.
54. These approaches can have the benefit of improved ownership of the audit by duty holders, better targeting of
topics for audit and can be an effective and efficient use of HSE's resources. But they do not usually have the
same degree of independence as the traditional approach. Inspectors should ensure that adequate regulatory
control is maintained when these approaches are employed. HID does have experience of a co-ordinated audit
producing a very satisfactory outcome where the duty holder resisted any co-operation with a traditional imposed
audit but was very willing to conduct an audit with the regulator under the banner of a `best practice review'.
Further work is currently being undertaken to look at the value and the consequences of this type of partnership
approach, At this stage we recommend that the traditional approach is taken but that inspectors remain open to
suggestions from operators and, if thought appropriate, to discuss the options and safeguards with OPPG.
55. Further guidance on COMAH safety management systems and MAPP assessment criteria and how to assess
them can be found in the COMAH SRAM Chapter 2 Part 4. Although this is targeted specifically at COMAH
establishments, many of the criteria and evidence can be applied at other premises.
Auditors - non-HSE lead
56. Audits of COMAH establishments may be led and, in some cases, carried out exclusively by EA or SEPA rather
than HSE. See SIP Product 2(g): Policy and procedures for carrying out management system audits for further
advice in these cases (to be prepared for COMAH Manual Chapter 11).
Enforcement
57. Contraventions identified during audits should be dealt with in the same way as they would be at other
interventions and reactive contacts i.e. in accordance with the Enforcement Management Model (EMM). Duty
holders subject to audits should be informed of this policy. It is expected that enforcement action i.e.
enforcement notices or prosecution should follow when duty holders fail to adequately progress audit action
plans where there are breaches of legal requirements.
58. Auditors should make clear when audit findings are the subject of specific legal duties and distinguish them from
findings which will help duty holders improve standards, but where compliance with particular legal duties is not
required.
Hostility
59. In general the audit approach is supported by duty holders (see CC/ADMIN/8: CIA Report on HID audit
inspection method). However, there may be cases where duty holders are hostile to audits. They should be
informed that it is HSE policy to examine operators' systems for managing health and safety and to achieve this
by auditing. In cases where hostility is so strong as to make auditing unfeasible inspectors will need to shift to an
inspection based approach and focus on compliance issues.
Audit methodology
60. A summary of audit methodology is provided in Appendix 2.
Involvement of employees/employee representatives
61. It is HID LD policy to involve employees in interventions and reactive work. By its nature auditing involves
interviewing a range of employees across various organisational levels and functions. In addition to this, auditors
should ensure that employee representatives are informed about proposed audits and that they are able to see
the audit report and are aware of the outcome of the audit follow-up. The decision whether to include employee
representatives as audit interviewees is left to the discretion of the audit leader and will depend on the scope and
nature of the audit. See OC 111/2 for more information on employee involvement.,
Audit reports
62. A suitable format for audit reports is provided in Appendix 5. Reports should normally be completed and
submitted to auditees within two months of the start of the audit field work. Advice on handling requests from the
public to disclose reports may be obtained from staff responsible for disclosure issues in OPPG. Staff should be
aware that the report may be put in the public domain by others e.g. recipients of the report.
63. The audit report should normally be supported by a presentation to the duty holder. This may be done as a
close-out meeting at the end of the audit or as a separate, more formal, presentation once auditors have
considered their findings fully (see paragraph 17).
Response to audit report by duty holders
64. Duty holders should be requested to submit a formal response to the audit report. This should include their
action plan for addressing the report's findings. Requesting this response serves to make explicit duty holders'
responsibilities, can help to secure their commitment and stimulate their activity. The nature and quality of
response received will provide an indication of duty holders' commitment and competence in terms of
understanding audit reports' findings. The responses should cover all the findings and describe planned and/or
completed means of addressing them.
Audit follow-up
65. Audits need to be followed-up to monitor duty holders' progress with findings. One means of doing this is to
complete an audit follow-up report - see Appendix 6 for a suggested format. Auditors are not obliged to adhere to
this format but should ensure that duty holders' progress with audit findings is clearly recorded and available.
Follow-up should be carried out not later than 6 months after the start of the audit on-site activity. It should be
pursued to the point where the auditor(s) is satisfied that either progress with findings is satisfactory, though not
necessarily complete, or that inadequate progress has been made and further action, including enforcement
where necessary, is required to secure improvements. Issues which require longer than 6 months to address
should be monitored against the duty holder's action plan and included as part of future intervention plans.
66. Auditors are not required to undertake formal follow-up interviews with duty holders' staff, although employee
representatives should be consulted as part of the follow-up process and able to see the audit follow-up report or
other record of progress.
67. The process of carrying out the audit is considered to be complete once the audit follow-up has been completed.
Any outstanding issues which should have been addressed by this time but have not been should be considered
and prioritised for enforcement action. Auditors should keep a record of progress with these issues by updating
the audit follow-up report or similar record - see Appendix 6.
Timing of follow-up issues
68. Duty holders should be requested to prepare a response to the audit report within 2 months of receiving it.
Auditors should complete the audit follow-up within 6 months of the start of the audit i.e. the first interview /
inspection.
MONITORING
69. There are two elements to this:
a. monitoring the resources spent on audit work done by land division; and
b. monitoring the extent to which these policies, procedures and guidance are implemented.
Recording audit work
70. HID needs to be able to account for the resources spent on auditing. It assists the Directorate to plan future work
and helps to promote consistency across the Directorate. Information on HID audits carried out in past years is
available from BOIU.
71. Audits should be recorded on CIS. Details of how to do this are included on the CIS help file under `audit
inspection'. The CIS help file also explains how to link documents such as audit reports and audit follow-up
reports to specific audits.
72. The CIS procedure requires setting up a job type audit and records:
a. contact and non-contact time on audits;
b. names and location of auditors;
c. type of audit i.e. corporate, divisional or single site;
d. level of audit i.e. level 1 management arrangements and / or level 2 risk control system;
e. risk control system(s) audited;
f. certain milestones in the audit process i.e. dates of start and end of on-site activity, submission of audit
report and audit follow-up.
73. Monitoring this information should be carried out by field line management. BOIU will evaluate and interpret
periodically FOCUS / CIS audit data and make the results available to HID LD.
Quality standards
74. Appendix 3 contains a list of quality standards against which these audit policies, procedures and guidance can
be assessed. BOIU will audit and review these periodically. They are designed to monitor whether key audit
issues and milestones have been met and the extent to which the information in this Chapter is fit for purpose.
The results of this monitoring will assist in reviewing this Chapter and inform our approach to auditing. This
guidance forms part of HID LD's quality system and will itself be subject to audit.
Feedback
In addition to the monitoring proposed above, users of this Chapter are invited to suggest improvements to it at any time
by sending comments to HID CD OPPG.
APPENDIX 1
DEFINITION OF AUDIT
76. The following descriptions are working definitions to aid consistency in the use of the terms.
Audit - a systematic, documented, verification process of objectively obtaining and evaluating evidence
to determine whether an employer has developed a management system and implemented the
arrangements necessary to meet its legal obligations in respect of health and safety and the control of
risks and whether the system and arrangements are effectively implemented.
Management Systems Audit (MSA) - is the audit of a company at a defined level of management.
Such an audit should consider all the elements of the management arrangements i.e. Policy, Organising,
Planning and implementing, Measuring performance, Audit and Review - or POPMAR. The following
definitions identify the targeted level of management and do not indicate any change of style or
approach to the auditing process.
Corporate Audit - the audit of a company directed at the decision making board level.
Divisional Audit - the audit of a company directed at a senior level of management that
are able to make long term strategic decisions about the particular business activity or
discrete part of the company such as a division or group.
Single site audit - the audit of a company directed at the management of a single
establishment/premises. This might be part of a multi-establishment/premises
organisation when it operates autonomously.
Risk Control Systems Audit (RCSA) - the audit of a defined and restricted risk control system. It
includes auditing both the level of compliance with legal requirements and the auditing of the
management of that risk. Such an audit can be used as a free standing inspection technique or as part
of a MSA.
APPENDIX 2
SUMMARY OF AUDIT METHODOLOGY
1. PLANNING THE AUDIT
2. ON SITE ACTIVITY 3. REPORTING 4. FOLLOW UP
1. Select dutyholder. 1. Carry out initial briefing. 1. Derive audit findings from 1. Request and record
evidence obtained. dutyholder's response to
audit findings.
2. Determine audit strategy 2. Conduct interviews, verify 2. Prepare audit report and 2. Check progress with audit
i.e corporate/divisional/site, documentation, observe send to dutyholder. findings.
involving LU co-ordinator as workplace conditions.
necessary.
3. Determine audit scope i.e. 3. Obtain and evaluate 3. Present audit findings to 3. Include longer-term
Level 1 and/or Level 2. evidence. dutyholders (unless already actions on intervention plan
covered in close-out for dutyholder.
meeting).
4. Select RCSs. 4. Hold close-out briefing
(unless presentation
proposed once audit report
complete).
4. When audit report
complete enter contact and
non-contact work on CIS,
including report milestone.
Link report and other relevant
correspondence on CIS.
4. Take enforcement action
where legal requirements not
met.
5. Identify auditors and their
roles.
5. When on-site activity
complete, enter contact and
non-contact work on CIS,
5. When follow-up complete
enter contact and non-
contact work on CIS,
including milestone for on-
site activity.
including follow up milestone.
Link follow up report or
similar record on CIS.
6. Inform duty holder,
arrange initial briefing and
prepare interview schedule.
7. Identify specific issues for
interviews / doc. verification
and observation.
8. Enter any relevant
contacts and record non-
contact work on CIS.
9. Set up job-type "audit" on NOTE: audit on-site activity NOTE: audit report should be NOTE: audit follow up should
CIS and enter relevant info. should be completed within 1 completed within 2 months of be completed within 6
and milestone for audit month. start of on-site activity. months of start of on-site
preparation stage. activity.
APPENDIX 3
QUALITY STANDARDS FOR AUDIT WORK
This Appendix provides a summary of the quality standards against which audits will be assessed. HID Central Division
will assess performance against these standards.
a. Appropriate liaison with the lead unit co-ordinating inspector to ensure that the audit scope is consistent with
relevant corporate intervention plans
b. For COMAH establishments, appropriate liaison with EA/SEPA
c. Staff with the necessary competencies lead and assist in audits (see para 21)
d. That employees and/or their representatives have been informed about proposed audits and the outcome of
completed audits (see section on involvement of employees / employee representatives)
e. That audit on-site activity is completed within one month
f. That an audit report is submitted to duty holders within 2 months of the start of the audit on-site activity
g. That audits are followed-up within 6 months of the start of the audit on-site activity.
APPENDIX 4
REFERENCES AND USEFUL SOURCES OF FURTHER INFORMATION ON AUDITING
Reference 1
78. HSG65: Successful health and safety management:
a. describes the principles and management practices which provide the basis of effective health and
safety management;
b. sets out the issues which need to be addressed;
c. can be used for developing audits; and
d. contains a list of useful other references.
Reference 2
79. Report on the specialist inspector role in the assessment of COMAH safety reports. K B Ratcliffe. The report
summarises the results of a project undertaken for HSE to map out the extent of the role that specialist
inspectors will play in the assessment of safety reports prepared and submitted under COMAH, their involvement
in subsequent site interventions and provides a model to determine strategies and priorities. Contact HID CD
OPPG for more information.
Other information
80. BS8800: Guide to occupational health and safety management systems provides guidelines based on the
general principles of good management. It is designed to enable the integration of occupational health and safety
management within an overall management system. It covers both the HSG65 approach and the BS EN ISO
14001 environmental systems approach.
81. The FOD Guide to the inspection of health and safety management. Parts of this overlap with the guidance in
this and other chapters of the HID Inspection Manual. The Guide is expected to be revised in due course and the
overlaps will then be eliminated. In the meantime, as a general guide, where there are overlaps and / or when
this chapter provides additional information and guidance, the latter takes precedence. However the FOD Guide
does provide more expansive information on, for example, inspection methods and very useful information to
assist auditors to assess a range of risk control systems.
82. The report on `A Review of HID Auditing Approaches to duty holders' by HID's Benchmarking and Operational
Intelligence Unit was produced in November 2000 and describes the main findings and recommendations arising
from the project. It is a substantial and thorough report that includes a list of further reference documents. It will
be available from BOI from J anuary 2001. An executive summary of the report will also be produced and
available at that time.
83. The report on the HID audit workshop - HID Divisional Management Board paper DMB/99/53. This provides a
comprehensive report on the auditing issues identified and proposals for addressing them and forms the basis
for this Chapter of the Inspection Manual.
APPENDIX 5
AUDIT REPORT STRUCTURE
84. A written report should be prepared following an audit. This Appendix provides guidance on a suitable structure
for reports.
a. Title page
This should be in the form: Report on Health and Safety Executive or, where relevant,
COMAH CA audit of (name and address* of organisation); and state the date the audit
report was completed. Earlier draft reports should be marked as such and dated.
*For single site audits the address of the site visited should be stated. For audits which
involve visits to more than one site the address should be omitted from the title page
and a list of the sites visited included in the report's introduction.
b. Contents page
This should list the contents and associated paragraph numbers.
c. Summary
This should set out the report's purpose, main findings, main conclusions and the action
required by the auditee (e.g. to prepare an action plan to address the report's findings).
It should list or provide reference to the audit findings (see (e) below).
d. Introduction
This should explain the purpose of the audit, perhaps in more detail than in the
summary. It should:
i) state the addresses of the sites visited (unless it is a single site audit -
see para. a) above) and the date(s) of the audit.
ii) specify the reason for selecting the particular auditee;
iii) identify any risk control systems assessed and why they were
selected;
iv) explain that HSE use the HSG65 POPMAR framework as the means
of assessing management systems;
v) include acknowledgements.
e. Findings
This is the main part of the report. It should follow the HSG65 POPMAR
framework and be set out as below:
Finding State your finding here. It should be derived from the evidence below.
Relevant legal requirements, ACoP, guidance
State the source and status of any requirements here.
Evidence State the evidence you found which led you to the finding. This could be from interviewees'
responses, documents examined or site inspection.
Action required State the action required by the duty holder to address the finding.
Findings are the auditor's assessment of duty holders' performance against elements of
the POPMAR framework. They should be derived from the evidence found during the
audit. For example, evidence could be found that emergency showers were not
functioning; bund walls were damaged; and pipework was badly corroded. From this
evidence an auditor could derive the finding that the duty holder's active monitoring
arrangements need improvement.
The relevant legal requirements and other requirements should be considered at this
stage so that the status of the finding is clear. This will also assist in any subsequent
consideration of action to take should duty holders fail to adequately progress findings.
Where level 1 management arrangements and level 2 RCSs are both audited it is
helpful to separate the findings for each.
f. Conclusions
These are inferences you draw from the Findings section. This would
identify and prioritise the main strengths and weaknesses of duty
holders' SMSs. For example, one might conclude that a duty holder has
in place effective means of ensuring they have competent staff but that
their arrangements for monitoring require improvement and should be
addressed urgently.
g. Action required
State what the auditee has to do e.g. prepare a response to address the
report's findings, and the required timescale for this. Also state the
proposed HSE action e.g. any enforcement action. You should make it
clear that the audit will be followed up.
APPENDIX 6
AUDIT FOLLOW-UP REPORT STRUCTURE
85. This Appendix provides guidance on a suggested structure of audit follow-up reports. This format is not
obligatory and auditors may record duty holders' progress in other ways. The suggested structure aims to
minimise additional work by requiring relatively minor amendments to the audit report.
86. A written report should be prepared within 6 months of the start of on-site activity. Once this report has been
completed the process of carrying out the audit is considered to be complete. Audit findings requiring longer-term
action should be monitored against the duty holder's action plan and included as part of future intervention plans.
The audit follow-up report may follow the structure below (based on the original audit report):
a. Title page
The audit report title page should be amended to indicate that this is an audit follow-up
report.
b. Contents page
This is likely to require no changes or only minor amendment from the original audit
report.
c. Summary
This should be amended to summarise duty holders' progress with the audit report
findings and action proposed by HSE.
d. Introduction
This should be amended to explain the purpose of the follow-up report. Most of the
information in the original introduction will remain valid.
e. Findings
An `outcome' heading should be added to the Findings section and should be completed
for each finding for which duty holder action is required.
f. Conclusions
This should be amended to draw inferences based on duty holders' progress.
g. Action required
This should state the further action proposed by HSE e.g. any enforcement action as a
consequence of inadequate progress with findings, plus the timescales for any
subsequent follow-up.
Operation Of The Lead Unit System
Introduction Implementation
Overview Appendix 1 - Lead Unit Document
Management Appendix 2 - Further details of Definitions
Operating Appendix 3 - Allocation of Lead Units
INTRODUCTION
Purpose of the chapter
1. The purpose of this chapter is to provide guidance to inspectors on the operation of the Lead Unit system. The
system is based on the following four principles that were agreed by the DMB under the Inspection Strategy
project:
a. The system should provide for co-ordinated central approach to inspection of appropriate multi-
establishment companies;
b. The co-ordination of the inspection should be managed by a Head of Unit;
c. Where a co-ordinated central approach is not considered appropriate, other mechanisms should be in
place to ensure consistency between sites of the same company;
d. Special arrangements will have to be made with respect to HID enclaves in FOD sites, where HID or
FOD consider that a central approach is appropriate.
2. The chapter covers 4 areas - overview, management, operation and implementation of the system.
Background
3. The potential benefits of co-ordinated interventions with multi-establishment companies are well known, e.g;
a. they improve the consistency, proportionality and transparency of HSE's dealings with those companies
by maintaining a central overview;
b. more efficient use of inspection resources can be achieved;
c. they enable better targeting of problem areas within and throughout a company at its various
establishment locations;
d. improved communication links with the company;
e. where companies monitor HSE activity across their sites they will be able to identify that we are taking a
co-ordinated approach to the company;
4. In addition to these benefits other key issues for HID that will be assisted by co-ordinated central approaches are
consistency in the processing of COMAH safety reports and the development of pragmatic charging
arrangements across a multi-site company.
5. Along with the advantages it must be remembered that there are resource requirements to set up and fully
implement the arrangements required to deal with multi-establishment companies.
6. Consequently attempts have been made in the past to capitalise on these benefits and produce systems for co-
ordinating central approaches etc. The main initiatives have been the HOPI (Head Office PI) system set up to co-
ordinate safety reports and the Lead PI system, which followed the HOPI initiative and was set up to develop
inspection plans for multi-establishment companies. This work was largely linked to the audit programmes for
these companies.
7. In 1996 HID set up a working group to review the use of the Lead PI system and auditing in HID. From this
working group the topics of audit and Lead PI were separated with the development/replacement of the Lead PI
system coming under the Inspection Strategy project.
8. It is from the work on HOPI/Lead PI and other central intervention initiatives such as the HID 5 Lead inspector
system and the work of the HID Gas team that the Lead Unit system has been developed. The system builds on
the positive parts of the Lead PI/HOPI system and strengthens the weaker aspects.
COMAH Competent Authority Issues
9. The arrangements that have been made to interface with the agencies can be found in the COMAH Manual as
chapters 2 and 3.
10. The Agencies do not operate a similar system of intervention because they are of the view that most
environmental issues can be dealt with either by the preparation of standards that can be applied to all relevant
companies or by dealing with specific establishments at site level as the environment is unique in each location.
They achieve consistency by working through a series of industry groups with specific inspectors taking the lead
and sometimes setting up task specific responsibilities.
11. However, they recognise that there are some issues that could be dealt with centrally and agree that HSE having
a central intervention option may be useful to them. In practice therefore:
a. HID establishment inspectors should involve agency inspectors by consulting the local contact when
considering raising issues for central intervention
b. Co-ordinating inspectors should consult the agencies when planning central intervention programmes. In
this case the local inspector should be contacted but they may refer the issue to other inspectors who
are nominated to deal with a particular industry sector.
OVERVIEW
The Lead Unit System
12. The aim of the system is to deliver central co-ordination of interventions with multi-establishment companies to
achieve the goal of efficiently making significant improvements in health and safety standards across a multi-
establishment company.
13. The system will be managed by Heads of Operational Units with the approach used being tailored for each
company. The system will operate at two levels and includes arrangements for dealing with enclave sites where
HID or FOD consider a central approach is appropriate.
a. Level 1 approach - This is aimed at companies where HID has a relatively high level of involvement and
will be based on information sharing and accessibility, co-ordination of intervention activity and
development of a long term inspection plan for the company.
b. Level 2 approach - This is aimed at companies where HID has a lower level of involvement and will be
based on communication, liaison and monitoring of trends to aid consistency of intervention with the
company.
14. Multi-establishment companies will be allocated, by the Heads of Operational Field Units forum, to one of HIDs
operational units. The allocated Unit will then be responsible for considering if a lead unit approach is likely to be
beneficial and if so, developing and co-ordinating the appropriate approach for that company following the
guidance set out in this chapter.
15. It is the responsibility of the HOU to ensure the appropriate multi-establishment approach is delivered. Although
much of the work will be delegated to Unit staff, direct involvement by the HOU is anticipated when dealing with
company senior management.
16. HOUs will allocate a Co-ordinating Inspector (CI) to multi establishment companies where the Lead Unit
system is to be applied. The CI is responsible for managing the Lead Unit approach for their allocated company.
17. To operate the system effectively staff outside the Lead Unit will be involved in interventions with the company.
However this does not mean the Lead Unit assumes the authority to direct those staff. The success of this
system will depend on co-operation between Units to contribute to the central approach .
18. To enable the system to function effectively resources need to be allocated to Lead Unit work. To meet this need
Lead Unit work has to be planned and specifically included in plans of work at, Divisional, Unit, Group and PWP
level. Consequently Lead Unit work will need to be actively reviewed during the work planning cycle.
19. A large proportion of the companies within HID's remit will fall within the multi-establishment definition. From a
basic search of FOCUS asking the question "How many HID clients have more than one location recorded
against them?" the following figures were obtained:
20. Clients with two or more Locations attached;
NUMBER OF LOCATIONS
2 - 4 5 - 10 11+
Unit 1 94 19 5
Unit 2 232 44 16
Unit 3 229 37 15
Unit 4 338 51 28
Unit 5 32 7 6
Total 925 158 70
21. From these figures it is clear that it is unrealistic, from a resource point alone, to apply the Lead Unit system
arrangements to them all. Hence criteria for selection and an approach to implementation are provided.
Definitions
Multi-establishment company
22. A company, or discrete part of a company (e.g. a division) with a number of establishments in the UK linked to a
central company point - the intervention locus - for health and safety purposes. (See below for definition of
intervention locus and Appendix 2 for further details on the structure of multi-establishment companies and
defining intervention loci.)
Establishment
23. Establishment is a defined term under the COMAH Regulations, however for the purposes of the Lead Unit
system, which covers both COMAH and non COMAH companies, establishment refers to a geographically or
organisationally discrete part of a multi-establishment company.
Lead Unit
24. The HID Unit with overarching responsibility for centrally co-ordinating interventions under the Lead Unit System
with a multi-establishment company. (i.e. applying the Lead Unit System)
Lead Unit System
25. The system to deliver central co-ordination of interventions with establishments of multi-establishment
companies. The system will operate at two levels - a detailed proactive approach, based on an inspection plan
(Level 1) and a less detailed approach of communication between inspectors (Level 2).
Intervention locus (Only relevant for companies subject to a level 1 approach)
26. The point within the multi-establishment company structure where the HID Lead Unit interventions should be
targeted to achieve maximum influence This will usually be the highest level of company management that
effectively holds the health and safety responsibility. This is not necessarily the legal entity HID would prosecute,
but is more the level at which significant company changes to health and safety standards within the company
can be authorised.
Co-ordinating inspector
27. The inspector responsible for acting as central contact for co-ordination of HID's approaches to multi-
establishment companies under the Lead Unit System. For Level 1 approaches the Co-ordinating inspector will
need to oversee the production and implementation of a central inspection plan, whilst for Level 2 approaches,
the Co-ordinating inspector's role will be restricted to monitoring central issues and liaising with other inspectors
MANAGEMENT
The Role of the Lead Unit
28. The role of the Lead Unit will depend on the structure and management system of the multi-establishment
company and its health and safety performance and will involve the appropriate use of Level 1 and 2
approaches.
29. The role of the Lead Unit is defined as principally one of co-ordination and information sharing. The Lead Unit
doesnt have the authority to dictate that an establishment is inspected, but it will be able to inform and influence
the agenda of what is dealt with at an inspection. The responsibility for any one establishment within a company
remains with the Unit holding prime responsibility for inspecting the site . Where an initiative across anumber of
establishments within the company is proposed the Lead Unit will have responsibility for co-ordinating resource
and facilitating the initiative. This will require agreement between HOUs to provide the required resources.
30. The Lead Unit will act as a central point of contact for the company on company wide issues, through a Co-
ordinating Inspector.
31. As the system involves information sharing and accessibility IT data quality will be one of the keys to success.
Consequently the Lead Unit will be responsible for ensuring that the company FOCUS/CIS record is accurate
and reflects the company structure as far as possible, and highlights that the company is subject to the Lead Unit
system.
Role of the Heads of Units and the Heads of Field Unit Forum
32. As set out in the introduction to this chapter the second principle the Lead Unit system is based on places
responsibility for management of the system at the level of Unit Band 1 as they are accountable to the Head of
Division. However this does not prevent the Unit Band 1 from delegating tasks/specific companies within the Unit
as deemed appropriate.
33. The Heads of Field Units forum has a key role to play in managing the Lead Unit system. It is at this forum that
the Heads of Field Units will consider HID's multi-establishment companies and
a. identify those for which particular Units have Lead Unit responsibilities, and also those for which formal
or informal Lead Unit arrangements already exist;
b. agree the allocation of Lead Unit for companies for which the appropriate Lead Unit is unclear;
c. agree cross-Unit resource commitments for Lead Unit approaches. Management tasks that need to be
carried out are;
d. Identification of the Co-ordinating inspector (for both Level 1 and Level 2 approaches). It is suggested
that in the case of Level 1 approaches, the Co-ordinating inspector role/inspector band should reflect the
status/level of company management being interfaced with;
e. Liaison with other HID Heads of Units regarding resource availability for delivering the intervention plan
for the company (only applicable to Level 1 approaches);
f. Allocation of the tasks a Lead Unit is required to perform;
g. Allocation of sufficient Unit resources to enable the Lead Unit System to function satisfactorily. This will
entail inclusion of the planned Lead Unit work in both Unit, Group and Personal Work Plans. Above this
HID will need to include this work in its Divisional Plan of Work;
Role of the Co-ordinating Inspector
34. For individual multi establishment companies subject to the Lead Unit system the Co-ordinating Inspector is the
key player in the system. Their role is to manage the Lead Unit system for that company. They will be the point
of contact for both Inspectors and the company on centrally co-ordinated issues.
35. In particular the Co-ordinating Inspector will be responsible for delivery of the Level 1 or 2 approach agreed for
the company. The tasks listed in the sections level 1 what to do and level 2 what to do specifically have to be
managed by the Co-ordinating Inspector.
36. Both level 1 and 2 approaches will require significant input from the Co-ordinating Inspector and as such will
need to be built into PWPs.
Interface with work planning
37. Allocation of adequate resources for operation of the Lead Unit system is vital to the success of the system.
Consequently Lead Unit work will need to be considered as a specific issue during the work planning cycle and
should subsequently be a specific item in Division, Unit, Group and Personal work plans.
38. As part of the planning cycle Lead Unit work should be actively reviewed and the following issues considered at
Heads of Field Unit forum and Unit level;
a. Progress against the Divisional implementation plan (see para 67);
b. Progress with specific companies currently subject to the system;
c. Identification of companies that should be brought into the system;
d. Identification of companies that should come out of the system;
e. Identification of companies that should move from a level 2 to a level 1 approach and vice versa.
39. These issues will obviously need to be considered in the context of the resources available.
OPERATING
Selection of Companies
40. Selection of multi-establishment companies for the Lead Unit System is based on their major hazard potential
(i.e. TT COMAH, LT COMAH or non COMAH), the number of people, both on and off site, at risk from their
activities and the need for HID to deal consistently and transparently with the company across all locations. From
these basic criteria two broad groups of companies can be identified (Group A and Group B):
41. Typical features of a group A multi-establishment company:
a. One or more COMAH installations. (NB the higher the number of TT installations the more weight this
criterion carries;
b. Medium or high hazard or complex activities across the company;
c. Multi-national or national company;
d. Significant numbers of employees and MOPs potentially at risk from the company.
42. Typical features of a group B multi-establishment company:
a. Company does not have any COMAH sites;
b. Medium to low hazard, probably non-complex activities carried out across the company;
c. Mainly locally based company or few sites spread nationally.
43. These criteria are intended to be indicative rather than mandatory. Multi-establishment companies do not have to
meet all the criteria for a category, and should be placed in the category where the best match of the criteria
exists.
44. Group A companies will typically be appropriate for a Level 1 approach and group B companies a Level 2
approach. However the boundaries between the groupings and approaches should be seen as flexible to enable
the most appropriate approach to be used. Changes in management structure and organisation will mean that
companies will move from one group to another, and that the Lead Unit approach may cease to be appropriate.
The possible need to change the way the Lead Unit System is applied should be considered at the annual review
stage.
Selection of the Lead Unit
45. The allocation of multi-establishment companies to a Lead Unit is an appropriate function for the Heads of
Operational Units' forum as it is these Units that will be charged with operating the Lead Unit System. To assist
in the allocation process the following guiding principles are given:
a. The central health and safety function of the multi-establishment company to be in the Lead Unit's
geographical area. (NB this is not necessarily the company head office and often will not be.)
b. A significant number of the company's establishments to be in the Lead Unit area.
c. Allocation of multi-establishment companies to be in line with Unit's resources. (NB This does not mean
each Unit should be allocated the same number of multi-establishment companies as different
companies will require different resource input.)
d. If a Unit is already performing a lead role, whether formally, from previous Lead PI/HOPI work or
informally, consideration should be given to maintaining and enhancing that role.
46. Note - If all a multi-establishment company's establishments are located within the geographical area of one HID
Unit the Lead Unit System should still be applied within that Unit.
Selecting a Level 1 or Level 2 approach
47. In general group A companies will tend to be appropriate for a Level 1 approach and Group B companies a Level
2 approach (see para 44).
48. When deciding on the level of approach for a company it will be useful to consider HID's anticipated intervention
with the company, resources available and any relevant local factors.
49. Changes in management structure, organisation and HID resources will mean that companies may move from
one level to another. Also in some cases it may be that the Lead Unit system will cease to be appropriate. The
possible need to change the way the system is applied should be considered at the annual review stage.
Level 1 - What to do
50. The Level 1 approach is based on information sharing and development of an appropriate co-ordinated
inspection plan across the company. It is aimed at those companies where HID has a relatively high level of
involvement and would typically be applied to group A companies.
51. The implementation of this approach will typically have three stages;
a. Stage 1. Information collection
i. collect information on the company structure, organisation and management responsibilities and
identify the intervention locus;
ii. obtain an overview of the health and safety performance e.g. from FOCUS/CIS, HI251, safety
report assessments etc.;
iii. seek views from inspectors responsible for the company's other sites and any other parts of
HSE that may have involvement with the company (e.g. other operating DDs, policy sections,
DST etc);
iv. in the case of COMAH companies information should also be sought from EA/SEPA;
v. at the end of this stage, a decision should be made on the degree and amount of central
intervention required. e.g. It may be decided that a Level 2 approach is appropriate;
vi. record information on the Lead Unit document (Appendix 1);
vii. ensure the FOCUS/CIS records reflect the company structure (Ideally any parts of the company
which are the responsibility of FOD or other ODDs should also be included);
viii. Make an entry in the FOCUS 'Client clue' to highlight that the HID Lead Unit system (Level 1) is
being applied to this company.
b. Stage 2. Development of an intervention plan.
iii. identify how and where the Lead Unit approach should be applied, and the issues it
should address. To be effective this will need to be done in consultation with those
inspectors with operational responsibility for the company establishments, possibly at a
team meeting. Note in the case of COMAH companies EA/SEPA inspectors will need to
be involved;
iv. develop a single agreed intervention plan with all inspectors with operational
responsibility for the company's establishments. As the plan is intended to apply to all
sites of the multi-establishment company the exchange of information and priorities is
vital, as is obtaining the agreement and commitment of all the inspectors involved. A
team meeting may be the best way of doing this;
v. record the existence of an inspection plan on the Lead Unit document;
vi. Inspection plans should cover the period of time appropriate for the issues involved. For
companies that include TT COMAH sites, inspection plans will need to cover the five
year period between safety reports and be linked to COMAH inspection plan;
vii. The inspection plan should not exclude inspectors from dealing with local issues at
specific sites, but is intended to guide them to look at identified company-wide issues as
well as issues arising from local needs . Information on local issues will need to be
communicated to the Co-ordinating inspector, who can monitor emerging trends;
viii. The key to the success of the inspection plan is for it to be developed as a team
approach, aimed at improving standards across the company;
c. Stage 3. Implementation of the inspection plan.
i. meet the company's management and central health and safety function to explain the
Lead Unit approach and introduce the inspection plan;
ii. implement the inspection plan and monitor progress, obtain feedback from inspectors
involved in the Lead Unit approach and monitor trends in the company performance;
iii. review and update the intervention plan for the company at regular intervals, perhaps
annually. At the review stage, consider whether the level of approach continues to be
correct;
iv. where appropriate provide feedback to the company on central health and safety issues;
53. These three stages will be required for all companies subject to the Lead Unit System, but the complexity of
stages 2 and 3 will depend on the company structure and performance.
54. For multi - establishment companies that are subject to a level 1 approach and include more than one Top Tier
COMAH establishment the Lead Unit will need to consider issues (especially of consistency) arising from safety
report assessment work and in particular the central co-ordination of safety report assessment work where
appropriate. Lead Units will need to consider these issues on a company by company basis.
55. The issues arising from the assessment of safety reports from multi-establishment companies need to be seen in
the light of management controls, technical controls etc. applied both centrally and locally. Some Lead Units will
be able to contribute to some of the safety report assessment issues and the process needs to be flexible
enough to facilitate this involvement.
56. Estimated resource requirements to implement a Level 1 approach for a company;
CO-ORDINATING INSPECTOR OTHER INSPECTORS
1st year Other years 1st year Other years
Information gathering 2 days 0.5 day 0.5 day Minimal
Developing inspection
plan
3 days 2 days 1 day 1 day
Implementation 5 +days 3 +days 1.5 days 1.5 days
'Other ' LU work 2.5 days 2.5 days 0 0
Totals 12.5 days 8 days 3 days 2.5 days
Level 2 - What to do
56. The Level 2 approach is based on information sharing and accessibility to aid consistency of inspections at sites
where HID has a lower level of involvement than for the Level 1 approach. It would typically be applied to group
B companies.
57. Basic principles of the system;
a. To be managed by the co-ordinating inspector assigned to the company
b. System to be user friendly and accessible to all inspectors involved with the company. (i.e. to be IT
based making best use of FOCUS/CIS)
c. Minimal resource required to operate the system
d. System to be based on the sharing of good quality information on the company.
e. To include a periodic (annual) review of information to monitor consistency of approach and emerging
trends.
58. This approach will typically have three stages
a. Stage 1. Information collection.
i. Obtain details of the company structure and organisation.
ii. Carry out an initial review of the company's FOCUS records to identify any common issues
affecting the consistency of HID's approach e.g. common problems, inconsistencies, emerging
trends etc. Any issues identified should be added to the FOCUS Client file note.(see below)
b. Stage 2. Upgrading FOCUS/CIS records
i. Ensure the FOCUS/CIS records reflect the company structure (Ideally any parts of the company
which are the responsibility of FOD or other ODDs should also be included).
ii. Make an entry in the FOCUS 'Client clue' to highlight that the HID Lead Unit system (Level 2)
applies and that further information is held on the Client file notes. (The character field for Client
clue is limited and entries will need to be brief e.g. LPG distributor. See Client file notes re HID
Lead Unit information)
iii. Record appropriate information in the FOCUS Client file note. This field has 490 characters
available which should be sufficient to record the basic information required by the Lead Unit
system - i.e. the HID co-ordinating inspector, where he/she is located and any current company-
wide issues.
c. Stage 3. Annual review and Update of FOCUS /CIS records
i. Once per year review the FOCUS/CIS records to identify any common issues affecting the
consistency of HID's approach to the company e.g. common problems, inconsistencies,
emerging trends etc
ii. Update the Client file note.
59. Inspectors responsible for companies subject to a Level 2 approach have two roles:
a. Prior to interventions with the company the information on the Client file note should be accessed to
inform the intervention.
b. Forward to the co-ordinating inspector any potential cross-company consistency issues identified from
their dealings with the company.
Resource requirements of the system
60. Start up resources
a. Allocation of companies to HID Units by HOFU forum - 1/2 day
b. Allocation of Co-ordinating inspectors by Unit Band 1 and Band 2s - 1/2 day
61. The estimated time required by the Band 3 Co-ordinating inspector is shown in the table below;
1st year Subsequent
years
Checking accuracy of FOCUS record. Recording existence and location of Co-
ordinating inspector
1 day Minimal
Reviewing FOCUS contacts 1 day 1 day
Incorporating feedback from other inspectors Up to
1
/
4
day Up to
1
/
4
day
62. The input from the other inspectors involved with the company is predicted to be minimal
Enclave Sites
63. As set out in the introduction to this chapter the fourth principle the Lead Unit system is based on requires
arrangements to be made with respect to HID enclaves in FOD sites, where HID or FOD consider that a central
approach is appropriate.
64. In the case of multi-establishment companies which include enclaves sites the Lead Unit will need to ensure that
effective communication is encouraged. HID OPPG (b) leads on HID/FOD demarcation issues and currently
have in draft a joint FOD/HID OC regarding enclaves issues.
65. The draft OC sets out how co-ordination of FOD/HID approaches could be achieved with employers at enclave
sites. OC 18/5 discusses allocation of premises to HID and FOD, and how enclaves are set up - the draft OC
adds specific responsibilities for co-ordinating central approaches at enclaves. The draft OC lists brickworks,
manufacture/storage of explosives, and water treatment. These will be the majority of sites involved, but there
may be others. The draft proposes the creation of a Lead Division, which has responsibility for the main activity
on site. In the case of a multi-establishment company the Lead Division will have responsibility for the activity of
the company as a whole. The Lead Division has responsibility for establishing effective communication between
HID, FOD and the company, and to take the Lead in dealing with the employer on site-wide issues.
66. The application of the Lead Unit system, will be relevant at multi-establishment companies for which HID is the
Lead Division.
IMPLEMENTATION
67. At the April 1999 DMB meeting it was agreed that the Lead Unit system should be implemented within HID over
a three year period with specific groups of companies being brought into scope of the system each year. (Details
of the three phases are given below.)
68. Each company brought into scope needs to be considered by the Heads of Field Units forum to decide whether a
Lead Unit approach is required for the company.
69. Companies where a Lead Unit approach is appropriate will then be allocated to a Unit by the Heads of Field
Units forum for implementation of a level 1 or 2 approach.
70. Although the detail will be resolved at the Heads of Field Units forum it is anticipated that phase 1 would result in
the allocation of between 50 and 70 companies for consideration of applying the Lead Unit system..
71. Companies in scope are:
Phase Work Year Companies
1 1999-2000 Those companies allocated by Heads of Field Units in October 98, as listed in
appendix 3
All companies with at least 1 top tier and 1 or more other COMAH establishments
2 2000-2001 All companies with 2 or more lower tier COMAH establishments but no top tier
3 2001-2002 Remaining multi-establishment companies as resources allow. Consideration to be
based on experience gained from phases 1 & 2
72. The implementation plan also includes the overriding principle that any multi-establishment company can be
brought into the system at any stage if operational needs direct that this is appropriate. This includes
consideration of requests from a company for a central intervention or the maintaining and updating of any
existing arrangements. It was also agreed by DMB that a workshop would be run in Autumn 1999 to evaluate
progress of the system. From this workshop the implementation plan may be revised.
APPENDIX 1
LEAD UNIT DOCUMENT
Name of company:
Client number:
LEAD UNIT
Location of Lead Unit
Name of Lead Unit contact
Date Lead Unit set up
Reasons for Lead Unit
Other HID Units/groups involved
Other DDs with responsibilities for sites and details of
enclaves
COMPANY DETAILS
Location of sites and location numbers
Organisation chart available? - Attach electronic copy if YES/NO
possible
Appropriate level for intervention by HID
Name of central contact
Comments - e.g. on joint ventures, holding company,
conglomerate etc
INSPECTION DETAILS
Inspection plan prepared? YES/NO
History of central interventions - e.g. issues raised, audit
topics etc.
Brief details of type of LU involvement planned
Revision no Prepared by Date
APPENDIX 2
Further details on defining multi-establishment companies (or part of a company)
73. A typical company structure is shown in the attached charts. Depending on the allocation of Health and Safety
responsibilities within the company it may meet the multi-establishment company definition in a number of ways.
74. Example 1. Company Head Office has a significant Health and Safety function influencing how the company
divisions, units and sites operate. In this case the whole company would be considered for the Lead Unit
approach. With the company Head office being the primary intervention locus.
75. Example 2. Company regions have a significant Health and Safety function influencing how the divisions, units
and sites operate. The regions have no significant link with the company head office for Health and Safety
purposes. In this case each region would be considered for the Lead Unit approach. with the regional offices
being the primary intervention loci.
76. Example 3. Company divisions have a significant Health and Safety function influencing how the units and sites
operate. The divisions have no significant link with the company regional or head office for Health and Safety
purposes. In this case each division would be considered for the Lead Unit approach. with the regional offices
being the primary intervention loci.
77. Example 4. Company units have a significant Health and Safety function influencing how the sites operate. The
units have no significant link with the company divisional, regional or head office for Health and Safety purposes.
In this case each Unit would be considered for the Lead Unit approach with the Unit offices being the primary
intervention loci.
78. The key principle is to identify within the company structure the points (intervention loci) where the Lead Unit
approach is likely to have a significant effect on Health and Safety performance of that multi-establishment part
of the company.
APPENDIX 3
Allocation of Lead Units
Company Lead Unit Co-ordinating Inspector
Inspec 4
Flogas 4 Clive Dennis
Supergas 4
Powell Duffryn 4 David Perry
ST Services 4 David Perry
British Aerospace 5
Explosives Developments Ltd 5
Orica Europe Ltd 5
Exchem Industries 5
Chemring Group PLC 5
MOD 5
Akzo Nobel 1
BOC 1
BP Amoco 1 Alistair McNab
BP Gas 1
Elementis 1 Alex Keddie
Phillips Petroleum 1 Neil Anderson
Shell Exploration 1
Terra Nitrogen 1 Alex Keddie
Oil & Pipeline Agency 1
Accordis 2 David Snowball
Allied Colloids 2
BG Storage 2 Frank Perkins
BTP 2
CCL Industries 2
Ciba Speciality Chemicals 2
Croda International 2
Hydro Agri Ltd 2 David Snowball
Novartis 2
Shell Gas 2 David Snowball/Graham King
Simon Storage 2 David Snowball
Transco 2 Frank Perkins
Yule Catto 2
Air Products 3
Albright & Wilson 3 Chris Eaton
Elf Atochem 3 Terry Durkin
ETC Sawmills 3
European Vinyls Corporation. (EVC) 3 Robin Cowley
Hays Chemicals 3
ICI Chemicals and Polymers 3 Robin Cowley/Terry Durkin
Rhodia 3
Shell UK 3 Ron De Cort
Contract Chemicals 3
Agrevo 4
Calor Gas Ltd 4 Clive Dennis
Enichem 4
Esso 4
Exxon 4
Assessing Risk Control Systems
Introduction o RCS 7 - Selection & Management of
RCS 00 - Generic RSC Inspection Guidance
Contractors
RCS 01 - Examination and Testing of Safety Critical
o RCS 8 - Emergency Response
Plant
o RCS 9 - Plant Commissioning
RCS 2 - Permit to Work
o RCS 10 - Plant and Process Design
RCS 3 - Operating Procedures
o RCS 11 - Assessing Auditing
RCS 4 - Planned Maintenance Procedures
o RCS 12 - Assessing Competence
RCS 5 - Management of Change
o RCS 13 - Hazard Identification and Risk
RCS 6 - Occupational Health - Dermatitis
Assessment
INTRODUCTION
1. This guidance is primarily for HID discipline/topic and regulatory specialists, although much of it may prove
useful OG wide. It comprises a general guide common to all risk control systems (RCSs), plus a series of topic
specific guides.
2. Its purpose is to help inspectors assess the adequacy of RCSs by determining whether the necessary
prevention, control and mitigation measures have been provided, are operating effectively, and have procedures
in place to ensure their maintenance.
3. The guidance is based on the POPMAR framework:
Policy,
Organising,
Planning and implementing,
Measuring,
Auditing and
Reviewing,
as explained in HSG 65,'Successful Health and Safety Management'.
4. Inspectors must have the necessary competencies to inspect a particular RCS, and should note that:
The guidance has not been designed to help staff develop competency in the topic areas covered, and
will not effectively support inspections where a required expertise is lacking. Its purpose is to help
inspectors apply their expertise to the assessment of particular RCSs.
Inspectors should be aware that the POPMAR 'Planning and Implementing' phase associated with
technical risk control systems is a particular area where the level of expertise needed may rapidly
deepen as inspection progresses. It is not practical to offer guidance covering the full range and depth of
technical issues that might arise, and inspection may rely heavily on specialist knowledge to question
evidence and probe sufficiently to determine the RCS adequacy.
5. The guidance does not specify clear discipline/topic and regulatory specialist interfaces because:
The inspection planning process manages discipline/topic and regulatory specialist contributions.
Allocating responsibility for inspection of each RCS is a matter for agreement by the inspection team,
involving all appropriate specialists.
Where unplanned RCS inspection takes place, the decision to seek specialist support is necessarily a
matter for each inspector to judge based on an assessment of his/her own level of competence in the
relevant subject area.
What is a risk control system?
6. A risk control system is simply a part of the overall safety management arrangements. It sets out how the safety
management system is applied to a specific task or activity.
Guidance scope
7. The following risk control system inspection guides are offered:
RCS 00 - Generic RSC Inspection Guidance
RCS 01 - Examination and Testing of Safety Critical Plant
RCS 02 - Permit to Work
RCS 03 - Operating Procedures
RCS 04 - Planned Maintenance Procedures
RCS 05 - Management of Change
RCS 06 - Occupational Health - Dermatitis
RCS 07 - Selection & Management of Contractors
RCS 08 - On-Site Emergency Response
RCS 09 - Plant Commissioning
RCS 10 - Plant and Process Design
RCS 11 - Assessing Auditing
RCS 12 - Assessing Competence
RCS 13 - Hazard Identification and Risk Assessment
8. The topic guides are being revised as part of an ongoing update process. The format of the revised sections
varies from the older parts, which remain valid and available for use.
9. Further guidance on aspects of technical risk control systems can be found in the Safety Report Assessment
Guide (Technical Aspects) measures documents.
Using this guidance
10. The general inspection guide covers areas common to all risk control systems. This should be used in
conjunction with the individual RCS topic guides.
11. Each topic guide identifies key features that should be part of an effective risk control system, along with typical
evidence that would confirm the adequacy of the system. Key issues, questions and guidelines (including
benchmarks, where available) are offered.
12. The topic guides are not exhaustive, but they do cover a range of issues and circumstances. It is not envisaged
that inspectors will explore every aspect covered, but rather, will exercise their judgement to direct the inspection
and gather sufficient information to determine the system adequacy.
13. Guidance on using RCSs as part of a process safety management inspection approach can also be found in
Appendix 3 - The Intervention Process (paras 8-11) of the Major Hazard Intervention Policy in the HID (CI, SI)
Inspection manual.
Deciding which systems to inspect
14. In the majority of cases inspection plans document the risk control systems to be inspected however Incidents,
complaints or issues uncovered during routine inspection may lead to the unplanned inspection of specific risk
control systems.
15. The mechanisms for developing inspection plans vary across HID and inspectors should refer to the relevant
inspection manual for details:
PM/Enforcement/05 - HID (CI, SI) Inspection Manual
PM/Enforcement/07 - OSD Inspection Manual
16. In general, the following criteria should inform the process for selecting risk control systems for inspection:
Issues arising from previous incidents and intelligence gathered from other interventions at the
establishment
Issues and lessons that are known to be important and relevant to the industry/ installation/ process to
be inspected. For example, SPC/ENF/90 - Loss of Containment Incident Analysis, indicates that from
around 800 onshore chemical sector incidents analysed, primary risk control systems failings were
associated with maintenance, plant and process design, and operating procedures.
The age and condition of the plant, eg consider;
o The maintenance and examination/testing RCSs for older plant
o The operating procedure RCS for processes with a lot of human intervention
Any safety report/safety case data:
o Systems safeguarding against the most significant hazards and risks
o Weak areas identified through the assessment process.
HSE/HID priority programmes addressing major hazard risk control system topics
17. Inspectors should aim to examine a range of RCSs at each site to ensure the full range of major hazard control
systems are adequate, including, where relevant, verification of controls, as described in safety cases/reports.
18. Over time it is expected that relevant RCSs will be re-examined to ensure adequacy is being maintained.
Legal basis
19. Inspectors should refer to individual topic guides for clarification of the topic specific legal basis and any
associated guidance.
Contact
20. Please direct any queries or comments on the guidance to HID HQ1D.
21. User feedback on this guidance is most welcome. Please use the feedback form that can be returned to HID
HQ1D, 3rd Floor, St Anne's House, Bootle.
RCS 00 - Generic Risk Control System Inspection Guidance
Introduction
This guidance comprises generic questions under each POPMAR element. It reduces repetition of these common
questions in the specific guidance, and can be used for two main purposes:
To support the questions in the specific risk control systems guidance
As a set of higher level questions that inspectors can use when examining duty holders' safety management
systems
For some of the questions relevant examples from major incidents are referenced to put the questions into context and
demonstrate why the issues are important.
Key documents relevant to the POPMAR elements are referenced at the end of the guidance. There are many more
references, but for ease of use we have presented a limited number.
1
No Question
Does the policy demonstrate
management commitment to health and
safety and their intention to include it as
an integral part of productivity,
competitiveness and profitability?
Longford
Explosion
Incident
POLICY
The Esso Longford Gas
Plant Accident Report of the
Longford Royal Commission;
Dawson, D Brooks, B.J . J une
1999 By Authority.
Government Printer for the
State of Victoria No.61-
Session 1998-99
Pg 237
Ref
"Insofar as the failure to
conduct the HAZOP study for
GP1& the reduction of
supervision at Longford.
were a result of Esso's
desires to control its
operating costs, asset
management practices or
policies may have been a
contributing factor to the
explosion, fire & failure of
gas supply"
Example
2 Is there recognition of the potential of
operations to cause major accidents and
a clear focus on major hazard control
within the SMS?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report
Pg 235
"The failure to conduct a
HAZOP study or to carry out
any other adequate
procedures for the
identification of hazards (in
GP1) contributed to the
occurrence of the explosion
& fire"
3 Is there recognition of need for specific
risk control systems e.g. hazard
identification & risk assessment,
maintenance, Permits To Work, selection
& control of contractors, emergency
response, operating procedures,
managing change?
4 Does the policy recognise that human
factors need to be managed with as
much rigour as technical measures for
roles, responsibilities and tasks which
can impact on the control of major
hazards?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report
Pg 240
"An obligation should be
imposed (upon Esso) to
demonstrate that its training
programmes & techniques
impart knowledge of all
identifiable hazards & the
procedures required to deal
with them."
5 Is there commitment to specifically
identify and control all major accident
hazards, in addition to occupational
health & safety hazards?
Associated
Octel
The Chemical Release and
Fire at the Associated Octel
Company Limited: A report of
the investigation by the
Health & Safety Executive
into the Chemical Release
and Fire at the Associated
Octel Company, Ellesmere
Port on 1 and 2 February
"However, the underlying
cause was a failure on the
part of the company to
identify the risk of a major
release in this part of the EC
plant" Octel recognised the
hazards from chlorine on site
but had not given enough
attention to flammable gas
No Question Incident Ref Example
1994. HSE Books 1996
ISBN: 0-7176-0830-1
Para 123
releases.
6 Is there commitment to provide sufficient
resources to identify & control major
hazards?
7 Is there commitment to set and monitor
major hazard performance indicators (in
addition to) conventional safety
measures like lost time accidents
(LTAs)?
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000. A Public Report
Prepared by the HSE on
Behalf of the Competent
Authority'.
Pg 65
Inadequate performance
measurement and audit
systems, poor root cause
analysis of incidents, and
incorrect assumptions about
performance based on lost
time accident frequencies
and a lack of key
performance indicators for
loss of containment incidents
meant that the company did
not adequately measure the
major accident hazard
potential.
8 Is there recognition of the importance of
a positive organisational culture and its
direct impact on e.g. compliance with
rules and procedures and that
management is responsible for ensuring
this e.g. by putting in place effective
working practices (rather than putting
responsibility on individuals and trying to
change their attitudes & values) (See
Longford Report Chapter 6)?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 200
"Esso's OIMS, together with
all the supporting manuals,
comprised a complex
management system. It was
repetitive, circular, and
contained unnecessary
cross-referencing. Much of
its language was
impenetrable. These
characteristics made the
system difficult to
comprehend both by
management and by
operations personnel"
9 Is there commitment to leading by
(positive) example e.g. regular site tours
by management and taking action when
problems found?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 240
"Finally, Esso should be
required to show that plant
operations are monitored &
operating practices are
overseen at an appropriate
level& that there would be
regular & comprehensive
surveillance of operating
practices, using properly kept
records as well as day to day
observations."
10 Is there commitment to dealing speedily
with reports of health & safety problems?
11 For multi-site / multi-national
organisations, are there central policies
and are these reflected at individual
sites?
Piper Alpha 'The Public Enquiry into the
Piper Alpha Disaster' by The
Hon Lord Cullen, published
by HMSO 1990, ISBN
010113102.
Pg 191
'In order to ensure that an
effective permit to work
system it is essential that
operating staff work exactly
to the written procedure
which has been developed
by the company. The
Occidental written procedure
was contained in their safety
procedures manual. The
evidence at the inquiry
demonstrated that in a
number of significant
respects this procedure was
habitually or frequently
departed from It is not
unreasonable to proceed
No Question Incident Ref
upon the basis that the
Occidental procedure was
devised with the intention of
achieving the safety
objective to which a good
permit to work system should
be directed. Accordingly
each of the departures from
the written system
represented a departure from
safe practice.'
Example
12 How is health & safety represented at the
board?
ORGANISING - Control
13 What is the level of health & safety
reporting to the board?
14 Are limits of authority stated, accepted
and understood?
15 Are people's roles and responsibilities
clear, linked to major hazard risk
assessments, and understood by the
individuals involved?
"
16 Are people's responsibilities realistic or
have they been given more to do than
they can cope with?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 236
"The reduction of supervision
at Longford necessarily
meant a reduction in the
amount & quality of the
supervision of operations
there. There was a
correspondingly greater
reliance by Esso on the skill
& knowledge of operators"
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 241
" (the safety case) would
require each employee
working in the facility to be
competent & to have the
necessary skills, training &
ability to undertake in both
normal & abnormal
conditions, including
emergency conditions &
during changes to the facility,
the tasks allocated to that
employee & to respond to
conditions appropriately..."
17 Have key tasks been allocated e.g. the
production of operating procedures,
including new procedures or updates
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 234
"Not only was their training
inadequate, but there were
no current operating
procedures to guide them in
dealing with the problem
which they encountered "
18 Do people have clear job descriptions?
Do managers take full responsibility and
are they held accountable for controlling
activities that could lead to injury, ill
health and loss of containment
incidents?
19 Are health & safety responsibilities, for
ensuring systems and processes are
working effectively, allocated to line
managers?
20
21
Are lines of command and control within
the management structure clear and
understood?
Are safety specialists appointed as
22
No Question
advisors when necessary?
Are contractors used and, if so, what are
the criteria for employing them? (Could
be because particular specialism not
available in-house, to carry out infrequent
specific tasks, or simply to try to save
money)?
Incident Ref Example
23 Is it clear how contractors are selected
and managed?
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 28
"The number of failures
and underlying causes
demonstrated a failure in
BP's control of contractors &
in the management of
change in this incident"
24
25
aims?
26 Are supervisors appointed to help staff
and monitor health and safety
standards?
Do people have clear performance
standards for measuring their health &
safety achievements? Are these
standards used in people's performance
reviews / appraisal systems? (Measures
based solely on avoiding accidents are
not recommended, as they tend to lead
to under reporting
Do the health & safety objectives have
the same importance as other business
27 How are employees / contractors
consulted about and involved in health
and safety issues?
Piper Alpha
ORGANISING - Co-operation
'The Public Enquiry into the
Piper Alpha Disaster'
Pg 392
"The regulatory body,
operators & contractors
should support & encourage
the involvement of the
offshore workforce in safety.
In particular, first line
supervisors should involve
their workforce teams in
everyday safety"
"The operator's
procedures included in line
management of operations
which are aimed at involving
the workforce in safety
should form part of its
SMS"
28
29
30
Are there safety representatives
appointed?
Is there a health & safety committee, and
if so, how does it operate?
How do employees / contractors BP Major Incident Investigation
It has been found that where
there is full cooperation and
consultation with union
representatives and
employees, the number of
accidents is half that of
workplaces where there is no
such employee involvement -
See Safety Representatives
and Safety Committees
Regulations 1977 and Health
and Safety (Consultation with
Employees) Regulations
1996)
"lack of organisational
assessments, setting performance
standards, maintaining risk control
No Question
participate in carrying out risk
Incident
Grangemouth
Scotland. 29th May to 10th
J une 2000.
Ref
Report. BP Grangemouth
distribution personnel were
not actively involved in the
Example
resourcement that power
procedures & instructions and
investigating accidents?
measures, devising operating systems,
What role do employees / contractors
have in reviewing health & safety
Pg 27
E4 11kV electrical supply
project although it had the
planning & execution of the
31
performance?
32
power distribution system for
the Complex."
potential to impact on the
How are employees / contractors
encouraged to report hazards?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 221
"In practice, however, the
obligation to report incidents
was construed narrowly both
by Esso management and by
operations personnel.
Process upsets were rarely,
if ever, the subject of an
incident report, unless they
were accompanied by injury
to persons or damage to
property."
How are employees / contractors
encouraged to be proactive in improving
safety i.e. are they encouraged to
suggest improvements and changes to
the HSMS?
33
34 What procedures are in place to ensure
co-operation between different parts of
the organisation?
35 What procedures are in place for
resolving disputes?
How does the organisation monitor legal,
technical and other health & safety
developments to ensure they are aware
of the latest requirements, standards &
good practice guidance?
36
ORGANISING - Communication
How is the safety policy, and other
important health & safety information
communicated to people throughout the
organisation?
37
38 Do senior managers and other managers
& supervisors lead by example by
carrying out regular safety tours, chairing
H&S committee meetings and being
involved in incident investigations?
Are there systems to encourage
employees / contractors to communicate
health & safety information to line
managers?
39
40 Are the outcomes of health & safety
inspections & investigations
communicated to employees /
contractors?
41 How does the organisation communicate
with regulators and the public?
Are key documents such as process &
instrumentation diagrams and operating
procedures kept up to date?
42
43 How does the organisation ensure that
employees / contractors are recruited
ORGANISING - Competence
No Question Incident Ref Example
with sufficient skills, knowledge and
abilities to do the work expected of
them?
44 How are employee / contractor
competence needs identified and can
they be clearly traced back to the risk
assessment process?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 236
" the ultimate cause of the
accident on 25 Sept was the
failure of Esso to equip its
employees with appropriate
knowledge to deal with the
events which occurred. Not
only did Esso fail to impart
that knowledge to its
employees, but it failed to
make the necessary
information available in the
form of appropriate operating
procedures."
45 How is employee / contractor
competence maintained over time?
Associated
Octel
The Chemical Release and
Fire at the Associated Octel
Company Limited:
Para 129
Lesson 8 "The competence
of process operators should
be assessed after initial
training & when first put to
work on plant &
subsequently on a routine
basis. The frequency of
assessment should be
determined at the completion
of training & by a number of
factors, e.g. the complexity of
the task, technical content, &
in particular the risks
associated with the
process."
46 How does the organisation ensure that
training has been successful i.e. that
required levels of competence have been
achieved and that it is the right training
for the hazards present?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 234
"The lack of knowledge on
the part of both operators &
supervisors was directly
attributable to a deficiency in
their initial or subsequent
training."
47 Are there sufficient people with the
necessary competences available to
meet all of the foreseeable routine and
emergency scenarios identified in the
operational and emergency procedures?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 209
". There were no
experienced engineers on
site at the time of the
accident on 25 Sept 1998.
Expert knowledge from that
source, of plant operating
parameters, of the
metallurgical limits of
equipment & vessels in GP1
& of the consequences of
cold temperatures resulting
from loss of lean oil
circulation in the ROD/ROD
area, were absent"
Piper Alpha 'The Public Enquiry into the
Piper Alpha Disaster'
Pg 353
"The failure of the OIMs to
cope with the problems they
faced on the night of the
disaster clearly demonstrates
that conventional selection &
training of OIMs is no
guarantee of ability to cope if
the man himself is not able in
the end to take critical
decisions & lead those under
his command in a time of
extreme stress."
48 How are gaps in competence identified
and the need for specialist advice
Are all foreseeable operational conditions
covered in the competence management
system e.g. normal, abnormal/upset,
emergency, maintenance, start up /
shutdown?
No Question
identified?
49
50
Incident Ref Example
Is there a competence management
system and, if so, does it include
adequate consideration of major hazard
control?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 225
"In order to provide a safe
working environment there
could and should have been
appropriate operating
procedures to deal with the
loss of lean oil circulation,
cold temperatures & the
shutdown & start up of the
plant. Furthermore, the
operators & supervisors
could & should have known
of & understood the real
hazards confronting them on
the day."
identify and prioritise the most significant
risks?
51 Are risk assessments carried out that
Octel
PLANNING & IMPLEMENTING
Associated The Chemical Release and
Fire at the Associated Octel
Company Limited:
failure to conduct a
fundamental assessment of
the inherent risk, insufficient
"As a direct result of the
Para 123
attention was paid to a range
of safety precautions which
would have reduced or
avoided the risk of a major
release or mitigated its
effects"
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 240
"Esso should also be
required to demonstrate that
its operating standards,
practices & policies are
periodically reviewed & that
the documentation of each
identified procedure includes
an explanation of the
potential hazards associated
with the procedure. The
critical procedures include
start up, controlled
shutdown, emergency
shutdown & any other
deviation from normal
operating conditions."
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 235
". The failure to conduct a
HAZOP study or to carry out
any other adequate
procedures for the
identification of hazards in
GP1, contributed to the
occurrence of the explosion
& fire."
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 217
"There was no evidence of
any system to give priority to
important alarms. Good
operating practice would
have dictated that critical
alarms be identified & given
priority over other alarms"
No Question
BP
Grangemouth
Incident
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 54
Ref
The HSE investigation
recommended that
improvements be made in
"Process safety review -
systematic reviews should be
initiated at regular intervals
to help assure the overall
integrity of process units.
Example
52 Have the key risk control systems been
identified, e.g. for ensuring initial integrity,
maintaining integrity, managing changes,
operational control, cessation of
operations and emergency response?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 206
". Had a HAZOP study of
GP1 been conducted, as
Esso initially believed it
should, Esso would have
acquired knowledge of those
hazards, which, as it
transpired, were critical. In
due course, that knowledge
would have been
disseminated by way of
training, the development &
use of procedures & the
adoption of protective control
systems. In short, the failure
to conduct a HAZOP study of
GP1 contributed to the
disaster which occurred on
25 Sept 1998"
Associated
Octel
The Chemical Release and
Fire at the Associated Octel
Company Limited:
Para 125
"Maintenance of these
components was on a
breakdown basis & no
written records of the
frequency of component
failure or replacement were
kept."
53 What arrangements are in place to
eliminate or control the identified risks?
54 What performance standards are in place
for health & safety?
55 Is there a structured process to identify
and manage hazards & risks resulting
from human error (e.g. for identified
safety critical tasks) and how is this
integrated with the main risk assessment
process?
Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 238
"However, the failure to
report the incident deprived
Esso of an opportunity to
alert its employees to the
effect of loss of lean oil flow
& to instruct them in the
proper procedures to be
adopted in the event of such
a loss."
56 Are the control measures identified to
eliminate or otherwise manage human
error selected appropriately for the type
of error concerned?
57 How are health & safety targets
formulated?
58 To what extent are health & safety plans
developed?
MEASURING PERFORMANCE
59 What arrangements are there for actively
measuring performance i.e. measuring
performance before something goes
wrong? For any given RCS this might
include a combination of activities
involving different personnel, including
workforce and task checking, review of
risk assessment activity, reviewing
records, audits and follow-up from audit
activity, regular site inspections, checking
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Page 68
"It was recommended that
BP consider the period from
the Hydro-Cracker Major
Accident in 1987 in order to
consider similarities between
the accidents & establish if
safety performance improved
after this accident, when it
deteriorated, & why the
stated continuous
No Question
process instrument readings, reviewing
shift records, compliance checking for
safety critical procedures, corrosion
monitoring of plant, completion of safety
audits, and checking that reports of
health & safety problems have been dealt
with?
Incident Ref
improvement culture failed to
fully materialise"
Example
60 Longford
Explosion
The Esso Longford Gas
Plant Accident Report:
Pg 219
"The lack of plant
surveillance activity in GP1
was demonstrated by the
lack of use made of process
information. Electronically
generated process
information was
automatically retained in the
PIDAS database. However, it
would seem that it was
rarely, if ever, looked at, let
alone subjected to any trend
analysis."
61 What arrangements are there for
reactively measuring performance i.e.
accident & incident investigations,
responding to reports of problems?
62 Are there arrangements for receiving and
dealing with reports of health & safety
concerns from staff?
63 Do performance measures cover major
accident hazards as well as lost time
accidents?
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 49
This reference directs users
to a table of information.
64 Is performance compared against
predetermined standards?
65 Is action taken when gaps in
performance are identified?
66 How is health & safety performance
verified?
AUDITING & REVIEWING PERFORMANCE
67 Are audits of health & safety systems
carried out
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 68
The report recommended
that BP "review the
targeting of audits to major
hazards".
Piper Alpha 'The Public Enquiry into the
Piper Alpha Disaster'
Pg 356
"Audits need to assume a
far higher prominence as a
means of checking the ability
of the organisation to
achieve safe designs,
operations practices &
systems to interrupt a chain
of events leading to a Piper
Alpha type accident"
68
69
Do they assess whether adequate risk
control systems exist and are
implemented and adequate workplace
precautions are in place?
Do the audits examine all aspects of the
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 68
The report recommended
that BP "review
procedures for initiating
"before the event" task force
type audits where evidence
exists of deteriorating
performance which could
lead to a major accident"
No Question Incident Ref Example
health & safety management system?
70 Are the results of the audits (good and
bad) communicated to the right people -
including senior managers / directors?
Piper Alpha Quote from video of lecture
on the disaster
"When we asked senior
management why they didn't
know about the many failings
uncovered by the inquiry one
of them said 'I knew
everything was alright
because I never got any
reports of things being
wrong'"
71 Are the people carrying out audits
independent of the area or system they
are auditing?
Piper Alpha 'The Public Enquiry into the
Piper Alpha Disaster'
Pg 356
"This will require more
skilled personnel for
operations to conduct
specialist audits, for third
parties to check them & for
Govt departments to review
their success"
72 Do the audits involve interviewing people,
examining documents and checking
physical conditions?
73 Are audits a real challenge to the SMS
(i.e. do they examine site conditions or
are they focused on system paper
compliance)?
74 What arrangements are there for taking
account of the results of performance
measuring and audits?
75 Is there a prioritised programme of action
to deal with the issues from performance
measures & audits?
76 Does the programme identify what needs
to be done, when and who is responsible
for doing it
77 Is the action plan monitored to ensure all
actions are implemented? What happens
if actions are not completed by specified
times?
78 Are regular reviews carried out of safety
performance to ensure that the correct
procedures are in place and are
functioning correctly?
Piper Alpha 'The Public Enquiry into the
Piper Alpha Disaster'
Pg 358
"Common sense &
experience of what
happened on Piper indicate
that it is not enough to set up
a systematic approach to
safety & put it into
operationIt is also
necessary to "audit" the
extent & quality of adherence
to the system & to "verify"
that its results are in practice
satisfactory"
79 Do reviews lead to changes to systems,
procedures or specific precautions and
measures required by law e.g. safety
reports?
BP
Grangemouth
Major Incident Investigation
Report. BP Grangemouth
Scotland. 29th May to 10th
J une 2000.
Pg 49
"BP reviewed the FCCU
earlier in 2000, partly to try to
determine why it was not
operating properly.& to
compare it with BP FCCU
world standards. The review
findings were not
implemented or
communicated properly"
80 Are there examples of where the review
process has lead to the elimination of
hazards, significant risk reduction,
continuous improvements in control
standards or better mitigation measures
that demonstrate innovation and
awareness of current developments and
No Question Incident Ref Example
standards?
KEY REFERENCES
Policy
Leadership leaflet. A free HSE publication identifying the key characteristics of effective leadership in health &
safety context. Includes sections on h&s culture, leadership by example, systems & workforce.
Successful Health & Safety Management (HSG65) 90 page HSE priced publication summarising the key
elements of the POPMAR model for managing h&s.
Managing Health & Safety - An open learning workbook for managers and trainers. 70 pages. A priced HSE
publication (1997) giving practical activities on a range of h&s management issues. Useful to recommend to
dutyholders as a training guide.
Major accident prevention policies for lower-tier COMAH establishments - a free HSE leaflet
Directors' responsibilities for health & safety (INDG343). A free HSE leaflet.
A guide to the Control of Major Accident Hazards Regulations 1999. (L111). 120 page priced HSE publication.
Management of Health & Safety at Work - Approved Code of Practice & Guidance (L21). Priced HSE publication.
40 pages.
Organising - Control
Managing contractors - A guide for employers. 45 pages. Priced HSE publication aimed at SME's in the chemical
industry. A useful practical guide to recommend to dutyholders.
Managing contractors - free leaflet.
Organising - Co-operation
Involving employees in health & safety - forming partnerships in the chemical industry (HSG217). 60 page HSE
priced publication designed to help employers increase employees' involvement in all aspects of h&s
management. Includes case studies & benchmarking questions.
A guide to the Health & Safety (Consultation with Employees) Regulations 1996 (L95). HSE priced publication
giving guidance on the regulations.
Consulting employees on health & safety - a guide to the law (INDG232). A free HSE leaflet.
Organising - Communication
Nothing identified
Organising - Competence
Reducing error and influencing behavior (HSG48) 1999. 80 page HSE priced publication giving guidance on the
essential role of human factors in effective h&s management.
Developing and maintaining staff competence - Railways Safety Principles & Guidance Part 3 Section A. 70
page HSE priced publication aimed at the railway industry but relevant across all industries (2002)
Effective Health & Safety Training - a trainer's resource pack (2001). (HSG222). A priced HSE publication
designed to help employers & trainers improve h&s performance. Designed for SMEs but useful for all trainers.
Planning & Implementing
Formula for h&s. HSG166 76 pages. HSE priced publication aimed at SMEs in chemical manufacturing.
Identifies main hazards & gives guidance on controls.
Measuring performance
Health and Safety Climate Survey Tool. A computer application on CD ROM with a detailed questionnaire for
dutyholders and means of analysing the results.
Audit & Review
Nothing identified
RCS 01 - Examination and Testing of Safety Critical Plant
Introduction Organising - Competence
Policy Planning and Implementing
Organising - Control Measuring Performance
Organising - Co-operation Auditing
Organising - Communication Current Issues
Example Question Set
Appendix
INTRODUCTION
The purpose of an Examination/Test of Plant System is to provide confirmation of initial plant integrity, prior to it being
brought in to use, and to confirm continuing integrity/ function by the periodic examination/test at a predetermined
frequency throughout the plant life. The examination/test of plant is one of the key risk control systems identified by the
analysis of the cause of incidents on major hazard sites (STATAS and Loss of Containment Project findings).
In this guidance plant includes any associated control and instrumentation (C&I) systems, the failure of which will
significantly increase the risk of injury or harm to healthof people, or the likelihood of a major accident.
In this guidance, the individual carrying out the examination/test is referred throughout as the Examiner, and the HSE
Inspector as the Inspector. This is to avoid confusion over the use of the terms. Examination/test is defined as the act of
physically checking plant items and Inspection as the regulatory function.
This guidance should be used in conjunction with the RCS General Introduction and the RCS Generic Guidance that is
designed to cover issues common to all risk control system inspections.
Inspectors should examine the management processes and activities associated with examination/test of plant to
discover if there is sufficient evidence to indicate that the system:
Has a clear purpose/objective.
Is suitably organised.
Is planned and implemented to achieve control of the risks.
Ensures that performance is monitored.
Includes a periodic review of design, operation and achievement of objectives
Is verified by someone external to the system to ensure that the system: exists; is properly designed; is
operating; is effective.
LEGAL BASIS
The Health and Safety at Work etc Act 1974 (HSW Act)
The Management of Health and Safety at Work Regulations 1999 (MHSW)
Comah Regulations 1999 (COMAH)
Pressure Equipment Regulations 1999 (PER)
Pressure Systems Safety Regulations 2000 (PSSR)
The Provision and Use of Work Equipment Regulations 1998 (PUWER)
The Electricity at Work Regulations 1989 (EAWR)
Confined Spaces Regulations 1997
Safety Case Regulations 1992 (SCR)
Offshore Installations (Prevention of Fire etc) Regulations 1995 (PFEER)
Offshore Installations and Wells (Design etc) Regulations 1995 (DCR)
POPMAR
ELEMENT
KEY FEATURE INSPECTION GUIDELINES
POLICY Is there a clear policy for the
planned examination/test of
plant? Can senior management
outline the purpose of the
examination/test programme,
and the consequences of
failure?
Are the arrangements between
insurance company
examinations/tests and in-house
examinations/tests properly
understood?
Policy should cover:
Purpose/ objectives, scope and the consequences of not
having a system;
The legal requirements for examinations/tests e.g. Pressure
Systems, Provision and Use of Work Equipment, Lifting
Equipment. Be aware that examinations/tests that fall
outside of the scope of specific legislation (such as PSSR)
are just as important and need to be part of a properly
planned programme. Companies may assume that non-
PSSR examinations are not as important. They are, and are
covered by PUWER Reg 6. For example, periodic proof
testing of a safety instrumented system or interlock, to
ensure an adequately low probability of failure on demand;
Any contracting out of examination/test activities;
The assurance of examination/test tasks and systems
against human failure, including the role of human error.
Who does what, and how they ensure that there are no gaps
in coverage.
Verification of Documentation:
Corporate policies of plant examination/test (Head Office
Instructions etc);
Any contract arrangements with 3rd party examination/test
services. Company should understand who covers what. For
example, the interval of examination/test of safety relief
valves is covered by PSSR, but site is responsible for valve
testing;
Examination/test requirements imposed as part of insurance
policies.
ORGANISING CONTROL
Is the system for managing the
examination/test of safety critical
plant adequate?
Are responsibilities clearly
allocated and accepted?
Are people held accountable for
managing the system, carrying
out the examination/test
programme and completing
follow-up action?
Are changes in the way that the
plant is run, that can undermine
the examination/test regime,
properly controlled?
Are the Duty holder's
responsibilities regarding
operation of plant beyond next
examination/test dates
absolutely clear?
Equipment should be examined and tested in accordance
with a planned programme. The frequency of
examinations/tests should be determined taking into account
the likely rate of degradation of the plant/equipment, and the
consequences associated with failure. Examination findings
should include an estimate of the urgency of any repair.
Responsibilities should cover oversight, scope,
implementation, monitoring, audit and review.
The programme should be adequately resourced- this will be
specific to each plant and depend, for example on its age,
history and degradation mechanisms.
Senior managers should be aware of the status of the
planned programme (are examinations/tests being
completed on time?) and should take action where issues
arise. Overdue examinations/tests should be managed,
concentrating on the items of highest criticality. For PSSR
written scheme of examination (WSE) equipment you are not
allowed overdues unless notified to HSE in advance, and
then only one. PSSR Reg 9(7)(b)(c).
Specific arrangements for in-house (2nd party) and or 3rd
party examination/test activity should be clearly understood,
with no gaps in coverage. The company should know exactly
who provides what. If the in-house activity is not accredited
by the United Kingdom Accreditation Service (UKAS) to BS
EN ISO/IEC 17020:2004 General criteria for the operation of
various types of bodies performing inspection, then it should
be able to demonstrate sufficient independence from the
operating functions of the company.
Any difficulties encountered in implementing the programme
(for example, timely release of plant or preparation of plant)
should be reported. As described in HS (G) 244.
Where examination and testing schedules cannot be met,
the plant should not be operated unless an adequate case
for continued operation has been made and signed off by
senior management.
For C&I systems, UKAS accredited certification schemes
such as CASS (Conformity Assessment for Safety-Related
Systems), when properly applied and as part of a systematic
approach, can help duty holders in demonstrating that the
arrangements for periodic proof testing are adequate.
Verification of Documentation:
To show how people are held accountable e.g. performance
appraisal;
To show a clear allocation of responsibilities e.g. contract
documents with 3rd party examination/test services;
To show evidence of adequate resource allocation e.g.
budgetary plans/forecasts
Look for cases justifying continued operation when plant
examination/testing schedules have not been met.
ORGANISING COOPERATION
Do all personnel cooperate to
ensure the successful operation
of the System?
Is there good cooperation
between 3rd party and in-house
teams?
Is there coordination with other
parts of the SMS e.g.
plant/equipment design, planned
maintenance etc.?
All parties should show a shared understanding and
acceptance of the examination/test programme. There
should be good communication between 3rd party and in-
house teams, so that no tasks are forgotten.
Procedures should be in place to overcome any disputes
e.g. between production and maintenance departments
concerning release of plant for examination/test.
Verification of Documentation:
Most evidence will come from interviewing personnel, but the
following sources may be useful in some circumstances.
Look for evidence of failures in cooperation between parties
involved in planned examinations/tests e.g. letters to
contractors or insurance companies, safety/production
committee minutes.
Documents relating to dispute resolution procedures.
Interrogate scheduling systems (mostly computer software
but can be paper systems) for evidence of overdues. Ask for
output reports used at review meetings for demonstration of
the performance of the system.
Check that modifications include involvement with
Competent person where necessary. The WSE should be up
to date.
ORGANISING COMMUNICATION
Are there adequate information Details of the examination/test programme should be
flows into, within and from the communicated to: those undertaking examinations/tests, and
organisation to secure the line managers. Visual observation of selected plant should
effective operation of the be used to confirm that the identification and tagging system,
System? where utilised, is being implemented.
Is plant identified or tagged to
Findings should be passed on to plant managers and to
ensure that the correct piece of
those responsible for taking action.
equipment is examined or
Outstanding examinations/tests should be flagged up so that
tested?
action can be taken.
Are there written or verbal
Modifications to recommended examination/test frequencies
instructions covering; what plant
or methods and performance criteria provided by equipment
is to be examined or tested; by
manufacturers or suppliers need to be brought to the
whom; examination/test
attention of examination/test personnel.
frequency; examination/test
Imminent danger reporting arrangements should be in place
criteria and recording of findings
so that all relevant personnel are informed if
etc.; follow up action?
examinations/tests reveal situations of imminent danger.
Are there imminent danger
reporting arrangements?
Where schedules cannot be met, examination/test
Are there postponement
postponement arrangements should be in place. Overdue
reporting arrangements?
examinations/tests should be managed concentrating on
items of highest criticality. Plant should not be operated
unless an adequate case for continued operation has been
made and signed off by senior management.
Verification of Documentation: Most evidence will come from
interviewing personnel, but the following sources might be useful:
Examination/test programmes, records procedures/
instructions/ manuals;
J ob requests/ completion notifications;
Internal memos - progress chasing/ overdue
examination/test lists;
Imminent danger reports;
Postponement requests approved/rejected.
Overdue lists
ORGANISING COMPETENCE
Are people competent to
achieve the system objectives?
Is the examination/test body
competent?
People undertaking the actual examinations should be
competent, and where necessary, have suitable
qualifications. There are a number of these e.g.
PCN/GEN/2000 certification by BINDT. S.R.A.G. (Technical
Aspects) -Inspection/ Non-Destructive Testing Pages 33-34
for details of the many guides and codes, including
personnel qualification, relating to Examination and NDT. For
examination/test departments, reference to the adoption of
BS EN ISO/IEC 17020:2004 and UKAS accreditation is one
means by which competence can be demonstrated. The
company should make checks on 3rd party competence and
procedures etc. to confirm their adequacy. Action should be
taken where issues arise.
Individuals should know the purpose of examination/test
tasks that they perform, and the consequences if the task is
not done properly. For example, employees involved in
examination of plant pressure systems should be able to
describe the criteria against which they are making the
examination/test and why those criteria have been chosen.
An examination/test engineer should be able to look at
corrosion measurements and know what the retirement
criterion is. They can then decide if it is safe to continue with
the plant in use and what the retest interval should be.
Plans for the examination/testing of C&I systems should be
approved by a person having the relevant competence (see,
for example, IEE/BCS Competency guidelines for safety-
related system practitioners, Institution of Electrical
Engineers).
There should be realism about which examination/test tasks
people can be expected to perform reliably . Competence
should be seen as only one means for addressing potential
human failure and errors. PM/ENF 11 Human Factors -
Inspector Toolkit, Common Topic 2 Maintenance Error for
means of addressing human failure/errors.
Inspectors may wish to select a particular examination/test task to
check conformity to the procedure outlined in documents or during
interviews.
Verification of Documentation:
Examination/test accreditation certificates;
UKAS website lists accredited bodies (and dates) and
names of body leaders.
Training records of examination/ testing body personnel.
PLANNING AND
IMPLEMENTING
Has all plant been identified?
Have appropriate examination
and test techniques been
applied at appropriate intervals?
Have the requirements of
specific legislation been
complied with e.g. PSSR, and
Safety critical plant and equipment should be identified and
an examination and test scheme developed based on:
o Legal requirements;
o Safety criticality (linked to major accident hazards
scenarios);
o Likely failure modes;
o Historical data;
PUWER?
Is there a system to ensure
registration and periodic
examination and test of new (or
re-reviewed) equipment?
Are Examination/Test Bodies
trending results?
o Published standards/codes.
Some plant integrity management systems adopt a risk-
based approach. Inappropriate or incorrect application of RBI
could lead to an inadequate examination and test system.
Further guidance on RBI can be found in SPC/Tech/Gen/32.
Sample examination and testing can validate judgements
and provide assurance. Pipework Example.
Schemes should adopt examination and test techniques
Does the based on identification of likely failure modes. Identification
Examination/Test of failure modes is not an exact science.
System take Human
Factors into account?
S.R.A.G. (TECHNICAL ASPECTS) INSPECTION/NON-
DESTRUCTIVE TESTING for details of examination and test
techniques and capabilities and a checklist for the Inspection
follow up properly
Is post examination/test
of NDT
planned? Is appropriate SPC/Tech/Gen/18 for guidance on techniques for detecting
action taken on Corrosion under Insulation (CUI) and where checks should
examination/test be carried out.
findings? Examination and testing schemes should be comprehensive
- identifying and addressing known problem areas. A
Pipework Example.
Examination/test bodies should trend results over time in
order to identify problem areas before incidents occur.
Links to further guidance:
1. Eutech Report Para 6.3.9. - Suggested Good
Practice for assuring integrity of pipelines
2. Eutech Report Para 7.7 - Causes of loss of
containment in pipework
3. Eutech Report Para 8.3(g) - Recommends the use of
API 570 Piping Inspection Code for the inspection of
existing pipework
4. Eutech Report Para 9.3.3- Why in-service
examination/test schemes fail
5. SPC/Tech/Gen/33 Paras 87-97 -Information on
standards, codes and guidance for examination/test
of piping systems.
6. HSE Contract research report CRR 428/2002
Provides principles for proof testing of safety
instrumented systems in the chemical industry
including proof testing practices, content of
procedures, planning and scheduling, proof test
records competence, awareness of hazard and risk
and management of change. Suggests companies
should adopt a more structured and focussed
approach to proof testing.
Those involved in examinations/testing should be able to
give details of the tasks they perform and the criteria they
use to judge acceptable performance.
Procedures should describe details of site-specific issues for
failure modes and examination and test techniques,
acceptance/ rejection criteria, and arrangements for
supervision and task checking.
Those responsible for carrying out the examinations and
tests should be closely involved in the task design process.
Look for evidence of improvements/changes that have been
made to make the examination/test task easier. For
example, is 'inspectability' (e.g. access) considered in design
and modification processes?
Procedures should include checks for errors at critical stages
to allow for error recovery, particularly for complex tasks. For
example, checklists can be used for complex series of task
steps. Other job aids may be appropriate and used to
support and assure safety critical tasks. For example,
accurate and easily readable calibration information, key
examination/test criteria, and supporting visual aids etc. Staff
should find these useful and accurate.
Critical work shouldn't be planned for the end of long
shifts/cross-shift. If such work does cross shifts then extra
vigilance and monitoring may be required as well as the
usual shift handover arrangements and permit to work
issues. HS (G) 48 (pp35-38) gives a summary of the main
issues. Fatigue should be managed e.g. overtime monitored
individually; clear limits set on hours. There should be
evidence of realism about task performance over time, for
example on repeated and monotonous tasks.
Items of plant, especially sensors/alarms and trips taken off-
line for examination and testing, should be clearly flagged up
to production staff as non-operational.
Maintenance staff should be given the correct details of
faults and repairs required following examination and test.
Repairs should be carried out within the timescales specified
in the examination/test report.
Inspectors can make a judgment on the conditions in which
examination and test tasks are carried out (e.g. lighting,
access) and if this is likely to lead to poor work, errors and
mistakes, and incomplete work.
It is unlikely that inspectors will be able to observe many (if
any) plant examinations/tests during the on-site inspection.
Visual observation may be more feasible in the lead up to
major plant shutdowns/maintenance programmes.
Inspectors can check to see if: equipment is properly
identified or coded following examination/test; items of plant
removed for examination/test have been replaced e.g.
sample of latest pressure relief valves; the plates on vessels
correspond to information on the examination/test schedule.
Verification of Documentation:
Check the examination/test records and fitness certificates
for a representative sample of critical items of plant e.g.
pressure relief valves, alarms and trips, remotely operated
safety valves, flexible hoses, pressurised storage vessels
etc. Look for discrepancies with written scheme.
Written schemes of examination (Pressure Systems
Regulations, Risk Based Inspection). These should be up to
date.
Lists of safety critical equipment, plant and processes, failure
modes and the consequences for other things such as
maintenance.
In-house examination/test standards/ criteria/instructions and
plant identification codes etc.
Work instructions indicating a requirement for plant
examination and test. Enough detail and adequate
instructions are key features. For example, The Octel
Investigation, where maintenance staff were given no
instructions on the type of examination to carry out on a
critical plant item. As a result, only a cursory visual
examination was carried out. SRAG (tech) incident
summary.
Procedure detailing how emergency shutdown equipment
capacity is maintained during examination and test.
MEASURING Is the examination/test Useful feedback can be gained from staff on the operation of
PERFORMANCE programme monitored? Is pre- the programme. Management should actively listen to issues
determined action taken when or problems experienced by examination and test staff, as a
examinations/tests are overdue? means of early checking for possible system degradation.
Is assessment made about
Compliance checking should be carried out. E.g. against
whether it is safe to continue
examination and test procedures, data entry, quality of
using plant or equipment beyond
repairs etc.
the due examination or test
Poorly performing sites may not carry out examinations/tests
date?
on time but work from overdue lists. Overdue
Are examination findings acted
examinations/tests should be managed, concentrating on the
upon?
items of highest criticality. N.B. for PSSR WSE equipment
Are leading and lagging process
you are not allowed overdues unless notified to HSE in
safety performance measures
advance, and then only one. PSSR Reg 9(7)(b) (c).
used that reflect the process risk
Are any actions outstanding?
profile of the plant? Is leading
Good practice is to communicate the information from the
and lagging data used to drive
monitoring of the Examination/Test Programme (to take
performance improvement?
account of early equipment failure or greater than expected
service life) to relevant personnel.
Are incident findings Examples of Leading Indicators include - % of overdue plant
acted upon? examinations and tests beyond the examination/test interval;
% of high hazard pipework where (under lagging) corrosion
is greater than acceptable for the safe operation of the plant;
the number of examinations and tests completed to plan; the
number of reports to timescales; the number of cases of peer
review and oversight of examiner judgment (task checking)
where problems have been identified.
Examples of Lagging Indicators include - The number of
incidents involving loss of containment of hazardous
materials per 100,000 hours operation; the number of
incidents involving loss of containment of hazardous material
where corrosion/ wear was found to be a contributory factor;
the number of demands placed on a safety instrumented
system.
The data (from measuring process safety performance)
should be used to drive performance improvement. For
example, a committee of technical and management staff
could meet monthly to review process safety measures and
agree and steward necessary improvement actions. There is
no published guidance on monitoring of plant
examination/test systems at present. However, the ABB
Ageing Plant Project to be published at the end of 2005
should contain some guidance. Companies should be
encouraged to put monitoring/feedback systems in place.
OECD Guidance on Safety Performance Indicators. Further
guidance on HSE's programme to promote the use of
process safety performance indicators can be found in
SPC/Enforcement/87.
Where failures to examine items of plant or equipment, or
examination errors were thought to have been a contributory
factor - these should be separately identified and addressed.
Verification of Documentation:
Written instructions covering monitoring of the examination
of safety critical plant programme;
Written guidance on fitness for service assessment;
Workplace examination/test records covering the operation
of the examination of safety critical plant system;
Check records/ computer data systems to find reports on
overdue examinations/repairs (there should be none for
PSSR unless postponed)) or on forward planning indicators
to operational staff;
Near miss or incident investigation reports may indicate that
a failure to examine or to properly examine, or to examine
plant on time may have been a contributory factor.
Is the design and operation of AUDIT AND The design and operation of the examination/test of plant
REVIEW the Examination/Test of Plant system should be subject to an independent audit. LINK TO
System subject to periodic SPC/Tech/Gen/33 Paras 5 and 6 Integrity of Pipework
scrutiny and verification by Systems Project - UK Refineries for good practice
someone not involved in benchmarks for assuring integrity of pipework systems.
planned examination/test at the
The design and operation of the system can be reviewed in
workplace under review?
respect of: items of plant subject to examination/test;
Does the audit determine
examination/test frequencies; assessment criteria; whether
whether the examination regime
the objectives are realistic; examination/test methods and
is technically compliant with
choice of examiner; use of examination intelligence to review
good practice?
examination/test frequencies. (Not currently clear on what
constitutes good/best practice.This means that HSE does
not have anyone available who can offer further advice on
this subject).
Information can be gathered about the operation of the
system from other management activities such as, hazard
identification and risk assessment studies and incident/ near
miss investigations etc. (Not currently clear on what
constitutes good/best practice. This means that HSE does
not have anyone available who can offer further advice on
this subject).
In larger companies, audits of 2nd party examination/test groups do
get undertaken, but in less detail to the above. Larger companies
usually use managers from other sites. If the examination/test
department is UKAS accredited they will be subject to an
independent audit. You could ask to see the non-compliances from
the UKAS Report. In smaller companies, you will be unlikely to find
anything, particularly if the bulk of their plant was under PSSR and
examination by a 3rd party (insurance company).
Verification of Documentation;
Copies of audit reports (including UKAS non-compliances)
covering either the specific operation of the examination
system or of more wider aspects of health and safety
management which include aspects of the examination/test
of plant system;
Any evidence of reviews of human performance in
examination activities;
Documented reviews of the performance of the system, or
other sources of review, HAZOPs, FMEAs, accident or
incident reports, plant change procedures etc;
Reports on performance to senior management, detailing
achievement of objectives or explaining why objectives have
not been met.
CURRENT ISSUES
1. Industry moves to a Risk Based Inspection (RBI) approach. Further guidance on RBI can be found in
SPC/Tech/Gen/32. Issues include:
Areas excluded from schemes with no inspection evidence to confirm assumptions made at exclusion;
Extending the intervals between examinations/tests;
The reliability of non-invasive examination techniques (see Paragraph 51 SPC/TECH/Gen/32);
RBI methodology relying heavily on the identification of potential degradation mechanisms. Research has
revealed wide discrepancies between the degradation mechanisms identified by different duty holders. There
needs to be provision for validating the assumptions made about degradation mechanisms (see Paragraphs 30-
35 SPC/TECH/Gen/32);
Assurance of the competency and suitability of the "expert review team";
The process can be front end heavy on resources before benefits are achieved. There can be a drive for benefits
at too earlier stage to "sell" RBI projects;
RBI is sometimes used to sort out inadequate examination/test regimes but can take more time than anticipated
to deliver.
2. A lack of experienced examination personnel.
3. 2nd party v 3rd party inspectorates. 2nd party inspectorates (Company employees) use Risk Based Inspection (RBI)
to target examination/test resources more effectively across the site and include all plant and equipment (PSSR and
everything outside of PSSR included). 3rd party inspectorates (Insurance industry engineers) rarely get involved in RBI
and examine/test to fixed intervals, generally on the smaller to medium sized sites. Gaps occur when site maintenance
staffs are left to deal with all items outside of PSSR. These items are covered by HSW Act, COMAH or PUWER, but can
be seen as less important, and not examined appropriately.
4. Use of generic Written Schemes of Examination (WSE's) for PSSR examinations. HSE challenged the use of generic
schemes because they were not bespoke to sites, and type "A" Competent Bodies agreed to stop using them. A scheme
should be clear as to what is examined, how, when, and why. Some in-house type "B" Competent Bodies has schemes
of examination that are scoped largely at the discretion of the examiner.
5. The implementation of process safety performance measures (leading and lagging indicators). A communities of
interest website has been set up. Most sites do not use process safety performance measures at the moment, but it is
something that HSE is keen to encourage. It was a key point that came out of both the Longford enquiry after the Esso
gas explosion, and the BP Grangemouth Report. The BP Grangemouth Report highlighted weaknesses in safety
management systems in that incorrect assumptions about major hazard performance were drawn from measuring lost
time accident frequencies. Performance measures for examination/test of plant are important because they provide
evidence of how well key risks are being controlled. Safety management systems can then be improved, as employers
have reasonable evidence about major hazard performance.
6. OSD KP3 Project on maintenance management. This is aimed at improving installation integrity (with a significant
proportion of infrastructure approaching/ exceeding original anticipated life) and securing the future for the UK
continental shelf. Bulletin Board for the KP3 Handbook.
7. For safety-related control and instrumentation (C&I) systems - the increasing adoption of risk based approaches such
as BS EN 61508 or 61511. Regular proof testing of all elements of C&I systems is an essential part of maintaining safety
integrity.
QUESTION SET EXAMINATION/TEST OF PLANT
EXAMPLE QUESTIONS FOR INTERVIEW
POLICY
1. Does the organisation have a programme for plant examination/test?
2. What is the purpose of the programme?
3. Does it cover examination/testing as part of plant construction and commissioning?
4. What are the consequences (for health and safety) if critical plant is not routinely examined/tested?
5. What are the legal requirements for examination and testing of plant?
6. What is the policy on contracting out of examination/test activities?
7. How do they ensure that there are no gaps in coverage?
8. Does it cover the assurance of examination/test tasks and systems against human failure, including the role of
human error?
ORGANISING - Control
1. How are responsibilities for the following identified:
Oversight of the plant examination/test system?
System design and scope:
o Items subject to examination/test?
o examination/test criteria?
o examination/test frequency?
o selection of examiners?
Implementation of the examination/test programme?
Monitoring of the examination/test programme?
Review of examination/test programme?
2. Do third parties carry out any examinations/tests? (contracted out by the organisation or imposed externally by
nd
insurance companies?) Do 2 party bodies carry out any examinations/tests?
3. Who decides what tasks are contracted out?
nd
4. How does the in-house (2 party) body demonstrate independence from the operating functions of the
company?
5. How do they demonstrate that the arrangements for periodic proof testing are adequate?
6. Are objectives set for individuals involved within the system?
7. How is achievement of the objectives at this business level monitored and reviewed?
8. What resources are allocated to examination/test objectives?
9. What happens if there is a shortfall in allocation? Who decides what doesn't get done?
10. What is the trend in resource allocation for examination/test tasks for the last 3 years?
11. How is achievement of the overall objectives of the examination/test system reported to more senior
management?
12. Were the examination/test targets for last year met?
13. What would be the consequences if the examination/test targets were not met?
14. How do examinations/tests imposed by 3rd parties, e.g. insurance companies, complement the in-house
examination/test activity?
15. How much reliance is there on 3rd party bodies?
ORGANISING - Co-operation
1. How is equipment made available for examination/test?
2. Are any difficulties encountered in getting equipment released from production to allow for examination/test?
3. What advance notice is given to production departments to make plant available for examination/test?
4. Are there difficulties in completing examination/test sufficiently promptly to allow equipment to be handed back to
production departments?
5. How are conflicts with production departments over release of equipment for examination/test within the prescribed
examination/test interval resolved?
6. What sanctions can be applied when or if equipment is not released for examination/test?
7. What is the attitude from production managers if the examination/test programme falls behind schedule so that they
are running with plant or equipment significantly overdue for examination/test?
8. Are there any difficulties in getting maintenance personnel to properly prepare equipment or provide access to plant
for examination/test?
9. What are relationships like with third party examination/test services, especially those contracted out by the
organisation?
ORGANISING - Communication
1. How are details of the examination/test programme communicated to:
Those undertaking the examinations/tests?
Line managers for the departments in which the plant is situated?
2. How are findings of the examination/test programme passed on to:
Line managers for the department in which the plant or equipment is situated?
Line managers responsible for maintenance?
3. How are abnormal or unexpected findings passed on to:
Other examination/test departments/managers within the organisation?
Equipment manufacturers/suppliers?
Those responsible for plant designed commissioning and for equipment purchase?
4. Are there imminent danger reporting arrangements?
5. How are outstanding examinations/tests flagged up to:
The examiner responsible for the examination/test task?
The production department in which the plant/equipment is situated?
Senior management?
6. How are modifications to recommended examination/test frequencies or methods provided by equipment
manufacturers or suppliers brought to the attention of examination personnel?
7. How are requests for delayed examinations/tests handled?
ORGANISING - Competence
It may be appropriate to select a particular examination/test task and explore questions about that role. This
examination/test task could be pre-selected during the audit preparation stage by asking what examinations of plant are
undertaken in-house.
Safety Managers
1. What are the criteria for selecting a person to undertake the examination/test of [e.g. (safety critical) electrical
instrumentation]?
2. What are the qualifications required for that post holder?
3. What previous skills/experience are required before someone is appointed to examine/test [electrical instrumentation]?
4. Do [electrical instrumentation] examiners have to belong to a specified professional body?
5. How are the additional training needs of [electrical instrumentation] examiners identified. For example, familiarisation
with particular items of plant; examination/test criteria; examination/test standards for plant
6. How do you satisfy yourself that [electrical instrumentation] examiners are competent to perform their duties?
7. How do you know that [electrical instrumentation] examiners who undertake examinations/tests as part of your service
contract with (equipment manufacturers/suppliers/other) are competent?
8. What training is provided in terms of the operation of the examination/test system?
Individuals Involved in Examination/Test (Aimed at verification of claims made by system managers)
1. What qualifications do you hold?
2. Are you a member of ...... [answer to question 4 above]?
3. What is your past experience in examining/testing [electrical instrumentation]?
4. What training have you received from the company to assist you in performance of your examination/testing duties?
5. What training is planned for the future?
6. How do you keep up to date with technological developments and current examination/test practices within the
industry?
7. How is your competence assessed?
8. Is this done routinely?
PLANNING and IMPLEMENTING
1. What criteria are used to select items for examination/test?
2. What criteria are used to determine the examination/test frequencies?
3. Are selection and frequency judgements validated by sample examination and testing?
4. Is the examination/test programme comprehensive does it identify and address known problem areas?
5. What criteria are used to decide who undertakes the examination/test tasks?
6. What standards/codes etc, are used to determine examination/test methods?
7. Are there written instructions covering:
the operation of the planned examination/test programme?
the individual examination/test procedures?
acceptance/rejection criteria?
8. How is plant flagged up as requiring examination/test?
9. What prior notice is given to production departments indicating that an examination/test is due?
10. Is the examination/test programme on target?
11. Are examiners recommendations for repairs, etc. duly acted upon?
12. What sort of overdue time is permitted and how have these parameters been decided?
13. How is the planned programme adjusted following a plant change?
14. How are new items of plant brought into the system?
15. How are examination/test frequency extensions controlled?
16. How does the system take human factors into account? (e.g. do procedures allow for error recovery)
17. Are examination/test bodies trending results?
MEASURING PERFORMANCE
Questions to both managers of examination/test functions, and managers in production departments.
1. What measures are taken to monitor the implementation of the examination/test programme?
2. How often is the achievement of examination/test targets checked?
3. What actions are taken if the programme is falling behind?
4. Is assessment made about whether it is safe to continue using plant/equipment beyond the due examination/test
date?
5. Are regular progress reports on completion of the programme produced throughout the year?
6. What level of (senior) management sees these progress reports?
7. What sanctions are applied if the programme is not being met?
8. Are there any actions outstanding?
9. How do they monitor the implementation of the examination/test programme undertaken by 3rd party bodies?
10. How are outstanding items pursued?
11. Have there been any incidents or near misses in the last 3 years in which failure to properly examine/test plant was
thought to have been a contributory factor?
12. Are leading and lagging process safety performance measures used that reflect the process risk profile of the plant?
Is leading and lagging data used to drive performance improvement?
REVIEWING PERFORMANCE
1. How is the design and operation of the system reviewed?
2. What changes/improvements have been made to the examination/test system in the last 3 years?
3. What prompted these changes?
4. Have there been any changes to the examination/test programme brought about as a result of the investigation into an
accident or incident?
5. Are any difficulties encountered in obtaining sufficient resources to implement changes to the system needed as a
result of performance review?
6. Is examination/test intelligence used to determine examination/test frequency?
AUDITING
1. Has the design and operation of the plant examination/test system been subject to an independent audit?
2. What were the findings?
3. Does the audit determine whether the examination/test regime is technically compliant with good practice?
4. How were the findings prioritised and implemented?
5. How are decisions about what to implement and what to disregard taken?
6. Are there any plans to audit the examination/test system in the near future?
Appendix - LEGAL BASIS
The Health and Safety at Work etc Act 1974 (HSW Act)
Sections 2 and 3. The Act contains requirements to the effect that an employer has duties to employees and persons
other than their employees to ensure their safety at work so far as is reasonably practicable. This extends to the
provision and maintenance of plant and systems of work that are safe and without risks to health, and the provision of
information, instruction, training and supervision.
The Management of Health and Safety at Work Regulations 1999 (MHSW)
Regulations 3, 4, and 5. These require employers and self-employed people to assess the risks to workers and any
others who may be affected by their work or business, to implement preventive and protective measures and make sure
that appropriate arrangements are in place to cover health and safety.
COMAH Regulations 1999 (COMAH)
Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident
prevention policy and a safety management system for implementing it have been put into effect in accordance with the
information set out in Schedule 2.
COMAH safety reports, as part of their minimum information, are required to include information on operators' accident
identification, risk analysis and prevention methods and an assessment of the extent and severity of the consequences
of identified major accidents (see COMAH Schedule 4 Part 2).
Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their
consequences to persons and the environment.
Regulation 5(3) requires operators' SMS to identify and evaluate major hazards. There should be documented
examination and test procedures to help ensure safe operation of plant, processes, equipment and storage facilities (see
COMAH Schedule 2).
Pressure Equipment Regulations 1999 (PER)
These implement the EC Pressure Equipment Directive and provide for free trade in Pressure Equipment across the
European Economic Area. Although a free trade directive, it has important implications on the initial integrity of pressure
systems covered by the directive/regulations. All pressure equipment within scope, with the exception of some low
hazard equipment, is conformity assessed against the Essential Safety Requirements by a recognised third party, a
Notified Body. In essence, the conformity assessment ensures that the pressure equipment is safe for its intended use
and equipment must bear a CE marking (if within scope).
Some operators take on the responsibility of designing and/or constructing pressure equipment on their site. This is
especially true for piping systems and the HSE would expect clear recognition of designer's constructor's duties and a
suitable conformity assurance process.
This RCS does not explicitly address PER (see Plant Design RCS), however if issues relating to initial integrity are found
on equipment within scope of PER, they should be referred to an appropriate specialist for action.
Pressure Systems Safety Regulations 2000 (PSSR)
These Regulations are only concerned with the danger from steam and stored pressure energy, whereas we are often
concerned with the danger from the content on HID sites. So some key items of fixed plant are often not covered with the
WSE's required by PSSR, e.g. a lot of pipework and atmospheric storage tanks, but these should still be looked after to a
similar standard.
Regulation 8 requires a written scheme of examination for pressure systems containing a relevant fluid, where a defect
may give rise to danger (see Schedule 1 for exceptions).
Regulation 9 requires examination in accordance with the written scheme.
The Provision and Use of Work Equipment Regulations 1998
Regulation 6 is the catch all, requiring inspection of all items not covered by WSE's in PSSR, but which can deteriorate
and give rise to dangerous situations.
The Electricity at Work Regulations 1989 (EAWR)
Regulations 4, 5, 12 and 13.Regulation 4 requires the testing, commissioning, operation and maintenance of electrical
equipment throughout the life of the system. Records of maintenance, including test results should be kept. Every work
activity, including maintenance and work near a system should be carried out in a safe manner so as not to give rise to
danger.
Regulation 5 requires that electrical equipment should not be put into use where its strength and capability may be
exceeded in such a way as may give rise to danger.
Regulation 12 requires the provision of suitable means for cutting off the supply and for isolation.
Regulation 13 requires adequate precautions to be taken for work on equipment made dead, to prevent equipment
becoming electrically charged, if this charging would give rise to danger.
Confined Spaces Regulations 1997
Regulations 3, 4, and 5. These place duties on employers and self-employed persons. Where work has to be carried out
in a confined space, it should be in accordance with a safe system of work. Emergency arrangements should be in place.
OFFSHORE LEGAL BASIS
Safety Case Regulations 1992,
Regulations 2 and 15. These require a suitable written scheme of verification for Safety Critical Elements to ensure that
SCE's remain in good repair and condition. Regulation 15B Schedule 9 lists matters to be included in the verification
scheme.
Offshore Installations (Prevention of Fire etc) Regulations 1995,
Regulations 5, 9, and 19. Regulation 5 requires the duty holder to perform an assessment to identify the events which
could give rise to 'a major accident involving fire or explosion; or the need for evacuation or rescue to avoid or minimise a
major accident; the evaluation of the likelihood and consequences of such events; the establishment of appropriate
standards of performance to be attained by anything provided by measures for ensuring effective evacuation, escape,
recovery and rescue to avoid or minimise a major accident.' Regulation 19 further requires that a suitable written scheme
be prepared for the systematic examination, by an Independent Competent Person, of plant provided under specific
PFEER Regulations.
Offshore Installations and Wells (Design etc) Regulations 1995.
Regulation 8 requires duty holders to ensure that suitable arrangements are in place for maintaining the integrity of the
installation, including suitable arrangements for periodic assessment of its integrity and carrying out remedial work in the
event of damage or deterioration.
POPMAR INSPECTION GUIDELINES
POPMAR INSPECTION GUIDELINES
ELEMENT:
ORGANISING-
CONTROL
Responsibilities Scope covers what items are subject to examination/test; location of items; examination/test
criteria/standards against which to judge; examination/test frequency; selection of Examiners.
Status of the Are they performing allocated tasks to agreed timescales?
programme
Were the examination/test targets met for last year?
What are the consequences if the planned examination/test targets are not met?
Verification of Accountability e.g. performance reports to senior management, plans for improvements on
Documentation modifications to the system operation, contract reviews with 3rd party inspection services.
Responsibilities e.g. job descriptions, work procedures.
Resource allocation e.g. staffing plans.
POPMAR INSPECTION GUIDELINES
ELEMENT:
ORGANISING-
COMMUNICATION
Details of Identification and selection of equipment for examination/test, frequencies and priorities.
examination/test
programme
Examination/test Abnormal or unexpected findings (performance data/ early breakdown data) should be passed on to
findings others for action. e.g. to examination/test departments/ managers, to equipment manufacturers/
suppliers, and to those responsible for plant design, commissioning and for equipment purchase.
POPMAR INSPECTION GUIDELINES
ELEMENT:
ORGANISING-
COMPETENCE
Inspectors could look at United Kingdom Accreditation Service (UKAS) reports for non-
conformances, and then concentrate efforts on those areas. UKAS audits accredited companies, to
check that they are properly applying examination/test schemes.
POPMAR INSPECTION GUIDELINES
ELEMENT-
PLANNING AND
IMPLEMENTING
Pipework Example If pipeline areas have been excluded from a scheme on the basis of low degradation and thus low
(This is only an failure probability, there should be examination/test evidence to confirm these assumptions.
example. Plant can
be excluded for lots
of reasons e.g.
contents,
pressures,
temperatures etc)
A Pipework Particular problem areas need to be addressed such as dead legs, start-up and shut-down pipes
Example that are out of service most of the time, pipework that are out of service most of the time, pipework
(Examination/test that is in intermittent use, injection points, and stagnant areas of pipework. There should be a clear
schemes) understanding of the deterioration mechanisms associated with contaminants within the process
stream. (Source: Eutech Report)
POPMAR INSPECTION GUIDELINES
ELEMENT - AUDIT
AND REVIEW
UKAS
Accreditation
Accreditation by UKAS means certification and inspection bodies have been assessed against
internationally recognised standards (currently BS EN ISO/IEC 17020:2004) to demonstrate their
competence, impartiality and performance capability. Accreditation is on a 4 yearly cycle. There is
an initial assessment, where non-conformities found against accreditation requirements will be
notified to the company in writing. These have to be cleared before accreditation is granted.
Accreditation in confirmed on an annual basis by surveillance visits, with a full assessment every
fourth year.
The UKAS team will look at the following topics:
1. Organisation. They will expect to find a named technical manager in overall charge, effective
supervision, deputies, job descriptions including requirements for education, training,
technical knowledge and experience.
2. Quality systems. They will expect a maintained, audited system for control of all
documentation related to its activities, with procedures to deal with feedback.
3. Personnel. Sufficient numbers of competent staff (including relevant knowledge of the
defects which may occur during use, and the understanding of the significance of deviations
found), documented training system and record keeping.
4. Facilities and Equipment. Should be suitable and adequate, properly identified, maintained
and calibrated. There should be procedures for selecting suppliers and inspecting received
materials. Data integrity protection procedures should be implemented.
5. Inspection methods and procedures. Will check that the inspection body is using the
methods and procedures that are defined in the requirements, against which conformity is to
be determined. Will check that there are documented instructions for carrying out inspection
safely.
6. Handling inspection samples and items. Including unique identification of items to be
inspected, recording of abnormalities notified or noticed before commencement of
inspection.
7. Records. Maintained records system that permits satisfactory evaluation of the inspection.
8. Inspection reports and inspection certificates. Should include all the results of examination
and the determination of conformity made from the results as well as all information needed
to understand and interpret them. Subcontractors' results should be clearly identified.
Should be signed off by authorized staff.
9. Subcontracting. Inspection body must demonstrate that any subcontractor is competent and
complies with the relevant standard of the EN 45000 series. This should be recorded.
10. Complaints and appeals. Should be documented procedures for complaints and appeals.
Records should be kept, including actions taken to resolve complaints.
11. Cooperation. Inspection body is expected to participate in an exchange of experience with
other inspection bodies and in the standardization processes as appropriate.
Assessing Risk Control Systems
RCS 2 - PERMIT TO WORK
Policy Measuring Performance
Organising - Control Auditing
Organising - Co-operation Reviewing Performance
Organising - Communication Example Questions For Interviews
Organising - Competence References
Planning and Implementing
POLICY
Key Issue:
Is there an effective policy for risk assessment of high hazard operational and maintenance activities, and the control
procedures, normally a permit-to-work system?
Key Characteristics:
Senior management can clearly describe the purpose of their permit-to-work system or justify any alternative
system used.
The permit-to-work system should be adequately resourced to ensure that the system has sufficient capacity
(available competent signatories) to cope with peak demands.
Note: The purpose can be described as: a method which ensures that all foreseeable hazards of such activities are
identified and appropriate precautions specified to eliminate the hazards or control the risks. Details of the hazards and
precautions are effectively communicated to all involved in the work, thereby safeguarding their health and safety.
ORGANISING - Control
Key Issue:
Is there an adequate management system to implement the policy on risk assessment and controls for high hazard
operational and maintenance activities?
Key Characteristics:
Responsibilities for oversight, design, documentation, operation, monitoring and review of system clearly
allocated.
Personal responsibilities in job descriptions or performance standards, with clear objectives, and subject to
appraisal.
Identification of personnel with responsibility for: issuing permits, identifying hazards, making plant safe,
checking that plant is safe, supervision of the work and its completion to the required standard. Suitable
authorisation of personnel with special responsibilities.
Acceptance of responsibilities by those involved.
Performance of those with responsibilities under the permit-to-work system subject to routine appraisal.
ORGANISING - Co-operation
Key Issue:
Are there adequate and appropriate arrangements to secure the trust, participation and involvement of persons involved
in high hazard operational and maintenance activities?
Key Characteristics:
Individuals involved with the permit-to-work system co-operate to ensure that it is appropriately designed,
introduced and implemented. This will include: raising awareness of the permit system, access to key persons,
and provision of training.
Arrangements for consulting users during permit design to ensure practicability and useability.
Arrangements to ensure all relevant personnel, including contractors, are made aware of the permit systems and
are trained in their operation.
Co-ordination between jobs to ensure that unforeseen hazards are not introduced.
Ready access to the permit authoriser when required.
Close liaison between the permit authoriser, operations staff, and the person in charge of the work to ensure
provision is made for: interactions between jobs, shift changeover and hand-back of the permit.
Permit recipients sign the permit to indicate they have read, understood and accept the permit conditions.
Cross-referencing to other relevant certificates e.g. isolation certificates.
Securement of commitment, ownership, and acceptance of the value of the PTW system.
ORGANISING - Communication
Key Issue:
Are there adequate arrangements to secure information flow between those involved in high hazard operational and
maintenance work.
Key Characteristics:
Formal and thorough communication between all of the parties involved in the work. Permits should never be
used as a substitute for full discussion between permit issuers and those in charge of the work.
Sufficient written instructions to: identify all foreseeable hazards, ensure co-ordination between jobs, highlight the
hazards, specify the precautions necessary to control or eliminate the hazard, ensure people new to the job and
at shift changeover are made aware of the hazards.
Information about new activities, changes in legislation or workplace standards, from reviews and audits
communicated to the people who need to know.
Documentation and communication of the rules/standards and control arrangements governing the PTW system.
A permit form which is clear, easy to follow, and the lay-out follows the sequence of events in its life cycle. The
text is legible and the task explicitly and unambiguously described.
Records of live and suspended permits maintained.
Clear specification of the location of the work to be controlled by the permit.
Specification of the hazards, and the precautions required to control them both to people doing the work, those
new to the job, and those who might be affected by it.
A means exists of informing departments that items of plant/equipment will be the subject of a permit-to-work, for
how long and the consequences.
Measures to ensure that the right people, those who may be affected by it, know a permit has been issued and
individuals know whether one permit affects another e.g. live and suspended permits displayed at the workplace.
Mechanisms to alert fitters to particularly high risk tasks.
Effective communications during shift changeover to ensure that the necessary precautions remain in place, new
operational staff are fully aware of work being undertaken, and that new maintenance personnel are briefed on
the hazards and precautions required.
Communication of hand back, plant reinstatement and shift change procedures to all those involved with and
affected by permits.
Liaison, training and supervision arrangements for contractors.
ORGANISING - Competence
Key Issue:
Are there systems and arrangements to secure the competence of those working within high hazard operational and
maintenance activities?
Key Characteristics:
Individuals involved in design, implementation, monitoring and review of the permit-to-work system are
competent to achieve the objectives.
Selection criteria for permit staff including: relevant experience, knowledge of the plant, process/plant hazards,
and risk assessment.
Competencies in terms of: knowledge, skills, and experience are clearly defined and reviewed. These include
abilities in methods of identifying and assessing the hazards, processes and plant involved. Formal assessment
before appointment of authorised permit signatories and personnel responsible for carrying out isolation.
Identification of existing skills/knowledge and consequential training programmes.
Appropriate training allocation; induction training provision for all persons involved in the system, basic training
for fitters, with extended provision for authorised permit issuers.
Training of contractors, usually recent site induction training.
Site specific workplace training to ensure that it is relevant to the hazards of the industry, plant or processes and
appropriate to the site PTW system; production and maintenance teams have a knowledge of each others work
requirements.
Competence routinely assessed by observation and testing of the understanding of hazards, risks and control
measures.
Training records for individuals which are reviewed periodically. Provision of refresher training where necessary.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Are there adequate processes to generate plans and performance standards to implement the policy on high hazard
operational and maintenance work?
Key Characteristics:
Performance standards covering: design of the permit, when permits should be used, how the system should
work and appropriate work procedures.
Production and communication of written performance standards to all.
Control of permit initiation. Issue of permits only for those jobs for which it is absolute necessary, i.e. there
should not be job control systems for routine tasks.
Issue of a permit by a person to themselves prevented.
Incorporation of contractors into the system to ensure that the same high standards of control, as applied to the
company's own staff, are maintained.
A clear description of the work to be done specifying unambiguously the plant involved, the job and location.
Identification of all foreseeable hazards. Hazard identification as a formal written step in the permit initiation
process. Requirement for work to be stopped if new hazards arise or recur.
Clear rules on emergency action.
Permits which document the precautions, and who is to take them. Clear allocation of responsibility for specific
tasks. Specification of precautions with detail appropriate and proportionate to the risk.
Implementation of permit suspension procedures if the work cannot be done immediately, or dealing with the
situation where it is necessary to vary the work from that specified on the permit.
Checks to ensure that the work equipment/plant is safe to bring on line once the permit-to-work tasks have been
completed.
Documentation of pre-start up procedures.
Signing off procedures.
Procedures for identifying jobs which appear routine but which differ slightly but significantly.
The risk assessment methodology for application and criteria for use of PTWs.
Procedures for variation from authorised practices.
Documented isolation procedures for standard activities including; isolation standards related to risk, isolation
certificates, leak testing, and security tagging.
MEASURING PERFORMANCE
Key Issue:
Is there adequate and sufficient measurement of performance of high hazard operational and maintenance work both
before and after accidents/incidents.
Key Characteristics:
The operation of the permit-to-work systems and the functioning of the system as a whole closely monitored
through active and reactive monitoring.
Written instructions detailing monitoring procedures for:
i. Routine monitoring to check that: the permit form is being completed accurately, unambiguously and
with sufficient detail, permits are being used for appropriate work, the hazards are being properly
identified, the precautions stipulated in the permit are appropriate and are being followed, work activities
are confined to those authorised by the permit, and hand-back procedures are being followed;
ii. Periodic monitoring of the PTW system documentation and operation, by those not directly involved
in the system on a plant, to ensure that: the system is being applied as intended, the right activities are
covered, the type of permit e.g. hotwork, confined spaces etc, adequately cover the work activities
undertaken.
Procedures for checking the work site, during permit issue, by permit authoriser/issuer.
Procedures for checking that the work has been done as specified and the work equipment is safe to bring back
on line.
Independent checking of important actions to be taken under the permit system, and confirmation on the permit.
Systems to ensure that no one is allowed to carry out permit work without training.
Checks to ensure that the precautions are executed, and that the work is being done as specified.
Procedures for reporting any incidents that have arisen during work carried out under a permit, and for reviewing
procedures as necessary
AUDITING
The design and operation of the permit-to-work system, should, periodically be subject to a formal audit. The auditor(s)
should not be part of the system or have any responsibility for it.
The audit should verify that a permit-to-work system:
Exists.
Is properly designed.
Is implemented.
Is effective in meeting its objectives.
The audit should check that performance monitoring and reviews are occurring at the correct frequency and are
addressing the right issues.
Select and Review HSM Documentation
Copies of audit reports covering either the specific operation of the permit-to-work system or wider aspects of HSM which
include the permit-to-work system.
Collect and Evaluate Evidence - Interviews
Managers should be able to explain the findings of audits which have been undertaken or audits planned for the future
and their response to the findings.
REVIEWING PERFORMANCE
Key Issue:
Is there adequate and sufficient review of the performance of high hazard operational and maintenance activities to
ensure that lessons learned are effectively put into practice to improve performance of the system.
Key Characteristics:
Periodic review of the achievement of the objectives of the permit-to-work systems in respect of:
o Permit design.
o The relevancy of a permit to control the risks.
o Identifications of hazards prior to work starting.
o Duration of permit.
o Precautions to be taken.
o Permit display.
o Variations from accepted procedures.
o Updating the system in the light of new information about hazards of success/failure of the system.
Information about the operation of the system may arise from other management activities such as, risk assessment,
HAZOPs, Failure Mode and Effects Analysis (FMEA), incident/near miss investigations etc.
EXAMPLE QUESTIONS FOR INTERVIEWS
OBJECTIVE
1. Does the organisation have a permit-to-work system?
2. What are the objectives of the permit-to-work system?
3. What are the legal requirements relevant to a permit-to-work system?
4. What could the consequences for health and safety be, should a permit-to-work fail?
ORGANISING - Control
Managers
5. How are the responsibilities for the following made clear:
o Oversight of the permit-to-work system?
o Permit form design and system scope?
o Type of jobs subject to permit?
o Control of contractors?
6. Are objectives set for individuals involved with the system?
7. How is achievement of the objectives monitored and reviewed?
8. What resources are allocated to ensuring effective working?
9. If there is a shortfall in real resources, how are decisions made about what doesn't get done?
10. How is achievement of the overall objectives of the permit-to-work system reported to senior management?
11. What would be the consequences if the objectives were not met?
Individuals Involved in the Permit-to-Work System
12. Who was involved in the design of the permit system and form(s)?
13. Who was consulted?
14. How is the permit system initiated?
15. Is a job request form used and does it have safety information on it?
16. Who decides whether a job needs a permit?
17. Is it clearly laid down who may issue permits?
18. Are there ever any problems in getting a permit issued?
19. Does the permit system extend to contractors and their employees?
20. Who identifies the hazards before work starts?
21. Does someone else double check that all the hazards have been identified before work starts?
22. When the hazards have been identified who does the work to make the plant safe?
23. Does anyone check that this work has been done correctly?
24. If work under a permit gives rise to new work what do you do? Do you, for instance, stop to check whether a new
permit is required or do you tend to get on with the job?
25. Who decides when the permit expires?
26. How is the expiry time decided upon?
27. Does the time allowed ever cause problems e.g. rushing to get the job done before the permit expires?
28. When the work is finished, and the permit expires does anyone check that the work has been done correctly?
29. Does anyone check that the item of plant is safe for use?
30. What do you understand should happen in the event of a major general site emergency i.e. how should the job
be controlled, should it simply be abandoned?
31. Do the rules allow the issue of a permit by a person to himself?
32. Do permits specify clearly the plant or geographical area to which work must be limited?
33. Does the permit procedure include a hand-over mechanism for work which extends beyond a shift or other work
period?
34. Is there a signing off procedure when the job is complete? What does it involve?
35. Have you ever done permit work without a permit being issued? Does it happen often, sometimes, rarely?
36. How do you know that the contractors coming on site today are the same ones that were on site yesterday?
37. Is there a set of properly documented isolation procedures for working on potentially dangerous items of plant
and does it provide for long-term isolation?
ORGANISING - Co-operation
Managers and Individuals
38. Is there close liaison between the permit issuer and the person in charge of the work?
39. Are copies of permits issued for the same equipment/area kept and displayed together?
40. Is there a means of coordinating all work activities to ensure potential interactions are identified?
41. Is there provision on the permit form to cross-reference other relevant certificates (e.g. isolation) and permits?
42. Is there a procedure to ensure that the agreement of others who could be affected by the proposed work is
obtained before starting the work or preparations for it?
43. Where there are isolations common to more than one permit is there a procedure to prevent the isolation being
removed before all the permits have been signed off?
ORGANISING - Communication
Managers
44. How are details of the permit - procedures communicated to:
o permit operators?
o line managers in the department where the work is carried out?
o issuers and receivers of permits?
45. Following monitoring and review of the system, how are any changes communicated to the workforce?
46. Do you know what those receiving the permit think about the system? Do they think the system works?
Individuals involved with Permit Procedures
47. Are you aware that a permit is essential for certain types of work?
48. Who issues permits?
49. How do you obtain a permit?
50. Do permits specify clearly the job to be done?
51. How would you know who a permit had been issued to?
52. Do permits clearly specify the plant or geographical area to which work must be limited?
53. How does the permit issuer know that the recipient has understood the conditions laid down in the permit?
54. How do people know whether one permit affects any other permits?
55. Are there procedures for noting that overlapping jobs are specified on the permits?
56. What happens to permits at shift changeovers?
57. If a permit was unclear in any way what would you do?
58. Do you think managers think the system works?
59. Do you think management are committed to the system?
60. Do you think others see the system in the same way as you or differently?
Process Operating Staff
61. How are you able to readily see and check the plant status?
ORGANISING - Competence
Managers
62. What criteria are used when selecting personnel to authorise and issue permits, and for permit operators?
63. What are the qualifications required for that person?
64. What previous skills/experience are/is required before someone is appointed to carry out permit-to-work tasks?
65. What training is provided in terms of the operation of the permit procedure?
66. Does the system require formal assessment of competence of personnel before they are given responsibilities
under the permit procedure?
67. Is a record of training and assessment maintained?
68. Do training and competence requirements include contractors?
69. Are individuals provided with written confirmation of successful completion of relevant training and are these
documents checked before appointments are made within the permit-to-work system?
70. Are personnel who issue permits properly authorised and trained to undertake the duties required of them?
Individuals involved in the Permit-to-Work System
71. What qualifications do you hold?
72. What type of training did you have for operating the permit-to-work system?
73. Were you trained before using the permit system or was training on the job?
74. Was the training site specific?
75. Was the permit-to-work system included in your induction training?
76. Was that training taken seriously?
77. Did the training conclude with a formal written test?
78. Did you receive written confirmation of your successful completion of the training?
79. Have you got a training record? If so, have you seen it and do you know where it is kept?
80. Have you had any refresher training since your original training?
81. When the permit system is modified is new training given?
82. Do contractors receive any training?
PLANNING and IMPLEMENTING
Managers
83. How does the company ensure that the permit system is appropriate to the site and hazards it will be used
with?
84. Are end users consulted and involved during permit design and system planning to ensure useability and
practicability?
85. How is it decided:
o what jobs permits are used for?
o that permits are only used for jobs that need them?
86. Is the work area always clearly identified?
87. Is the plant involved in the permit work always clearly identified, by tagging or some other means?
88. Are the limitations of the work specified?
89. Does each permit state the precautions which have been taken and those needed whilst the work is in progress
(e.g. isolations, purging, personal protective equipment)?
90. Are there written instructions covering, for example:
o The system rules (i.e. a description of the operation of the system)?
o Shift change over procedures?
o Recommissioning and hand back procedure?
o Suspension procedures?
o Coordination between jobs?
o How the system is monitored?
91. What standards/codes etc, are used to ensure compliance with specific regulations?
92. How does the company ensure that contractors follow the system rules?
93. What arrangements do you have for your annual shutdown when several hundred contractors may be brought
onto the site?
MEASURING PERFORMANCE
Managers
94. How is the permit system monitored in operation?
95. How are permits monitored after issue, i.e. when the work is in progress?
96. Is there a system of spot checks to ensure that permits are being followed?
97. Does someone senior to the authoriser check work descriptions, risk assessments etc?
98. Have there been any incidents or near misses in the last three years in which failure of the permit-to-work
system is thought to have been a contributory factor?
AUDITING
Managers
99. Has the design and operation of the permit-to-work system been subject to an independent audit?
100. What were the findings?
101. How were the findings prioritised and implemented?
102. How are decisions about what to implement and what to disregard taken?
103. Are there any plans to audit the permit-to-work system in the near future?
REVIEWING PERFORMANCE
Managers
104. How is the design and operation of the system reviewed?
105. Is the design of the system reviewed, regularly, occasionally, or only after incidents?
106. What changes/improvements have been made to the permit-to-work system in the last three years?
107. Have any changes to the permit-to-work system been brought about as a result of the investigation into
an accident or incident?
108. Are any difficulties encountered in obtaining sufficient resources to implement changes to the system
needed as a result of performance review?
109. Are there any major obstacles to having the system modified?
110. Who is consulted about changes to the system?
111. Who makes suggestions about how to improve the system?
112. Are there any formal procedures in place to evaluate the effects of change?
REFERENCES
HSE Leaflet IND(G)98(L) - Permit-to-Work System.
Oil Industry Advisory Committee - Guidance on Permit-to-Work Systems in the Petroleum Industry.
CM NIG Book Dangerous Maintenance - A Study of Maintenance Accidents and How to Prevent Them.
Oil Industry Advisory Committee - The Safe Isolation of Plant and Equipment.
RCS 3 - OPERATING PROCEDURES
Introduction Planning and Implementing
Policy Measuring Performance
Organising - Control Auditing
Organising - Co-operation Reviewing Performance
Organising - Communication Example Questions For Interviews
Organising - Competence
INTRODUCTION
This RCS concerns the procedures required to operate the plant. These procedures should have been arrived at by
including a consideration of the task and hazard analysis of the process and should identify safety critical operations.
Hazards may include chemical reactivity, sampling procedures, inerting requirements for flammable liquid storage tanks,
purging procedures such as double block and bleed as well as general process operating hazards. It is expected that
there will be documentation to describe the operating procedures. The scope of operating procedures should cover plant
start-up, shut-down, normal process operations, loading, purging, inerting and so forth. Consideration should be given to
ergonomic principles in the work and to the potential for human error.
POLICY
Key Issue:
Senior management should lay down a clear policy and objectives for operation of the plant to ensure that loss of
containment of hazardous substances does not occur and that the health and safety of the workforce and members of
the public are safeguarded.
Key Characteristics:
The overall objective is to operate the plant using experienced and competent staff provided with clear, up to
date and useful operating procedures. Operations of the plant should be properly planned and resourced. There
is a requirement for operation to fit in with other needs such as maintenance.
The policy for plant operation should consider:
o level of training/experience needed by operators as a function of the safety critical nature of the task;
o the integration of site policy with head office policy;
o new processes;
o supervision and task checking.
ORGANISING - Control
Key Issue:
Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:
Overall management of operations on the site.
The writing of operating procedures including new procedures/updates.
Supervision of operating work.
The control of any contractors.
Resourcing of operations.
Key Characteristics:
The system for operating the plant should include:
o the allocation of adequate financial and human resources;
o documented procedures;
o personal responsibilities being defined, e.g. in job descriptions which specify position in organisation
structure, reporting links, responsibilities and duties;
o the allocation of work between permanent staff and any contractors;
o record keeping and trend monitoring;
o the definition of the checks made before and after maintenance. Examples might include combustible or
toxic gas checks carried out, ensuring that the work has been carried out correctly and ensuring that the
integrity of the plant after completion of maintenance is satisfactory;
o controls to manage conflict between production/safety;
o critical tasks for safety and control of operators who perform these tasks;
o material data sheets, process information, P&IDs.
ORGANISING - Co-operation
Key Issue:
Individuals involved with the operation of the plant should cooperate to ensure:
success, balancing safety, production, maintenance and time pressures;
plant is made available for maintenance work in a planned way;
plant is returned to operation in a sound condition.
Key Characteristics:
The system for operation of the plant should encourage cooperation:
o those involved with operation should ensure priorities are balanced between the requirements to carry
out maintenance, production pressures and safety;
o operational procedures should be practical in the context of other demands on personnel
o resources for operating should be adequate, so that all needs within the plant/site are met. For example,
the allocation of resources should be robust and allow for:
financial performance of company;
production requirements;
major personnel reductions or increases;
quantity of overtime worked.
Coordination between control rooms is maintained.
ORGANISING - Communication
Key Issue:
Formal and thorough communication between all parties involved in the operation of the plant.
Written instructions are adequate to ensure information about new activities, changes in legislation or changes to
workplace standards from reviews and audits are communicated to the people who need to know.
Key Characteristics:
The system for operation of the plant should ensure:
o a forum exists for accessing industry guidance and corporate expertise on operating procedures for the
plant, control room design, man-machine interface;
o documentation on operational procedures exists which are clear and up to date;
o learning from previous experience, incidents and equipment history;
o Communication to Senior Management about needs for changes to procedures;
o verbal (face to face) discussion and communication is important e.g. between operations and
maintenance, between shifts and between control room and plant operators;
o that the results and actions of formal studies such as HAZOP or other safety studies/reviews, are built
into operating practices and made known to operating personnel, this may include:
requirements to pass HAZOP worksheets to procedures writers and operations supervisors;
requirement to use HAZOP and the results of other safety studies in the writing of all
procedures;
direct briefing of personnel;
memos and special instructions/notices;
plant familiarisation;
special safety training regarding plant hazards and consequences of procedures violations.
ORGANISING - Competence
Key Issue:
Individuals involved in operating the plant are competent. Competencies in terms of knowledge, skills and experience are
clearly defined and reviewed. Selection and promotion criteria for staff and any contractors are clearly laid down.
Key Characteristics:
The system for operating the plant should ensure:
o optimal use of company experience in defining and optimising operation of the plant;
o learning from previous incidents;
o well defined competencies of staff and any contractors;
o training programmes to ensure personnel are familiar with the plant hazards, operating procedures and
supervision requirements. This may include:
on-the-job, off-the-job, refresher, management skills;
training needs assessment;
training effectiveness assessment, revision of training.
Training of operators and supervisors (including contractors) should include:
o process hazards;
o safety interlocks;
o the use of procedures;
o the use of the PTW system;
o the consequences of equipment failure;
o the engineering of plant and processes;
o technical theory on plant and processes;
o the operation of valves, gauges etc.
The competence of contractors for example using accredited contractors whose employees are familiar with the
methods and hazards at the plant.
Assessment of personnel e.g. involving on-the-job evaluation, trade tests, certification checks, comparing
experience with job descriptions, formal written tests and so on.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Up to date, clear, relevant and realistic procedures, should be available for operation of the plant. These should consider
the hazards and the risks involved and describe the rules and standards required.
Key Characteristics:
Procedures should:
o incorporate guidance on hazards/risks; such hazards might include:
hazards arising from other processes and working methods, which will be going on at the same
time, such as processing ongoing in vessel connected to the vessel being operated by common
pipework;
vehicle impacts;
inadequate inerting;
unsafe operating procedures, such as conducting pressure tests whilst continuing operations in
connected pipework;
mixing of incompatible materials/chemicals.
o incorporate existing regulations, industry guidelines, certificators requirements codes of practice,
corporate standards and manufacturers requirements;
o consider the ergonomics of operating tasks, control room layout, alarm displays;
o provide for task checking if appropriate;
o define when procedures should be used, process parameter;
o ranges and requirements for isolation, checks etc.
Indicators of plant status should be clear.
There should be specific procedures for start-up and shut-down including start-up check lists.
Methods for developing suitable procedures in various areas may include:
o the writing of technical operating procedures by equipment suppliers, such as the provision of operating
procedures for turnkey processes which then need to be tailored for a specific installation;
o the use of techniques such as HAZOP. Attention should be given to whether the conclusions of HAZOP
etc, are fed into operating procedures or just used for safety engineering purposes;
o the use of checklists;
o using the results from special chemical reactivity tests regarding the dangers of runaway chemical
reactions, spontaneous ignition, chemical stability, mixing of incompatible materials associated with a
process etc.
Standards, rules and criteria for operators may include:
o the degree of isolation applicable to different circumstances e.g. single valve versus double block and
bleed;
o two operators for certain tasks;
o isolation requirements;
o purging requirements;
o special precautions;
o toxic or flammable gas tests.
Operating procedures should specify the need for critical operational tasks to be checked by a competent
authority. Particularly critical operations are:
o start-up and shut-down;
o loading/unloading
o breaking of containment.
MEASURING PERFORMANCE
Key Issue:
The operation of the plant should be monitored to measure its performance.
Key Characteristics:
The collection of incident and near miss data and analysis for possible operational failures e.g. using a root
cause analysis.
Trend analysis for failures.
Comparison of plant performance with operational standards.
Records might include shift logs, process status record sheets.
Methods to check whether unsafe procedural modification or short cuts have been made or have evolved.
Check to assure key plant status indicators.
AUDITING
Key Issue:
The operation of the plant should be periodically the subject of a formal audit. The auditors should not be part of the
system or have responsibility for it, i.e. be independent of the function being audited.
Key Characteristics:
The audit should check that performance measuring and review are occurring at the correct frequency, are
addressing the right issues, appropriate information flows occur at specified periods to senior management. It
would be reasonable to expect an annual review.
REVIEWING PERFORMANCE
Key Issue:
Information from operational experience "measuring" and "auditing" is used to make judgements about the performance
of the operation of the plant and is used to make decisions about improving performance and updating procedures.
Key Characteristics:
Periodic reviews of the operation of the plant including such issues as the performance of the plant.
Learning from experience about the effectiveness of the plant.
Revision of procedures in the light of experience, standards, codes, manufacturers' requirements etc. For
example procedures may only be reviewed after an incident or a continuous review process may exist, including
the collection of performance data, perhaps as part of a Quality Control system.
Revision of operational checking requirements in the light of experience.
Consideration of the practicality of procedures.
Revision may cover the preparation of new operations; documentation for new plant or modifications, as well as
checks to ensure accuracy of existing documentation and the involvement of different levels of operators in the
review process.
EXAMPLE QUESTIONS FOR INTERVIEWS
OBJECTIVE
1. What is the policy on the requirement for technical skills training of operations personnel?
2. How strong an influence does the company head office exert on site policy on staffing levels?
3. What is the company policy towards the process of developing technically safe and valid operating procedures?
4. Has the company developed a clear and thorough policy concerning operations hazard studies and safe
operating procedures?
5. Is there a stated policy regarding the conduct of hazard and safety studies, formal or otherwise, for planning
operations. Are such studies mandatory, optional, or not mentioned at all?
6. Describe the overall policy towards supervision of operators and plant.
7. Does the checking of completed tasks comply with policy at the corporate level and with industry guidance?
8. Are operational tasks checked in accordance with company policy and procedure? Can you give examples?
ORGANISING - Control
9. Who is responsible for ensuring that operating procedures are comprehensive, unambiguous and easy to use?
10. Who is responsible for ensuring that operating procedures are updated in a consistent and systematic manner?
11. Who is responsible for ensuring that the practicality of plant operation is considered in the design phase and
prior to modifications to hazardous plant?
12. How comprehensive are job descriptions?
13. When a new procedure is required for a new operation is it clear who is authorised and responsible for writing
it?
14. How is it ensured that all relevant operations personnel are made aware of the applicability and content of new
operating procedures?
15. What are the allocations of responsibility for arbitrating between safety and production?
16. What are the controls used to manage conflicts between production and safety?
17. What are the allocations of responsibility for ensuring adequate staffing levels are maintained?
18. What are the allocations of responsibility for ensuring operating procedures are kept up-to-date and are usable
and available?
19. What are the allocations of responsibility for ensuring that engineering management are informed of equipment
problems identified during operations?
20. What are the allocations of responsibility for identifying and implementing the training needs of operations
personnel?
21. What are the allocations of responsibility for developing selection and promotion criteria within operations?
22. What controls are there on the amount of overtime worked?
23. What is the allocation of responsibility for ensuring operational hazard reviews are carried out and safe operating
procedures are developed and implemented?
24. Are the responsibilities for developing safe operating procedures noted in job descriptions, policy documents,
project engineering plans, etc?
25. Who is responsible for assessing the validity of operation hazard/safety studies, especially after plant
modifications?
26. Who is responsible for revising the process of carrying out safety/hazard studies?
27. How rigidly are operating procedures enforced?
28. Given the criticality of certain tasks how is work allocated to operators?
29. What is the allocation of responsibility for revising the rules, standards policy etc, governing operations hazard
studies in the light of experience or changes in the regulations etc?
30. Who is responsible for monitoring the implementation of safety standards as they relate to operations?
31. Who is responsible and what are the resources for the review of industrial guidance and corporate standards for
their incorporation into company policy on operating hazard assessment and control?
32. What is the allocation of responsibility for ensuring that appropriate resources are allocated to the review of
operational hazards and development of operating procedures?
33. What is the allocation of responsibility for managing information required for operations hazard studies?
34. How are responsibilities allocated for:
o ensuring that critical task checking and supervision requirements are written into operating procedures?
o checking that critical operations tasks have been undertaken correctly?
o checking that the process/plant is in a satisfactory state before and after a critical operational task?
35. What details of supervision or checking responsibilities of staff are contained in job descriptions?
36. Who is responsible for monitoring near miss reporting, analysis and implementation of findings?
37. What are your task checking responsibilities?
38. What is the allocation of responsibility for ensuring that site standards on supervision and task checking are
consistent with corporate standards and industry guidance?
39. What is the allocation of responsibility for upgrading internal standards in the light of feedback on the
effectiveness of current standards?
40. When would you be required to ensure that hazardous tasks you have carried out are checked?
41. Outline the responsibilities for deciding upon levels of supervision required for operational tasks.
42. Who is responsible for ensuring that the checking of operations tasks is covered during training?
ORGANISING - Co-operation
43. What is the control room arrangement at this site?
44. What are the economic, scheduling, production and political pressures acting on the company that impact on the
process of managing the potential for operator error?
45. Who is responsible for revising the means of controlling conflicts between production pressures and safety
requirements?
46. What methods of communication are used to manage conflicts between production and safety?
47. What is the influence on safety of productivity or promotion schemes?
48. How good is the relationship between operations and the safety department and between operations and
maintenance?
49. Is there evidence of operational procedures not complying with the recommendations of hazard/safety reviews?
50. Are the requirements of operating procedures realistic or do they require the operators interpretation?
51. Are there pressures from regulatory authorities, insurance companies, corporate management etc, to review
operational hazards and develop operating procedures?
52. Does the company frequently carry out new operations, reactions, processes, treatments which come under time
pressure for implementation?
53. Does the scheduling of major projects allow time for adequate operational hazard review and development of
operating procedures prior to start-up?
54. Is there a procedure for resolving actual or potential conflicts between, for example, the resource requirement of
a procedure of operation and the need for productivity etc?
55. What guidance is available for reconciling conflicts between safe operating procedure requirements and
resource and time constraints?
56. Are operating procedures used as the procedure writer intended?
57. What systems are there for verifying that appropriate checks are being carried out on critical operations tasks?
58. How are conflicts between the requirement to supervise and check hazardous work and production needs
handled?
59. Are the requirements for checking tasks realistic in the context of operators and supervisors workloads?
60. On complex tasks is it clear at what point the supervisor should be asked to check work done?
ORGANISING - Communication
61. Is there a forum for accessing industry guidance and corporate expertise on managing human error during
hazardous operations?
62. What means is there of ensuring that operation procedures are primarily written to aid the operator rather than to
insulate management from operator errors?
63. What documentation is available on the training of operations personnel?
64. What documentation is available on operational staffing levels?
65. What documentation is available on the means of input of operations orientated improvements into the plant
design process?
66. What are the communication means used during shift and cycle handovers?
67. What communication means are used between operations personnel (management and operators) at all levels,
such as memos and job instructions?
68. What forms of feedback between organisational levels are formalised in operational policy?
69. What is the process of communication between the control room and operators on the plant?
70. What is the means by which operations personnel can make suggestions for modifications to control room
layout?
71. What is the system of communication with maintenance?
72. How effective are communications between operators in the control room(s) and those on the plant?
73. Are operating procedures always clear and unambiguous? If not, can you give examples of where there are
problems?
74. Are the means of communication on operational safety concerns to management effective, and how do
management respond?
75. Are operating procedures readily available and consistently used?
76. Are you required to carry out any hazardous tasks that are not covered by a procedure?
77. Is there an independent route for the communication of operational safety concerns other than through line
management? If so, how useful is it?
78. What documentation is available covering policy on training, selection and promotion, and staffing level
requirements?
79. Is there a forum which the company uses to access industry practices such as hazard review techniques?
80. How are the results and actions from safety/hazard studies communicated and who is responsible?
81. Is documentation available describing the procedures for assessing operational hazards and developing
appropriate procedures of operation?
82. What is the system for ensuring that account has been taken of safety studies in the development of operating
procedures?
83. What is the method for ensuring that the results and actions of formal studies such as HAZOP or other safety
studies/reviews, are built into operating practices and made known to operating personnel?
84. What evidence is there that safety studies are used in the development of operating procedures in the way
specified by company policy and procedures?
85. What are the means by which persons could report the evolution of unsafe procedures of operation arising from
production, economic or schedule pressures?
86. How can concerns regarding safety of established or proposed operating procedures be communicated to
management?
87. What is the system for supplying information, such as material hazard data sheets and process and
instrumentation diagrams, checklists etc, for the performance of an operations hazard study?
88. What is the forum for ensuring that changes in regulations or industry standards are taken account of in the
formulation of site policy as regards the supervision and checking of operational tasks?
89. Describe the systems for the communication of information regarding the status of the plant.
ORGANISING - Competence
90. Who is responsible for ensuring that operators are sufficiently trained and that suitable selection and promotion
criteria are applied?
91. What documentation is available on operator competency requirements?
92. How does this site compare with others in the company and/or industry in terms of its production and safety
performance?
93. What is the typical response to accidents and incidents in terms of improving training and procedures?
94. How committed are management to safety? Do they share your level of commitment?
95. Are the criteria for the selection and promotion of operators the same as they have always been? If not, what has
changed and why?
96. When starting your present job what training did you receive? Have you received any further training since?
97. Have you been required to increase the range of work that you do? If so, what new work do you do and have you
received training?
98. What is the level of access to trained and experienced operators and supervisors?
99. What is the system for assessing the competency of employees?
100. Outline the programme of technical skills training for operators.
101. Are there always sufficient experienced operators available to cope with abnormal and emergency
events?
102. How was your competence assessed before you were given your current job?
103. How are you introduced to new operating procedures?
104. Do you feel you are familiar with all equipment, piping and vessel interfaces such as gauges, valves and
displays that you are required to work with?
105. Have you experience of other plants? If so, how do they compare with your present plant in terms of
ease of operation and support available to you to make your job easier?
106. Outline the company's experience of the hazards associated with the operation of this type of plant or
process.
107. How does the training of operators incorporate the assessment of hazards?
108. How is the competence of operators for the tasks they are required to perform assessed?
109. Is training provided to those responsible, both project engineers and operations supervisors, for writing
procedures and developing operational rules etc, on techniques and scope of operations hazard studies?
110. Are those responsible for reviewing process and operational hazards familiar with the plant and its
hazards?
111. Does the content of operator training cover process hazard identification?
112. Have incidents occurred when operation hazard/safety studies have not identified certain hazards due to
lack of understanding of the process?
113. What are the criteria for selection and promotion of supervisory staff and those responsible for task
checking?
114. To what extent is task checking included in the training of supervisors and operators with particular
emphasis on means for identifying an unsuccessfully performed task?
PLANNING and IMPLEMENTING
115. How are operational tasks assessed and the results of such assessments used to alter the way the task
is carried out?
116. How comprehensive, clear and unambiguous are operating procedures?
117. Were operability aspects of the control room(s) systematically assessed at the design stage or prior to
any layout modification?
118. What features of the control room environment or work scheduling are designed to maximise the
likelihood that operators will remain alert at all times?
119. What are the main difficulties that arise in doing your job?
120. Is it easy to identify all items of plant and their status? Can you give any examples of where there have
been problems?
121. Does your job involve long periods of work wearing heavy personal protective equipment (PPE)? Does
this affect the ease with which you can do your job?
122. Do control room displays represent all critical plant information such as status of valves? To what extent
must the operator make a judgement of plant status from process parameters?
123. Are control room alarms clearly prioritised? Is there a permanently displayed alarm summary?
124. What industry guidance, regulations, codes of practice and corporate standards are relevant to the
development of criteria for the management of human error in operations?
125. How are external standards and regulations and corporate codes of practice relevant to the
management of operator error integrated into local standards and codes of practice?
126. What is the means of ensuring that operating procedures are consistent with standards on the
management of operator error?
127. To whom are operations standards/rules distributed?
128. What operations standards and codes of practice are you required to work to?
129. Are the standards and rules you are required to work to always realistic in relation to the demands of the
tasks you are required to carry out?
130. Do you think those that set the standards and rules you are required to work to reflect a full
understanding of the demands of your job?
131. Do you feel that the available operational standards and rules give sufficient guidance on the hazardous
tasks you are required to carry out?
132. Describe the system for planning the provision of personnel for operations.
133. What resources are allocated for developing and reviewing written information for operations?
134. How is cover provided for personnel shortages?
135. What resources are available for assessing the quality of operator- hardware interfaces and making
suggestions for improvement to engineering management?
136. How are staffing shortages overcome?
137. What is the scope and depth of safety/hazard reviews for modifications during the operation of the
plant?
138. What are the requirements for carrying out safety/hazard studies of operating methods, reactions,
sampling procedures, inerting systems, purging procedures, equipment testing procedures etc?
139. Are changes to operating methods only permitted after a hazard study has been undertaken?
140. What are the methods for developing suitable procedures in various areas?
141. What are the major hazards commonly assessed during safety/hazard reviews?
142. Are there specific procedures for start-up and shut-down and have they had hazard reviews?
143. Are operating procedures used as specified/written?
144. What regulations, industrial guidelines, codes of practices or corporate standards have been used in the
development of an operations hazard assessment policy?
145. Are company rules/criteria available which are implemented within safe operating procedures and
practices?
146. What standards/rules are available to enable development of operating practices/procedures?
147. What tools are available to operators for assessing hazards in the operating environment?
148. What is the process by which resources (time, budget and personnel) are allocated to the performance
of safety reviews and the development of safe operating procedures?
149. What is the process for deciding the staffing level for operators?
150. What aides are provided to support the conduct of operational hazard reviews and development of safe
operating procedures, such as hazard checklists, HAZOP software, procedure writing manuals, MSDSs etc?
151. How can changes be made to the resources available for reviewing operational hazards and developing
safe procedures if there were problems with competence or workload?
152. Is the staffing level in the plant sufficient to cover the requirements of procedures?
153. Do operating procedures specify the need for critical operational tasks to be checked by a competent
authority?
154. Are there specific checklists to be followed prior to start up?
155. What industry standards, regulations and corporate standards are used for setting the criteria for the
supervision of operations and the checking of critical tasks?
156. Is there a clear specification of the site standards regarding the checking of complete tasks?
157. How is the criticality of tasks assessed with a view to specifying which tasks require checking?
158. Describe the system for assessing the comprehensiveness of operational procedures in terms of their
task checking and supervision components.
159. How is it ensured that staffing levels are sufficient to cope safely with abnormal and emergency
operational events?
160. What is the status of checking requirements, i.e, mandatory or guidance only?
161. Is there a means of assessing whether the levels of supervision and checking of critical tasks are
adequate?
162. Have there been changes in staffing levels that have made the carrying out of task checking and
supervision requirements difficult?
163. Is the level of access to personnel and technical resources sufficient to ensure adequate supervision of
operations?
164. What level of detail is specified in procedures referring to critical task checking?
MEASURING PERFORMANCE
165. What guidance is given on the analysis of incidents and near misses from a human error perspective?
166. What records such as shift logs or process status record sheets are produced as part of the
communication process?
167. How are the root causes of operational incidents and accidents determined?
168. What is the system for monitoring progress in implementing changes to operating procedures?
169. How are internal standards and codes relevant to the management of operator error audited and
assessed?
170. How does the company head office monitor production and safety performance and the relationship
between the two?
171. Are there periodic assessments of the adequacy of methods for developing and reviewing procedures?
172. What checks are carried out to ensure that operating procedures are in accordance with company
policy?
173. How are historical records and operator feedback analysed to review and monitor and pursuance of
unsafe operating practices?
174. Is there analysis of incidents which have resulted in subsequent changes to either operating procedures
or the requirement for safety reviews?
175. What methods are used, such as routine plant audits, to check whether unsafe procedural modifications
and short cuts are made or have evolved over time?
176. Are checks carried out on operational hazard reviews in order to verify that such studies are correct and
are being carried out by competent persons?
177. How can management be assured that checks are carried out where specified?
178. Describe the system for reporting near misses.
179. What indications are there on equipment to show current state?
180. Are there ever plant identification problems that make it difficult to check work done?
REVIEWING PERFORMANCE
181. How are the policies on analysing incidents and near misses for operational errors revised in the light of
industry guidance changes or practical experience?
182. How are the policies on maintaining unambiguous operating procedures revised in the light of industry
guidance changes or practical experience?
183. How are the policies on the training of operations personnel revised in the light of industry guidance
changes or practical experience?
184. How are the policies on ensuring good operator-hardware interfaces revised in the light of industry
guidance changes or practical experience?
185. What is the process of reviewing operating procedures and how are changes to procedures
communicated to all concerned?
186. How are production communication processes reviewed?
187. Is there a clear means by which you can make suggestions for changes in the way you are required to
carry out tasks or for modifications that might make your job easier?
188. What are the means for operations personnel to express opinions on standards/rules and their
application?
189. What feedback is used to assess the success of controls on pressures?
190. Is there a backlog of required modifications to operating procedures?
191. What is the typical response from management when safety problems are reported?
192. Are the written operating procedures regularly reviewed and updated, and how are you informed of
changes?
193. What is the process by which the method for developing operating procedures would be revised in the
light of experience or regulatory/policy change?
194. What is the process of revising company policy in the light of changes in industrial practice, corporate
policy or required changes due to experience?
195. Have changes been made in the operating procedures in the light of experience?
196. Are procedures reviewed on a regular basis?
197. Is there a method for reviewing the policy on operating safety in the light of practical experience?
198. Are operators involved in reviewing incidents or making recommendations for improvement?
199. Are operators involved in review of operations procedures?
200. Which personnel are available and/or required to carry out independent (independent from the relevant
project team or operations department) checks on the technical safety of operating procedures and the
adherence to safe operating practices on plant?
201. Is there a formal and mandatory system, such as requiring approval from a safety officer, for assessing
procedural revisions for their impact on safety prior to their implementation?
202. What is the process by which unsafe operating procedures, either proposed or actual, may be revised?
203. Are safety reviews carried out where specified?
204. What are the criteria, formal or otherwise, for determining who may carry out reviews and checks on the
safety of operations, such as chemical process background or operational experience?
205. Outline how the system of supervision of plant and personnel is revised in the light of experience and/or
policy change.
206. What is the process of changing procedures for supervision and task checking of operations to take
account of operational errors and how are any changes communicated?
207. What is the method of revising site standards in the light of external events such as new legislation and
codes of practice?
208. Outline the method for reviewing the effectiveness of training for task checking and assessing the need
for further training.
RCS 4 - PLANNED MAINTENANCE PROCEDURES
Introduction Planning and Implementing
Policy Measuring Performance
Organising - Control Auditing
Organising - Co-operation Reviewing Performance
Organising - Communication Example Questions For Interviews
Organising - Competence
INTRODUCTION
This RCS concerns the procedures required to define maintenance work including the (task) analysis of the maintenance
process. It is expected that there will be documentation to describe the maintenance procedures. Consideration should
be given to ergonomic principles in maintenance work and to the potential for human error. Maintenance planning should
cover what equipment is to be maintained and when to carry out the maintenance. The supervision and checking of
routine maintenance tasks should be considered.
POLICY
Key Issue:
Senior management should lay down a clear policy and objectives for planned maintenance procedures to ensure that
loss of containment of hazardous substances does not occur and that the health and safety of the workforce and
members of the public are safeguarded.
Key Characteristics:
The overall objective is to maintain the plant using experienced and competent staff provided with clear and
useful maintenance procedures. Maintenance should be properly planned and resourced to fit in with production.
ORGANISING - Control
Key Issue:
Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:
o Overall management of maintenance on the site.
o Assessment of maintenance performance compared to standards.
o The writing of maintenance procedures.
o The provision of maintenance job aids.
o Supervision of maintenance work.
o The control of maintenance contractors.
o The control of spares used in maintenance.
o Maintenance fault trend monitoring.
o Resourcing of maintenance work.
Key Characteristics:
The system for planned maintenance should include:
o The allocation of adequate financial and human resources for maintenance;
o Documented support for maintenance work for example, up to date P&IDs, maintenance schedules,
records and up to date procedures;
o Documented maintenance procedures;
o Personal responsibilities being defined, e.g. in job descriptions which specify: position in organisation
structure reporting links, responsibilities and duties;
o The allocation of work between permanent staff and contractors;
o The definition of maintenance standards;
o The control of spares by a quality system;
o Record keeping and fault trend monitoring;
o The definition of the checks made during and after maintenance. Examples might include:
combustible or toxic gas checks carried out periodically or at particular junctures in the work;
ensuring that the work has been carried out correctly and the integrity of the plant after
completion is satisfactory. e.g. who checks that the correct couplings, pipe materials, pressure
tests, welding technique etc, have been used?
who checks that the flanges are correctly tightened?
ORGANISING - Co-operation
Key Issue:
Plant is made available for maintenance work in a planned way and work is carried out safely. Plant is returned to
operation in a sound condition. Individuals involved with the planned maintenance process should cooperate to ensure
successful maintenance of the plant, balancing safety, production and time pressures.
Key Characteristics:
The system for planned maintenance should encourage cooperation:
Those involved with maintenance should ensure priorities are balanced between the requirements to carry out
maintenance and production pressures. For example, is the conduct of safety checks before, during and after
maintenance work mandatory or optional and thereby at the discretion of, for example, the issuer of the permit-
to-work?
Maintenance procedures should be practical in the context of other demands on personnel time and pressures to
minimise down time and ensure co-operation between different needs.
Resources for maintenance should be adequate, so that all needs within the system are met. For example, how
is the maintenance budget related to and affected by:
o financial performance of company;
o maintenance priorities;
o production requirements;
o major personnel reductions or increases;
o quantity of overtime worked;
o amount of maintenance work contracted.
Ownership of maintenance activities by front line maintenance staff, including contractors, is important.
Involvement of staff in safety committees and other health & safety related issues.
ORGANISING - Communication
Key Issue:
Formal and thorough communication between all of the parties involved in the planned maintenance process.
Written instructions are adequate to ensure information about new activities, changes in legislation or workplace
standards from reviews and audits are communicated to the people who need to know.
Key Characteristics:
The system for planned maintenance should ensure:
o A forum exists for accessing industry guidance and corporate expertise on maintenance procedures for
the plant.
o Documentation on maintenance procedures exists which is clear, up to date and covers
application of condition monitoring;
preventative maintenance;
criteria for overhaul;
criticality assessment;
special requirements for critical equipment;
tasks for which procedures should be developed;
plant engineering requirements for ease of maintenance.
o Maintenance standards should cover:
standards set for the provision of information on the status of equipment, such as pressure
gauges on pipe runs;
standards set for the labelling of equipment to be maintained, including labelling of valves and
pipes;
sampling methods employed in checking inspection, testing and maintenance (e.g. for
inspection of welding);
minimum time intervals between tests for hazardous environment during the course of
maintenance;
minimum checks on the integrity of plant needed before plant can be restarted.
o learning from previous experience, incidents and equipment history.
o Communication to Senior Management about needs for changes to maintenance procedures.
o Verbal (face to face) discussion and communication is important e.g. between operations and
maintenance.
ORGANISING - Competence
Key Issue:
Individuals involved in planned maintenance are competent to achieve the objectives. Competencies in terms of
knowledge, skills and experience are clearly defined and reviewed. Selection criteria for staff and any contractors are
clearly laid down.
Key Characteristics:
The system for planned maintenance should ensure:
o optimal use of company experience in defining and optimising routine maintenance frequencies and
techniques for the plant;
o well defined competencies of staff and contractors;
o training programmes to ensure personnel are familiar with the plant hazards, maintenance procedures
and supervision requirements;
o well written, clear and up to date maintenance procedures exist including details of the checks carried
out during and after maintenance;
o the control of contractors, e.g. using accredited contractors whose employees are familiar with the
methods and hazards at the plant.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Up to date, clear, relevant and realistic procedures, should be available for maintenance tasks.
Aides and equipment for maintenance.
Frequency and scheduling of maintenance including shutdown.
Criticality of plant items should be considered so that work is done and not postponed due to time or production
pressures.
Key Characteristics:
Maintenance procedures should be available which are clear, easy to follow and used for all work. These may
include:
o procedures for removing bonnets/gauges from valves;
o procedures for isolating components, purging lines and vessels;
o welding procedures in areas with flammable materials;
o which materials should be used in flushing lines.
Maintenance procedures should:
o incorporate guidance on hazards;
o incorporate existing regulations, industry guidelines, certificators requirements, codes of practice,
corporate standards and manufacturers requirements;
o consider the ergonomics of maintenance tasks;
o provide labelling and easy identification of equipment;
o provide for task checking during and after maintenance. Checks may include:
gas tests;
weld inspections;
isolation checks;
purging checks;
pressure tests;
checks on integrity of plant before authorisation back into operation.
o specify equipment requirements;
o consider special requirements for critical safety equipment e.g. ESDS, flares, PRVS and interlocks.
Maintenance work should be planned by the criticality of the plant items and scheduled to provide plant shut
downs which dovetail with production needs. A good system maximises up time and minimises intervention,
particularly unplanned maintenance. Frequency may originally be specified by suppliers and adapted to practical
experience in the plant. The system may include the following:
o reactive/breakdown maintenance only in response to maintenance requests from operations;
o referencing manufacturers guidelines;
o predictive, for example by measuring rate of corrosion/erosion in pipes and vessels;
o preventative, for example on electrical or instrumentation components which give little warning prior to
failure;
o raising periodic maintenance work orders for different types of equipment such as static versus rotating
equipment;
o scheduling of routine maintenance;
o maintaining a record system;
o devising and implementing methods of monitoring plant for corrosion etc.
Attention should be paid to systems that may not be normally used such as emergency systems. A component
may be inoperative, but the condition may go undetected until the component is required to operate.
Maintenance priorities during plant down times should be specified.
MEASURING PERFORMANCE
Key Issue:
The planned maintenance system should be monitored to measure its performance e.g. whether plant or equipment
failures occur at unacceptable intervals.
Key Characteristics:
The collection of incident and near miss data and analysis for possible maintenance failures e.g. using a root
cause analysis system.
Trend analysis for maintenance failures.
Determination of maintenance needs for all plant items.
Control of outstanding maintenance work based on criticality of plant items. Backlog should be measured.
Monitoring of checking of maintenance tasks for example, is information collated on the frequency of authorising
equipment back into operation which subsequently fails due to poor repair, perhaps as part of a quality control
system or site incident reporting system, or the frequency of weld failures after maintenance or actually while in
service.
Monitoring of unplanned stoppages.
A system for checking the adequacy of maintenance work, e.g. spot checks. Frequency/depth based on criticality
of plant items.
System for checking that correct materials/replacement parts have been used.
AUDITING
Key Issue:
The planned maintenance system should be periodically the subject of a formal audit. The auditors should not be part of
the system or have responsibility for it, i.e. be independent of the maintenance function being audited.
Key Characteristics:
The audit should check that performance measuring and review are occurring at the correct frequency, are
addressing the right issues, appropriate information flows occur at specified periods to senior management. It
would be reasonable to expect an annual review.
REVIEWING PERFORMANCE
Key Issue:
Information from "measuring" and "auditing" is used to make judgements about the performance of the operation of the
planned maintenance system and is used to make decisions about improving performance.
Key Characteristics:
Periodic reviews of the planned maintenance system including such issues as the performance and frequency of
condition monitoring, periodic overhaul of PRVs etc, for example:
o is there a policy of periodic internal auditing of plant maintenance;
o is the performance of the procedure for issuing correct replacement parts formally and periodically
reviewed;
o is the performance of inspection and test procedures formally and periodically reviewed.
Learning from experience about the effectiveness of the system.
Revision of procedures in the light of experiences, standards, codes, manufacturers requirements etc. For
example are procedures only reviewed after an incident or is there a constant review process, including the
collection of performance data, perhaps as part of a Quality Control system?
Revision of maintenance checking requirements in the light of experience.
Revision of technical support and aids to maintenance.
Consideration of the practicality of procedures.
EXAMPLE QUESTIONS FOR INTERVIEWS
OBJECTIVE
1. What is the policy on managing maintenance on the site and how is it developed?
2. What is the policy for assessment of maintenance performance?
3. What is the policy for providing job aids, for example, pipework layout diagrams to maintenance fitters?
4. Are there particular safety issues associated with the process used in the plant which influence the approach to
maintenance?
5. Describe the policy and approach to checking maintenance work.
6. Describe the process for incorporating corporate standards, regulations etc, on safety checks for maintenance
into site policy, site codes of practice and procedures.
7. What is the policy for selecting contractors with regard to their technical competence and quality of work and
safety performance?
8. What is the policy regarding resourcing of competent maintenance personnel?
9. What is the policy for maintenance planning, including shutdowns, minimisation of interruptions and balancing
safety with production pressures?
10. How is resourcing for maintenance managed?
ORGANISING - Control
11. What is the responsibility for managing maintenance on the site?
12. What is the responsibility for assessment of maintenance performance?
13. What is the responsibility for writing maintenance procedures?
14. What is the responsibility for the provision of job aides, for example, pipework layout diagrams to maintenance
fitters?
15. What documentation, such as job description on the site safety manual is available specifying the roles and
responsibilities of personnel involved in managing maintenance?
16. Describe maintenance supervisory responsibilities particularly in relation to contractors.
17. To what extent do the company's maintenance standards apply to contractors?
18. What are the allocation of responsibilities for setting and revising maintenance standards aimed at reducing the
likelihood of maintenance error?
19. Where outside contractors are used for maintenance, how is their activity controlled?
20. What are the allocation of responsibilities for developing, integrating and compiling maintenance standards?
21. What is the allocation of roles and responsibilities for checking that site maintenance standards abide by
company standards or codes of practice?
22. Are the spares and replacement parts controlled through a quality control process?
23. What is the allocation of roles and responsibilities for monitoring trends and faults detected in routine
maintenance?
24. What checks are used that maintenance work is completed satisfactorily and the plant has been returned to a
safe operating condition - who is responsible?
25. What checks might be carried out during maintenance and who is responsible?
26. What is the allocation of responsibility for ensuring that an adequate budget is available for maintenance?
27. Outline the allocation of responsibility for ensuring that competence/skill levels are maintained for both
employees and contractors.
28. Outline the allocation of responsibility for reviews and checking whether the designated resourcing for
maintenance is adequate.
29. Outline the allocation of responsibility for ensuring adequate information is displayed on equipment and the
necessary tools and information are available to allow easy monitoring of conditions.
ORGANISING - Cooperation
30. What is the impact of costs, schedules and other pressures on maintenance?
31. How are priorities balanced between the requirements to carry out maintenance to agreed procedures and
production pressures?
32. Outline the responsibilities for checking practicality and useability of maintenance procedures in the context of
other demands on personnel time and pressures to minimise downtime etc.
33. Is maintenance or checking of maintenance ever omitted due to unavailability of personnel, cuts in budget or
production schedules?
34. Are there sufficient maintenance personnel to cover for absentees?
ORGANISING - Communication
35. Is there a forum for accessing industry guidance and corporate expertise on managing human error during the
maintenance of hazardous plant?
36. What documentation is available for regarding the site's maintenance policy?
37. What is the means for ensuring previous maintenance history of equipment is available?
38. What is the process of reporting progress for maintenance to senior management?
39. What are the channels for communicating the need for changes to maintenance requirements?
40. What is the mechanism of reporting contravention of maintenance procedures to management?
41. What is the process of communicating changes to maintenance standards to maintenance personnel?
42. What documentation is available on the site on the company's standards for maintenance task checking?
43. What is the means of communication of standards on the supervision and checking requirements on
maintenance?
ORGANISING - Competence
44. What experience does the company have in defining and optimising routine maintenance requirements for this
type of plant?
45. What is the required level of competence for maintenance fitters and how is this assessed?
46. Where outside contractors are used for maintenance how is their competency assessed?
47. What training is given to contractors as regards the hazards in the plant?
48. Outline the company's experience of developing procedures for checking prior to and during maintenance and in
the hand-over phase following the completion of maintenance.
49. What changes have occurred in the manning levels of the maintenance department recently?
50. Has there been an increasing trend recently to move more towards maintenance following breakdown?
51. What is the means of assessing and meeting maintenance training and supervision needs? Is there an adequate
level of expertise for maintenance within the site?
52. What proportion of maintenance is carried out by contractors?
53. Outline the system of training for maintenance staff, including the training of existing staff on new or unfamiliar
parts of plant.
54. What emphasis is placed on the technical training of maintenance staff in comparison with general safety
training?
55. What are the certification, competence and training requirements for employees and contractors?
56. What is the process of assessing competence of staff who check maintenance work and those responsible for
developing safe maintenance procedures?
57. What is the means determining the competence of maintenance supervisors prior to appointment to ensure that
they have an adequate understanding of plant hazards, safety equipment, pressure gauges, isolation equipment
and safety procedures?
PLANNING AND IMPLEMENTING
58. Describe the procedures available for maintenance tasks.
59. What means is there to ensure that items of plant are clearly labelled to allow easy and accurate identification by
maintenance fitters?
60. If PPE is required for maintenance tasks is this well enough resigned to allow the fitter to work in it without
excessive restriction?
61. Are maintenance procedures clear and easy to follow and used for all work?
62. Do maintenance procedures give guidance on hazards and issues such as spade locations?
63. What are the existing regulations, industry guidelines, codes of practice and corporate standards relevant to the
management of maintenance errors?
64. Are the standards and rules for maintenance procedures realistic in relation to the demands of the work?
65. What access does the company have to the latest industry guidelines on techniques and methods for
maintenance?
66. How is the criticality of equipment determined?
67. What is the means used for assessing frequency requirements of maintenance?
68. How are external standards and guidelines on maintenance integrated into internal standards?
69. What documentation is available on maintenance codes of practice, standards and requirements?
70. What documentation is available regarding the roles and responsibilities of persons involved in checking
maintenance work?
71. Are there procedures available for carrying out checks before, during and after maintenance work?
72. What is the procedure for scheduling plant shutdowns and duration of shutdowns?
73. What procedural guidance is available for calibrating and validating test equipment?
74. How are maintenance requirements prioritised within a shutdown period?
MEASURING PERFORMANCE
75. Who is responsible for collecting incident and near miss data and analysing it for possible maintenance
failures?
76. How are the causes of maintenance failure assessed?
77. How are trends in maintenance incidents measured and communicated?
78. How are maintenance requirements and results for each item of plant recorded?
79. How is the criticality of outstanding maintenance work controlled, prioritised and reviewed?
80. How is effectiveness of the planned maintenance programme measured?
81. How is the success of maintenance task checking assessed?
82. What are the responsibilities for monitoring the implementation of site maintenance requirements?
AUDITING
83. What is the level of availability of independent personnel to monitor the conduct of maintenance including task
checking and pressures to cut time and cost?
RCS 5 - MANAGEMENT OF PLANT AND PROCESS CHANGE
o Introduction Organising - Communication
o Policy
Organising - Competence
o Organising - Control
Measuring performance
o Organising - Co-operation
Audit and review
INTRODUCTION
Plant, process and organisational change, and how organisational change is integrated into operations management, are
often an underlying cause of failure. In particular, many of the catastrophic events that have occurred on Major Hazard
sites/installations are attributable to such changes. All levels of change - small or large - are capable of affecting the
safety of the site/installation.
This guidance is aimed primarily at plant and process change.
For organisational change, guidance on implementation can be found by clicking on the linked guidance at the start of
the Organising section. This linked guidance broadly follows the HS(G)65 POPMAR framework. Inspectors need to be
aware that organisational and plant change can, and do, overlap.
Assessment by Inspectors should ensure that an effective management system is in place for the identification, control,
implementation, monitoring, audit and review of change within the organisation. This will include planning the change,
hazard identification, and risk assessment, commissioning and, where relevant, safety report/case review. Inspectors
should expect to see changes contribute to a policy of continuous improvement in terms of health and safety. Each stage
should embody the principles of risk assessments and measures taken to reduce risks to as low as is reasonably
practicable (ALARP).
This guidance should be used in conjunction with the RCS General Introduction and the RCS Generic Guidance that is
designed to cover issues common to all risk control system inspections. Inspectors should also refer to the RCS
guidance on Hazard Identification and Risk Assessment (HIRA).
Legal Basis
Examples of Change
An example assessment procedure
Guidance available
Codes of Practice relating to plant modification - from Tech SRAG
Major accident case studies illustrating the importance of plant modification/change procedures - from Tech
SRAG
RCS 5 - MANAGEMENT OF PLANT AND PROCESS CHANGE - LINKS PAGE
Legal basis Guidance available
Offshore legal basis Codes of practice relating to plant modification
Examples of change Further reading materiall
An example assessment procedure would include: Case studies illustrating the importance of plant
Decommissioning procedures modification / change procedures
LEGAL BASIS
COMAH REGULATIONS 1999
Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their
consequences to persons and the environment.
Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident
prevention policy and a safety management system for implementing it have been put into effect in accordance with the
information set out in Schedule 2.
COMAH safety reports, as part of their minimum information, are required to include information on the operators'
management system and on the organisation of the establishment with a view to major accident prevention. (see
COMAH Schedule 4 Part 2, paragraph 393, L111).
Regulation 5(3) requires the operators' MAPP to include sufficient particulars to demonstrate that the operator has
established a SMS. The SMS should take account of the principles specified in paragraphs 3&4 of Schedule 2. Schedule
2 requires the adoption and implementation of procedures for planning modifications to, or the design of new
installations, processes or storage facilities. Although Schedule 2 isn't explicit on organisational change, the guidance to
Schedule 2 is (see paragraph 368, L111).
Also see HS (G) 190 Preparing Safety Reports, pages 45-6, for further guidance.
Safety Reports must be reviewed and if necessary revised whenever changes are made to the organisation that could
significantly impact on the control of major accidents (COMAH Reg 8(c)).
THE HEALTH AND SAFETY AT WORK ETC ACT 1974
Sections 2(1), 2(2)(a) and 3(1). Section 2(1) requires the employer to ensure, so far as is reasonably practicable, the
health, safety and welfare at work of all his employees. Section 2(2)(a) requires the provision and maintenance of plant
and safe systems of work that are,. safe and without risks to health. Section 3(1) requires employers to ensure,. that
persons not in his employment. are not. exposed to risks to their health and safety.
THE MANAGEMENT OF HEALTH AND SAFETY AT WORK REGULATIONS 1999
Regulations 3, 4 and 5. These require employers and self-employed people to assess the risks to workers and any
others who may be affected by their work or business, to implement preventive and protective measures and make sure
that appropriate arrangements are in place to cover health and safety.
OFFSHORE LEGAL BASIS
SAFETY CASE REGULATIONS 1992
Regulation 9(1) requires the revision of the contents of the SC as often as may be appropriate. Regulation 9(2)(a)&(b)
requires the operator to send a revised SC to HSE where revision will render the SC materially different. This will include
any amendments to the key operating parameters relating to the installation (e.g. designed capacity, operating
pressures, composition changes etc). A description of the SMS for control and implementation of the changes from
conceptual design to commissioning should also be given. This will include details of the hazard identification reviews
and risk assessments carried out to ensure that the changes are safe and that the existing facilities are not
compromised. Regulation 9(4) (regular resubmission of a SC) requires a description of how smaller changes are
monitored for their effect on the validity of the current SC and the mechanisms and criteria whereby 'material change' is
determined. Regulation 15C&D requires the operator to review and, where necessary revise the verification scheme, and
to ensure the continuing effect of the verification scheme.
OFFSHORE INSTALLATIONS (PREVENTION OF FIRE ETC) REGULATIONS 1995
Regulations 5(1) and 19(1), (2), and (3). Regulation 5(1) requires an assessment to be performed and repeated as often
as may be appropriate. Regulation 19(2)&(3) requires the operation of a suitable written scheme of examination.
EXAMPLES OF CHANGE
Change can be addition, replacement, removal or modification, covering:
a. Plant and equipment, changes in:
Design;
Equipment;
Software;
Layout/location;
Instrumentation;
Set points of critical alarms/relief systems or trip settings;
Materials;
Specifications; and
Status (for example bringing "mothballed" plant and equipment back into use).
b. Process, changes in:
Raw materials:
Suppliers;
Mode of raw material delivery;
Process steps;
Process parameters (for example temperature, pressure, flow, etc);
Scale;
Waste disposal and disposal agent; and
Packaging/format of final product.
c. Procedures, changes in:
Operational procedural steps;
Computer controlled software;
Maintenance procedures; and
Style (for example from step-by-step flow diagrams)
d. Organisational, changes:
People coming within "operating envelope";
Staffing levels and "delayering";
People within the management of change system;
People's responsibilities;
People's span of responsibility;
Competence;
Methods of work e.g.teamwork/multi-skilling;
Contracting out; and
Work shift patterns.
e. External circumstances which are capable of affecting the control of major accident hazards,
where appropriate.
FOR EXAMPLE: AN ASSESSMENT PROCEDURE WOULD INCLUDE:
A safety, engineering and technical review should be undertaken prior to change. This review should be
traceable and identify changes proposed to the following factors: Process conditions; Operating methods;
Engineering methods; Human Factors (tasks and personnel); Safety; Environmental conditions; Engineering
hardware and design. All parts of the plant should be considered, as change may affect parts that are quite
remote from the source of change. All human factors changes should be considered, as they could have an
impact on MH prevention, even if a small change.
Consideration of the depth of risk assessment required by reference to a written procedure. (e.g. whether the
change requires a team or individual assessment and whether more detailed assessment such as Scenario
Assessment or HAZOP is appropriate.) The procedure should take account of: the degree of hazard and extent
of the change, including a full, realistic account of the range of human reliability; the worst case accident likely to
arise as a result of the modification; previous risk assessments relating to the item/issue; the appointment of a
competent person (excluding the HAZOP chairman) to decide the requirements for HAZOPs or other studies;
and facilitation of the assessment process by well trained persons independent of the facility being assessed. If
hazards cannot be eliminated by actions placed during the HAZOP, hazard analysis should be employed to
determine the likelihood of an incident occurring and if the risk is acceptable.
Consideration of evidence from previous incidents - their cause and means of preventing them to minimise risks.
Consideration of available options in the design of safety measures (preventative and protective) where
necessary.
Identification and mapping of all changes to both tasks and personnel that could have an impact on MH
prevention, no matter how small the change.
Consideration of assessments of the organisations handling of a range of crisis scenarios post-change, including
upsets, escalating incidents and emergencies.
Identification and recording of conclusions and control requirements.
Resultant actions prioritised
a. the change is authorised subject to particular requirements;
b. the results of any review and authorisation requirements are actioned;
c. the change is implemented;
d. a check is made to ensure the change has been completed according to the review and authorisation
requirements, examined and tested, and that plant is safe to bring into operation;
e. other actions required as a result of the change, for example, amendments to records and piping and
instrumentation diagrams, maintenance procedures, standard operating procedures,
training/competence issues etc, are carried out.
Plans record change by implementation steps and dates and responsibilities for actions. In the case of major
changes this may be best done through formal project management techniques.
Procedures cover temporary changes and criteria for implementing changes in exceptional circumstances where
"normal" management of change procedure is not possible.
Adequate and comprehensive performance standards are in place to enable the management of change process
to be effectively measured and reviewed, well beyond the end of transition.
DECOMMISSIONING PROCEDURES
General measures that should be adopted for a common approach to decommissioning include:
Establish communication with plant personnel to ensure surrounding plant areas are prepared for
decommissioning activity;
Undertake removal of hazardous substance via a cleaning procedure to ensure plant item is clean and empty
with particular consideration where there may be dead-legs where material may be trapped;
Consideration of the disposal of items which may be contaminated by absorption of hazardous substances and
chemical change;
Mechanically isolate plant item from other surrounding plant items by physical disconnection or fitting of blanks;
Electrically isolate plant item from power sources by physical disconnection.
GUIDANCE AVAILABLE
Chemical information Sheet No CH IS7 provides guidance on how to manage the impact of organisational change on the
control of major accident hazards. PM/ENF/10 Human Factors Inspectors Toolkit includes useful question sets on
organisational change and transition management, and maintenance error. It also contains an extremely useful guidance
list, sorted by topic.
There is no guidance available that specifically covers plant modification. Most companies usually adopt internally
generated plant modification procedures that have been developed through:
Corporate history and experience;
Good industry practice;
Input from Safety, health and Environment department;
Input from Operations dept;
Input from Technical dept;
Input from Engineering dept.
Related Technical Measures Documents include Plant Layout, Design Codes - Plant, Design Codes - Pipework and
Maintenance Procedures.
The relevant Level 2 Criteria are: 5.2.1.4 (34) c, 5.2.1.6 (38) h, i, 5.2.2.1 and 5.2.5.1.
CODES OF PRACTICE RELATING TO PLANT MODIFICATION
CISHEC/8906/1000, CIA, Guide to Hazard and Operability Studies.
Kletz T.A., 'HAZOP and HAZAN: Identifying and Assessing Process Industry Hazards', 3rd Edition, IChemE,
1992.
HS(G)176 The storage of flammable liquids in tanks, HSE, 1998.
Paragraph 23 to 27 give guidance on the requirements for HAZOP and Risk Assessment. Paragraph 26 requires
that risk assessments are carried out for modifications and demolishing.
Paragraphs 158 to 161 give guidance on testing and commissioning.
Paragraphs 201 to 205 give guidance on decommissioning.
HS(G)28 Safety advice for bulk chlorine installations, HSE, 1999.
Paragraph 210 requires that modifications are only carried out after conducting a risk assessment (possibly
HAZOP) and discussions with the chlorine supplier.
HS(G)30 Storage of anhydrous ammonia under pressure in the UK : spherical and cylindrical vessels, HSE,
1986.
Paragraphs 98 to 117 give guidance on commissioning and decommissioning.
Paragraph 121 requires that a competent person authorise returning the plant to service after modification.
LPGA Code of Practice 1, Bulk LPG Storage at Fixed Installations ( Part 1, Part 2, Part 3 and Part 4), LP Gas
Association.
Supersedes HS(G)34, The Storage of LPG at Fixed Installations. 1987, HSE.
Part 3, Section 2.6 requires that modification or repairs for whatever purpose, including change of duty shall
comply with the design codes in Parts 1 and 2.
HS(G)34 Storage of LPG at fixed installations, HSE, 1987.
Superseded by the above.
Paragraphs 172 to 191 give guidance on commissioning, decommissioning and maintenance, including that a
competent person should certify modifications.
FURTHER READING MATERIAL
ILO, Major hazard control: A practical manual, 1988.
Section 3.3.5 provides guidance on procedures for carrying out repair work (e.g. welding of components
containing flammable substances).
European Federation of Chemical Engineering, EFCE Publication Series No. 59, Hazards from Pressure:
Exothermic Reactions, Unstable Substances, Pressure Relief and Atmospheric Discharge, The Institution of
Chemical Engineers, 1987.
Knowlton, R.E., An Introduction to Hazard and Operability Studies, Chemetics International, Vancouver, 1981.
Coulson, J .M., & Richardson J .F., Chemical Engineering Volume 6, Pergamon Press, Third Edition, 1983.
Lees, F.P., Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control, 1996,
Second Edition.
CASE STUDIES ILLUSTRATING THE IMPORTANCE OF PLANT MODIFICATION / CHANGE PROCEDURES
Allied Colloids Limited (21/7/1992)
Bhopal - Union Carbide (3/12/1984)
BP Oil (Grangemouth) Refinery Ltd (22/3/1987)
Dow Chemical Factory Explosion (27/6/1976)
Flixborough (Nypro UK) Explosion (1/6/1974)
Texaco Refinery - Milford Haven - Explosion and Fires (24/7/1994)
POPMAR
ELEMENT
KEY FEATURE INSPECTION GUIDELINES
POLICY Is there a clear policy
for the management of
change (plant and
organisational)?
Does the policy commit
to proportionate
consideration of all
organisational
changes, large and
small?
Policy should cover:
Purpose/objectives, scope of where and what the system applies to,
and consequences of not having a system. Recognition that change
has been associated with major accidents. Commitment to analyse
and control organisational change as thoroughly as plant change.
Consideration of all changes, whether permanent or temporary. Those
not at first connected to safety need to be scrutinised to confirm
whether or not they may have indirect impacts on safety. E.g. impact
to facilities beyond the installation offshore should be identified where
applicable. Definition of terms, e.g. what is meant by temporary
change, emergency change, modification? Examples of change, and
typical change control problems.
Verification of Documentation:
Management of change policy
ORGANISING CONTROL
Are you inspecting
organisational
change?
Is there an adequate
management structure
to manage the change
effectively?
For organisational change, follow the guidelines in PM/Enf 11 Human
Factors - Inspector Toolkit ,and CHIS 7 for guidance on risk
assessment for organisational change. See SPC/Enf/70 for practical
operational information to help make a judgement on the adequacy
and robustness of Duty holders' change management arrangements
with respect to organisational changes.
Further useful publications : Improving Maintenance. A guide to
reducing human error. ISBN 0-7176-1818-8. Reducing error and
influencing behaviour HS(G)48.
Is there clear
leadership from senior
management?
Are responsibilities
clearly allocated and
accepted?
Are people held
accountable for
managing the system?
There should be visible, clear leadership from senior management.
Thorough, consistent and well documented procedures should identify
who is responsible for the following key tasks:
o Overall responsibility for the management of change system;
o Defining any plant changes;
o Designing plant;
o Reviewing the original design intent, effects on plant integrity,
process operating parameters, safety and control systems;
o Document management;
o Initiating change;
o Hazard and risk analysis requirements;
o Authorising change (including levels of authorisation
relative to the potential hazards associated with the
change);
o Implementing change (including the provision of relevant
competencies appropriate to the task and examination/test of
plant / equipment modifications before commissioning to
ensure that work is complete and in accordance with the
design intent);
o Monitoring, reviewing and auditing. (Limits of authority for
individuals/posts within the management of change system
should be defined).
Are there clear Change should be subject to documented and structured management
procedures for of change procedures. What is meant by change should be clearly
initiating, assessing, stated, so that it is obvious when management of change procedures
authorising and should be followed. Procedures should demonstrate how details of
implementing change? proposed modifications are developed, checked and distribution
controlled. For example, is there a drawing change note system for
notifying change? Even replacement of equipment with non-identical
parts should trigger a review to see if improved technology is available
to ensure ALARP. Procedures should cover each element of
management of change. Decommissioning Procedures should be
subject to hazard review and risk assessment in the same way as for
commissioning. The minimum requirements for approving a
modification should be clearly indicated.
Temporary changes e.g. use of an override or inhibit on a safety
related system, will normally be put into effect through a separate
procedure for control of overrides/inhibits. The use of overrides/inhibits
needs to be kept under review, and any changes e.g. to modify or
design out a trip function, should be handled through the change
control procedure.
Consistent procedures and recording systems should be applied
across departments e.g. Maintenance and Engineering Design. The
process between the initial raising of a change to its final
implementation should be capable of being followed from beginning to
end through proper referencing.
Are potential problem Procedure should draw reference to evidence from previous incidents
areas specific to the - their cause and means of preventing them. They should identify the
plant identified and required steps to ensure that all potential hazards arising as a result of
considered on a risk- the modification are properly identified, with associated risks
based principle? minimised and recorded, before implementation of the change. E.g. is
the design basis of the modification compatible with existing plant? If
not, interfaces need to be managed to avoid operational difficulties
after commissioning. If relevant, Inspectors can question why
modifications are being undertaken on live plant. The procedure
should also list the options that are available in the design of safety
measures, preventive measures (process control, instrumentation etc),
and protective measures (containment, reactor venting, quenching,
reaction inhibition).
It is good practice to maintain a register of individuals and their tasks,
roles and responsibilities related to the major hazard.
The opportunity for initiating changes should be widely available to
people associated with process systems.
A clear description of the scope of the proposed change, the date of
the proposal, and the need for change, including health and safety and
welfare issues, should be recorded on a purpose-designed document.
The team/individuals responsible for hazard reviews/assessments and
authorisation of change should have the appropriate level of
authority/competence.
The constitution and role of the hazard review/assessment team
should be defined. It should involve personnel with the background
and experience to ensure that changes will not result in operations
outside established safe limits. With offshore there is a need to involve
onshore support for the more significant changes. It should always
include technical assessment personnel, a safety advisor (for legal
compliance overview) and safety rep/process operators. Process and
maintenance operatives should be involved at an early stage in the
modification process to ensure their practical contribution to the
commissioning phase. This also provides them with experience and
training, and the taking of ownership of new equipment and/or
technology, ensuring a smooth transfer that is beneficial in risk terms.
A senior, highly influential manager should be the designated sponsor/
champion.
LINK to RCS Hazard Identification and Risk Assessment for further
Inspection guidelines. (put in link once published)
Is there adequate
control of operating
procedures during
change?
Is documentation
affected by the change
systematically updated
and issued to
personnel? Are
outdated drawings
withdrawn?
Procedures describing the document up-dating mechanism should be
defined. How and when documents are raised to "as built" status
should be clear. Originators of "redline drawings" showing changes
should be informed when changes have been made to as-built
drawings. All affected documents such as P&I Diagrams, s.o.p's,
maintenance procedures and training schedules and all associated
documentation e.g. panel mimics, alarm lists, should be updated in a
timely manner to reflect any recent changes to plant. How all affected
documents are identified is an important consideration.
Any change to the operating conditions (e.g. pressures and
temperatures, levels, flow rates) must be understood by the operators
and documented. There should be traceable recording of changes on
master control record prints between document up-dates. The date,
source, status etc. of the revision should be clearly marked up. If not,
the documents should be regarded as unreliable. It should be clear
how this is managed both onshore and offshore. The document
control system should ensure that outdated documents are withdrawn
from circulation, and that non-controlled versions are not used.
Only authorised personnel should amend existing operational
procedures or issue temporary operating instructions during changes.
It is good practice for the operating procedures to be authorised by
representatives from several different departments.
Modifications should not take place at night-time unless suitable
expertise is available to consider the full implications of the change,
and do a risk assessment.
Major accident prevention must be regarded as 'core business', not a
side issue.
Useful links:
RCS 3 Operating Procedures
Human Factors website Information sheet on Procedures (available
late 05 - put in link when published)
Improving Maintenance. A guide to reducing human error pp30-35 for
information on contents of procedures.
Verification
Should show how people are held accountable e.g. performance
appraisal.
To show a clear allocation of responsibility.
To show evidence of adequate resource allocation.
Look for non-compliances against procedures e.g. outdated
documents still in use, documents not all available, verbal
communication used instead of formal written requests, use of non-
standard format for risk-assessment.
ORGANISING COOPERATION
Do all personnel
cooperate to ensure
the successful
operation of the
system?
Is there good
cooperation between
contractors and in-
house teams?
Is there coordination
with other parts of the
Safety Management
System e.g.HIRA?
All parties should show a shared understanding and acceptance of the
management of change procedures. They should cooperate to ensure
that any changes are properly identified, communicated, assessed,
planned, controlled and executed to the specified standard.
There should be procedures to ensure that any conflicting engineering
objectives are identified and resolved.
There should be arrangements to ensure that all stakeholders are
consulted and involved in any proposed changes to plant and
processes.
There should be a dispute resolution procedure.
Tasks should be coordinated. Each individual element of the change
should be completed to the required standard before the next is
started,
Verification
Dispute resolution procedure.
Documentary evidence of consultation.
ORGANISING COMMUNICATION
Are there adequate
information flows into,
within and from the
organisation to secure
the effective operation
of the system?
Is there a clearly
written management of
change procedure
covering definitions,
roles and
responsibilities,
operation and
monitoring of the
management of change
system?
Is documentation
affected by the change
systematically updated
and issued to
personnel? Are
outdated drawings
withdrawn?
Formal and effective communication should take place between all
parties involved in the change procedure. This should occur at all
different stages of the process. Written records should be kept.
There should be clear management of change forms and links with
other documentation, e.g. work orders.
Any plant changes to be affected should be clearly specified.
There should be structured meetings to carry out RA as a formal step
in any change initiation process.
Documentation of the design specification for any plant changes
should include relevant engineering design codes, design procedures,
quality standards etc.
Authorisation of any plant changes should be done using forms that
are clear, unambiguous and easy to use.
Good practice is the provision of encouragement and feedback, from
monitoring data on positive achievement and on reasons why
proposals have or have not been approved.
Verification
Meeting minutes/records.
Design specification documentation.
Documentation associated with reviews/ disputes etc.
Feedback documentation.
ORGANISING COMPETENCE
Are people competent
to achieve the system
objectives?
There should be defined competence levels for team leaders, team
members, and assessment facilitators. People undertaking the hazard
studies should have adequate training in and experience of HI&RA
techniques to include where appropriate HAZOP, QRA, and FTA.
HAZOP team leaders should have gained a lot of experience as team
members, and have attended additional team leadership training.
There should be an overall view of site or business-wide requirements
for the core technical competencies required to keep risks 'ALARP',
including capacity for engineering, risk assessment (so that change is
not delayed), and adequate intelligent supervision of contractors. This
includes strategic planning using mapping techniques to ensure
adequate deputies for key strategic roles.
The need for specialist advice should be identified and ensured. The
procedure should ensure that comments from the ICP (offshore) are
taken into account.
There should be arrangements to educate people of the dangers that
might arise from uncontrolled change.
Competence should be assured and ensured during transition and
following any changes. This should include identification of training
needs for changed or additional roles in relation to major
hazards/process safety (bearing in mind that some key knowledge
may well not be documented), and adequate planning for competent
cover during the training period. There should be ample support
and/or supervision by competent people for all staff with new safety-
sensitive work e.g. contractor-based production operator fulfilling the
new role of control room operator may require further emergency
response training. Competence should be seen as only one means of
addressing potential human failure and errors. For other means, LINK
TO PM/ENF 11 Human Factors - Inspector Toolkit, Common Topic 2
Maintenance Error -put in link
See also RCS 12-Assessing Competence.
Verification
Strategic planning documents e.g. mapping records.
PLANNING AND
IMPLEMENTING
Are all changes and all
e involved peopl
The system should be able to cope with the number and type of changes. The
number of change requests may need to be controlled to ensure that the
identified, and the need system isn't overloaded.
for change The system should be clear and logical. There should be criteria to define the
communicated as part
of a managed system?
types of change subject to the change procedures, performance standards for
operating the procedures and a formal system for ensuring that the system is
followed and changes documented.
An example of an assessment procedure for change.
Is there adequate
assessment of the
change? Is
outsourcing, where
used, adequately
managed? Are risk
reduction options
weighed up in terms of
ALARP and reasonably
practicability?
Changes should be categorised, with greater importance attached to, and a
higher level of management approval for, more safety-significant categories.
The scope and detail of the risk assessment should be proportionate to the
criticality of the change. There should be clear guidance on when a significant
risk assessment is required. (The system should not heavily rely on individual
judgment). Guidance on appropriate risk assessment qualitative and
quantitative techniques should be available. For most plant change control
applications, risk will be evaluated qualitatively using some sort of risk matrix.
If the risks are found to be intolerable and cannot be reduced, then the change
must not be implemented. Prompts should be used to get teams to think about
using techniques other than HAZOPs. There should be evidence of the
application of the principles of inherently safer design (see Assessment
Principles for Offshore Safety Cases (APOSC) para.96).
The effects of the change on the original design intent, plant integrity, process
operating parameters, safety and control systems, any other affected facilities
(including plant which may be quite remote from the source of the change),
and human factors - should be assessed. Due account should be taken of the
impact of change at each of the plant/installations life-cycle stages.
If a change has the potential to affect facilities beyond the immediate
boundaries of the affected installation, appropriate consideration should be
taken of this impact and necessary consultation with affected parties
undertaken.
All assessments should be fully participative, ensuring that the knowledge
(including informally held knowledge) and views of people involved is gathered
and given dispassionate consideration.
If outsourcing is used, major accident prevention should be accepted as core
business. There should be arrangements to continue and resource, effective
control of outsourced major accident risks. Appropriate performance indicators
should have been selected for signs of degradation of performance.
Is there a clear
implementation
process to ensure that
actions identified during
RA are implemented,
tracked and closed
out? Is ALARP
attained/demonstrated?
After modifications have been carried out, the work should be inspected, and
the documents signed off only if the plant is safe to operate. Any non-critical
outstanding items should be listed on a Reservations sheet, and completed in
a timely manner. Where documents are signed off electronically, they should
be password protected on a protected field.
ALARP should be ensured even if it is simply replacement in kind. The general
rule is that measures must be put in place unless the test of gross
disproportion is met. Any previous cost benefit analyses, which discounted
improvements on the grounds of limited installation life, should be revisited if
the proposed modification results in an extended life. Indeed, the weighting
given to remedial actions and their priorities may change as a result of the
modification.
Actions from hazard studies should be summarized for tracking
implementation in the as-built modification.
There should be adequate cover to allow necessary extra work such as
training and writing new procedures.
Are changes to the
SR/SC identified and
initiated?
To meet the requirements of the SR/SC regime, the duty holder's method of
evaluating the impact of change on the current SR/SC should be
demonstrated. Even apparently minor changes to the SR/C should be
assessed and logged, and all relevant documents updated. This is to help
identify at what point between formally required SR/SC updates, amendment
to the SR/SC may be required. The SR/C should be revised periodically to
incorporate relevant changes. Material changes to the SR/C require
submission to HSE before the modification comes into effect.
Are potential changes The duty holder should repeat PFEER risk assessments as appropriate.
to the PFEER
Assessment (offshore)
considered? Is the ICP
notified of changes to
SCE's and are these
examined/verified by
the ICP?
Are potential changes
to the plant
examination and test
scheme considered? Is
the scheme Competent
Person (CP) notified of
changes to plant and
equipment and are
these examined by the
CP?
Written schemes of examination and verification should be updated.
For Offshore, see SPC/Enf/80. This advises inspectors that before a
SCE is changed, or its maintenance regime is modified, then it may be
necessary for the verification scheme to be reviewed and, where
necessary, revised or replaced by or in consultation with an ICP. The
nature of the change will determine whether a review etc. is
appropriate.
Inspectors should examine the outputs of the safety management
system (SMS), ensuring the enactment of protective systems and that
the implementation of risk control measures are effective, conform
with the SR/SC, relevant legislation and good health and safety
practice.
Offshore, for a design S.C., the key area of concern will centre around
the control of change during the design process after the issue of
Approved for Design (AFD) documentation.
Links to other guidance:
1. Hydrocarbon leak reduction offshore. Report on the
findings of HSE's Process Integrity National
Inspection Project 2000-2004. Link to be put in when
published.
2. SPC/TECH/OSD/13, para 4.4.1. This details change
control problems specific to Offshore.
Verification
Inspectors could select and follow through a change example to verify
that procedures are followed and records accurately kept.
Check for status of outstanding items on Reservations sheets.
MEASURING
PERFORMANCE
Is the management of
change system
monitored?
Active monitoring should take place of risks during change. Change
should be reversed if necessary.
Compliance checking should be carried out at all stages to assure
that:
Appropriate risk assessments have been carried out properly
and the results implemented.
Risk assessments are revisited if change results in an
extended installation life.
Change requests, studies and follow-up actions are completed
to reasonable timescales.
Changes have not taken place without going through the
appropriate system (check against the work order request or
maintenance shift logs etc).
There is selective investigation of sub-standard performance.
Modifications meet the design spec.
Useful feedback can be gained from staff on the operation of the
programme. Management should actively listen to issues or problems
experienced by operators and other staff, as a means of early
checking for possible system degradation.
Are leading and lagging
process safety
performance measures
used that reflect the
process risk profile of
the plant? Is leading
and lagging data used
to drive performance
improvement?
Examples of leading indicators include: % of HAZOP actions not
closed out; % of plant change authorisations completed
retrospectively.
Examples of lagging indicators include: Number of incidents where
non-conformance to intended design was a contributory factor;
number of incidents where inadequate plant/personnel
change/modification was a causal factor.
The data (from measuring process safety performance) should be
used to drive performance improvement. For example, a committee of
technical and management staff could meet monthly to review process
safety measures and agree and steward necessary improvement
actions.
Further guidance on HSE's programme to promote the use of process
safety performance measures can be found in SPC/Enforcement/87.
The results of monitoring should be analysed and acted upon.
The accident and incident investigation system should recognise the
management of change as a potential important underlying cause.
Where failures in the management of change system were thought to
be a contributory failure to an incident - these should be separately
identified and addressed.
Verification
Written instructions covering monitoring of the management of change
programme.
Near miss or incident investigation reports may indicate failures with
the management of change process.
Check changes have gone through the appropriate management
system e.g. check computerised maintenance logs, and change
requests against risk assessment records. Records should be
thorough and complete.
AUDIT AND
REVIEW
Is the design and
operation of the
management of change
system subject to
periodic scrutiny and
verification by someone
not involved in the
The design and operation of the management of change system
should be subject to an independent audit. Performance measures
should be used to measure the effectiveness of procedures and
assess performance. Procedures should be in place to implement and
review audit findings.
management of change
at the workplace under
review?
Is there an effective Verification
review of the System to
ensure continuing
improvement and
effectiveness?
Audit reports and reports on progress with audit actions.
Investigate how senior management is informed of the results.
RCS 6 - OCCUPATIONAL HEALTH - DERMATITIS
Introduction Planning and Implementing
Policy Measuring Performance - Active Monitoring
Organising - Control Measuring Performance - Reactive Monitoring
Organising - Co-operation Auditing
Organising - Communication Reviewing Performance
Organising - Competence
INTRODUCTION
This key issue has been developed to assist inspectors to assess the management of an occupational health issue.
Occupational dermatitis is used as an example but many of the issues and characteristics could be applied to other
occupational health risk control systems.
POLICY
Key Issue:
Is there an effective policy for the prevention of occupational ill health (and in particular for the prevention of occupational
dermatitis) and is there an effective management system to ensure protection?
Key Characteristics:
Senior management are committed to the prevention of occupational dermatitis and to compliance with COSHH
(this includes a commitment to control the risk of dermatitis caused by substances not covered by COSHH).
There is a clear policy on the use of an appropriate control hierarchy, e.g. substitution, containment, hygiene
measures, personal protective equipment.
Health surveillance is used appropriately.
The prevention and control of occupational ill-health is adequately resourced, i.e, money and resources should
be sufficient to develop and maintain the appropriate control measures.
ORGANISING - Control
Key Issue:
Is there an adequate management structure to effectively prevent occupational dermatitis?
Key Characteristics:
There should be clear allocation of responsibilities for:
o developing and implementing the assessment programme;
o implementing and maintaining control measures;
o assessing the need for health surveillance/pre-employment screening;
o undertaking appropriate health surveillance and keeping health records;
o reviewing the adequacy of risk assessment and updating controls.
Those with responsibilities for the control of dermatitis should be clear on what is expected of them.
The responsibilities outlined to control dermatitis and the actions needed to control risks should be reflected in
individual's personal objectives.
Completion of personal objectives and the discharge of responsibilities relating to the prevention of dermatitis
should be included in procedures for reviewing the performance of managers, supervisors and specialists.
ORGANISING - Co-operation
Key Issue:
Are there adequate and appropriate arrangements to secure the trust, participation and involvement of all employees in
the prevention of occupational dermatitis?
Key Characteristics:
Front line managers and supervisors should give the control of occupational dermatitis the appropriate degree of
priority. Preventative measures should be followed at all times not just when it is expedient in terms of production
priorities.
Employees should be involved in the assessment process and in devising, implementing and reviewing control
measures. There should also be employee involvement in the investigation of incidents and work practices which
give rise to occupational dermatitis providing that this does not lead to disclosure of confidential medical
information.
ORGANISING - Communication
Key Issue:
Are there adequate arrangements to secure information on the risks and control of dermatitis and to ensure that this
information is given to employees?
Key Characteristics:
Adequate and relevant information on the risks of dermatitis should be acquired by the organisation. This will
cover gaining information from suppliers on the hazardous properties of their materials by data sheets and
product labels. This information should be kept up to date and there should be controls over the acquisition of
products and substances without the appropriate health data first being obtained and assessed.
Arrangements should be in place for providing and updating of information to managers and employers who are
involved in work processes where there is a risk of dermatitis. This information should be in a style and language
appropriate to the users and should in sufficient detail be relevant to the risk and circumstances.
Arrangements should be in place for communicating the findings of assessments and of the appropriate control
measures to those at risk and those responsible for managing the risk.
Systems should be in place to provide information on the risk of dermatitis from products manufactured and
supplied by the organisation. This will include correct categorisation and labelling and data sheets produced
under CHIP as well as the provision and maintenance of information to customers.
Poster campaigns, tool box talks and safety tours should be used to inform employees of the risks of dermatitis
in the workplace and to keep them up to date on any changes in standards or risks. Information on the incidence
of dermatitis and the success or otherwise of the control strategies should be made available to employees and
their representatives.
Information on the risks of dermatitis and of the appropriate control measures should be made available to
contractors and peripatetic workers e.g, cleaners.
There should be appropriate systems in place to keep and update health records where appropriate and ensure
security and confidentiality of this information.
Arrangements should be in place to inform employees' GPs of symptoms exhibited by their patients and where
relevant of treatment given in-house for dermatitis and of referrals to specialists and consultants directly by the
company physician.
ORGANISING - Competence
Key Issue:
Are there systems and arrangements to secure the competence of those assessing the risks of dermatitis, those involved
in devising, implementing and reviewing the adequacy of control measures, and of those working with harmful agents?
Key Characteristics:
Managers and employees should recognise the potential for occupational dermatitis arising from the work
activities of the business, i.e, they should know there is a risk of dermatitis from specific substances and work
tasks.
Those involved in undertaking COSHH and other assessments should be adequately trained and competent to
perform these tasks. Competencies would include:
o ability to recognise substances and tasks which give rise to the potential to cause dermatitis or skin
irritation or the manner in which the risk may occur;
o ability to review the workplace and activities and to identify the opportunities which give rise to exposure
and to decide on the significance of such exposure;
o awareness of appropriate control measures and the ability to judge the suitability of alternative
substances/work methods, engineering or hygiene controls and selection and use of PPE.
There should be a suitable degree of competence by those involved in pre-employment screening and in
undertaking health surveillance where appropriate. Occupational health specialists (physicians, nurses etc)
should be familiar with the products in use in the workplace which give rise to a risk of dermatitis and with the
work activities and processes which may lead to exposure.
Those involved in work involving a risk of dermatitis should be aware of the risks and of the symptoms. They
should be trained in the appropriate control measures and the action to take if they suffer from dermatitis.
Instruction and training should be provided on induction, job change, change in responsibility and refresher
training.
There should be adequate specialist advice available on occupational health and occupational hygiene issues.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Are there adequate processes to generate plans and performance standards to prevent dermatitis?
Key Characteristics:
There should be performance standards covering COSHH and other assessments, workplace control measures,
acquisition and updating information, pre-employment screening and health surveillance, maintaining compliance
with controls and review of performance.
Performance standards should specify who does, what, when and with what result.
There should be performance standards detailing procedures for:
o identification of product hazards, particularly those with the potential to cause dermatitis or irritation and
for keeping up to date on new information on products, safer alternatives, changes in guidance and legal
standards, e.g. EH 40 revisions;
o task analysis aimed at identifying jobs/tasks which may lead to exposure to hazardous substances or
give rise to risk of dermatitis;
o risk evaluation including making decisions on acceptability of risk;
o devising control measures detailing substitution, engineering controls, systems of work and hygiene
measures, and selection and maintenance of PPE etc.
Assessments should be prioritised according to the tasks or substances which present the greatest danger in
terms of the potency of the hazard and the frequency of exposure.
Remedies for weaknesses in control measures identified in assessments should be developed and formulated
into plans. Areas for improvements should be prioritised and where protective equipment or hygiene measures
are used as an interim measure instead of engineering controls, containment or substitution then improvements
in the hierarchy of control should be included in medium and long-term improvement plans.
Work involving a risk of dermatitis should be undertaken in accordance with the designed performance
standards. This includes the use of the correct protective equipment.
MEASURING PERFORMANCE - Active Monitoring
Key Issue:
Are there adequate and sufficient checks on the operation and effectiveness of the measures taken to protect against
occupational dermatitis before the occurrence of any cases?
Key Characteristics:
Monitoring regarded as a line management function.
Progress in completing the assessment programme should be regularly monitored including revisions following
changes in substances or work practices.
Routine checks made on compliance with workplace precautions, systems of work, correct selection and use of
PPE etc.
Regular checks on the operation of any health surveillance programme and completion of health records.
Regular checks on workplace monitoring (where appropriate).
Investigation of sub-standard performance particularly where the incident may reveal weaknesses in
management.
Remedial measures prioritised and common trends analysed and investigated.
MEASURING PERFORMANCE - Reactive Monitoring
Key Issue:
Is there effective investigation of cases of dermatitis or incidents which give rise to risk of dermatitis?
Key Characteristics:
Reactive system owned and operated by line management.
Adequate reporting of cases of dermatitis and of incidents and hazards with the potential to give rise to
dermatitis.
An effective investigation system to examine immediate and underlying causes of incidents and propose
remedial action. Investigation selective based upon incidents with serious potential as well as serious
consequences.
Adequate occupational health treatment or referral for medical advice for cases of dermatitis. Suitable transfer or
placement in cases of sensitisation.
Analysis of data on cases/incidents to identify common failures, features or trends.
AUDITING
Key Issue:
Is the management of occupational dermatitis independently reviewed either separately or as part of audits of the whole
health and safety management system?
Key Characteristics:
Control of dermatitis reviewed alongside reviews of occupational health management as other management
systems.
Adequate procedures in place to review and implement audit findings.
REVIEWING PERFORMANCE
Key Issue:
Is there adequate and sufficient review of the success and failures of the measures in place to prevent occupational
dermatitis?
Key Characteristics:
Appropriate prioritised actions taken to remedy defects and weaknesses in workplace precautions, risk
assessments, monitoring and surveillance.
Effective follow-up systems to ensure remedial actions are carried out and remedial actions not allowed to
backlog.
Review of performance on control of dermatitis fed up to senior management.
Performance indicators used to assess performance.
RCS 7 - SELECTION AND MANAGEMENT OF CONTRACTORS
Introduction Planning and Implementing
Policy Measuring Performance
Organising - Control Auditing
Organising - Co-operation Reviewing Performance
Organising - Communication Appendix - Review of Client's HSM Documentation
Organising - Competence
INTRODUCTION
Because this agenda has to cover sometimes complicated relationships with second parties, it is structured differently to
other systems.
Apart from POLICY each element is considered under the subheadings of within client and client/contractor
interface.
Within client means arrangements within the client company to ensure high H&S standards.
Client/contractor interface means arrangements at the interface between the client and contractor to ensure
high H&S standards.
This agenda covers the two main areas of selection and management on site.
Selection is the management process by which the client uses relevant findings from enquiries and any previous
reviews to decide which contractors should be invited to tender. It also involves assessing their:
o technical competence;
o health and safety management system (HSMS) - including knowledge of hazards and their safe systems
of work;
o previous experience of similar work.
Management on site is the activity required to ensure that the way that the contractors work and the technical
adequacy of the completed job meet the performance standards agreed during selection.
The appendix lists the type of documents which should provide supporting evidence.
POLICY
Key Issue:
Is there an effective H&S policy for the selection and management on site of contractors together with the necessary
provision of resources to make it work?
Key Characteristics:
Successful policies are clear in their objective i.e., the need to select and manage contractors and to comply at
least with minimum legal requirements.
The different needs of client/contractor employees and the public are covered.
Facet to explore -
The business policy on the balance of core/non-core activities and any H&S implications of this e.g. is there a
business policy on out-sourcing? (NB - HSE should take a neutral stance).
Whether the client's H&S policy covers the H&S at work of contractors' employees (whether on their sites or not)
and adequately identifies and addresses the risks created by the contractors' work activities.
Whether the lowest tender is accepted regardless of H&S standards (can be legal problem for LAs and other
public bodies).
Interactions between multiple contractors and sub-contractors on site.
ORGANISING - Control
Key Issue:
Is there an adequate management structure to implement the policy on contractors?
Key Characteristics (within client):
Successful systems typically incorporate:
o Clear allocation of H&S responsibilities for selection and management of contractors on site to
individuals and teams and their acceptance;
o A contract which is comprehensive and unambiguous;
o A structured and comprehensive approach to using contractors covering planning, operation, monitoring
and review;
o Sub-contractors covered within the same system.
Key Characteristics (client/contractor interface):
The contractor's arrangements align with to those of the client e.g. agreement over the degree of segregation of
work areas.
ORGANISING - Co-operation
Key Issue:
Are there arrangements to secure effective working together of client and contractors?
Key Characteristics (within client):
Successful systems typically incorporate:
o Co-operation between different parts of the client organisation (selectors- users-monitors) to ensure
consistent standards for contractor working, e.g. regular inter-departmental meetings to include
employee representatives where necessary.
Key Characteristics (client/contractor interface):
Effective co-ordination between the client, their contractors and sub- contractors in terms of who has the
knowledge, who does what, when and how, i.e., the contractor may take the lead in certain operations where
they have the expertise but rely on the client's expertise in other areas:
o e.g. specialist analysis offshore where the contractor has the expertise on the activity but relies on the
client's expertise for safety while on the installation;
o e.g. trackside safety on railways;
o roofing work on a nuclear power station;
o e.g. movements on a stretch of road or rail may be restricted to allow maintenance activities;
o e.g. a nuclear plant may be shut down for overhaul.
Direct involvement of the contractor's management/supervision in the client's management H&S meetings, H&S
workplace tours/inspections and investigations where appropriate (nature and scale of activity very relevant).
Involvement of contractor's workforce in site H&S meetings, H&S campaigns etc. (This may not be appropriate
for one-off short term contracts).
ORGANISING - Communication
Key Issue:
Are there arrangements to ensure that sufficient information flows within the client, within the contractor and between
client and contractor?
Key Characteristics (within client):
Successful systems typically incorporate:
o Information on contractor selection and control passing within and between departments of the client
including feedback on any interventions;
o Information as above to and from senior managers at all levels.
Key Characteristics (client/contractor interface):
Information (both positive and negative) passing from client to contractor (and vice versa) and between both of
these parties and the sub-contractors including regular meetings and opportunities for dialogue at all levels
between all parties e.g. progress briefings, snagging meetings, tool box talks.
Facets to explore -
Communication is important at all key stages i.e. pre-tender, tender, start-up, during the work and after as part of
particular review of that job or general regular review of ongoing performance.
Are there means of informing other parties that contractors are on site and what they are doing together with the
likely effects?
Is there a 'no blame' culture which encourages reporting and discussion of incidents and other problems arising?
ORGANISING - Competence
Key Issue:
Are there systems and arrangements to ensure that all people working on site (client, employees, contractors, sub-
contractors) are competent?
Key Characteristics (within client):
Successful systems typically incorporate:
o Clearly stated necessary skills, knowledge and experience (including the identification and fulfilment of
training needs) for client employees involved in selection, control, monitoring and review of contractors
and sub-contractors;
o A mechanism for ensuring that client employees actually possess them.
Key Characteristics (client/contractor interface):
The client having a system to ensure that the contractor employs competent people.
The same for sub-contractors.
A preferred list of contractors and sub-contractors (if used) derived systematically against set H&S standards.
A successful selection system typically takes account of:
o history, particularly experience of similar work in the same industry;
o H&S documentation (policy, plans, method statements, risk assessments);
o accident/enforcement history (to be used with care);
o training records;
o supervision arrangements;
o references.
There is an effective review of all the above facets with appropriate weight given to H&S performance compared
with other selection criteria e.g. financial considerations.
Client and contractor HSMS should be compatible and complementary.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Are there adequate processes to generate plans and performance standards to implement the policy on contractors?
Key Characteristics (within client):
Successful systems typically incorporate:
o Performance standards for hardware, people and systems;
o An assessment of any hazards introduced onto the site by contractors which may affect the client's
employees and others;
o The client carrying out adequate risk assessments to both inform the selection process and provide the
outline for the contractor's H&S plan, taking account of multiple working e.g. at major shutdowns;
o Risk based prioritisation of management resource between concurrent projects;
o Risk assessments and method statements produced by the client for his own employees affected by
contractor working.
Key Characteristics (client/contractor interface):
Risk assessments carried out by the client to cover hazards which contractors will be exposed to on-site - this
being done prior to work commencing.
A H&S plan produced by the contractor and based on adequate risk assessments which has been checked by
the client.
Adequate risk assessments and method statements produced by contractors and sub-contractors for their own
and other employees/visitors/members of the public which have been checked by the client.
Adequate performance standards set by the client.
Site induction carried out by client and contractor as appropriate covering the setting and explanation of site
rules, the highlighting of hazards and emergency arrangements.
Adequate arrangements for controlling access to the site by contractors' personnel.
Adequate arrangements for controlling contractors' plant and equipment brought on site.
An appropriate level of segregation between client and contractor based on risk assessment.
MEASURING PERFORMANCE
Key Issue 1:
Is there adequate and sufficient measurement of performance before incidents happen?
Key Characteristics (within client):
Successful systems typically incorporate:
o an effective measuring system which enables the client to assess its own compliance with performance
standards - i.e. is its selection and management of contractors adequate?
Key Characteristics (client/contractor interface):
The client measures contractor performance in doing the job in terms of milestones, H&S plans, quantity and
quality of risk assessments, method statements and working practices and implementation of these.
The client has a clearly defined procedure for taking action if the contractor's performance falls below the set
minimum standard.
Adequate safety of the completed job e.g. clearance certificates following asbestos stripping, quality checks on
structural integrity.
An effective measure by the client of the contractor's own measuring systems e.g. shadow tours/audits to ensure
key risks covered and prioritised.
Key Issue 2:
Is there adequate and sufficient measurement of performance following incidents?
Key Characteristics (within client):
Successful systems typically incorporate:
o an effective measuring system enabling the client to record and measure accidents, incidents and near
misses resulting from contractor activity.
Key Characteristics (client/contractor interface):
The client either investigates contractor incidents itself or requires the contractor to do so, and is actively
involved in this process (particularly the results).
The client monitors contractor reporting and investigation procedures with particular emphasis on establishing
root causes, with a view to the contractor improving where necessary.
The client compiles contractor incident statistics and monitors trends.
AUDITING
Key Issue:
Is there adequate auditing of this system as part of the overall HSMS?
Key Characteristics (within client):
Successful systems typically incorporate:
auditing targeted at specific risks.
Key Characteristics (client/contractor interface):
Any audits carried out of the contractors (by themselves or the client) are made available to the client and
findings integrated into this system.
REVIEWING PERFORMANCE
Key Issue:
Is there adequate and sufficient review of performance to ensure that lessons learnt are effectively put into practice and
disseminated throughout the organisation?
Key Characteristics (within client):
Successful systems typically incorporate:
the review process (using information from 'measuring' and 'audit') being used to improve the operation of the
contractor selection and management system and driven by senior management;
the review process ensures that the system delivers the stated policy on contractors.
Key Characteristics (client/contractor interface):
Client review of contractor and sub-contractor H&S performance which is fed back up to the 'level 1' elements of
its HSMS.
Adequate feedback to the contractor selection process to ensure that poor performers are not re-selected (at
least without effective intervention).
Feedback to the contractor to effect improvements.
APPENDIX - Review of Client's HSM Documentation
Documentary evidence which may be reviewed includes:
H&S Policy - parts covering selection and control of contractors;
Any other policy documents referring to this;
Relevant sections of any statutory safety case;
Company organisation charts for those involved with contractors;
Contractor selection procedure;
List of preferred contractors;
Contractor control procedure;
Pre-tender documentation;
Tender documentation from a contractor;
Contractor selection checklist;
Copies of any appraisals/audits of contractors carried out by client at this stage;
Evidence of references having been checked;
The contract (excluding irrelevant financial information);
Minutes of liaison meetings where H&S areas discussed;
Risk assessments - prepared by client and contractors;
Method statements - prepared by client and contractors;
Criteria to which these are compared (performance standards);
Signing in/out log books;
Completed checklists used to monitor contractors;
Evidence of other active and reactive measuring processes (client and contractor) with examples;
Accident/incident reports involving contractors;
Accident/incident investigations involving contractors;
Evidence of contractors having been removed from a preferred list;
Audit reports by client or contractor.
RCS 8 - GUIDANCE: ON-SITE EMERGENCY RESPONSE INSPECTION
Introduction Organising - Co-operation
Policy / Objectives Planning & Implementing
Organisation - Control Measuring Performance
Organising - Competence Audit & Review
Organising - Communication
Introduction
This guidance has been prepared to help inspectors assess & audit on-site emergency response arrangements. It is
aimed primarily at top tier COMAH establishments but the principles can be applied to other establishments.
This guidance is not intended to address off-site emergency plans (although many of the issues are similar) and it will
allow inspectors to explore the key interfaces between on- and off-site plans.
On-site emergency response arrangements form part of an establishment's health and safety management system
(HSMS) for preventing and limiting the consequences of major accidents. They are, in effect, an establishment's system
for managing emergencies and should not be treated as a 'bolt on' and something different from other company systems
and arrangements. Therefore, this guidance is structured in line with HSE's guidance on "Successful safety management
systems" described in HS/G 65 and looks at emergency management in line with the POPMAR model (Policy,
Organisation, Planning, Measuring, Auditing and Review) for HSMSs.
Many of the questions will be answered by reviewing the operator's written plan and this is the best starting point. The
guidance could also be used selectively to assess written on-site emergency plans independently from site inspection. If
significant shortcomings are identified then it may be worthwhile ensuring these have been resolved before proceeding
further.
The on-site emergency plan is the framework for an establishment's emergency response. It should cover the objectives
and information required by COMAH Schedule 5 Parts 1 & 2 respectively. If inspectors intend to assess on-site
emergency plans, then the objectives and minimum information should be addressed and this guidance indicates points
to be considered on these matters as well as other features to be included in an on-site plan.
Whilst COMAH creates specific requirements dealing with defined industrial major accidents involving dangerous
substances there is also a wider emergency-planning field. The responsibility for this area of activity rests with the
Cabinet Office Civil Contingencies Secretariat, which has published draft guidance on emergency planning and response
in connection with the Civil Contingencies Act 2004. This guidance ("Preparing for Emergencies" and "Responding to
Emergencies") and related material can be found at http://www.ukresilience.info/ccact/index.htm. That guidance adopts a
different structure from the guidance presented in this document and focuses more on emergency preparedness by the
"external" (off-site) emergency services, however it contains much useful information. It recognises 6 key stages:
Anticipation
Assessment
Prevention
Preparedness
Response
Recovery
The first four stages are covered in "Preparing for Emergencies" and the final two in "Responding to Emergencies".
Another way of looking at the key issues involved in a good emergency response could be to check that the following
features exist:
Clear aims and objectives
Clear and well rehearsed procedures
An effective organisational structure
Efficient means of information handling
Required technical knowledge
Necessary resources, based on testing and experience
Planned and rehearsed interfaces between the various responders.
Policy / Objectives
Key Issues
The overall aim of the emergency response is to ensure that appropriate response measures will
be implemented when and where needed to protect/minimise the harmful effects on people and
the environment from major accidents.
Inspectors should be satisfied that
The plan has clear aims, objectives and information meeting the requirements for on-site
emergency plans detailed in COMAH Schedule 5 and
There is evidence that it is systematic in its approach and in how it has been devised.
In achieving this, there should have been appropriate consultation with those who have a part to
play in the plan and account taken of review and testing.
1. Does an "on-site emergency" plan exist?
2. Are the purpose and objectives of the plan clear? In particular with respect to:
Containing and controlling incidents so as to minimise the effects, and to limit damage to people,
the environment and property.
Implementing the response measures (procedures, roles and resources) necessary to protect
people and the environment.
Communicating the necessary information to the public, emergency services and authorities
concerned in the area.
Providing for the restoration and clean up of the environment following a major accident.
For some foreseeable scenarios, e.g. oil spills, it may be relatively simple to include quite
detailed clean up arrangements. But in other cases the information may relate to indicative
arrangements only, e.g. with information about expertise to call upon and where resources could
be found to assess and implement appropriate measures under the actual circumstances.
Question 2 covers the high level objectives set out in COMAH Schedule 5 Part 1 and required by
Regulation 9(1). These are top-level questions and the final answer may only be apparent once
the emergency plan and response arrangements have been considered as a whole. The
questions outlined in the remainder of this guidance will help to answer whether these objectives
have been met.
The objectives of the emergency response should be stated as clearly as possible (and
appropriate training should reinforce this). For example it should be clearly stated that the
primary purpose is to protect people, followed by protecting the environment, protecting
property, preserving the company's reputation etc. This might be achieved primarily by training,
but the written plan should include important strategic considerations. Examples might include
whether, in the event of a fire, incoming and outgoing pipelines should be isolated, whether
certain vessels take priority re protection by water curtains or cooling, in the event of a release of
a toxic gas cloud explaining that the approach is to get people to safe muster point upwind or to
reach havens for awaiting further instructions.
3. Do the arrangements in place reflect a systematic approach to planning for emergencies based on the major
accident hazard scenarios?
The on-site plan should deal with the full range of events identified in the establishment's
COMAH safety report. The level of planning can be proportionate to the probability of the
accident occur although consideration should also be give focusing on those events most likely
to occur. It is important for the inspector to be familiar with the representative set of major
accident scenarios for that establishment.
4. Is there evidence that the statutory consultees, both internally and externally, are involved in devising the plan?
It should be clear, e.g. from the safety report, what consultation has taken place. COMAH Reg.
9(3) requires consultation for the on-site plan to include employees; EA/SEPA; emergency
services; health authority and local authority[1]
5. Is a formal review process in place that evaluates the effectiveness of the approach taken to emergency
planning and to the suitability and effectiveness of the arrangements?
Setting response objectives in relation to the identified major accident scenarios (e.g. Time to
shut down & evacuate affected plant; onsite fire team and fire brigade response times) will help
both in the preparation and any subsequent review of emergency response.
Organisation - Control
Key Issues
Maintaining control in emergency situations is very complex and the allocation of
responsibilities to key people with appropriate accountability and job descriptions is important.
Inspectors should be satisfied:
that there is an effective organisational structure with suitable deputising and back up
when required and
that the roles and responsibilities are clear for those who play a part in the plan.
A plan will normally identify a Site Main Controller and Incident Controller.
Command & control structure
6. Does the plan clearly identify who should assume responsibility in an emergency?
7. Is the command and control structure clearly defined and does it identify who responds to whom in the event of
an emergency?
8. Are the levels of authority assigned within the command structure such that they allow decisions to be taken at
the lowest level commensurate with the urgency of the situation?
An important example of this is whether people have authority to shut down processes or await
authorisation e.g. outside working hours.
It should be clear at what point or degree of loss of control the arrangements should come into
effect.
9. Is there a logical sequence of actions for key personnel that are identified and given a role in the emergency
plan?
10. Are overview charts showing the emergency command and control structure available?
Such charts provide a useful summary for staff and external bodies.
A relatively flat emergency management structure helps to allow rapid flow of essential
information.
11. Does the emergency plan show how on-site command and control arrangements interface with external bodies?
12. How will emergency responders be readily identifiable; where will they rendezvous and how will they
communicate?
Much time can be wasted if external services cannot find the right person at the scene.
Distinctive tabards, flashing lights on vehicle and coloured helmet are commonly used. Tabards
are probably the most explicit but often not effective in the dark.
Roles and Responsibilities
13. Are the roles and responsibilities clear, concise and unambiguous, with the decision-making boundaries clearly
defined?
This question can be best answered after considering the more detailed questions below.
14. Does the emergency response plan identify key emergency responders (including those who will initiate/activate
the on-site emergency response, take control and alert the external emergency services) and contain a
statement of authority (mandates and roles of all concerned)?
15. Is there a designated person (usually called the Site Main Controller) who has overall responsibility during an
emergency?
N.B. Except at the incident scene where the Incident Controller has responsibilities when called, the Fire
Brigade senior officer will assume control at the incident scene and this is confirmed by statute when fighting
fires. However the police will still retain responsibility for co-ordinating the off-site response and operators will
retain responsibility for their employees including HSWA duties.
16. Has the Site Main Controller got a deputy?
The position of site main controller is much strengthened by the addition of a deputy). The
inclusion of a deputy role recognises the need to distance the Site Main Controller from the detail
(e.g. Routine communications and detailed work).
17. Are appropriate measures in place to ensure 24-hour cover, 7 days a week (including sickness and holiday
cover)?
18. Are the duties of the Site Main Controller specified?
The duties should include:
Being on site at the time of the incident or to be quickly available.
Going to and remaining at the designated control centre for the duration of the incident -
unless the location becomes untenable.
Taking an overview of the incident and making sure certain resources are provided and
steps taken to ensure the safety of others who may be affected.
Directing any operation from the control centre and ensuring liaison with public
emergency services regarding developments and possible off-site effects.
Arranging for an incident log to be maintained.
Having the authority to make decisions on behalf of the site and to ensure correct liaison
with media.
Arranging where necessary for off-site and environmental monitoring.
19. Are the duties of the Incident Controller specified?
The duties should include the following:
Being on site at the time of the incident.
[Inspectors should give particular attention to unmanned sites and how the plan deals with
situations where the emergency services arrive first].
Being generally aware of the overall site situation and having detailed knowledge of the
incident area.
Staying at or near the incident and directing the efforts of the site emergency team to
control the situation at the scene of the incident - distinctive clothing recognisable by all
concerned is recommended.
Overseeing all responsibilities pending arrival of the Site Main Controller.
Ensuring Liaison with public emergency services at the scene.
Communicating progress of the incident to the control centre.
Accounting for personnel located near the incident scene.
Initiating search and rescue, where necessary, usually jointly with the fire brigade.
Initiating arrangements for casualty treatment.
20. Is there adequate technical expertise available to support the Site Main Controller and the Site Incident
Controller?
Generally the Site Incident Controller should be separate from the Site Main Controller.
21. Has more than one senior management team been trained to deal with emergency situations?
22. Are the duties of the emergency response teams clear, concise and unambiguous?
These should include those of the response team, fire, security and medical services.
23. Are the team skills and experience appropriate for the identified major accident scenarios identified?
24. Are team roles clearly defined?
However, there still needs to be sufficient flexibility to adapt to specific emergencies.
25. Is there evidence of a broad understanding of peer roles?
This is important that individuals understand how their role integrates with that of others.
26. Can an appropriate distribution of workload across the team be shown?
This may be difficult to demonstrate other than by verifying through practical drills and
exercises.
27. What consultation has there been with employees during the preparation of the plan?
Consultation with those that have a role in the plan is clearly important, however it is important
that all employees have an opportunity to give an input, e.g. via the safety representative or TU
representative.
Organising - Competence
Key Issues
Thorough pre-planning is vital for competence. Competence in the area of emergency response
can generally only be achieved via testing, training and learning from the lessons and experience
of others. These considerations define the nature of the training needed. Elements of required
training for inspectors to check knowledge is given.
Inspectors should be satisfied that:
There are arrangements in place to ensure all involved have the necessary skills and
knowledge required and that
Those involved in the plan have the required technical knowledge relating to the
foreseeable major accident scenarios.
28. Are the required competence criteria (i.e. Knowledge & skills) defined for all personnel on site?
This should include staff, contractors, visitors, etc and is concerned with staff with emergency
duties.
29. Is the defined essential knowledge based on risk?
This might include; site geography; knowledge of plant operation; familiarity with key
information; physical properties & access to detailed information; fire-fighting strategy for
different chemical hazards; emergency procedures; etc
30. Is there a training programme established for on-site personnel?
This should include contractors. Key external responders will also need familiarisation with
relevant aspects of on-site circumstances and procedures - see 33 below.
Any assessment of competencies should not be based on a 'snap-shot' 'one-off' performance.
31. Are training programmes and exercises aimed at meeting the defined competency levels?
Minor exercises should be conducted to hone certain skills/competencies.
32. Are arrangements in place for visitors?
Both staff and visitors should be aware of these arrangements.
33. Is there evidence that training covers co-ordination with outside bodies, for example, the emergency services?
Knowledge of Key Scenarios
34. Can the emergency response team demonstrate a detailed knowledge of significant hazards & potential
incidents?
Team members should be able to show they know what foreseeable scenarios they are likely to
encounter and what actions are required to bring the incident under control.
35. Is the Site Main Controller able to proactively manage the incident and take a strategic view of events?
This question will involve subjective judgement. For example, the SMC should not need to refer
any issues elsewhere before coming to a decision. However it should be clear whether there are
any issues that the SMC feels the need to refer elsewhere for a decision e.g. closing down plant,
pipeline feeds etc. The SMC should also be able to think 'outside the box'. In doing this SMCs will
need to understand what the key objectives of the emergency plan are (see earlier). They should
be clear about the bases for making decisions such as:
Understanding priorities e.g. protection of people, environment, property, good name of
company
Strategy for handling foreseeable scenarios
Importance of protecting the majority when considering the safety of individuals.
36. Are members of the emergency team sufficiently well trained and briefed to be able to respond appropriately
without having to constantly refer back to the incident controller regarding predictable developments?
The 'emergency team' includes all those who have roles and responsibilities during an
emergency response. For example it will include the incident team and senior management.
Elements of training that are relevant include:
Relevant legal requirements
Emergency planning principles
Knowledge of the companies emergency plan procedures, including how to recognise
and respond to a major emergency on site
Appreciation of different types of major accidents
The nature of the hazards and how to prevent harm being realised e.g. fire prevention.
Technical capability. This should include the different ways (organisational & physical) of
mitigating the effects of major accidents. The following categories of incident, and the
associated relevant action, should be identified:
o Gas clouds - flammable / explosive / toxic
o Fire / explosion
o Spillage of toxic liquids and solids
o Spillage of flammable liquids and solids
o Domino effects - how an incident on-site impacts on other sites and the
consequent impact for the site of such domino effects
o Natural incident e.g. floods if site is close to a river etc.
Appreciation of the roles and limitation of the various emergency response organisations
Having been involved in exercises to develop both skills and knowledge
Required casualty care and appreciation of the concerns of the public
Knowledge of ranks of emergency services
The level of detail will vary for different groups of staff. Specialist staff will require additional
training egg:
Command and control (site main & incident controllers & deputies)
Fire fighting
First aid
Handling the media
And training for use of specialist equipment egg:
BA
Hoses
PPE
Fire extinguishers
37. Are the emergency team members familiar with the plan and do they have detailed knowledge of those aspects
relating to their involvement?
Organising - Communication
Key Issues
Communication during an emergency is vital and " lessons learned" studies have shown that
communication between the operator and the emergency services is the most critical factor in
determining the success or not of an emergency response. Speed of communication is a key
factor here, as every incident will develop rapidly in the early stages. The effects of poor
decisions made in these early stages will be compounded as the incident develops. Inter-
organisational communication " networks" need to be established and are very complex. In
addition, emergency services will each establish their own complex communication networks.
Inspectors should be satisfied that:
There are planned interfaces between the operators and emergency responders
(including alert/call-out and liaison during a response) and
There are efficient means of information handling between all parties.
These are essential elements for ensuring the necessary interface between on- and off-site
emergency plans. Focusing on arrangements during the early stages of an incident is key.
Inspectors should also be satisfied that the plan and associated documentation contain the
required information and are appropriate for their purpose.
38. Have information requirements been identified as far as possible prior to an incident?
These relate to the type and nature of information, which is likely to be required during an
emergency either by staff or by external organisations.
38. Have communication flows been defined for staff that are involved in undertaking emergency duties?
For each staff role this is likely to involve identifying the following:
What information persons require to perform their tasks
What information they need to supply to others
What communication media are necessary to supply this information
When and how the communications will take place.
40. Is there a strategy in place to promote a shared team understanding during incident?
Although the skills of the team leader are important here, there are approaches that will help
shared understanding. For example:
Logging of information by the emergency response team as it is received is essential.
The log should be regularly reviewed as the incident progresses and actions followed
through
The emergency response team (considering tactical issues) might call 'Time Outs' to
enable members of the team to say what they understand is happening and for all to get
an overall view of the incident. 'Time Outs' will include taking phones off the hook for a
short period; however phone contact should be retained with the incident control team at
least.
Liaison with Offsite Bodies
41. Has the company consulted with and provided information to relevant statutory consultees?
Under COMAH, relevant statutory consultees are local authorities, the Agencies, emergency
services (police, fire & ambulance plus HM Coastguard where appropriate) and the local health
authority? Consultation is required to enable development of the interfaces between the off-site
and on-site plans.
Information needs for the emergency services are outlined in Appendix 2 of HS/G 191
'Emergency planning for major accidents'.
42. Does the emergency plan identify what information needs to be given to emergency services during an incident?
There should, as far as possible, be a clear interface between the on- and off-site emergency
plans. The provision of information is key to this.
For example, establishments should ensure that they are able to supply the emergency services
with information on the location of people across site and the details of any missing personnel.
All those involved in providing assistance in the event of an emergency should have identified
the information they need to assist their response and the plan should be clear how to access
the information quickly during the actual incident. This should also cover organisations other
than statutory consultees who may require further information.
43. Are there arrangements in place for the company to provide information on hazardous chemicals to the
emergency services (before an incident to facilitate preparation of external ("off-site") emergency plans and
during/after an incident, to inform the external response and subsequent clean up)?
This should be planned for and provided in advance of an incident. However operators may need
to be adaptable. An operator does not need to give details of every possible chemical and its
products of combustion but does need to give an indication of the type of harm to health and the
environment based on categories of chemicals liable to be on site to enable a planned response.
Products of combustion for example should at least be treated as toxic and steps taken
accordingly. Certain products or mixtures of chemicals may give off particularly noxious fumes
in the event of a fire and may require additional personal protective measures and specific
treatment if people are exposed. These should be identified in advance and emergency services
and hospitals advised.
44. Are arrangements in place to ensure that the Site Main and Incident Controllers and team share a common
picture of the emergency in terms of what has happened, what is the current situation and a forward plan of what
needs to be done?
The use of aids such as white boards should be considered as a means to promote this shared
understanding.
45. Are arrangements in place for giving advice and necessary information to relevant bodies and the public?
46. Does the statutory off-site emergency plans state clearly:
what immediate actions are needed to prevent and mitigate environmental contamination during
or after a major accident?
Who has responsibility for undertaking them?
47. Has the company provided up to date information to the public?
Information should be provided in accordance with Regulation 14(1) of COMAH. The company
and local authority should also consider what information is required to people beyond the area
that is designated under COMAH (i.e. the PIZ) before and during the incident. This will help allay
the anxieties and concerns of those who are not at risk but may hear the alarm siren.
Documentation presentation & layout of emergency procedures
48. Is the content of the emergency response procedures adequate?
This should include location of individuals; means of identification; main duties, equipment and
information provided / needed; aide memoir of key prompts.
The emergency plan documentation should cover:
Introduction
Installation details
Hazard data (including chemical properties). Only the relevant properties should be given
e.g. boiling point, storage temperature and pressure, reaction with air/moisture, behavior
of gas cloud or evaporating liquid in various air conditions.
Chemical effects on people; needs to be specific regarding effects of increasing
concentration; length of exposure; effects on vulnerable people; food safety implications.
Potential major accidents
Emergency plan activation arrangements
Organisation
Control centres & communication arrangements (both physical (egg telephones) & lines
of communications)
Support services
Medical response
Public protection
Information management / press / media / arrangements
Domino effects
49. Does the plan show where communications may need to be established?
For example between:
Emergency response team at the scene
Emergency response team in the dedicated control centre
All other parts of the site
Fire / police / ambulance / service from the emergency response teams
Media
Water companies
Local Authority
Competent Authority
DEFRA (& equivalents in Wales and Scotland) especially for off-site
Adjacent premises
See also Organisational - Control
50. Do team members consider the procedures usable?
The procedures should be succinct (no more than two pages per role) and to the point. As a rule
the key elements of the procedures should be capable of assimilation in about 1 minute.
51. Are 'aide memoirs' such as charts, maps, and flow charts used where appropriate to remind staff of key
information?
Possible examples include: a scheme for warning and communication, telephone calls, lists of
personnel, services, authorities etc, organisation charts, chart for emergency assistance and
command.
52. Is information well structured in order to enhance communication & training?
Information Provision for External Organisations
53. Has (where appropriate) advanced information (e.g. site plans, inventories, shelter points and muster points etc)
been provided to external organisations?
54. Has chemical information been provided to the Ambulance service and hospitals e.g. MSDS sheets?
It is good practice for local hospitals to be briefed in advance about practical implications when
dealing with affected casualties i.e. pre- and during-incident exchanges between site and
hospital medics.
55. Can incident specific information be easily provided during the incident itself?
For example:
Confined space information, or details of particular processes in the area of the incident
Details of fire fighting strategy for specific plant areas;
Which are tailored to local conditions
Organising - Co-operation
Key Issues
Emergency response arrangements should encourage co-operation. A successful response will
need full co-operation between all the parties involved; the site, the emergency services and so
forth.
Inspectors should be able to determine this from feedback from earlier tests, which test the
interface between on, and off-site emergency plans. Observation of such a test will provide a
direct indication.
56. Do emergency response arrangements encourage co-operation between all parties?
The following are external agencies that may be involved:
The police, fire and ambulance services
HM Coastguard
Local authorities
Adjacent LA and emergency services
Environment agency
Health and Safety Executive
Health Authority
Water Company and other Utilities
Media
Voluntary organisations
Adjacent major hazard sites (e.g. domino effect & sharing resources)
Contacts and arrangements for obtaining further advice and assistance e.g. technical
advice
Meteorological e.g. wind direction and strength and forecast changes.
Planning & Implementing
Key Issues
Methods need to be in place for developing the emergency response arrangements and the
procedures contained within or referred to within those arrangements. The operator should also
be able to demonstrate that adequate resources are in place to implement the plan. Inspectors
should be satisfied that there are:
Clear site-specific procedures
Particular procedures include the setting up and use of the Emergency Control Centre (ECC),
muster & evacuation, decontamination, fire fighting, shut down, PPE, gas monitoring, first aid &
medical support
Planned interfaces between emergency responders
Efficient means of information handling.
Tailored to Local Requirements
57. Is the plan tailored to reflect the site / location?
The plan should not simply be a generic company document.
58. Is information about the specific site adequate and readily available?
Information that should be included (where appropriate):
The company products and personnel
The locality (egg residential population, industrial installations, prevailing winds, etc)
Site plans (including drains) and neighbourhood maps
Processes carried out
Hazardous materials used, stored and manufactured
Classification of hazardous areas
Equipment, buildings, storage
Transport (including vehicle access routes)
Special hazards
External risks (off-site)
Safety / emergency organisation
Fire-fighting materials, extinguishing equipment & water supplies
Information on the main buildings, plant/equipment and control rooms including (where
appropriate):
Substances, properties, hazards
Hazardous areas classification
Equipment containing hazardous materials
Stores
Numbers of people
Local organisation
Alert and Communication Facilities
59. Are the criteria for calling the internal/external emergency services unambiguous?
There should not be any doubt about what these are. Discussions on previous incidents and
what happened may help to clarify issues.
For some sites, an emergency will be declared in such a way that the emergency services do not
await confirmation but respond with an appropriate predetermined response for a major
accident.
60. Has a site-wide warning system been provided to enable everyone on site to be alerted to a major emergency?
61. Are site alarms clear and unambiguous?
Hazards requiring a specific, different response should be assigned a discrete alarm. N.B. The
number of distinct alarms should be manageable preferably no more than three).
62. Are communications facilities and information management systems tested regularly and realistically?
More than one telephone technology is desirable along with a back-up system in case of power failure.
63. Can radio systems use alternative frequencies?
The communication system should not solely rely on radios as they have high failure rates and
are not reliable in high noise areas.
64. Are the communication facilities adequate once people are mustered?
For example PA system with plant radios as backup.
65. Is a list of phone numbers of services, staff, external bodies, etc readily available?
66. Can it be demonstrated that the initial response team is able to cope for as long as it has to during out of hours
or at times when others have to be called in?
Demonstration will be required by showing the required training has been provided supported by
testing. This should cover all shift teams for example and for each type of hazard that is relevant.
67. Are effective arrangements in place for contacting and calling in staff during low manning periods (e.g. night
shifts, weekends, etc)?
These should be tested to ensure an appropriate speed and rate of response (for example testing
how quickly staff respond to pagers during out of hours periods).
68. Are there clear arrangements for alerting the public?
At major hazard sites equipped with public warning sirens, agreement should be reached
between the company and the external emergency services on the circumstances in which the
alarm can be sounded and who can order its sounding. This procedure should also be written
into the off-site emergency plan.
69. Can the company demonstrate that means of public warning (sirens etc) are effective and reliable?
Evidence is required of how this is tested and feedback recorded and acted on. Back-up power
supplies should be provided where necessary.
Emergency Control Centre
70. Is there an Emergency Control Centre, with sufficient resources to manage the emergency?
This will normally be the location occupied by the site main controller and others e.g. senior
officers of the external emergency services in attendance for tactical and operational command
& control.
Guidance can be found re the resources required by the ECC in HS/G 191 at Para 87 onwards. 3
main categories are required (HS/G 191 para 90).
Equipment for external off-site communications
Equipment for internal (on-site) communications
Site plans & maps to show clearly the current incident situation
71. Can non-permanent facilities be set up very quickly?
This will require clear instructions to be given, all equipment (telephones, fax machines, PCs,
etc) to be stored in an orderly way and on-site people trained to deploy efficiently.
72. Does the emergency control centre have a means of collating a record of who is on site and their location?
This information will be required by the emergency services upon arrival on site.
73. Can an alternative emergency control centre with the required resources be made available if the main one is
liable to be incapacitated during an emergency?
A means of moving from one to another needs to be established and practiced.
Muster and Evacuation
74. Can the company show that there is a sufficient number of muster points to allow those not involved in
emergency duties to gather?
This should include provision for contractors and visitors as well as for all company staff.
75. Has the location of muster points been carefully assessed?
There should be sufficient muster points to ensure safety, depending on wind direction. Hazards
such as blast (over pressure & flying debris) smoke, hazardous fumes etc should be considered
as part of this assessment. Muster points will generally be at safe locations outside, but a
number of companies identify havens located in buildings for people to resort to in the event of a
toxic release.
Guidance on havens can be found in the CIA's Guidance 'Safety in the design and location of
Occupied Buildings at hazardous installations'.
76. Are procedures in place to ensure that the number and identity of people at each muster point is noted, reported
to the emergency control centre and acted upon?
There must be practical arrangements in place to account for personnel and to identify any that
might be missing. Good practice is for central control to ring refuge rooms. Multiple telephones
trying to contact one point such as central control are likely to block lines. There should be
appropriate communication points at each muster point.
77. Does the muster point roll call include the assessment of potential casualties, and their location, as well the
factual roll-call information?
Casualties should be identified as a priority. The casualty identification system should operate
more quickly than the roll-call system, especially on larger sites.
78. Are appropriate arrangements in place to deal with emergencies of long duration?
This is a consideration for all major accident scenarios but is key for dealing with those people
who have traveled to a 'haven'. It may be preferable to move people from muster points to
alternative safe locations in such circumstances. There should be an appropriate contingency
plan in place to evacuate people from havens, where necessary.
79. Does the site have several evacuation routes?
This will make it possible to evacuate upwind of an incident. Criteria for deciding when and how
evacuation is appropriate should be established.
Decontamination procedures
80. Are decontamination facilities available and are staff trained in its use?
Chemical or radioactive contamination must be cleaned away before PPE is removed. Also
casualties need to be decontaminated before loading into ambulances.
81. Can the decontamination facilities be put into effect without delay?
82. Is there a policy to cope with casualties who are too ill or injured to be fully decontaminated?
This relates to how such casualties are handled. Protective arrangements for first aid/medical
staff, early warning to ambulance service/hospitals are issues to be covered.
On-site Fire Fighting
83. Is the overall fire fighting strategy clearly defined?
The fire-fighting strategies should address the range of on-site hazards, appropriate actions to
take, and means of preventing escalation. This should include any 'let burn' decisions, which
should be discussed with the fire service.
84. 84. Does the emergency plan include details of on-site fire-fighting expertise?
Site personnel should have expertise in chemical fire-fighting and gas-cloud handling. Managers
should be properly trained if they are to direct fire teams because this requires a high level of
fire-fighting competence.
85. Does the emergency plan include details of fire fighting facilities including materials, equipment and water
supplies?
86. Does the range the capability of fire fighting equipment match the on-site demand or can it be supplied in a
timely way by external fire service?
87. Is the location of fixed and mobile fire-extinguishing systems clearly indicated in procedures/maps/plans?
88. Is the location of fixed and mobile fire-extinguishing systems clearly marked?
These should be in line with the Safety Signs and Signals Regulations
89. Is a testing and maintenance regime in place for the materials and fire fighting equipment to ensure that it is fit
for purpose?
Documentary evidence is required that the regime is in place and actions taken on findings. The
frequency of equipment testing and maintenance should be regularly reviewed.
Safe Isolation & Shutdown
90. Is there a defined process in place for managing the isolation and shutdown of plant, processes and equipment
during the emergency?
91. Are there arrangements to check and test the integrity of isolations?
This should include provision of sufficient staff to keep essential services such as water
available during the emergency itself.
Personal Protective Equipment (PPE)
93. Is there sufficient PPE available to protect all personnel who may be at risk including staff, contractors and
visitors?
It may be useful if on-site breathing apparatus is compatible with that used by the Fire Brigade.
Often site personnel with local knowledge need to assist the Fire Brigade. Logistics are eased if
similar systems of the same duration are used. For example it is good practice for operator's
staff to work from the same BA control board as the Fire Brigade. This is a matter for discussion
with the Fire Brigade at the planning stage and then supported by the required training.
94. Has the location of PPE storage points been carefully considered?
For example, does it take into account the location of site hazards, evacuation routes etc?
95. Are the PPE storage points clearly marked?
These should be in line with the Safety Signs and Signals Regulations
96. Is there a testing and maintenance regime in place to ensure that the PPE is fit for purpose?
Documentary evidence is required that the regime is in place and actions taken on findings. The
frequency of equipment testing and maintenance should be regularly reviewed.
Gas monitoring
97. Are gas monitoring facilities and procedures in place?
There is usually a need to determine gas concentrations at key positions such as the site
boundary. Adequate resources and reliable equipment must be available to do this, but off-site
monitoring may not be reasonably practicable. Mobile monitoring may be used where this is not
likely to put people at risk in setting it up.
Medical
This should cover medical treatment, triage and casualty handling procedure - linking with the
ambulance service for casualty labeling and tracking.
99. Are first aid/medical facilities provided suitable (in so far as is reasonably practicable) to deal with immediate
effects of the emergency e.g. gas inhalation; burns?
100. Are personal records (e.g. next of kin, relatives, etc) readily available?
101. Is there a planned approach for accounting for casualties and evacuating them?
Resourcing
102. Can the operator demonstrate that it has provided sufficient resources to enable appropriate
development and testing of the emergency plan relative to the foreseeable major accident scenarios identified in
the COMAH Safety Report?
103. Can the operator demonstrate that it has provided sufficient resources, so far as is reasonably
practicable, to contain the major accidents identified in the safety report until the emergency services arrive?
[See also COMAH Safety Report].
'Resources' refer to both manning levels and equipment.
Inspectors should have considered this demonstration as part of the COMAH safety report
assessment. The operator should be able to support the demonstration by giving information
about the results of testing the emergency plan.
The adequacy of manning levels should be assessed by considering:
The worst foreseeable major accident scenario, identified as foreseeable in the COMAH
safety report;
Including periods where the manning levels are lowest such as 'out-of-hours' or 'call-in'
situations.
When deciding on the manning levels required to deal with emergencies, it is preferable to
initially 'man-up' beyond perceived requirement, and then 'man-down' later.
104. Are arrangements in place for individuals to take responsibility on behalf of others in order to cope with
the full range of possible circumstances?
This includes coping out-of-hours and with the absence of personnel.
105. What resources are available on site and what additional resources could be quickly obtained?
The following are examples that would normally be expected to be available where relevant for
the identified major accident scenarios:
Fire and toxic gas alarms
Fire-fighting equipment, e.g. assured water supply, hose reels, etc
First aid facilities
Sandbags or other absorbent materials
Windsock or flag (illuminated at night)
Radiophone or telephone backup
The following additional resources may be on-site or there should be arrangements to make
them available, where necessary. Details of where the resources are to be obtained from should
be readily available during an emergency. Performance measures for obtaining these should also
be available i.e. clear timescales. These should be consistent with the major accident scenarios
and the risk assessments argued in the COMAH safety report.
Heavy lifting gear
Bulldozers and other transport facilities for movement of equipment
Specialised fire-fighting equipment
Extra communications equipment e.g. loudhailers, two-way radio
Water spray or curtains
Standby water supplies e.g. pump out of Local River
Specialised protective clothing
Atmospheric monitoring equipment
Gas dispersion expertise
Emergency engineering work, egg provision of emergency lighting, temporary
modifications, oxy-acetylene cutting equipment, ladders or scaffold etc
Medical facilities, including specific antidotes where necessary
Extra breathing apparatus
Specific neutralising agents, antidotes or absorbent materials
Access to firms or individuals with specialised chemical knowledge, laboratory facilities,
computing expertise, etc
Containment equipment for materials that get into waterways, e.g. strategically placed
boom
Early warning devices, e.g. smoke detectors.
Additional resources can often be obtained from nearby sites. Where these are to be relied upon,
then there should be formal agreements in place.
Measuring Performance
Key Issues
The emergency response arrangements need to be thoroughly tested. Testing is essential to
make sure that the arrangements are suitable, accurate and capable as working as intended.
Inspectors should be satisfied that there are:
Well-rehearsed procedures.
Rehearsed interfaces within on-site teams and between those teams and various responders.
And that these are tested by those who have the skills and knowledge to do so.
106. Is there a testing programme in place to regularly test and improve the effectiveness of emergency
arrangements?
The testing programme should include drills and exercises to test a range of scenarios.
107. Who conducts and evaluates these tests?
For the test to be worthwhile, the person running the test should have the skills and knowledge
in the emergency response matters being tested, the necessary technical knowledge and be able
to understand and evaluate what is happening during the test.
108. Do the scenarios selected, test across a wide range of the worst foreseeable and lesser, more realistic
events?
109. Do the scenarios respond to actions taken by the emergency team, rather than leading them through the
exercises?
This question is aimed at developing the scenario in response to the actions of the emergency
team. This would require some skill by the 'tester' and would need some planning in setting up
the test to develop the scenario, depending on the actions of the team. Computer based tests,
which are often aimed at command and control skills can be programmed to respond to actions
being taken place by the team.
110. Is the testing scenario ever moved beyond the procedural envelope, so that the flexibility of the
arrangements can be tested?
For example, are there scenarios, which have been discounted by the safety report because they
were not considered foreseeable, but could be used to test how well the arrangements work
beyond their original scope.
111. For each exercise, are there clearly defined exercise objectives?
The objectives of the exercise need to be met. However, if the scenarios change sufficiently, as
discussed above, then the exercise may never get to the part that is to be tested.
112. Are appropriate types of exercise selected?
The purpose of an exercise with its objectives should be clear. Some examples of tests and their
value are outlined below.
Drills - testing a specific and relatively simple aspect of the emergency plan in isolation.
Examples are fire drills; roll call and searching; cascade telephone calls; spillage control
and recovery;
Seminar exercises - training of staff and developing emergency plans. The facilitate
discussion about different organisations responses in particular circumstances during
an emergency.
Walk through exercises - training staff or developing emergency plans. The emergency
response is "walked through" , including visiting appropriate facilities such as Emergency
Control Centres;
Tabletop exercises - allowing information exchange and dissemination between
organisations at the emergency control centre, together with decision making to be
tested. They are carried out in relation to a model, plans or photograph to depict the
establishment. They could involve using information technology or virtual reality
systems;
Control post exercises - testing the communication arrangements during an emergency,
with participating organisations located where they would be during an emergency;
Live exercises - fully testing some or all aspects of the emergency plan for the on-site
and off-site response. These exercises will be costly.
113. Do the emergency exercises used simulate so as possible a real emergency and do they keep to a
realistic time-line?
114. Is an adequate range of staff involved in the exercises?
This should include practising taking on other roles, for example, covering for the absence of
colleagues.
115. Does the testing programme incorporate some exercises that involve collaborating with off-site services?
116. Is there careful observation of the response of key players during an exercise?
This can be used to study the effectiveness of training of the decision makers and their
suitability for involvement in emergency response.
Audit & Review
Key Issues
Audit and review is essential to the effective development of the emergency response
arrangements. It is only by reviewing the emergency response arrangements (e.g. by means of
post exercise de-brief) can the emergency response be amended and adapted to address the
shortcomings identified by the emergency response exercises. Review of the emergency
response arrangements should also take place after changes on site.
117. Is information from the testing programme used as the basis for evaluating and improving the
emergency plan?
For example, the command and control structure and interfaces should be reviewed on a regular
basis.
It would be valuable to know what information is recorded and collated from testing to inform
any such review.
Evaluation of adequate resources is a key element of a review and should inform any changes
proposed to the procedures.
118. Is the frequency and nature of the testing programme itself periodically reviewed?
119. 119. Is there a process in place for evaluating team performance?
This should address issues such as whether the team brought the emergency under control,
saved life, whether the team performed well together, where were the weaknesses.
120. Can it be shown that the plan reflects lessons learned from previous incidents/exercises?
Management of Change
121. Is there a formal review process in place that is initiated following any significant changes to plant/
process/ location/ personnel or after a defined period?
The review process should consider the impact of change to plant/ process/ location and
personnel COMAH at Regulation 8 requires a review and also revision of the safety report where
there are changes that have significant repercussions with respect to the prevention of major
accidents or the limitation of consequences of major accidents to persons and the environment.
A management of change system should include confirmation as to whether a Regulation 8
review is required and a record of the conclusions. As a result the safety report and the on-site
emergency plan may require amendment. Where possible, the operator should attempt to
maintain the continuity of key personnel in emergency roles. Where this is not possible, an
emergency response review process should be triggered.
[1] Except where the LA has been exempted from preparing an off-site emergency plan
RCS 9 - PLANT COMMISSIONING
Introduction Planning and Implementing
Policy Measuring Performance
Organising - Control Auditing
Organising - Co-operation Reviewing Performance
Organising - Communication Example Questions For Interviews
Organising - Competence
INTRODUCTION
This risk control system relates to the inspection and testing of constructed plant prior to commissioning and to
commissioning procedures. It includes the systems in place to ensure that inspection and testing work is carried out
correctly and to standard. The RCS covers all construction projects as well as all installations of new equipment to
existing plant. Examples of failures that comprehensive construction work inspection should detect are the installation of
wrong equipment; installing equipment at the wrong location; incorrect installation of equipment and the likelihood of
damage from dropped objects during construction projects. Other failures should be picked up using specialist inspection
and testing techniques, such as NDT. Plant commissioning failures may relate to the leak testing of as built plant,
mechanical breakdown of new and unused parts or to software problems with plant control software.
POLICY
Key Issue:
Senior management should lay down a clear policy and objectives for the inspection and testing of constructed plant
prior to commissioning and to plant commissioning procedures to ensure that loss of containment of hazardous
substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.
Key Characteristics:
The overall objective is to construct, check and test a plant according to the best worldwide and industry practice
and to commission the plant and assess its safety performance, so as to bring the plant to a safe normal
operational state.
ORGANISING - Control
Key Issue:
Responsibilities for the following should be clearly allocated and accepted by the individuals and teams:
o overall management of a construction/commission project;
o overall management of an inspection/testing programme during construction and commissioning.
Key Characteristics:
The system should be adequately resourced in terms of time and money. The system for inspection and testing
during construction and commissioning should include specification of roles and responsibilities for:
o specifying which inspections and tests are required;
o integrating all functions into the construction process (builders and managements, site engineers and
management, inspection and testing people, operations etc);
o the scheduling of the inspection and testing throughout construction projects;
o overseeing the handover of the plant to operations personnel, and ensuring that plant is in a safe state to
operate and all checks have been completed;
o provision of aids e.g drawings/diagrams.
Details of job descriptions should be given and may include lines of reporting, roles and responsibilities, skill
requirements and liaison lines.
Specific hazards such as lifting over live plant should be controlled by relevant plans.
ORGANISING - Co-operation
Key Issue:
Individuals involved with the construction and commissioning of plant should cooperate to ensure a successful outcome.
Inspection and testing during construction and commissioning should be built into the time schedules and the plant
brought safely up to normal operational conditions.
Key Characteristics:
The system for plant construction and commissioning should provide procedures for dealing with problems
identified by construction, inspection and testing.
Procedures for hand-over from construction to commissioning to normal operations.
Recognition of schedule and cost pressures and procedures for the resolution of conflicts.
The inclusion of checking of construction and commissioning in critical path analyses of the project. Attention
should be given to how allowance is made for implementing the results of checks on construction work, such as
building a buffer into the project schedule to take account of rework.
ORGANISING - Communication
Key Issue:
Formal and thorough communication between all parties involved in construction/commissioning.
Written instructions are adequate concerning construction/commissioning of the plant type based on worldwide/industry
standards.
Key Characteristics:
The system for plant construction/commissioning should ensure a forum exists for accessing industry guidance
and corporate expertise on plant construction and commissioning.
Documentation is available on construction/commissioning tests and inspection requirements. Guidance may
include:
o the criteria with which to determine inspection and testing requirements for different categories of
construction work, such as pressure tests for pipes carrying hazardous materials;
o the types of test to be carried out for different types of equipment;
o quality requirements for inspection and testing of equipment e.g for various categories and kinds of weld.
A method of document control for P&IDs.
Oral communication e.g about hazards of adjacent live plant.
Learning from previous construction experience/incidents.
A system of communicating problems in executing the construction/inspection and testing programme to senior
management.
ORGANISING - Competence
Key Issue:
Individuals involved in plant construction/commissioning are competent to achieve the objectives. Competencies in terms
of knowledge, skills and experience are clearly defined and reviewed. Selective criteria for staff and constructions are
clearly laid down.
Key Characteristics:
The system for inspection and testing during construction and commissioning should ensure:
o optimal use of company experience on large scale construction projects and experience of installation
sections of new or modified plant;
o access to competent and experienced construction inspectors;
o access to adequate equipment and information for construction/- commissioning;
o well defined competencies of staff and contractors;
o the control of contractors for example using accredited contractors whose employees are familiar with
the plant type;
o training programmes to ensure personnel have the correct qualifications and knowledge.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Methods for developing inspection and testing requirements for construction and commissioning.
Procedures for inspection, testing and commissioning standards, including mandatory requirements for inspection and
testing.
Support such as equipment, checklists, diagrams etc, for inspection and testing of construction and commissioning.
Key Characteristics:
There should be a process hazard analysis performed using one or more established methodologies to identify,
evaluate and control the hazards involved in the process.
The hazard analysis should address:
o the hazard of the process;
o engineering and administrative controls applicable to the hazards and other inter-relations;
o consequences of failure of these controls.
Procedures should be available which are clear, easy to follow and used to cover inspection, testing and
commissioning of new plant.
Procedures should be developed to incorporate industry standards, codes and mandatory requirements.
There should be a safety review and an inspection prior to commissioning. The pre-start up safety review should
confirm that prior to the introduction of highly hazardous chemicals to a process:
o construction is in accordance with design specifications;
o safety, operating, maintenance and emergency procedures are in place and are adequate;
o process hazard analysis recommendations have been addressed and actions necessary for start-up
have been completed;
o operating procedures are in place and training of each operating employee has been completed.
Support should be available in terms of safety equipment, equipment, checklists etc, for construction testing and
inspection and for commissioning.
Checks are required for newly constructed plant, for modified plant and plant additions. These may cover:
o improper welds;
o installing bursting discs upside down;
o failing to connect pipes to connections, or failing to fully engage valves to pipes etc;
o use of wrong materials (such as carbon steel instead of stainless steel, or use of titanium flanges in lines
with dry chloride);
o flanges mounted under tension;
o packing of pipes;
o cracks in welds;
o siting of bellows in wrong place on pipe (causing lateral thrust on bellows);
o failure to connect all instrumentation and controls (such as level gauges to alarms);
o the checks may also include a pre-planned set of pressure tests, leak tests and electrical tests.
Plant commissioning may cover:
o leak tests for all equipment probably using nitrogen;
o controlled introduction of process fluids, checking temperatures, pressures, flows and so on;
o control loop tuning to adjust the plant process conditions;
o establishing the correct trip conditions;
o consideration of plant control software reliability.
MEASURING PERFORMANCE
Key Issue:
The plant construction/commissioning testing and inspection system should be monitored to measure its performance.
Key Characteristics:
Inspection and testing results should be reported to plant management and engineering personnel.
Active monitoring of the construction/commissioning inspection and testing programme, for each phase of the
process.
AUDITING
Key Issue:
The plant construction/commissioning system should be periodically the subject of a formal audit. The auditors should
not be part of the system or have responsibility for it, i.e they should be independent of the function being audited.
Key Characteristics:
The audit should check that performance measuring and review are occurring at the correct frequency, are
addressing the right issues, appropriate information flows occur at specified periods to senior management. It
would be reasonable to expect an annual review.
REVIEWING PERFORMANCE
Key Issue:
Information from 'measuring' and 'auditing' is used to make judgements about the performance of the plant
construction/commissioning system and is used to make decisions about improving performance.
Key Characteristics:
Periodic reviews of the plant construction/commissioning system.
Revision of the system in the light of data collection and incident analysis - learning from experience.
Scope to review and revise the system during construction.
Identification of problems and follow-up as a result of construction inspection and testing.
Updates of standards of inspection and testing.
Use of incident analysis to revise procedures.
EXAMPLE QUESTIONS FOR INTERVIEWS
OBJECTIVE
1. What is the policy regarding the conduct of systematic checks on the adequacy of inspections and testing during
construction?
2. What is the policy on the use and control of construction contractors?
3. What is the policy regarding the priority given to inspection and testing within construction projects in relation to,
say, the close out of projects and the start up of plant?
4. What is the policy for commissioning new plant?
ORGANISING - Control
5. What is the allocation of responsibility for arranging inspection and testing of all equipment at each stage of the
construction process?
6. For whom are job descriptions available within construction project teams, including contractors and what details
do those job descriptions provide?
7. What specific controls are in place on the hazards of lifting equipment over live plant during construction or
installation work?
8. What specific controls are in place for installation work that involves hot tops into 'live' pipelines?
9. What is the allocation of responsibility for matching appropriate checking, inspection and testing standards to
items of plant?
10. How are responsibilities allocated for scheduling construction inspection and testing?
11. What is the allocation of responsibility for assessing and meeting resource demands of checking and testing
construction and installation work?
12. What is the allocation of responsibility for producing and supplying construction inspection and testing aids such
as diagrams and drawings?
13. What documentation is available on the responsibilities of persons in control of resources for construction
inspection and testing such as job descriptions?
ORGANISING - Co-operation
14. What are the procedures for dealing with problems identified by construction, inspection and testing?
15. What is the means of handover from construction to operations?
16. Are inspections and tests regarded as an integral part of the construction process or as an additional
requirement?
17. Which are the schedule and cost pressures upon the construction, inspection and test programme?
18. What is the procedure for resolving conflicts between time needed to conduct construction inspection and testing
and completion schedules?
19. What is the process for allocating time and budget to the checking of construction work and installation work?
20. What is procedure for reorganising construction inspection and testing in the light of experiencing conflicting
pressures?
21. Do time or schedule pressures ever severely restrict the amount of inspection and testing of construction work?
ORGANISING - Communication
22. What means is there for accessing regulations and industry guidance on the inspection and testing of
construction work prior to commissioning?
23. What documentation is available on construction tests and inspection requirements?
24. When design changes are made during the construction phase, what are the communication requirements
between design and construction personnel?
25. What are the procedures for communicating between personnel with regard to commissioning requirements and
procedures?
26. What is the process of communicating problems in executing the construction, inspection and testing programme
to senior management?
27. What documentation is available on inspection and testing of construction and installation procedures and
standards to be followed?
28. What documentation is available on the procedures for resolving conflicts between construction inspection and
testing and project close-out schedules?
29. What is the system for documentation control such as P&IDs and equipment specifications, for use in
construction, inspection and testing?
30. Are construction personnel made aware of the hazards of live plant adjacent to the construction area?
ORGANISING - Competence
31. What experience does the company have of checking inspections and controlling construction projects and
installation work?
32. What is the level of access to competent construction inspectors?
33. What is the level of access to information and equipment used in carrying out construction inspection?
34. What is the level of access to experienced construction contractors?
35. What is the allocation of responsibility for ensuring that inspectors, including contractors are competent?
36. What is the method for ensuring that those responsible for checking the adequacy of construction work are fully
and adequately competent?
37. What is the method for taking into account a contractors track record in the contractor selection process?
PLANNING and IMPLEMENTING
38. What are the methods for developing inspection and test requirements for specific construction projects?
39. What are the systems for ensuring that all required tests and checks on newly constructed or modified plant have
been carried out?
40. Does the level of inspection and testing vary with size of construction/- installation job? If so, who assesses the
requirements?
41. What is the applicability of codes, regulations, corporate standards, insurance requirements, etc, for governing
checks on adequacy of construction and installation work?
42. How are construction inspection and testing requirements integrated into internal codes and standards?
43. What are the mandatory requirements in force regarding the performance of construction checks on safety
critical items?
44. What is the procedure for producing a detailed list of checks to be conducted throughout the construction
process?
45. Are checklists/diagrams/written procedures provided for construction work inspection?
46. Is there a procedure for ensuring appropriate equipment is available for carrying out inspections/tests, such as
NDT equipment?
47. Is there a procedure for selecting and preparing necessary safety equipment required during construction work
checks or commissioning activities?
48. Is there evidence of insufficient procedural or checklist type guidance being given to construction inspectors?
49. How have commissioning procedures been developed?
50. Does commissioning cover:
leak testing of all equipment?
progressive introduction of process fluids?
control loop tuning to obtain the required operational conditions?
consideration of safety trips?
consideration of control software reliability?
MEASURING PERFORMANCE
51. What checks are required for newly constructed plant, for modified plant and plant additions?
52. What is the procedure for reporting results of inspection and testing from construction inspectors, to plant
management and engineering personnel?
53. What is the method of monitoring progress of the construction inspection and testing programme?
54. What is the allocation of responsibility for monitoring and auditing the performance of the construction inspection
and testing programme?
55. What is the system used to monitor and review effectiveness of procedures used for construction and installation
work?
56. What is the procedure for carrying out audits of each phase of the construction, inspection and testing
programme?
57. What records are kept on problems or faults identified during the inspection and testing of newly constructed or
installed plant?
58. Are aides, such as log books, supplied for recording data and information arising from checks on construction
work?
AUDITING
59. Are independent personnel available to carry out checks on the adequacy of construction work?
REVIEWING PERFORMANCE
60. What is the means of revising the system of construction management?
61. Describe the method for reviewing inspection and test procedures during a construction project?
62. How is it ensured that follow-up requirements for problems identified by construction inspection and testing are
carried out as specified?
63. What is the system for learning lessons from previous construction inspection and testing programmes?
64. What is the evidence that construction inspection and testing procedures have been revised in the light of
indication of construction faults?
65. Has incident analysis identified insufficient checking of construction work?
66. What is the allocation of responsibility for reviewing the performance and appropriateness of the organisational
systems for managing resources for inspection and testing of construction work? Is there a procedure by which
lessons learnt are recorded and conveyed to construction inspection and testing personnel?
RCS 10 - PLANT AND PROCESS DESIGN
Introduction Organising - Competence
Policy Planning and Implementing
Organising - Control Measuring Performance
Organising - Co-operation Auditing
Organising - Communication Reviewing Performance
INTRODUCTION
This RCS concerns the development, implementation and application of safety engineering codes, standards and
procedures to the design of new plant. It covers both the design of safety devices, such as PRVs and emergency
shutdown systems, and the correct design of piping and vessels in terms of materials, process parameters and control
systems to prevent and control hazards such as overpressure, corrosion and erosion.
POLICY
Key Issue:
Is there a clear policy covering the design of new plant and processes to ensure that loss of containment of hazardous
substances does not occur and that the health and safety of the workforce and members of the public are safeguarded.
Key Characteristics:
Plant and processes which have been designed by competent and experienced people according to the best
standards available, on an industry-wide or world-wide design basis.
The design process should be adequately resourced to ensure that sufficient time is allowed for the proper
design and evaluation plant and processes and that sufficient competence people are deployed on the tasks.
ORGANISING - Control
Key Issue:
Is there an adequate management structure to implement the policy on plant and process design?
Key Characteristics:
Responsibilities for the following:
o Overall design safety;
o Control of contracted out design;
o Risk assessment of proposals - HAZOP etc;
o Design acceptance;
o Division of design responsibilities e.g mechanical, instrumentation;
o Quality Assurance of plant process design;
o Control of design changes;
o Record keeping for design specification and P & I Diagrams etc.
Clearly allocated and accepted by the individuals and teams:
o Personal responsibilities in job descriptions, performance standards or recorded elsewhere;
o Objectives set for individuals with key tasks in the design process;
o Performance of those with responsibilities for design processes subject to routine appraisal.
ORGANISING - Co-operation
Key Issue:
Are there adequate and appropriate arrangements to secure the trust, participation and involvement of persons included
in plant and process design?
Key Characteristics:
Individuals, including specialist contractors, involved with the design process should cooperate to ensure a
successful outcome, balancing safety, production and time pressures.
Conflicting project engineering goals should be successfully managed, e.g the need to get new plant operational
and the need to complete safety reviews.
The role of external specialist contractors should be explicitly integrated into the design process.
Arrangements for consultation between designers and also with construction, production and maintenance
personnel should be in place.
ORGANISING - Communication
Key Issue:
Are there adequate arrangements to secure information flow to, from and between those involved in plant and process
design.
Key Characteristics:
Formal and thorough communication between all the parties involved in the design processes, including external
contractors. Consideration should be given to flows of information both verbal and written and to forums to allow
communication to take place.
Information about new activities, changes in legislation or workplace controls from reviews and audits effectively
communicated to people involved in plant and process design.
Adequate systems to provide information on design specifications, tolerances and parameters to those involved
in plant commissioning.
Adequate systems for drawing up and communicating operational and maintaining instructions from design
specifications.
Adequate systems to provide information on the pilot or trial operations and subsequent scale up.
The company should maintain an up to date knowledge of industry standards and guidelines via meetings,
documentation etc.
Documentation should describe safety engineering codes, policy, design procedures, HAZOP procedures etc.
Design procedures to include information on the risks arising in plant construction, operation and maintenance
and decommissioning of plant and equipment.
Adequate records kept of design specifications, results of HAZOPS, P & I Diagrams etc.
Modern standards, regulations, codes of practice and corporate design standards should be available on safety
engineering and process safety.
ORGANISING - Competence
Key Issue:
Are there systems and arrangements to secure the competence of those working on plant and process design?
Key Characteristics:
Individuals involved in design are competent to achieve the design objectives.
Competencies in terms of knowledge, skills and experience are clearly defined and regularly reviewed.
Selection criteria for staff and contractors clearly defined.
Design personnel familiar with the hazards associated with plant and processes and information provided to
them from operational experience following commissioning.
Adequate training of design personnel.
Training programmes for formal methods: HAZOP, QRA, FTA.
Selection of a design team of the appropriate composition including, where appropriate, operators.
Training records kept outlining qualifications and skills of design personnel.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Are there adequate processes to generate plant and performance standards to implement the policy on plant and
process design?
Key Characteristics:
Criteria on when formal design procedures are to be used should be clearly defined.
Performance standards developed for the design procedures detailing the key stages in the process, who and
what disciplines are involved, what safety reviews should be undertaken and how decisions on the final design
specifications are made and recorded.
Industry norms should be included in standards, hazard analysis procedures and design codes.
Information sources from both within and outside of the company on the hazards associated with the plant and
the appropriate measures to be taken should be used.
Safety of software should be considered.
Ergonomics principles should be applied.
Formal methods; HAZOP, QRA, FTA should be used in the design process. World-wide experience of hazards
and incidents on the plant-type should be incorporated in the design.
Safety analyses and risk assessments should cover all possible causes of component failure, examples might
be:
o adequacy of pressure relief arrangements under normal and extreme conditions;
o checking line connections do not allow entry of incompatible materials or contaminants;
o selection of correct construction materials;
o adequate inerting capacity;
o venting is to safe environment;
o adequacy of specifications for likely operation pressure levels;
o load capacity of welds, supports etc;
o valve blockage hazards;
o ignition source hazards, such as static electricity;
o protection against corrosion and allowance for erosion;
o pipeline specification allows maximization of flow;
o vibration from nearby equipment.
MEASURING PERFORMANCE
Key Issue:
Is there adequate and sufficient measurement of the performance of the plant and process design system?
Key Characteristics:
The plant/process design system monitored to measure its performance.
Failures and problems within the plant/company associated with design should be recorded and made available
to designers.
Measures of performance may include compliance with design procedures, and the adequacy of transfer of
information to those involved in subsequent stages e.g construction, commissioning, operational maintenance
etc.
Measurement of performance may be undertaken as part of quality assurance systems.
Some degree of independence of those involved in measuring from those involved in design is advantageous e.g
a mixture of self checking and independent checks.
AUDITING
Key Issue:
The plant and process design system should be subject to formal audit by people who are independent of the system or
element being audited.
Key Characteristics:
The audit should examine the effectiveness and reliability of the whole of the plant and process design system and
produce plans for corrective action where necessary.
REVIEWING PERFORMANCE
Key Issue:
Is there adequate and sufficient review of the performance of the plant and process design system?
Key Characteristics:
Information from "measuring and auditing" is used to make judgements about performance of the design process
and to make decisions about improvements.
The plant/process design system should be reviewed periodically e.g. old HAZOP's may be reviewed.
Lessons learnt from previous safety studies are used in the current design.
Information about problems, hazard and risks of plant and processes used to improve the design process.
RCS 11 - ASSESSING AUDITING
Introduction Organising - Competence
Policy Planning and Implementing
Organising - Control Measuring Performance
Organising - Co-operation Auditing
Organising - Communication Reviewing Performance
INTRODUCTION
This section deals with the management arrangements for the independent assessment of the validity, reliability and
effectiveness of the health and safety management system. (NB - independent means independent of line management
normally in control).
Key Issue:
Are there effective audit arrangements for the Health and Safety Management System (HSMS)?
POLICY
Key Issue:
Are the purpose, scope and limitations of the audit arrangements adequate and clear?
Key Characteristics:
Recognition of the importance and role of auditing within the health and safety management system.
Clear understanding throughout the organisation of the purpose of auditing.
Recognition that auditing has limits, is an integrated part of the HSMS, and is not isolated, standalone or self
perpetuating.
Scope covers all levels of the HSMS i.e the management arrangements, risk control systems and workplace
precautions.
Commitment at all levels to auditing.
Commitment to act on results of auditing.
Recognition of the need to allocate appropriate resources for both undertaking auditing and carrying out any
remedial actions.
Principles upon which audit is to be applied, for example, audit seen as a tool for improvement rather than "fault
finding".
Recognition that different types of audit may have different objectives, for example, self assessment compared
with external assessment or technical audits.
ORGANISING - Control
Key Issue:
Is there clear and effective allocation of audit responsibilities and are arrangements in place for holding individuals
accountable?
Key Characteristics:
Appointment of a coordinator, custodian or champion of the audit process.
Roles and responsibilities of the audit team are clear to both team members and others within the organisation
who need to know. For example, the distinction between corporate and local auditing functions; and the role
health and safety managers/advisors play.
Auditors have degree of independence.
No conflict between audit responsibilities and other job demands.
Personal performance standards for auditors exist, for example, auditor is required to undertake x audits, to y
procedure, according to z programme.
Auditors are held accountable for their performance.
ORGANISING - Co-operation
Key Issue:
Are there adequate arrangements to secure the trust, participation and involvement of everyone undertaking and
affected by the auditing activity?
Key Characteristics:
Audit programmes and sampling are discussed and determined both within the audit team and with others
affected (for example, audited system managers) by the audit activity.
Employees are encouraged to take part and provide input to the audits.
Employees are involved in planning and monitoring remedial actions.
Arrangements to resolve disputes and conflicts with audit findings.
ORGANISING - Communication
Key Issue:
Are there adequate arrangements to secure the information needs of everyone involved or affected by the audit
process?
Key Characteristics:
Those who need to know are aware of the audit purpose, scope and training requirements.
J udgement criteria are transparent.
Communication needs during preparation, on site and follow-up phases of the audit process have been identified
and catered for.
Audit findings are reported and communicated to those who need to know.
Audit best practice (both from internal and external sources) have been identified and used to inform and
develop the audit process.
ORGANISING - Competence
Key Issue:
Are there systems and arrangements to secure the competence of everyone involved in auditing?
Key Characteristics:
Auditor selection criteria are used.
Auditors have appropriate training and experience.
Lead auditors have additional and appropriate skills, knowledge and experience.
Auditor competence may include:
o planning and organising skills;
o interpersonal skills;
o communication skills;
o respect and authority relative to people being audited;
o awareness of company or industry best practice.
Arrangements to assess and monitor auditors competence.
Arrangements to update and refresh auditors/lead auditors.
(See also RCS 12 'Assessing Competence' in this Chapter).
PLANNING and IMPLEMENTING
Key Issue:
Are audit plans, procedures and performance standards generated from a planning process which is based upon the
hazard profile and/or legal requirements of the area being audited?
Key Characteristics:
All levels of the HSMS are subject periodically to auditing i.e the management arrangements, risk controls
systems and workplace precautions.
Criteria for drawing up the audit programme (i.e to determine where to go and what to look at) for example:
o the relative significance of hazards present (both on and between sites);
o accident and ill health history;
o health and safety policy requirements and current means of implementation;
o inspection and other active monitoring and risk information;
o results of previous audits;
o a significant change has occurred.
Procedures for audit planning and the audit process.
The audit process requires:
o objectives and terms of reference of each audit to be clearly identified;
o an emphasis on improvement;
o recognition of good as well as poor performance;
o looking to test whether system(s) is in place, adequate, implemented and effective;
o the use of 3 sources of information i.e documentation, interviews and observation.
The audit methodology ensures consistency and reliability throughout, for example, ensuring during:
Preparation that:
o Adequate steps and controls are in place to ensure the audit process will meet its objectives;
o The composition of the audit team is adequate for the task;
o The right sampling, decisions (depth, time and numbers) have been made to properly explore the issues
being examined;
o Adequate and objective criteria and standards have been used to make judgements against;
o Auditors arrive on site properly briefed and prepared;
o Full and appropriate use has been made of the information sources available. For example, the nature
and depth of prepared questions are proportional to the significance of the issues to be explored.
On site activity that:
o There is an initial briefing to inform everyone who needs to know of the audit process and outputs;
o Interviews are structured to ensure that the information is collected in an effective and painless way;
o Verification is determined and undertaken;
o Initial feedback on the audit findings is provided, for example, at a wash up meeting;
o Full and appropriate use has been made of the information sources available.
Follow-up that:
o Audit findings are reported;
o The organisation being audited is required to take remedial action in relation to the audit findings, for
example, to produce an action plan;
o Audit findings are recorded.
o Adequate and comprehensive performance standards established to enable the audit process to be
effectively measured and reviewed, for example, audit reports must be submitted within x days of
completing the on-site activity.
MEASURING PERFORMANCE
Key Issue:
Are there adequate arrangements to measure the performance of the auditing system and investigate sub-standard
performance?
Key Characteristics:
Information is routinely collected which compares audit performance at each phase with predetermined
standards.
Sub-standard performance and complaints are investigated.
Periodic 3rd part verification of audits is undertaken where required, for example, for self assessment audits (NB
- 3rd party does not necessarily mean from outside the organisation).
Findings are analysed to identify common trends.
AUDITING
This section has not yet been drafted.
REVIEWING PERFORMANCE
Key Issue:
Is there an effective review of the audit system to ensure continuing improvement and effectiveness?
Key Characteristics:
Audit programmes are assessed against performance indicators, for example, plans and % recommendations
closed out.
Assessment of the influence auditing is having on the overall improvement process.
The effectiveness of the audit process is examined, for example, the suitability of the sampling decisions.
The audit process and performance is compared with external benchmarks, for example, other organisation's
audit arrangements.
RCS 12 - ASSESSING COMPETENCE
Introduction Organising - Competence
Policy Planning and Implementing
Organising - Control Measuring Performance
Organising - Co-operation Auditing
Organising - Communication Reviewing Performance
INTRODUCTION
This agenda deals only with health and safety training development and competence. It does not deal with the
assessment of the adequacy of professional health and safety advice or the adequacy of health and safety departments.
Training in this context includes formal off-the-job training, instructions to individuals and groups and on the job coaching
and counselling.
POLICY
Key Issue:
Is there an effective recruitment, training and development (RTD) policy to secure competence in Health and Safety?
Key Characteristics:
Good practice suggests effective RTD policies for health and safety are:
o overseen by a senior manager and adequately resourced;
o competence-based and where appropriate relate to relevant NVQ, SVQ or other Lead Body standards
(sometimes NVQ, SVQ etc may not specify in detail the appropriate health and safety precautions etc.
They will often need complementing with organisation specific information to ensure adequate coverage
of health and safety);
integrated with other business training and development;
clear as to purpose and comprehensive - covering the health and safety needs of all levels of
employee - including management.
ORGANISING - Control
Key Issue:
Is there an adequate management structure to implement the policy?
Key Characteristics:
Responsibilities are assigned for:
o supervision of the overall system to secure competence so that it remains effective in changing times e.g
a custodian or "champion";
o assessing health and safety aspects of potential recruits against job specifications;
o identifying training and development needs and developing training and development plans (for
individuals or groups);
o delivering appropriate training or learning activities (except where outside organisations are used);
o providing coaching, counselling and instruction;
o supervising 'trainees' who are not yet fully competent;
o evaluating the standard and effectiveness of training and development (provided by the internal and
external providers) which should include the senior manager responsible;
o assessing competence;
o monitoring and maintenance of the overall system and securing any necessary improvements in the
system or the type and standard of training provided.
ORGANISING - Co-operation
Key Issue:
Are there adequate arrangements to secure involvement in health and safety training and development?
Key Characteristics:
Health and safety training and development plans and evaluations are presented and discussed at health and
safety committees.
Individuals and/or groups are consulted in identifying training and development needs and choosing appropriate
learning methods.
Suitably capable employees have opportunity of involvement in delivery of training and development activities.
ORGANISING - Communication
Key Issue:
Is there adequate information to support the policy?
Key Characteristics:
Recruitment forms covering health and safety aspects.
J ob specifications detailing physical and mental ability, appropriate medical screening and competence
requirements relevant to health and safety (for all levels).
Records of training needs analysis.
Training plans and records.
Training materials; lesson plans, handouts, OHPs.
Training evaluations and records of assessment of competence.
ORGANISING - Competence
Key Issue:
Are those recruiting, training, developing and assessing competence themselves competent in implementing the policy?
Key Characteristics:
Personnel and training specialists have achieved competence by experience and/or qualification e.g Institute of
Personnel and Development Membership, Meeting Training and Development Lead Body Standards.
Those in management and supervisory jobs undertaking training needs analysis, training and coaching, have
received training and/or have access to appropriate support and advice.
Those assessing competence (including external assessors) take due account of health and safety requirements
- especially where competencies are assessed against NVQs, SVQs or similar standards.
PLANNING and IMPLEMENTING
Key Issue:
Are there adequate procedures and standards to implement the policy?
Key Characteristics:
Recruitment procedures and job specifications which include health and safety requirements.
Systematic identification of health and safety training and development needs which:
o correctly identify training and development as an appropriate solution (training in particular should not be
used to compensate for inadequacies in other aspects of health and safety e.g poorly designed or
inadequately protected plant, work stations not designed to sound ergonomic principles);
o systematically examines the requirements of the job e.g by looking at accident and ill-health records,
observing jobs and discussing with employees working practices and the tools and equipment used;
o correctly identifies jobs with a safety critical content e.g safety critical work on railways, those who have
key posts in emergency procedures;
o establishes job requirements/competence statements identifying the essential knowledge and skills;
o prioritises training and development needs using risk assessment principles.
Identification of knowledge requirements for health and safety including:
o general organisational knowledge for all e.g:
details of the health and safety policy and the philosophy underlying it;
an overview of health and safety principles;
overview of the structure and operation of the health and safety arrangements such as planning
and measuring health and safety performance;
any general health and safety rules.
Identification of job specific knowledge for managers including:
o details of the hazards and risks in area of responsibility and the necessary precautions;
o the health and safety principles which underline their control and relevant legislation;
o detailed knowledge of health and safety arrangements such as risk assessment, inspection, accident
investigation systems.
Identification of job specific knowledge for non-managers including:
o health and safety principles relevant to job;
o detailed knowledge of relevant standards, systems procedures and rules intended to control the risks of
the job.
Identification of skill requirements for those directing health and safety including:
o devising health and safety policy;
o establishing and maintaining an effective organisation for health and safety;
o devising health and safety plans;
o measuring health and safety performance;
o reviewing performance;
o communication, coaching, health and safety problem solving.
Identification of skill requirements for those managing health and safety including the skills of
establishing/operating systems to:
o promote an organisational climate for promoting a positive health and safety culture;
o devise plans, risk assessments and performance standards;
o measure health and safety performance;
o audit and review health and safety performance;
o communicate, train, inspect and save health and safety problems.
Identification of skill requirements for those supervising health and safety including:
o operating the arrangements and systems for organising, planning, measuring (including inspection and
accident investigation) and reviewing health and safety performance;
o communication, training, instruction and health and safety problem solving.
Identification of skill requirements for those in non-management position including:
o applying the systems, rules, procedures forming the workplace precautions;
o communication and health and safety problem solving;
o risk assessment, inspection and accident investigation.
Preparation of training and development plans;
Procedures/arrangements which secure appropriate training, re-training etc:
o at induction;
o when persons change jobs or stand in for others;
o where there is a process or other operational or method change;
o where there is a need for update or refresher training.
Adequate supervision of 'new' workers (e.g on recruitment or transfer) following training but before competence
is achieved.
Procedures and succession plans exist to provide adequate cover for jobs, with critical health and safety duties,
arising from sickness/- absence/transfer/major process change.
MEASURING PERFORMANCE
Key Issue:
Are there adequate arrangements to assess the effectiveness of training and the achievement and maintenance of
competence?
Key Characteristics
Monitoring of delivery of training and development plan.
Systematic assessment/evaluation of training and assessment of competence in post after initial training and
development.
Identification of deficiencies in knowledge and skill from active and reactive monitoring.
AUDITING
Key Issue:
Is there adequate auditing of the recruitment, training and development process?
Key Characteristics:
Auditing covers an assessment of the whole recruitment, training development system.
Auditing evaluates the outcomes of the system for all levels of employee.
REVIEWING PERFORMANCE
Key Issue:
Is there effective review to ensure that lessons learned are put into practice to improve the recruitment, training and
competence development process and policy?
Key Characteristics:
Deficiencies identified have resulted in improvements.
Suitable performance indicators are identified.
Analysis of trends/patterns in overall training and development activity for health and safety.
Overall review involves senior manager(s).
RCS 13 - HAZARD IDENTIFICATION AND RISK ASSESSMENT (HIRA)
Introduction Further work
Common HIRA methods Legal basis
HIRA Systems and management of change Process of carrying out hazard identification and
Published standards risk assessment study
INTRODUCTION
Hazard Identification and risk assessment are essential for ensuring safe plant and safe methods of work in the chemical
industry. Hazards should be identified and risks assessed throughout the plant life cycle. Different techniques may be
appropriate, depending on the stage of this lifecycle.
Some companies, especially if American owned, may use the terms Process Hazard Review/Analysis (PHR/A) instead of
Hazard Identification and Risk Assessment (HIRA). PHA generally refers to an initial analysis e.g. when new plant is
being designed; PHR generally refers to periodic reviews of plant and processes over time. However, because of its
wider application, H.S.E. prefers to use the term Hazard Identification and Risk Assessment (HIRA) rather than PHR/A.
The purpose of HIRA is the systematic evaluation of a process, leading to improvements in safety (plant, processes and
human factors). The aim is to ensure that risks are reduced as low as is reasonably practicable (ALARP). The system
should consider the usual hierarchy of risk reduction measures i.e. hazard elimination (for example by the use of
inherently safer design), risk control and mitigation. Hazard identification and risk assessment is essential for major
hazard plant; duty holders must assess the risks from their operations before they can decide what action they need to
take to control them.
Human Factors (HF) should be taken into account by HIRA systems. However, the methodologies may or may not be
sufficient to do this, because the focus for HF is tasks and activities, rather than plant and processes. The HID S14A
Human Factors team are currently actively working on this area.
COMMON HIRA METHODS
The HIRA can take many forms. Industry typically use one or more of the following methodologies to carry out the HIRA:
What if; Checklist; What if/Checklist; Hazard and Operability Studies (HAZOPs); Failure Modes and Effects Analysis;
Fault Tree Analysis; or their own equivalent in house version. The HIRA Leader, in conjunction with the team will decide
the scope and methodologies to be used: these will vary depending on the process that is being reviewed, as well as
company policy and culture, but need to be proportionate to the hazards and risks involved. British companies are more
likely to use HAZOP methodology.
The '6 Stage Approach', also known as the 'Plant Life Cycle', has six stages (Initial Integrity, Control of Production,
Maintaining Integrity, Management of Change, Cessation of Operation, and Emergency Response) and deals with
HI&RA throughout the lifecycle of a plant.
Traditionally the term HAZOP is associated with the original part of the HAZOP procedures (now HAZOP3 stage). This
relates to the systematic review of P&I diagrams by a team of experts (e.g. engineering, process, operators) who use key
words to identify whether there are risks and the measures to control them. Because this is relatively late in the design
process, the outcomes tend to be procedures, alarms etc.
HIRA SYSTEMS AND MANAGEMENT OF CHANGE
HIRA Systems and management of change are closely related areas of risk management and reduction. The main
difference between the two is that change management procedures are reactive - they are required in response to
specific plant/ process/ personnel etc changes; whereas HIRAs are periodic and proactive.
A company's management of change procedure should be able to identify if a HIRA study is needed for that change. A
series of changes might be made that, on their own, would not warrant the full rigour of a HIRA study. But, over time they
may have cumulative effects on plant safety. Therefore, the HIRA system should have scope for review where the effects
of a number of changes can be assessed. Thus, paperwork needed for a cyclical HIRA would include the management
of change requests, assessments for that part of the plant since the last HIRA study as well as, updated P&ID's.
PUBLISHED STANDARDS
Techniques for HIRA originated in America, and the only published standard is the U.S. Department of Labour
Occupational Safety and Health Administration (O.S.H.A.): Process safety management of highly hazardous chemicals -
1910.119. This requires companies to carry out process hazard reviews at least every 5 years, after the initial analysis
has been carried out. As a result, in the U.K., Inspectors may be more likely to find HIRA complying with the OSHA
standard at American owned companies. Companies such as ICI (and successor companies) have been doing HIRA for
many years. These studies have been refined and now include environmental hazards amongst other things (PHR3 is
latest version).
The OSHA Links in the Inspection Guidelines section of this document are provided to give Inspectors additional useful
information and should only be used as guidance. The OSHA Standard is an American Standard and cannot be enforced
(see information on Further Research below). However, every chemical operator should be able to describe the HIRA
techniques they use for the design, modification and review of their processes. These will vary and should be
proportionate based on factors such as the hazards, complexity of process, competences of staff etc. For many
businesses, consultants are used for their expertise in the HIRA techniques. Input from company personnel about how
individual processes are operated is essential.
FURTHER WORK
HID HQ is planning to gather further information on current practices re Hazard Identification and Risk Assessment
Systems in the UK. Chemical Industry. We will then be able to either establish existing good practice or consider whether
this should be further developed e.g. more closely following the O.S.H.A. standard. If Inspectors have done any work in
this area e.g. enforcement, audits, and think it would be helpful to other Inspectors, please can you contact Cath Cottam,
HQ1E, 513 2850. Any feedback would be most welcome, and will be used to develop the guidance further.
HIRA LEGAL BASIS
COMAH REGULATIONS 1999: TOP TIER DUTIES
Schedule 4, Part 1, Paragraph 1 defines one purpose of safety reports as demonstrating that a major accident
prevention policy and a safety management system for implementing it have been put into effect in accordance with the
information set out in Schedule 2.
COMAH safety reports, as part of their minimum information, are required to include information on operators' accident
identification, risk analysis and prevention methods and an assessment of the extent and severity of the consequences
of identified major accidents (see COMAH Schedule 4 Part 2).
COMAH REGULATIONS 1999: GENERAL DUTIES
Regulation 4 requires every operator to take all measures necessary to prevent major accidents and limit their
consequences to persons and the environment.
Regulation 5(3) requires operators' SMS to identify and evaluate major hazards (see COMAH Schedule 2).
Regulation 15 requires every operator, when requested to do so, to provide sufficient information to the competent
authority to demonstrate that he has taken all measures necessary to comply with COMAH.
Carrying out a HIRA to ensure that plant and procedures are of a standard to ensure risks are acceptably low can be
interpreted as demonstrating that the operator is "taking all measures necessary" and reducing risk to a level as low as is
reasonably practicable (ALARP).
THE MANAGEMENT OF HEALTH AND SAFETY AT WORK REGULATIONS 1999
The Management of Health and Safety at Work Regulations 1999 Regulations 3,4, and 5 are relevant to non-COMAH
sites or hazards other than 'major hazards'. These require employers and self-employed people to assess the risks to
workers and any others who may be affected by their work or business, to implement preventive and protective
measures and make sure that appropriate arrangements are in place to cover health and safety.
OFFSHORE SAFETY CASE REGULATIONS 1992
SC Regulations 1992 Regulation 8 requires operators or owners to include in safety cases enough information to
demonstrate that 'all hazards with the potential to cause a major accident have been identified; and risks have been
evaluated and measures have been, or will be taken to reduce the risks to persons affected by those hazards to the
lowest level that is reasonably practicable'. Schedules 1-5 of the Regulations detail the particulars, which should be
included in the safety case.
PFEER 1995 Regulation 5 requires the duty holder to perform an assessment to identify the events which could give rise
to 'a major accident involving fire or explosion; or the need for evacuation or rescue to avoid or minimise a major
accident; the evaluation of the likelihood and consequences of such events; the establishment of appropriate standards
of performance to be attained by anything provided by measures for ensuring effective evacuation, escape, recovery and
rescue to avoid or minimise a major accident.' Regulation 19 further requires the duty holder to ensure that all plant on
the installation provided in compliance with the Regulations 'is so constructed or adapted as to be suitable for the
purposes for which it is used or provided'
DCR 1996 Regulation 13 stipulates that the 'well operator shall ensure that a well is so designed, modified,
commissioned, constructed, equipped, operated, maintained, suspended and abandoned that - so far as is reasonably
practicable, there can be no unplanned escape of fluids from the well; and risks to health and safety of persons from it or
anything in it, or in strata to which it is connected, are as low as is reasonably practicable'. In these Regulations,
Regulation 4 is the general duty whereby the duty holder 'shall ensure that an installation at all times possesses such
integrity as is reasonably practicable'.
POPMAR
ELEMENT
KEY FEATURE INSPECTION GUIDELINES
POLICY
Is a policy in
place, which
recognises that
Hazard
Identification and
Risk Assessment
(HIRA) are
fundamental to
control of major
accidents and that
hazards change
over time, and
therefore need to
be reviewed on a
regular basis?
Does the policy
include a stated
commitment to
provide adequate
resources, to
ALARP risk
reduction and to
continuous
improvement
including the use of
techniques of
inherently safer
design?
Do procedures
make clear that
HIRA refers to
technical, human
factor issues and
procedural hazards,
and is a method of
doing this
described?
The policy should cover:
Why a system for HIRA is needed.
Methodologies used.


What HIRA applies to (i.e. what plant, what processes, what human
factors e.g. structured identification and assessment of human error
potential etc)?
HIRA Frequencies. [OSHA 1910.119(e)(6)].
How the company achieves ALARP risk reduction.
How the policy has been communicated and understanding checked.
Verification - Company should be able to provide:
Policy document.
Details of scope and limits of system. These should be clearly defined
and understood by those involved. They should tie in with COMAH
requirements (all sites), but particularly at Top Tier sites with regards to
safety reports.
ORGANISING CONTROL
Is the management
structure to
implement and
manage the HIRA
system adequate?
Are
responsibilities
clearly allocated
and accepted?
Are people held
accountable for
managing the
system, carrying out
the HIRA
programme and
completing follow-
up action?
A HIRA should be carried out for all major accident scenarios/hazardous
processes.
The limits of authority should be clear. For example, the HIRA Leader
can discuss and try and resolve any issues or disputes associated with
the HIRA Actions report with the relevant staff, but the Site Manager has
the final say where necessary.
The performance standards for the system (Who, what, when, expected
results) should be recorded, clearly understood, and people held
accountable.
Verification of Documentation:
To show where a HIRA has been carried out.
To include clear responsibilities etc. (who, what and when).
To show how people are held accountable e.g. performance appraisal.
ORGANISING
CO-OPERATION
Do all personnel
cooperate to ensure
the successful
operation of the
All parties should show a shared understanding and acceptance of the
HIRA system.
There should be a dispute resolution procedure e.g. over resources,
including who has the final say if agreement cannot be reached.
system?
Is there a clear
procedure for
resolving disputes?
(E.g. over
resources,
availability of plant,
over acceptance
and priority of
recommendations)
Adequate notice should be given prior to HIRA studies to ensure that
relevant personnel can attend.
The stages of HIRA study should be arranged to ensure that all relevant
personnel can attend.
Recommendations relating to other parts of the site should be
discussed with and referred to relevant management.
Verification of Documentation:
Should provide clear information on consultation.
Should provide clear dispute resolution procedures.
ORGANISING
COMMUNICATION
Are there adequate
information flows
into, within and
from the
organisation to
ensure the
effective operation
of the system?
Are changes to
plant documentation
carried out when
required (P&IDS
and Operating
Procedures)?
Management of
Change
Are records of
reviews, disputes,
decisions and
actions available?
Are there
procedures in place
to ensure that
changes to the
system and findings
of HIRA are
communicated to all
relevant personnel?
Pre-HIRA information packs should be available to team members at
the start of a HIRA. Packs should include for example, team
composition; expected duration; methodology to be used; scope;
P&ID's; operating instructions; calculations; worksheets and checklists.
Changes to the system should be communicated to all relevant
personnel. For example, the person who takes the lead on HIRA issues
could produce and send out information sheets and/or could give a
presentation at the start of the HIRA study.
If there are a number of shifts, operator views from all shifts should be
taken in to account.
Recommendations should be fed back to plant documentation (P&IDs
and Plant Operating Procedures) to ensure that they are kept up to
date.
Records should be kept of reviews and disputes.
Changes which may impact on control of major accidents should be
identified.
Study findings should be communicated to all relevant personnel. For
example, you could find a copy of the outcome events table,(detailing
an action number, what is required, by whom, timescale and completed
date) that is produced at the end of the HIRA, circulated or formal
presentations of the report.
Outstanding actions/ reservations should be flagged up to relevant
personnel.
Changes to HIRA frequencies should be communicated;
Good practice is to review findings of different studies to identify
interactions and safety critical issues.
Verification of Documentation:
Pre-HIRA packs.
Check that changes are recorded in plant documentation.
Documentation associated with reviews, disputes etc.
Details of communication of changes (memos, training pack updates
etc).
ORGANISING
COMPETENCE
Are there systems
and arrangements
in place to develop
and maintain the
competence of
everyone involved
in the HIRA
system and
subsequently
affected by the
outcome of the
HIRA?



People undertaking the HIRA should have suitable training and
experience in HIRA procedures; OSHA 1910.119 Appendix C, point 4,
paras 3 and 4.
The HIRA team should know what specialist advice is available.
The need for specialist advice should be identified and ensured.
Continuing competence and knowledge of specialists should be
assured.
Competence should be ensured following plant changes. Competence
should be seen as only one means for addressing potential human
failure and errors. PM/ENF 11 Human Factors - Inspector Toolkit,
Common Topic 2 Maintenance Error.
Verification of Documentation:
Policy for succession management that recognises that competence
can be a safety critical issue. Having adequately trained deputies is
necessary for studies, as cover is required for sick leave, holiday
absences, people leaving etc.
PLANNING
AND
IMPLEMENTI
NG
Are HIRA studies
carried out and the
identified control
measures
implemented as
part of a managed
programme?
Are risk reduction
options weighed
up in terms of
ALARP and
reasonably
practicability?
Do the operators
evaluate
consequences of
changes since
previous HIRA
Studies?
Are there people on
the HIRA team with
the right mix of skills
and knowledge i.e.
engineers,
operators, and
safety specialists?









Studies should have been carried out for all areas of plant and
process(es) that will have an influence on safe operation.
HIRA methodology should be described. [OSHA 1910.119(e)(2)]; &
Appendix C point 4, paras 2, 5, 6 & 7and 9.
The team composition should be described. [OSHA 1910.119(e)(4)] &
Appendix C, point 4, para 3
The HIRA should address [OSHA 1910.119(e)(3)]. the following
areas:Operating and inspection (integrity) histories; the validity of
previous risk assessments (hazops etc); hardware and software
changes (including organisational); significant incidents and near
misses (internal and external to site); audits; measurement against
current standards and legislation (Regulatory Good Practice);
opportunities to reduce the hazard associated with the process by the
use of inherently safer design techniques; and relate to major accident
hazards identified in safety reports (Taken from the BP cat cracker
investigation report).
If plant is prioritised into HHP (high hazard plant) and LHP (low hazard
plant), personnel should be able to describe. how this is done, and who
does this. [OSHA 1910.119(e)(1)] & Appendix C point 4, para 8.
Study frequencies should be defined and adhered to. There should be
rules for agreeing to dispensations for postponement of HIRA studies.
There should also be rules for plant division, to avoid it being used as
an excuse to postpone a HIRA.
Information should be available on plant operation and any gaps in
information filled in.
Any serious deficiencies should be dealt with immediately;
The company should be able to describe the standards that are used to
check against during a HIRA and how they are decided upon. Best
practice should be studied. Any circumstances when deviation from
applicable codes and standards is allowed, including who decides,
should be clearly spelt out in the company HIRA procedures.
Recommendations should be prioritised with reference to standards and
best practice. [OSHA 1910.119(e)(5)]; Risk reduction options should be
weighed up in terms of ALARP and reasonably practicability. General
rule is that measures must be put in place unless the test of gross
disproportion is met.
The safety report should be reviewed and revised as a result of the
HIRA Study.
Verification of Documentation:
Examination and assessment of pre-HIRA information packs.
Evidence of HIRA frequency assessment.
Evidence of significant deviations from applicable standards.
Evidence of HIRA Reports. [OSHA 1910.119(e)(7)].
MEASURING
PERFORMAN
CE
Is there active and
reactive
monitoring of the
operation of the
HIRA system to
check that:
activities within
the SMS are being
conducted; the
elements of the
SMS are
delivering; and the
companies own
There should be adequate and sufficient checks on the operation of the
HIRA system.
Information should be routinely collected to allow comparison of
performance of the system against predetermined standards e.g.
number of studies completed, progress with recommendations,
prioritisaton of remedial action. Study progress should be monitored
prior to completion to flag up delays. Action should then be taken before
the deadline for HIRA completion.
Remedial action should be prioritised and monitored to ensure that it is
complete.
There should not be any outstanding HIRAs or actions from
recommendations. Any changes to study recommendations should be
documented and recorded. performance
standards (who,
what, where,
Verification of Documentation:
when) are being
achieved?
Review lists of recommendations and actions against priorities and
timescales.
Review study files to verify contents.
Is there an
AUDIT AND The design and operation of the system should be subject to an
independent
REVIEW independent audit. Performance measures should be used to measure
assessment of the
the effectiveness of procedures and assess performance. Procedures
entire HIRA
should be in place to implement and review audit findings.
system?
Verification of Documentation:
Audit reports and reports on progress with audit actions;
Investigate how senior management is informed of the results.
Recording Major Hazard Intervention Information On CIS
Introduction Information areas
Principles and features of the new CIS major hazard report
o
arrangements
Aim of information recording


Implementation of the new arrangements
Annex 1
o Overview of how information is to be
recorded
o CIS data fields
o Linked documents
o The 4 new major hazard document
templates
INTRODUCTION
Purpose of this guidance
1. The aim of this guidance is to enable users to efficiently transfer from the form HI 251 for recording major hazard
establishment information to the new CIS based arrangements.
2. The guidance provides details of how to record major hazard information in CIS data fields and linked documents
and how structured Major Hazard reports can be obtained.
3. If you have any queries on the new arrangements or use of the new document templates which are not
answered by the help text in the templates, this guide or your local systems administrator please contact
HIDHELP (VPN 523 4194 or e mail HIDHELP) for technical queries or LD6 (VPN 523 5789) for all other queries
concerning these arrangements.
Background
4. The HI251 system for recording major hazard intervention information has been in use since early CIMAH days.
Since then several significant changes have taken place notably;
the move towards predominately IT based information storage and retrieval systems (FOCUS/CIS); and
the introduction the COMAH Regulations placing specific inspection duties on HSE.
5. During 1999-2000 the HI 251 system was reviewed, in consultation with HID LD and CD, to assess how well it
met with current information needs for recording of major hazard intervention work.
6. The outcome of the review identified improvements that would:
Be more compatible with the COMAH regulations and associated processes;
Make full use of the facilities offered by CIS; and
Offer efficiency savings over the existing HI 251 system
7. New recording arrangements were drawn up and piloted across HID CI, SI during summer 2001 prior to final
agreement by LD management and formal rollout in April 2002.
PRINCIPLES AND FEATURES OF THE NEW ARRANGEMENTS
Aim of information recording
8. The aim of the major hazard information system is to record sufficient (but not excessive) details to enable both
field and central units to carry out their functions effectively and efficiently; to eliminate or minimise duplicate
recording; and be IT based and user friendly within the constraints of HIDs IT systems.
Overview of how information is to be recorded
9. The arrangements for recording major hazard intervention information are based on the following:
The HI 251 document is replaced by information stored solely on CIS.
Information is incumbent based and structured between 3 information areas, namely:
i. basic establishment details;
ii. major hazard information; and
iii. intervention information.
The diagram at annex 1 shows how the information for each area is made up.
Information is stored in a combination of data fields (and associated linked documents) and 4 newly
developed linked documents.
The 4 new documents record information on: basic establishment details; major accident scenario
details (for LT establishments only); management performance overview; and intervention planning.
CIS report No. 38 (COMAH incumbent briefing) provides selectable major hazard establishment briefing
information and is available from the CIS Reports Module.
CIS data fields
10. Details of the key data fields for each of the 3 information areas (basic establishment details, major hazard and
intervention information) are set out in the section on "Information Areas.
11. The CIS data fields are an integral part of the major hazard information recording system and it is vital that they
are fully populated and kept up to date.
Linked documents
12. Detailed information relevant to a major hazard incumbent will be held in a range of documents linked to CIS.
Some document templates have been in use since the start of CIS e.g. Safety Report Assessment Manual
(SRAM) templates, inspection and investigation reports, major accident report to EU templates etc. These
should be created, completed and linked on CIS as per current instructions.
The 4 new major hazard document templates
13. Four new document templates have been created for recording major hazard information i.e., the Basic
Establishment Details, LT Major Accident Scenarios, Management Performance Overview, and Intervention Plan
templates. The templates can be found in Microsoft word in the HIDLD MH templates folder installed on PCs.
14. Documents created from the 4 new templates differ from other CIS linked documents in that they are designed to
be updated from within the CIS system, as new information is available.
Common front page
15. Each of the four documents has a common front cover page to record basic incumbent and document related
information, input via an opening dialogue box. See Fig 3.
On-screen help comments and tips
16. On-screen help comments and tips have been included in the templates to provide guidance on the completion
and use of the documents. These are highlighted in yellow and are activated by hovering the mouse over the
highlighted area.
Template automatic function buttons
17. Three of the new templates have automatic function buttons to enable you to add new parts/tables, topic
keywords or organograms to the documents.
18. The function buttons are located on a toolbar created by the templates.
Figure 1 Automatic function buttons as they appear on the major accident scenarios template toolbar.
19. The template toolbars are accessed via the View menu or right clicking the toolbar area of the document and
selecting the appropriate toolbar.
Use of Microsoft Word 2000 versions facility
20. Documents created from the templates are designed to be updated from within CIS without the need to create
and link further revised copies. Word 2000 offers the facility to save versions of a document within the one file.
Earlier versions of the document can therefore be opened and read even though the document has subsequently
changed.
21. To save a version of a document:
Click on the
Click OK
Select versions. from the File function on the menu bar. The versions screen will then appear.
save now button and enter brief details of why the version is being saved in the comments dialogue box.
and the version is saved with the details of the time and date entered automatically.
22. To view earlier versions of the document, enter the version facility via the File function on the menu bar, highlight
the version you wish to read and click on open. Note: you cannot make changes to earlier versions.
23. It is recommended that use of the version save facility is restricted to freezing versions of the document at key
development stages when significant changes are made to a document.
24. Users are requested not to deploy the automatic save a version on close facility. Use of this feature can result
in large numbers of versions being saved where minor or even no changes to the document have been made,
leading to document management difficulties.
Hypertext links
25. Hypertext links can be created from any text or object from within a Word 2000 document to other documents
accessible to your PC, i.e. documents on your c, h or i drives, the HSE intranet or internet. This enables links to
be made to relevant HSE / industry guidance, company web sites etc.
26. Note: hypertext links to documents on your c,h,& i drives will only be accessible by users with access to these
drives. All HSE users have access to intranet and Internet links.
27. To create a hypertext link:
Highlight the word or object the link is to be made from and Right click with mouse button,
Select hyperlink from the menu that appears. The insert hyperlink screen should appear as in Fig.2.
l
Select what you want to link to e.g. "existing file or web page".
Select the file/web page you wish to link to. These can be seected either from those listed, by browsing for files/web
pages/bookmarks or by directly typing in the full file or web page name.
If using the browse route for files select the file to be linked to, click OK and the file name will be automatically inserted in
the correct place in the "insert hyperlink" screen.
If using the browse route for web pages this will take you directly to the intranet/internet, from which you go to the page
you wish to link to and then either minimise internet explorer or close it down. The web address will then be
automatically inserted in the correct place in the "insert hyperlink" screen.
Click OK in the "insert hyperlink" screen and the link is made.
Figure 2 The insert hyperlink screen.
Creating a document from the templates.
28. To create a new document from the templates:
Click OK
Launch Microsoft Word 2000 and select "new" from the file menu.
Select the template tab page "HIDLD_MH templates" and select the document template you require.
Complete the dialogue box information.
Save the document on your c,h or I drive until you are ready to link it to the CIS Incumbent record.
Complete the document.
Attach the document to the CIS incumbent record
29. When a new document is created from the template an opening dialogue box appears (see Fig 3) and prompts
you for a number of details about the establishment or installation. Once input, you will not be required to enter
these details again. Any future editing of the front-page incumbent details will also update the information held in
the document page headers.
30. Labelling of documents is dealt with by CIS and Word2000 applications and you do not have to provide a title for
the documents in the front page. The optional field for a title has been included for local use e.g. to label an
installation-specific plan for a COMAH multi-installation establishment.
31. An optional field has also been included to record the name &/or number of the unit if an installation specific
document is to be created. Unit names &/or numbers should be consistent with the naming conventions adopted
in the Unit module on CIS (to align with the safety report assessment process).
Figure 3 The opening dialogue box which appears on creating a new document from the templates.
Linking to CIS
32. The documents should be attached to the relevant incumbent record of CIS in the normal way and updated using
the edit document facility from within CIS.
33. To link a document to the incumbent record on CIS:
Launch CIS and go into the incumbent module.
Find the relevant incumbent record.
Attach the document to the incumbent via the documents tab page.
Provide a title and ownership details for the document.
Select the CIS document category for the document from:
MH Basic Establishment Details;
MH Management Overview;
MH LT Major Accident Scenarios; or
Intervention Plan.
Provide a comment for the attached document.
Ensure that the approved flag is not checked.
Save.
34. You are required to provide a title for the documents (up to 30 characters). Simple reference to e.g.
establishment will suffice for most cases. However, the installation name should be included in the title if the
document is installation specific at a COMAH multi-installation establishment. Be consistent with the naming
conventions for installations as in the unit module on CIS and as adopted for the safety report assessment
process.
INFORMATION AREAS
Basic establishment information area
35. The purpose of having good basic establishment information is to provide a brief overview of the establishment
to enable anyone unfamiliar with, or needing to refresh their memory about, the establishment to gain an
understanding of:
the business conducted at the establishment:
the major hazard processes undertaken;
the key personnel involved;
significant environmental and offsite feature; and
the key guidance/information relevant to the establishment.
36. This information is recorded in the CIS data fields identified below and the new Major Hazard Basic
Establishment details CIS linked document .
Key CIS basic establishment data fields
37. The table below identifies the key CIS data fields that need to be completed and kept up to date to provide good
quality basic establishment information.
Module Tab Page Data Field(s)
Client Client details Client ID
Client name
Client type
Main address all fields
Management group
Note - any appropriate information.
LU check box
Client Reps All fields for all representatives
Departments All fields for all departments
Incumbent None
PKA/SKA All (list any PKAs & SKAs)
Duties All (list all identified duties)
Alias All (list any aliases)
Location Locn details Location ID
Location name
Address all fields
Map reference
Note
Units All fields for all COMAH installation units. Naming conventions
should match safety report submissions.
All fields for other units
Locn Reps All fields for all representatives
Incumbent None
Addtnl Details Consultation distance
Domino effect applies
Other Enfing Auth All fields for other Authorities. For HID enclave sites, the primary
enforcing authority should be set to FOD and the other enforcing
authority set to HID.
Hazardous Subs All fields for all substances
Incumbent Representatives All fields for all representatives
Duties All fields for all duties especially major hazard duties e.g. COMAH
TT or LT operator.
CIS major hazard_basic establishment details document
38. The purpose of this document is to provide a structured format in which to record basic establishment
information that is not held within the CIS data fields.
39. A basic establishment details document is required for both top and lower tier establishments. Individual
documents should not be created for units/installations within an establishment.
40. The document is created from the MH_Basic Establishment Details template located in the HIDLD MH template
folder. See section: Creating a document from the templates.
Template structure
41. The template is divided into two sections
The front cover (see Fig 3)
A structured section to record brief details of key establishment information as set out below. Guidance
on what to record is provided within the template in the highlighted help comments.
Section What to record
Nature of Business
Brief outline of the business conducted at the establishment, e.g. storage,
distribution and cylinder filling of LPG
Safety Management System
structure
Brief outline of ownership, management and control arrangements for the
establishment. If helpful, organograms can be included here or at the end of the
document. (See section on organogram template function button)
Multi installation information
For multi installation establishments a brief description of how the establishment has
been unitised. It is not necessary to list all the units as this information is provided
on the CIS unit tab sheet in the location module.
Primary Major Hazard processes
under taken
Outline details of the key processes operated at the establishment. Tie in with units
if multi-installation.
Location
Information on the location of the establishment e.g. Map reference, directions to the
site, hypertext link to a map of the site from internet map provider such as
multimap.com, www.ordsvy.gov.uk
Significant environmental
information
Brief details of any sensitive features of the environment in the vicinity of the
establishment, e.g. SSSI's etc
Significant offsite information
Brief details of any vulnerable offsite populations in the vicinity of the establishment
e.g. schools, hospitals etc.
Pre CIS major incidents Brief details of any major incidents at the establishment not recorded on CIS
Relevant standards/guidance
References to key information documents specifically relevant to the major hazard
processes of the establishment. Examples include: GHIAs, significant British
Standards or industry guidance. Hypertext links can be created to any such
guidance on the HSE intranet or the Internet.
Relevant documents held on file
References to key documents held on file that are relevant to the major hazard
aspects of the establishment.
Other information/issues to note
Any other information that may be of use to regulating the establishment, e.g. links
to company web site H&S information.
42. The template features an automatic function button to enable an organogram to be created and pasted within the
document. The button is located on the template toolbar, see Fig 4. To access the toolbar, right click in the
toolbar area of the document and select the organogram toolbar.
43. To create an organogram place the cursor where the organogram is required and then click the create
organogram button. This will open the Microsoft organization chart program from which organograms can be
created.
Figure 4 Function button to create an organogram
44. Once you have created the organogram it should be saved and the application closed. The organogram will
appear within the document. To edit the organogram double click on it and the chart will open up for editing.
45. The document should be linked to the relevant incumbent record on CIS. See section on linking to CIS for
further details.
46. The document can be updated from within CIS using the edit document facility. It is recommended that the
Microsoft Word version-save facility be used to freeze a version of the document when it is first completed and
following subsequent significant changes.
Major hazard information area
47. The major hazard information area holds data on the major accident hazards present at an establishment and an
analysis of the relevant prevention, control and mitigation measures.
48. For COMAH TT establishments this information is contained in the COMAH safety report, which undergoes
detailed assessment by the CA. On CIS, each safety report is assigned a safety report assessment job via the
CIS job module and key assessment documents are linked.
49. Major hazard information for COMAH LT establishments is recorded in a new CIS linked document created from
the Major Hazard_LT Major Accident Scenarios template.
Key CIS major hazard data fields
50. The table below identifies the key CIS data fields that need to be completed and kept up to date for COMAH TT
establishments.
Module Tab Page Data Field(s)
J ob J ob details for: J ob type, Manager postholder, title, outline, status,
outcome, job id number.
all safety report assessment job types
(Full, Part and completion check)
Limitation of information in safety
reports job.
Tasks Title, Outline, Status.
(Note specific guidance exists for setting up a
safety report assessment job.)
CIS major hazard_ LT major accident scenarios document
51. The purpose of this document is to provide for COMAH LT establishments a record of the major accident hazard
scenarios, associated prevention, control and mitigation measures and HSEs assessment/ inspection of them.
52. The document is only required for COMAH LT sites but can be used for non-COMAH sites at local discretion.
53. The document can be used to record major accident scenario information for the establishment as a whole or
can be installation specific.
54. The document is created from the MH_Major Accident Scenarios template located in the HIDLD MH template
folder. See Creating a document from the templates.
Template structure.
55. The template is divided into two sections,
The front cover (see Fig 3); and
A structured section to record the major accident scenarios, associated potential initiating events,
prevention, control and mitigation measures and HSEs assessment of them. See Fig 5.
56. A major accident scenario is the set of circumstances which could lead to a major accident and the potential
consequences should it arise e.g. fire in chemical store leading to toxic plume, loss of containment from bulk
storage leading to ignition. Potential initiating events are the conditions and events considered significant in
bringing about a major accident scenario. Guidance on what to record is also provided within the template in the
highlighted help comments.
57. Note: For many sites the identification of the scenarios is aided by the GHIA guidance series.
Figure 5 Screenshot of the major accident scenarios page.
58. The document allows for an indefinite number of accident scenarios to be created to match the complexity of the
establishment/ installation.
59. The major accident scenario table is divided vertically into two parts to record:
a breakdown of the potential initiating events and the prevention/ control measures claimed to be in
place; and
the claimed mitigation measures.
60. Text fields are provided against both parts of the table to record:
the conclusions of HSEs assessment of the suitability and effectiveness of the measures claimed to be
in place or any other comments arising from HSE intervention (opinion may be derived from desk top
assessment of information or from an intervention at the establishment)
the proposed HSE action from a choice of five options:
to be assessed;
no further action;
inspect;
verify; or
refer to EA/SEPA.
any link(s) to a planned intervention item; and
an optional field to reference key relevant documents such as inspection reports etc.
Template function buttons
61. The template features three automatic function buttons to enable customisation of the document with the
appropriate number of major accident scenarios and related information. The buttons are located on a template
toolbar, accessed by right clicking the toolbar area of the document and selecting the MAS toolbar.
Figure 6 Screenshot showing automatic function buttons on the major accident scenarios template.
62. The Insert new scenario button adds new scenario tables sequentially to the document. Each scenario table
begins on a new page.
63. The Insert HSE action button generates a dialogue box from which one of five proposed actions (for the control
or mitigation measure being assessed) is selected. Note: HSE actions can also be selected by double clicking
on the blue text in the HSE action column.
64. The Insert new row button will insert a new row to the part of the table in which the cursor is placed.
65. The document should be linked to the relevant incumbent record on CIS. See section on linking to CIS for
further details.
66. The document should be updated from within CIS using the edit document facility. It is recommended that the
Microsoft Word version-save facility be used to freeze a version of the document when it is first completed and
following subsequent significant changes or review.
Intervention information area
67. The intervention information area contains the major hazard inspection and investigation information relevant to
the establishment.
68. Information is recorded in the CIS data fields identified below (and supporting intervention documentation)
together with two new CIS documents created from the MH_Management Performance Overview and
Intervention Plan Templates.
Key CIS intervention data fields
69. The table below identifies the key CIS data fields that need to be completed and kept up to date to provide good
quality intervention information.
Module Tab Page Data Field(s)
Notifications Notification details
Accidents Notification ID, type, date, kind, process, cause, investigated.
D/Os Notification ID, type, date, process, investigated
Ill health Notification ID, disease, date, investigated.
Complaints Notification ID, nature of complaint, date reported to HSE, investigated,
complaint justified.
Other
Notification ID, type (ie. COMAH major accident), management group,
date reported to HSE, date occurred/identified, summary, investigated
date, investigated, associated incident.
Notification Incident details Incident ID, incident title, date, associated notifications
of incidents
Enforcement Details ID number, type, issue date, level of compliance, note.
notices
Breaches Act, section, sub section or Regulation, number, paragraph
Enforcement Details ID number, offence start date, costs (total and hearing), fine
prosecution
Breaches Act, section, sub section or Regulation, number, paragraph
J obs Details (for type audit inspection, J ob ID number, type, title, status, status date, associations, documents.
local project)
Linked documents
70. Relevant linked documents providing intervention information are:
i. Investigation reports
ii. Reports of major accidents to EU
iii. Prosecution reports
iv. Intervention reports, specialist inspector reports etc.
v. Intervention plan Document(s)
vi. MH_Management Performance Overview document
CIS Intervention Plan document
71. Specific guidance on creating and completing the intervention plan document is given in Appendix 5 of Chapter 3
(Intervention Plans) of the HID LD Inspection Manual.
CIS major hazard_management performance overview document.
72. The purpose of the management performance overview document is to provide a brief overview of HSEs
assessment of current health and safety management performance at the establishment against the eight safety
management system elements set out in schedule 2 (Para. 4) of the COMAH Regulations. The overview should
be based on a digest of HSEs findings from interventions at the establishment and limited to key issues and
comments.
73. A detailed account of the management arrangements or their assessment is not required. This data will be set
out in safety reports, MAPPs etc., with analysis through the inspection programme and recorded in report
documentation.
74. A management performance overview document is required for both COMAH TT and LT establishments but can
also used for non-COMAH companies at local discretion. Note individual documents should not be created for
units/installations within an establishment.
75. The document is created from the MH_Management Performance Overview template located in the HIDLD MH
template folder. See Creating a document from the templates.
Template structure
76. The template is divided into two sections comprising:
The front cover; and
A structured information table to record key performance issues/ comments, with provision made for
recording references to an intervention plan or relevant key documents such as inspection reports.
77. The table below identifies what to record against each of the eight elements. This guidance is also provided
within the template in the highlighted help comments.
COMAH Schedule 2 management
Elements
What to record
Major Accident Prevention Policy
(MAPP)
Key performance issues/ comments and comments on the overall aims and
principles of action with respect to the control of major accident hazards.
Organisation and Personnel
Key performance issues/ comments on the roles and responsibilities of personnel
involved in the management of major hazards at all levels in the organisation; the
provision and maintenance of appropriate levels of management and employee
competence and the involvement of employees and other personnel in the control of
major accident hazards (COMAH Schedule 2, Para 4a).
Identification & Evaluation of Major
Hazards
Key performance issues/ comments on the adoption and implementation of
arrangements for systematically identifying major hazards; assessing the risks
arising from normal and abnormal operations and determining necessary control
measures (COMAH Schedule 2, Para 4b).
Operational Control
Key performance issues/ comments on the adoption and implementation of
procedures and instructions for safe operation, including maintenance of plant,
processes, equipment and temporary stoppages (COMAH Schedule 2, Para 4c)
Management of Change
Key performance issues/ comments on the adoption and implementation of
procedures for planning modifications to, or the design of new installations,
processes or storage facilities (COMAH Schedule 2, Para 4d).
Planning for Emergencies
Key performance issues/ comments on the adoption and implementation of
procedures to identify foreseeable emergencies and the preparation testing & review
of emergency plans (COMAH Schedule 2, Para 4e).
Monitoring Performance
Key performance issues/ comments on the adoption and implementation of
procedures for the ongoing assessment of compliance with objectives set by the
MAPP and safety management system; the mechanisms for investigating and taking
corrective action in the case of non-compliance; system for reporting major
accidents or near misses and their investigation and follow up on the basis of
lessons learnt (COMAH Schedule 2, Para 4f).
Audit and Review
Key performance issues/ comments on the adoption and implementation of
procedures for periodic assessment of the MAPP and the effectiveness and
suitability of the safety management system; the documented review of performance
of the policy and safety management system and its updating by senior
management (COMAH Schedule 2, Para 4g).
78. The management performance overview document should be linked to the relevant incumbent record on CIS.
See section on linking to CIS above for further details.
79. The document is designed to be updated from within CIS using the edit document facility. It is recommended
that the Microsoft Word version-save facility is used to freeze a version of the document when it is first
completed and following subsequent significant review e.g. following a major period of intervention or review of
management at the site.
CIS major hazard report
80. The nature of the CIS structure means that the required information on Major Hazard sites is held in a range of
modules and linked documents. To provide easy access to a complete picture of information on a Major Hazard
establishment a standard CIS report can be obtained from the CIS Reports module (Report number 38: COMAH
Incumbent Briefing).
81. The diagram in annex 1 sets out the information that will feed into the report.
Implementation of the new arrangements
Timing
82. The new arrangements for recording major hazard information took effect from April 2002.
83. For COMAH TT establishments the new arrangements should be applied at the time of completion of the safety
report assessment process and/ or preparation of the 5 year intervention plan and for COMAH LT
establishments, at the time of the next significant planned intervention. It is accepted that full implementation of
the new arrangements, particularly for LT sites, will take a number of years.
Existing HI 251 documents
84. Existing electronic versions of HI251s should be saved in Microsoft Word format and linked to the relevant
incumbent record against the MH HI251 CIS document category.
Annex 1