Sunteți pe pagina 1din 32

HEALTH AND SAFETY

CRITICAL CONTROL
MANAGEMENT
GOOD PRACTICE GUIDE
Foreword 3
Introduction 4
Definitions and acronyms 5

Critical control management 7


Summary 7
Step 1: Planning the process 8
Step 2: Identify material unwanted events (MUEs) 9
Step 3: Identify controls 10
Step 4: Select the critical controls 12
Step 5: Define performance and reporting 14
Step 6: Assign accountability 16
Step 7: Site-specific implementation 18
Step 8: Verification and reporting 19
Step 9: Response to inadequate critical control performance 20

Appendices 23
Appendix A: The CCM journey model and mapping tool 23
Appendix B: Guidance on critical controls 24
Appendix C: CCM lead and lag indicators 26
Appendix D: References 28

Acknowledgements 30
FOREWORD

The global mining and This document, one of a range of CCM is well established and
documents on good practice in in use in many high-hazard
metals industry has health and safety management, industries. However, this is
made great progress in is designed to support the the first time this approach
principle of continual has been captured in a single
improving health and improvement. It provides document designed specifically
safety performance. practical guidance on preventing for the mining and metals
One of the sustainable the most serious types of health industry. This would not have
and safety incidents, referred to been possible without the
development principles here as material unwanted guidance and support of
of the International events (MUEs). ICMM member companies.
Council on Mining and This guidance document provides As with most new organizational
Metals (ICMM) is to seek advice on how to identify and initiatives, the successful
continual improvement manage critical controls that can implementation of CCM requires
either prevent a serious incident senior executive support.
in health and safety occurring in the first place or This support is required in
performance. minimize the consequences if a terms of not only establishing
serious incident were to occur. CCM within companies, but in
Both types of control are needed. its ongoing implementation.
Evidence from major incidents The approach enables senior
in mining and metals, and in leaders to more effectively
other industries, indicates that exercise their leadership role
although the risks were known, in safety as a result of the
the controls were not always transparency brought to bear
effectively implemented. by applying CCM. Under CCM,
Therefore, this document critical controls should be
provides specific guidance on: clearly described, and their
required performance and the
• identifying the critical controls accountability for implementing
• assessing their adequacy the controls should be made
explicit. This should permit
• assigning accountability for senior leaders to participate
their implementation even more effectively in
• verifying their effectiveness managing the risks of major
in practice. incidents. Committed leadership
through the active monitoring
The approach described in this of CCM across the mining and
document is called critical metals industry is essential
control management (CCM). for the long-term success of
the approach.

R. Anthony Hodge
President, ICMM

Health and safety critical control management Good practice guide 3


INTRODUCTION

This document Aim Preparation for the


CCM process
provides advice on The document provides advice on
MUEs – guidance on how to identify and manage critical
controls that can either prevent a
The CCM process outlined here is a
step-by-step approach where the
managing critical serious incident occurring in the first process is divided between planning
place or minimize the consequences
controls that aligns if a serious incident were to occur.
and implementation. It is important
for an organization undertaking CCM
risk management and This document provides specific to have the right skills, experience
guidance on: and resources to implement it to a
good management high standard. The organization
• identifying the critical controls
practice. CCM is an should also have buy-in from senior
• assessing their adequacy executives. Such support is a
integral part of risk fundamental characteristic of the
• assigning accountability for their
management and implementation
organizational maturity required to
succeed with CCM.
aids in identifying • verifying their effectiveness in
If an organization is unsure whether
the priority risks in practice.
it is mature enough to begin, it is
a company and recommended that the organization
Structure undertake a review of its readiness to
implementing critical adopt CCM. This guidance document
controls to prevent This guidance document utilizes a includes an analysis tool that might
help identify that readiness: the CCM
number of steps that an organization
an incident or can use to structure their approach to journey model and mapping tool.
The tool is structured as a journey
mitigate its impact. CCM. This document describes:
chart, with each step of the journey
• the background and aim of the describing an increased level of
CCM process control management culture and
practices. The tool can help map the
• guidance to prepare an organization organization’s current status, as well
for the CCM process as provide ideas for moving towards
• nine steps to develop the CCM CCM by establishing the required
process foundation (see Annex A).

• annexes providing additional Once an organization has assessed


guidance on: its maturity and established the
– a CCM journey model and appropriate foundation, it is ready to
mapping tool to help organizations proceed with the process.
assess status and progress
– critical controls
– lead and lag indicators.

4 Health and safety critical control management Good practice guide


DEFINITIONS AND ACRONYMS

This is not a definitive Bowtie analysis (BTA)


An analytical method for identifying
Material unwanted event (MUE)
An unwanted event where the
list of risk management and reviewing controls intended to potential or real consequence exceeds
prevent or mitigate a specific a threshold defined by the company
terminology. The focus unwanted event. as warranting the highest level of
is on some of the attention (eg a high-level health or
Cause safety impact).
key definitions and A brief statement of the reason for an
acronyms associated unwanted event (other than the failure
of a control).
Mitigating control
A control that eliminates or reduces
with critical control the consequences of the unwanted
Consequence event.
management used A statement describing the final
in this document. impact that could occur from the Preventing control
material unwanted event (MUE). It is A control that reduces the likelihood
usual to consider this in terms of the of an unwanted event occurring.
maximum foreseeable loss.
Risk
Control The chance of something happening
An act, object (engineered) or system that will have an impact on objectives.
(combination of act and object) It is usually measured in terms of
intended to prevent or mitigate an event likelihood and consequences.
unwanted event.
Unwanted event
Critical control A description of a situation where
A control that is crucial to the hazard has or could possibly
preventing the event or mitigating be released in an unplanned way,
the consequences of the event. including a description of the
The absence or failure of a critical consequences.
control would significantly increase
the risk despite the existence of the Verification activities
other controls. In addition, a control The process of checking the extent to
that prevents more than one unwanted which the performance requirements
event or mitigates more than one set for a critical control are being
consequence is normally classified met in practice. Company health and
as critical. safety management systems might
use a variety of terms for “verification”
Critical control management (CCM) activities. Common terms include
A process of managing the risk of audit, review, monitoring and active
MUEs that involves a systematic monitoring.
approach to ensure critical controls
are in place and effective.

Hazard
Something with the potential for
harm. In the context of people, assets
or the environment, a hazard is
typically any energy source that, if
released in an unplanned way, can
cause damage.

Health and safety critical control management Good practice guide 5


Committed leadership
through the active
monitoring of CCM
performance is
essential for the
long-term success of
the process.
Image courtesy of Anglo American
CRITICAL CONTROL MANAGEMENT

Summary Figure 1: The critical control management process

CCM consists of nine steps, six of Planning steps


which are required to plan the CCM
1
program before implementing them Planning the process
in the last three steps, as seen in
Figure 1. Impementation steps

2
This document provides guidance for
each step in the process, as well as Identify material unwanted events (MUEs)
key actions and selected health and Feedback loop
safety examples.

Each step might require revisiting


9
the previous step to achieve the
Response to inadequate
3
desired outcome. For example,
critical control performance Identify controls
the loop from Step 7 to Step 6
indicates the potential need to
revisit information from the planning
steps when site implementation is
defined. This might occur because 8 4
the site control performance varies
from assumptions made at the Verification and reporting Select the critical controls
planning stage.

Each step in the process has a target


outcome that should be achieved
before moving to the next step. 7 5
Table 1 summarizes all steps and Site-specific implementation Define performance and reporting
outcomes.

The following pages provide a 6


step-by-step outline of the CCM Assign accountability
process.

Table 1: Critical control management steps and target outcomes

STEP TARGET OUTCOME

1 A plan that describes the scope of the project, including what needs to be done, by whom and the timescales.

2 Identify MUEs that need to be managed.


Planning steps

3 Identify controls for MUEs, both existing controls and possible new controls. Prepare a bowtie diagram.

4 Identify the critical controls for the MUE.

5 Define the critical controls’ objectives, performance requirements and how performance is verified in practice.

6 A list of the owners for each MUE, critical control and verification activity. A verification and reporting plan is required
to verify and report on the health of each control.

7 Defined MUE verification and reporting plans, and an implementation strategy based on site-specific requirements.
Implementation

8 Implement verification activities and report on the process. Define and report on the status of each critical control.

9 Critical control and MUE owners are aware of critical control performance. If critical controls are underperforming or
following an incident, investigate and take action to improve performance or remove critical status from controls.

Health and safety critical control management Good practice guide 7


CRITICAL CONTROL MANAGEMENT
STEP 1: Planning the process

The first step of the CCM process is to


Target outcome carefully scope out and plan the work.
A plan that describes the scope of a project, including what needs to be This includes planning what definitions,
done, by whom and the timescales. criteria and actions will need to be
carried out, what areas of an organization
and/or specific people will be involved,
and over what timeframe. The following
questions should be considered (each is
1 elaborated on in subsequent steps):
Planning the process • What is the organizational context?
Are there existing projects at a corporate,
business unit or site level that
complement or conflict with this work?
2
Identify material unwanted events (MUEs) • What is the objective and what are the
specific deliverables of the project?

• What sections of the business will be


involved?
9 • What method will be used to identify
Response to inadequate
3
potential hazards?
critical control performance Identify controls
• What methods will be used to identify
unwanted events?

• What methods will be used to assess the


8 4 risk of the identified unwanted events,
including the criteria for a MUE?
Verification and reporting Select the critical controls
• What method will be used to review MUE
controls?

• What will the criteria be for critical


7 5 control selection?

Site-specific implementation Define performance and reporting • What will the criteria be for assessing
the objectives and performance of the
critical controls?
6 • How will the verification processes be
Assign accountability defined?

• How will ownership and accountability


Key actions be defined?
• Develop a plan that describes the scope of the project. • How can critical control information be
This includes: adapted to become site-specific?
– organizational context
– project objectives • How will critical control performance be
verified in practice and what actions will
– responsibilities
be taken if requirements are not met?
– business sections involved.
• What methods will be used to investigate
• Develop methods to:
critical control underperformance?
– identify potential hazards and unwanted events
– assess risk • How will the impact of the CCM initiative
– review MUEs will be measured?
– select critical controls
Scoping for a major initiative should
– assess objectives and performance of critical controls
consider additional resources such as
– investigate critical control underperformance
leadership, facilitation, project team
– measure impact of the project membership, timing and budget.
– identify ownership and accountability.

8 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 2: Identify material unwanted events (MUEs)

Identify material unwanted events (MUEs)


Target outcome Identification of MUEs needs to consider
Identify the MUEs that need to be managed. historical as well as foreseeable events
given the operations and activities at
individual sites. As a result, identification of
MUEs needs to include suitably experienced
personnel and a review of relevant data.
This will need to include the history from
1 the site, company and the industry more
Planning the process
widely. This is because some incidents,
while rare, are potentially disastrous.
For example, underground ignition of
methane by lightning is rare but it is
2 foreseeable and potentially disastrous.
Identify material unwanted events (MUEs)
Materiality criteria
Materiality criteria define the threshold
that a risk must exceed before being
considered a material risk. The perceived
9 likelihood of an event by any one individual
Response to inadequate
3 might be inaccurate, especially for
critical control performance Identify controls low-probability/high-consequence events.
It is recommended that materiality should
be defined based on consequences, such
as the maximum foreseeable loss.

8 4 Examples of MUEs
Verification and reporting Select the critical controls The following table is a list of typical
mining- and metals-related MUEs based
on historical analysis.

7 5 Table 2: Typical mining- and metals-related


Site-specific implementation Define performance and reporting MUEs based on historical analysis

MINING AND METALS MUEs


6
Assign accountability Aviation
Underground ground control

Key actions Underground fire/explosion


Heavy mining equipment
• Understand major hazards and identify potential MUEs.
Dropped objects
• Apply selection criteria to MUEs with a focus on the consequences.
Pressurized systems
• Identify design opportunities to address the hazard, reducing the Confined spaces
potential consequences and eliminating the MUE from the
CCM process. Inrush/inundation
Explosives
• Describe the identified MUE, including the relevent hazard,
mechanism of release and nature of the consequences. Highwall stability
Flammable gas
Light vehicles
Work at height
Electricity
Hazardous materials

Health and safety critical control management Good practice guide 9


CRITICAL CONTROL MANAGEMENT
STEP 3: Identify controls

The purpose of Step 3 is to identify all


Target outcome the controls – both existing ones and
Identify controls for MUEs, both existing controls and possible new potential new ones – before identifying
controls. Prepare a bowtie diagram. which of the controls are the critical
controls in Step 4.

Identify controls
In most cases, controls will already exist
1 as a result of previous risk-assessment
work, experience within the company or
Planning the process
industry from incidents, or as a result of
legislation and associated guidance. This
stage recommends that each identified
2 MUE should be reviewed to check that the
Identify material unwanted events (MUEs) appropriate controls have been identified.

What is a control?
Deciding on what is or is not a control is
a key step. The following guidance is
9 available:
Response to inadequate
3
• the definitions at the start of this
critical control performance Identify controls
document

• the control identification decision


tree (see Figure 2)

8 4 • example of a critical control system


given in Step 5 (see Table 3).
Verification and reporting Select the critical controls

Figure 2: Control identification decision tree

7 5
Site-specific implementation Define performance and reporting
Is it a human act,
NO
object or system?

6
Assign accountability
YES

Key actions
• Identify the controls. Does it prevent
or mitigate an NOT A
NO
• Prepare a bowtie diagram. unwanted event? CONTROL

• Assess the adequacy of the bowtie and the controls.


YES

Is performance
specified, observable, NO
measurable and
auditable?

YES

A CONTROL

Source: Adapted from Hassall, M, Joy, J, Doran, C


and Punch, M (2015).
10 Health and safety critical control management Good practice guide
CRITICAL CONTROL MANAGEMENT
STEP 3: Identify controls continued

Too many controls Figure 3: Bowtie diagram indicating preventative and mitigating controls
Experience from other industries
suggests that it is possible to identify
PREVENTATIVE MITIGATING
a large number of plans, processes Hazard
and tools that can be inappropriately
classified as controls. This leads to
unnecessarily complex bowties
that dilute the attention needed to
effectively implement those controls
that can have a direct impact on
Cause Consequence
preventing and/or mitigating an MUE.
Control Control
Some examples of inappropriate
Unwanted
controls are: event
• management plans
Cause Consequence
• risk-assessment techniques such Control Control
as Step Back 5 x 5
• behaviour-based safety tools.

All of the above are important parts


of health and safety management What is a good control? It is usual to start with the MUE by
systems but are not specific to Good controls meet the definitions asking:
preventing or mitigating an MUE. given in this document and meet the
Management plans might describe criteria in the control identification • What are the possible causes that
controls, risk-assessment techniques decision tree in Figure 2. In addition, could lead to the MUE?
might lead to controls being identified they have the following • What controls are in place (or could
and behaviour-based safety tools characteristics: be put in place) to prevent the cause
might tell us something about how leading to the MUE?
controls are working or not working. • they are specific to preventing an
However, they are not controls MUE or minimizing its • What are the maximum foreseeable
themselves as defined by this consequences consequences of the MUE?
guidance document. • the performance required of the (It is usual at this stage to assume
control can be specified there are no controls in place,
This guidance document might which is sometimes referred to as
demonstrate that many activities, • their performance can be verified. low-risk.)
previously thought to be controls, do
Further guidance on controls • What controls are in place or could
not fit the definition or the purpose.
Additional information and guidance be introduced to reduce the
For example, previously mentioned
on controls can be found in Annex B. possibility of the consequences
procedures, rules and expected
occurring?
practices are not controls. Similarly,
training, supervision, maintenance Prepare a bowtie
Proprietary tools are available, but Assess the adequacy of the bowtie
and other plans are not controls.
bowties can also be drawn by hand and the controls
(eg on a whiteboard) or developed with Once the bowtie is developed, it
standard office productivity software. should be reviewed:

• to confirm that the controls are


There is no one right way to develop appropriate and relevant for each
a bowtie (see as an example in cause and/or consequence
Figure 3). However, this is a critical
stage and the bowtie should be • against the hierarchy of control –
prepared by careful reference to the is there overdependence on
definitions at the start of this people-type controls compared with
document and the additional guidance engineering controls, which are
given on controls in Annex B. higher up the hierarchy of control?

Health and safety critical control management Good practice guide 11


CRITICAL CONTROL MANAGEMENT
STEP 4: Select the critical controls

What is a critical control?


Target outcome The starting point for this step is
Identify the critical controls for the MUE. the bowties developed in Step 3.
The controls identified on the bowtie
should be assessed to determine if
they are critical controls.

The following questions can help to


1 determine if a control is critical:
Planning the process • Is the control crucial to preventing
the event or minimizing the
consequences of the event?
2 • Is it the only control, or is it backed
Identify material unwanted events (MUEs) up by another control in the event
the first fails?

• Would its absence or failure


significantly increase the risk
9 despite the existence of the other
Response to inadequate
3 controls?
critical control performance Identify controls
• Does it address multiple causes or
of mitigate multiple consequences
the MUE? (In other words, if it
appears in a number of places
on the bowtie or on a number of
8 4 bowties, this may indicate that it
Verification and reporting Select the critical controls is critical.)

Critical control decision tree


The decision tree in Figure 4 provided
by an ICMM member may also help
7 5 determine if a control is critical.
Site-specific implementation Define performance and reporting
Note that the decision tree indicates
that selecting a critical control may be
6 an iterative process and could involve
reviewing several aspects of a control
Assign accountability
before deciding whether it meets the
criteria for a critical control.
Key actions
• When identifying critical controls, apply the critical control definition
and guidance in this section.

• Consider the performance requirements of the potential critical


controls and how they could be verified.

• The final set of critical controls for an MUE should represent the
critical few that, when managed using CCM, can effectively manage
the MUE risk.

12 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 4: Select the critical controls continued

Figure 4: BHP Billiton critical control decision tree

Identified control

Does control Does control


prevent, detect or Is control
YES prevent event YES the only barrier? YES
mitigate a material initiation?
risk?

NO NO NO

Does control Is control


prevent or detect YES effective for multiple YES
event escalation? risks?

NO NO

Is control
NO independent?

YES

Not a critical control Critical control

Source: Adapted from BHP Billiton.

Health and safety critical control management Good practice guide 13


CRITICAL CONTROL MANAGEMENT
STEP 5: Define performance and reporting

Step 5 involves examining the


Target outcome objectives, performance requirements
Define the critical controls’ objectives, performance requirements and (including current performance) and
how performance is verified in practice. reporting mechanisms for a critical
control. The following questions
should be considered when defining
each of these points:

• What are the specific objectives of


1 each critical control?
Planning the process
• What performance is required of the
critical control? (This is sometimes
referred to as a performance
2 standard.)
Identify material unwanted events (MUEs)
• What activities support or enable
the critical control to perform as
required and specified?

• What checking is needed to verify


9 that the critical control is meeting
Response to inadequate
3
its required performance? How
critical control performance Identify controls
frequent is the verification needed?
What type of verification is needed?
• What would initiate immediate
action to shut down or change an
8 4 operation or improve the
Verification and reporting Select the critical controls performance of a critical control?

Control information summary


For each critical control the following
information is needed:
7 5 • The name of the critical control
Site-specific implementation Define performance and reporting
• What are the specific objectives of
the critical control?
6 • What performance is needed from
Assign accountability the critical control?

• What activities support the


Key actions performance of the control to the
standard?
• Define objectives and performance requirements for each critical
control. • What verification activities are
needed to ensure the critical control
• Identify current activities that affect the critical control’s is meeting its required
performance. performance?
• Describe activities to verify performance and reporting
requirements. An example of a critical control
system for a specific MUE is provided
• Identify what would trigger immediate action to stop or change the in Table 3.
operation and/or impose the performance of the critical control.

14 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 5: Define performance and reporting continued

Table 3: Health example (a critical control system)

1 What is the name of the critical control for diesel particulate overexposure (MUE)?
Enclosed cab on mining equipment

2 What are its specific objectives related to the MUE?


To restrict the access of diesel particulates into the operators’ environment to levels well below the occupational exposure limit

3 What are the critical control 4 What are the activities within the 5 What can be sampled from the set of
performance requirements to meet management systems that support activities for verification, providing a
the objectives? having the critical control able to do clear image of the critical control
what is required? status?

Positive pressure cabin environment Scheduled maintenance and calibration of Review maintenance and calibration
maintained to level that prevents ingress of indicator according to manufacturer’s records
diesel particulates requirements
Review alarm log and corrective action
Pressure differentiator indicator that taken
alarms when pressure drops below
critical level

Air intake filter operating at greater than Pre-shift filter housing inspection for Review documented pre-start inspections
99% efficiency damage
Review 500-hour inspection records
Filter inspection at planned maintenance
every 500 hours Review 1,000-hour change-out records

Filter change-out every 1,000 hours

6 What is the target performance for critical control?


100 per cent of inspection and tests either satisfactory or repair is done before truck is put back into operation
7 What is the critical control performance trigger for shutdown, critical control review or investigation?
5 per cent of inspections and tests indicate cab ventilation issues that cannot be resolved or are not resolved before truck returned
to service

Health and safety critical control management Good practice guide 15


CRITICAL CONTROL MANAGEMENT
STEP 6: Assign accountability

To ensure the risk of an MUE is being


Target outcome managed, the controls must be
A list of the owners for each MUE, critical control and verification working effectively. This requires the
activity. A verification and reporting plan is required to verify and report health of the controls to be monitored
on the health of each control. through verification activities that are
assigned to specific (or multiple)
owners. This can be described in a
verification and reporting plan.
1
The verification and reporting plan
Planning the process
must include:

• an MUE owner (this should be a


senior line manager responsible for
2
the operation)
Identify material unwanted events (MUEs)
• a critical control owner, who should
be a line manager responsible for
operations (they are responsible for
monitoring the health of the critical
9 controls through review of
Response to inadequate
3 verification activity reports)
critical control performance Identify controls
• a verification activity owner,
responsible for undertaking and
reporting the verification activity
outcome
8 4 • a communication plan among all
Verification and reporting Select the critical controls owners (see as an example Figure 5)

• a description of verification activities

• an owner for the review of


verification reports at a senior line
7 5 management level.
Site-specific implementation Define performance and reporting
An example of a verification and
reporting plan for a health MUE is
6 presented in Table 4.
Assign accountability

Key actions
• Assign owners for MUEs, critical controls and verification activities.

• Describe reporting plan for the health of critical controls.

• Assign owner for review of reports.

16 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 6: Assign accountability continued

Figure 5: A sample CCM management framework

MUE OWNER ACCOUNTABILITY


DEFINED EXPECTATION

VERIFY AND REPORT


Critical control 1 Critical control 2

Critical Control 1 Critical Control 2


owner accountability owner accountability

Verification Verification Verification Verification


Activity 1 Activity 2 Activity 1 Activity 2
owner owner owner owner

Table 4: Example of a critical control verification and reporting plan for an MUE

MATERIAL UNWANTED EVENT (MUE) CRITICAL CONTROL VERIFICATION ACTIVITY


Diesel particulate overexposure Positive pressure cabin environment Review maintenance and calibration
maintained records

MUE owner Critical control owner Verification activity owner


Underground mine manager Underground mine maintenance Maintenance supervisor who oversees
superintendent the relevant equipment/task

Role of MUE owner: Role of critical control owner: Role of verification activity owner:
• Review reports monthly* from • Review verification activity reports • Gather and review information-based
relevant critical control owners. weekly*. verification activity requirements and
• Decide on required action. • Report summary to the MUE owner. compare to expectations.
• Initiate actions.
• Submit weekly* verification summary
report to the critical control owner.

Note: * this is an example timeline only.

Health and safety critical control management Good practice guide 17


CRITICAL CONTROL MANAGEMENT
STEP 7: Site-specific implementation

Steps 1 to 6 may have taken place at the


Target outcome corporate or business unit level in a
Defined MUE verification and reporting plans, and an implementation company that has similar sites and therefore
strategy based on site-specific requirements. common MUEs. Step 7 requires that the
previous steps be reviewed to ensure they
are appropriate and applicable to each site.

Figure 6 describes the process required to


1 develop a site specific MUE control strategy
and subsequent implementation and roll
Planning the process
out. It involves taking the corporate or
business unit MUE control strategy
developed in steps 1 to 6 and adjusting it to
2 suit the local context.
Identify material unwanted events (MUEs)
A site-specific approach for a MUE should
include an overall MUE verification and
reporting plan, subsections of which define a
specific critical control owner’s verification
9 plan and the individual verification activities
Response to inadequate
3 for a critical control. The site specific
critical control performance Identify controls strategy may need to be tested with the
corporate or business unit level before
proceeding. Once agreed, a plan to
implement the strategy at the site will
need to be developed. The plan should
8 4 include leadership, accountabilities, a
Verification and reporting Select the critical controls communications plan, standards and
developing knowledge and understanding
related to the critical controls.

The feedback loop between Steps 6 and 7,


5 as shown in the CCM process diagram
7 above, indicates the iterative aspect of
Site-specific implementation Define performance and reporting
Step 7 where the site submits their CCM
plans to the corporate or business unit
before finalization.
6
Assign accountability
Figure 6: Developing a site specific control
strategy adjusted to suit local requirements
Key actions
• Critical control information must be specific to a site or asset. Corporate MUE control strategy

• Adjust the critical control definition, performance information and


verification requirements as necessary to suit the local context.
FILTER
• Site-specific planning for implementation may involve an Site specific context
iterative process.

• Site-specific planning should include establishing a foundation for


Site specific MUE control strategy
CCM that includes leadership, communication and appropriate
Includes adjusted: • critical control definition
development of knowledge and understanding related to the • performance information
critical controls. • verification requirements

Site implementation and roll out


Leadership Knowledge Accountabilities
Communication Standards

18 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 8: Verification and reporting

Step 8 puts into practice the


Target outcome verification of critical control status
Implement verification activities and report on the process. Define and that was defined in Steps 5 and 6,
report on the status of each critical control. and specified in the MUE verification
and reporting plan from Step 7.
Information regarding each critical
control will be gathered on behalf of
the critical control owner who will
1 report to the MUE owner at a defined
frequency. This information flow
Planning the process
should be designed to efficiently
communicate variances between
expected and actual critical control
2 performance, such as with a traffic
Identify material unwanted events (MUEs) light reporting system.

The threshold of unacceptable critical


control performance was defined in
Step 5 and localized in Step 7.
9 Performance below that threshold
Response to inadequate
3 should trigger action, which might
critical control performance Identify controls vary from an investigation to an order
to immediately stop the relevant
work processes.

8 4
Verification and reporting Select the critical controls

7 5
Site-specific implementation Define performance and reporting

6
Assign accountability

Key actions
• Undertake verification activities for critical controls as described in
MUE/critical control verification and reporting plan (developed in
Step 5).

• Report a summary of verification activity results to the critical


control owner.

• Report critical control verification status to the MUE owner.

• Reports should highlight priority information succinctly using traffic


light system.
• Action initiated if critical control performance drops below the
defined triggers (established in Step 5).

Health and safety critical control management Good practice guide 19


CRITICAL CONTROL MANAGEMENT
STEP 9: Response to inadequate critical control performance

The low performance or failure of


Target outcome critical controls must be investigated
Critical control and MUE owners are aware of critical control performance. and understood in order to
If critical controls are underperforming or following an incident, continuously improve the CCM
investigate and take action to improve performance or remove critical process. The absence of accidents or
status from controls. incidents must not be taken as
evidence that controls are working
adequately. Where there is more than
1 one control, a control may fail without
any incident occurring because of
Planning the process
redundancy in the controls. As a
result, the verification process is
important to detect controls that are
2 not performing according to the
Identify material unwanted events (MUEs) specified requirements.

Where the failure of a critical control


is detected following an incident, this
could be:
9
Response to inadequate
3 • a hazard or at-risk situation (usually
associated with a human
critical control performance Identify controls
action/error)

• a failure of the critical control

• an event that resulted in serious


8 4 harm or had the potential to cause
serious harm.
Verification and reporting Select the critical controls

It may be necessary to review the


current site incident investigation
methods to ensure that the
5 investigation process includes
7 identification of relevant critical
Site-specific implementation Define performance and reporting
controls, understanding of their status
at the time of the event and the
causation related to the critical control
6 failure. Many common accident
Assign accountability investigation methods may need to be
modified for the CCM investigation.

Key actions The critical control failure may also


trigger a review of the critical control
• Take action when critical control performance is inadequate (below
design related to its previously
the defined trigger threshold).
documented objectives and
• Investigate the causes of unacceptable critical control performance. performance requirements.

• Information and data from the investigation should be used to Following is a sample set of questions
continuously improve the CCM. for reviewing the critical control
design, selection and management
after an incident, adapted from BHP
Billiton information.

20 Health and safety critical control management Good practice guide


CRITICAL CONTROL MANAGEMENT
STEP 9: Response to inadequate critical control performance continued

For the inadequate performance of the The investigation of critical control


critical control in an incident: failures and a subsequent critical
control review process should
• What critical controls failed? establish required improvements or
• How did the critical control fail or changes related to the critical control,
perform inadequately? including modification of performance
requirements and the verification
• What were the causes of the failure activities, or even replacement of the
or inadequate performance of the critical control with another control.
critical control? In order to
determine the cause it can be As such, critical control failure
helpful to ask the “5 Whys”. investigation and review provides
important lessons learned for
Based on the answers to the last continuous improvement of the CCM
question, the following sample critical – hence, its circular design.
control questions might also be
helpful: Note that investigation might also
suggest a review of the MUE or the
• Was the critical control designed to
addition of a new MUE, requiring a
operate in the incident situation?
return to Step 2.
• Was the description of the critical
control performance requirements
adequate?
• Did the defined critical control
performance requirements include
the management activities that are
required to ensure its function in
the circumstances of the incident?

• Did the owners and operators of the


critical control understand its
objective, design and operation
(ie are they suitably trained and/or
experienced)?

• Was the appropriate critical control


documentation available to all
relevant control operators?

• Did the verification activities check


the status of the control in a manner
that could have avoided the
incident?

• Did the verification reporting system


communicate critical control status
prior to the incident to initiate
required action and to prevent the
incident?

Health and safety critical control management Good practice guide 21


Buy-in from senior
executives is a
fundamental
characteristic of
the organizational
maturity required to
succeed with CCM.
Image courtesy of Rio Tinto
APPENDIX A
The CCM journey model and mapping tool

The CCM summary journey model Managers should use the summary In implementing CCM improvements,
and mapping tool (see Figure A1) illustration to gain a high-level the tool provides a useful benchmark
is intended to assist a company, understanding of the characteristics for managers to review progress.
business unit or site to benchmark and the indicators. It can also be used The implementation plan should also
their current CCM maturity. to provide an indication of where the include information on the review
organization is positioned in regard cycle for monitoring progress.
to the CCM journey.

Figure A1: Summary illustration of the CCM journey model and mapping tool

GENERAL LIMITED CONTROL CONTROL FOCUS CRITICAL CCM PLANNING WORK PROCESS
CHARACTERISTICS FOCUS CONTROL FOCUS CCM

Leadership mindsets Compliance Compliance but Seeing value and CCM is driven by CCM is an accepted,
support health appreciating the line leaders important part of
and safety focus the work process
recommendations

Individual mindsets Limited appreciation Limited appreciation Engaged in the Critical controls are Work methods and
for the control focus for the critical control process and some an accepted focus CCM are the same
focus critical control
understanding

Finding the highest Basic historical or Systematic historical Effective historical Proactive and Proactive and lessons
risk unwanted proactive methods or proactive methods or proactive methods lessons learned learned processes
events for priority for priority unwanted for MUEs processes are identify MUEs
unwanted events events combined to identify
MUEs

Analyzing controls Controls noted to BTA applied to Critical controls Critical controls Identified critical
and identifying the re-rank risk but no discuss controls and identified using BTA are identified with controls include
most critical significant control their effectiveness and effectiveness objectives and information for work
discussion performance process integration
requirements

Defining required No discussion of No performance Control information Critical control Integrated critical
control performance required control requirements defined, including performance control information
performance defined accountability requirements is in work process
defined and the requirements
verification process

Embedding and Limited, if any, Some informal or Some monitoring is All critical controls Verifying the work
managing controls embedding and sporadic monitoring defined and done for are systematically process includes
monitoring of of controls critical controls embedded and critical controls
controls verified and status
is reported

Improving controls Sporadic actions Improved action Deviations from Any deviations from Acting on deviations
related to controls, management but critical control the CCM planning in work process
close out limited not well linked to monitoring generate expectations are includes critical
controls actions investigated and control needs
actioned

Health and safety critical control management Good practice guide 23


APPENDIX B
Guidance on critical controls

Method to assess control adequacy Figure B1: Example control adequacy analysis method
Figure B1 shows a sample control
adequacy analysis method developed
6 Response Response by CONTROL SCHEME
by an ICMM member. This example type
includes three control schemes: 5 People System Engineering

recommended
CONTROL

control level
based based based

Minimum
people based, system based and 4 LEVEL
engineering based. 3 6

The illustration shows seven levels 2 5


of event severity where Level 7 is the 1
4
highest. It also suggests that the most 1 2 3 4 5 6 7
effective controls for the highest- Potential risk severity 3
severity levels are engineering based
(or objects), that is Control Level 4, 5 2
Control design likely to be appropriate
and 6. Note that control levels equate
Control design may require enhancement
to levels of reliability.This framework 1
Control design likely to require enhancement
can assist with discussion on the
adequacy of controls for severe Sources: BHP Billiton and MMG.
consequences or an MUE.

Following is an overview of the support suitable for an MUE. A Level 5 system- This method can be used to establish
information for Figure B1. based control has a documented a control level for an individual control
procedure including document control, by assigning the relevant adequacy
People-based controls there are system-set rules and rating (green, yellow or red) based on
These rely on the skills, knowledge protocols (access, authority levels, consideration of the control level and
and experience of individuals or expected control range), operators are potential consequence. The method
groups. Control actions (or acts) are trained in the procedure including can be repeated for all controls in the
initiated by individuals based on their periodic assessment, control outcome MUE bowtie analysis (BTA). Also, the
skills, knowledge and experience and performance is clearly defined and graphic BTA can be modified to show
on their interpretation of the verified (similar to the suggested the relevant colour for each control.
organization’s values and objectives. CCM approach) and the system design
Given the reliance on people, the is covered by a rigorous change Once every control in the BTA is
reliability of people-based controls management process. categorized red, yellow or green, the
may vary over time. People-based BTA can be evaluated to consider the
controls (or acts) have three levels of Engineering-based controls (or objects) overall risk-control strategy. As a
adequacy based on considerations These execute automatically and do guide, tolerable risks will have at
such as degree to which people not require human intervention. least one green control per cause.
understand the roles and Engineering-based controls may As a result of applying this control
responsibilities, how skilled and include both hardware and automated adequacy analysis method to an MUE
trained they are and the overall level IT-based controls. Engineering controls BTA, there should be an opportunity to:
of process discipline. Note that even are designed to achieve a specific
the highest-level control, a Level 3, repeatable level of control to a set level • confirm that the overall MUE control
is not seen to be adequate for high- of availability. Reliability of engineering strategy is adequate and the risk is
severity consequences or MUEs. controls is achieved through the tolerable, or
management system surrounding the • identify causes for which control
System-based controls ongoing review and improvement of enhancements are required.
These are executed by individuals the controls performance. Engineering
within the bounds of a management controls can achieve the highest level Successful definition of a well-derived
system. Execution is based on a of adequacy ranging from 4 to 6. BTA for the selected MUE, which
prescribed approach either as a Levels 5 and 6 are suitable for MUEs. includes agreement that the overall
common practice or as a defined These controls are designed and control strategy is adequate, will
procedure and in some instances, implemented to specific performance provide the basis for critical control
input from people is governed by criteria (availability and reliability), are selection in Step 4. An example of a
system-set rules and protocols. managed as part of a preventative BTA is provided in Figure B2.
Control reliability is achieved through maintenance system, have a system-
the system surrounding the control, generated alarm/notification in the Other analysis methods for examining
including management review and event of control failure and have control design adequacy or overall
follow-up. Systems-based controls management follow-up of system control effectiveness are available
potentially range in adequacy from deficiencies, and there is a rigorous in Hassall, M, Joy, J, Doran, C and
Level 1 to Level 5, where Level 5 is management of change. Punch, M (2015).

24 Health and safety critical control management Good practice guide


THREATS/CAUSES CONTROLS CONTROLS CONSEQUENCES

Old engine
technology

Purchased as per Engine replaced


Tier 3 or 4 policy as per plan

Biodiesel fuel Synthetic fuels


used used Excessive
Figure B2: Health BTA example

Fuel and exposure to Excessive diesel


APPENDIX B

lubricating oil diesel particulate particulate matter


composition matter and and gases
Low sulphur Low ash oils Fuel additives gases accumulation in
diesel used used used Spot ventilation Dilution by the workplace
(10ppm) system ventilation atmosphere
system
Crankcase
emissions
Excessive diesel
Closed crankcase Filtered open particulate matter
ventilation design crankcase and gases
ventilation design accumulation at
Operator enclosed the operator
in environmental position
Full-flow diesel Partial-flow diesel
Guidance on critical controls continued

cabin
particulate filter particulate filter
used used Unacceptable
No exhaust diesel engine Personal exposure
after-treatment emissions into to diesel
particulate matter
workplace
Diesel oxidation Filtration system Respiratory and gases
catalytic filter with disposable atmosphere protective
used filter elements equipment used
used
Poor or inadequate
maintenance Ill-health effects
practices from excessive
Diesel vehicle Post-service Pre-shift tail-gas exposure1
maintained to tail-gas measurements Medical Occupational
plan measurements taken and reviewed surveillance hygiene program
taken and reviewed program
Operating
conditions

Limiting the Roads maintained


number of to minimize
vehicles in an area engine load

Inappropriate
vehicle
operation
“No idling policy” Equipment
followed operated correctly
for emission

Health and safety critical control management Good practice guide


minimization

25
1 Occupational hygiene monitoring and medical surveillance are used to monitor the effectiveness of controls on the “left hand” side of the unwanted event but are also regarded as controls if used to reduce
the severity of the consequence on the “right hand” side.
APPENDIX C
CCM lead and lag indicators

Like other major initiatives, there are A more effective lag indicator may As an example, Figure C1 shows basic
two measurement requirements for be found in the frequency of high- annual lag and lead indicators for two
CCM: potential incidents related to the critical controls related to a single
MUEs. These specific high-potential MUE. The lead indicators for the two
• the impact of the CCM initiative on incidents can be captured, compared critical controls are tracking upward,
the problem it is intended to address to pre-CCM frequency and tracked indicating increasing performance of
• the degree to which the initiative is so the numbers can be trended. the critical controls. The lag indicator,
functioning as expected. high-potential incidents, is tracking
Lead indicators for CCM should be downward. Assuming that the high-
Indicators for measuring the impact easily found in the reports from potential incident reporting culture has
of the CCM initiative can be lead critical control verification activities. not changed, this probably indicates
and/or lag. This “dashboard” information improvement too.
summarizes the performance status
Lag indicators are a common measure of the critical control versus defined
of occupational health and safety, expectations. For example, well-
though there is recognition of their defined and executed verification
limitations as a sole measure. CCM activities could yield information such
targets MUEs. Therefore, the lag as critical control performance
indicator could be the frequency of percentages.
those major events and, possibly, the
resultant consequences. Of course,
MUEs are rare and, as such, weak
measures.

Figure C1: Lag and lead indicators for an MUE

Critical Control 1 status Critical Control 2 status High-potential


from verification from verification incidents re critical
controls and MUE

100
Target performance for Critical Control 1

90 Target performance for Critical Control 2

80

70

60

50

40

30

20

10

0
2014 2015 2016 2017

26 Health and safety critical control management Good practice guide


APPENDIX C
CCM lead and lag indicators continued

The UK HSE suggests that both lag These measures can also be used This information can also assist with
and lead indicators should be used to define key performance indicators the continuous improvement of the
for MUE risk management. at various levels of the organization. CCM process.
The illustration below is from their The CCM process defines verification
guide, Developing process safety and reporting activities. For additional Additional information on leading
indicators (Health and Safety Executive information relating to the importance indicators can also be found in the
(HSE) 2006). Their focus is the “risk of developing key performance ICMM publication Overview of leading
control system”, which we can indicators, please refer to International indicators for occupational health and
consider synonymous with our CCM Association of Oil & Gas Producers safety in mining (ICMM 2012).
system – the result of applying the (2011).
CCM process in this document.
This ICMM document also
Like the UK HSE, this document recommends regular review of the
recommends that both lag and lead entire CCM process and system in
indicators be established to measure order to identify the degree to which
the CCM system. the initiative is being implemented and
operated to expectations. An annual
review of the CCM initiative could
involve a gap analysis comparing
actual status with the original scope
and the detailed execution of all
steps in the process, including the
measurement of performance and the
use of key performance indicators.

Figure C2: UK HSE illustration of “Dual assurance – leading and lagging indicators measuring performance of each
critical risk control system”

REACTIVE MONITORING RISK CONTROL SYSTEM (RCS) ACTIVE MONITORING

Lagging indicator: Leading indicator:


Outcome indicator Process or input indicators

An outcome is the desired Processes or inputs are the


safety condition that the RCS important actions or activities
is designed to deliver within the RCS that are
necessary to deliver the desired
safety outcome

Use the information from indicators to:

Follow up adverse findings


to rectify faults in the safety
management system

Regularly review performance


against all indicators to check
effectiveness of safety management
system and suitability indicators

Source: Health and Safety Executive (HSE) 2006.

Health and safety critical control management Good practice guide 27


APPENDIX D
References

Hassall, M, Joy, J, Doran, C and Punch, M (2015).


Methods for selection and optimisation of critical
controls. ACARP report no C23007.
Available at
www.acarp.com.au/reports.aspx (March 2015).

Health and Safety Executive (HSE) (2006).


Developing process safety indicators: a step-by-step
guide for chemical and major hazard industries. HSG254.
Available at
www.hse.gov.uk/pubns/priced/hsg254.pdf.

ICMM (2009).
Leadership matters: the elimination of fatalities.
London, ICMM.

ICMM (2012).
Overview of leading indicators for occupational
health and safety in mining.
Report. London, ICMM.

International Association of Oil & Gas Producers (2011).


Process safety: recommended practice on key
performance indicators. IOGP report no 456.
Available at
www.iogp.org/pubs/456.pdf.

National Offshore Petroleum Safety and Environmental


Management Authority (NOPSEMA) (2012).
Control measures and performance standards.
Guidance note N04300-GN0271, Revision no 4.
Available at
www.nopsema.gov.au/assets/Guidance-notes/N-04300-
GN0271-Control-Measures-and-Performance-
Standards.pdf.

28 Health and safety critical control management Good practice guide


CCM is an integral part
of risk management
with a focus on the
identification and
performance monitoring
of critical controls to
prevent the realization
of material risks.
Image courtesy of Rio Tinto
ACKNOWLEDGEMENTS

This document was Consulting team Additional technical support


prepared based on The process outlined in the document Ian Home (Anglo American)
a review of ICMM was developed by Jim Joy (Jim Joy &
Associates Pty Ltd), Michael Byrne
George Coetzee (AngloGold Ashanti)

member practices. (Michael Byrne & Associates Inc.) and Felipe Fuentes (Barrick)
Jeff Burges (Mel and Enid Zuckerman Rob McDonald (BHP Billiton)
The additional input School of Public Health, University of
Tony Egan (Glencore)
from the following Arizona). An independent technical
Andrew McMahon
review and edit was provided by Peter
people and companies Wilkinson (Noetic Risk Solutions). (Minerals Council of Australia)
is gratefully It was edited by Stu Slayen, proof read
by Richard Earthy and designed by
Martin Webb (MMG)

acknowledged. Duo Design.


Ben Huxtable (MMG)
Anthony Deakin (Rio Tinto)

ICMM members
ICMM team
The development of the document was
overseen by an ICMM working group Hannes Struyweg and Mark Holmes
with additional technical support led the process to develop this
provided throughout the process. document on behalf of the ICMM
ICMM is indebted to the following for secretariat. Communication support
their contributions to the research and was provided by Holly Basset and
their engagement on iterative drafts Laura Pocknell.
which led to the final document.

Photographs
Working group
Front cover – copyright © Rio Tinto
Chair: Andrew Lewin (BHP Billiton) Page 6 – copyright © Anglo American
Nerine Botes Schoeman Page 22 – copyright © Rio Tinto
(African Rainbow Minerals) Page 29 – copyright © Rio Tinto
Cas Badenhorst (Anglo American)
Frank Fox (Anglo American)
Gareth Williams (Anglo American)
Craig Ross (Barrick)
André Fey (Hydro)
Barries Barnard (Lonmin)
Phil Stephenson (Newmont)

30 Health and safety critical control management Good practice guide


Disclaimer Publication details
This publication contains general guidance Published by the International Council on
only and should not be relied upon as a Mining and Metals (ICMM), London, UK.
substitute for appropriate technical
expertise. While reasonable precautions © 2015 International Council on Mining and
have been taken to verify the information Metals. The ICMM logo is a trade mark of
contained in this publication as at the date the International Council on Mining and
of publication, it is being distributed Metals. Registered in the United Kingdom,
without warranty of any kind, either express Australia and Japan.
or implied.
Reproduction of this publication for
In no event shall the International Council educational or other non-commercial
on Mining and Metals (“ICMM”) (or its purposes is authorized without prior written
affiliates or contributors, reviewers or permission from the copyright holders
editors to this publication) be liable for provided the source is fully acknowledged.
damages or losses of any kind, however Reproduction of this publication for resale
arising, from the use of, or reliance on or other commercial purposes is prohibited
this document. The responsibility for the without prior written permission of
interpretation and use of this publication the copyright holders.
lies with the user (who should not assume
that it is error-free or that it will be suitable ISBN: 978-1-909434-13-4
for the user’s purpose) and ICMM assumes
no responsibility whatsoever for errors or Available from:
omissions in this publication or in other ICMM, www.icmm.com, info@icmm.com
source materials which are referenced by
this publication.

The views expressed do not necessarily


represent the decisions or the stated policy
of ICMM. This publication does not constitute
a position statement or other mandatory
commitment which members of ICMM are
obliged to adopt under the ICMM Sustainable
Development Framework.

We are not responsible for, and make no


representation on, the content or reliability
of linked websites, and linking should not be
taken as endorsement of any kind. We have
no control over the availability of linked
pages and accept no responsibility for them.

The designations employed and the


presentation of the material in this
publication do not imply the expression of
any opinion whatsoever on the part of ICMM
concerning the legal status of any country,
territory, city or area or of its authorities,
or concerning delimitation of its frontiers
or boundaries. In addition, the mention
of specific entities, individuals, source
materials, trade names or commercial
processes in this publication does not
constitute endorsement by ICMM.

This disclaimer should be construed in


accordance with the laws of England.
About ICMM
The International Council on Mining and Metals is an
industry body created by leading mining and metals
companies to catalyze strong environmental and social
performance in the sector; and to enhance understanding of
the benefits, costs, risks and responsibilities of mining and
metals in contemporary society. It works as a not-for-profit
organization, engaging with all parts of society and
collaborating with 21 major mining and metals companies
and 35 national mining and commodity associations that
are its members.

ICMM is governed by the CEOs of the following companies:


African Rainbow Minerals
AngloGold Ashanti
Anglo American
Antofagasta Minerals
Areva
Barrick
BHP Billiton
Codelco
Freeport-McMoRan
Glencore
Goldcorp
Gold Fields
Hydro
JX Nippon Mining & Metals
Lonmin
Mitsubishi Materials
MMG
Newmont
Rio Tinto
Sumitomo Metal Mining
Teck

ICMM
35/38 Portman Square
London W1H 6LR
United Kingdom Follow us
Phone: +44 (0) 20 7467 5070
Fax: +44 (0) 20 7467 5071
Email: info@icmm.com
www.icmm.com