MANUAL RISK ASSESSMENT MATRIX PTS 60.

133 MARCH 1996

PREFACE PETRONAS Technical Standards (PTS) publications reflect the views, at the time o f publication, of PETRONAS OPUs/Divisions. They are based on the experience acqu ired during the involvement with the design, construction, operation and mainten ance of processing units and facilities. Where appropriate they are based on, or reference is made to, national and international standards and codes of practic e. The objective is to set the recommended standard for good technical practice to be applied by PETRONAS' OPUs in oil and gas production facilities, refineries , gas processing plants, chemical plants, marketing facilities or any other such facility, and thereby to achieve maximum technical and economic benefit from st andardisation. The information set forth in these publications is provided to us ers for their consideration and decision to implement. This is of particular imp ortance where PTS may not cover every requirement or diversity of condition at e ach locality. The system of PTS is expected to be sufficiently flexible to allow individual operating units to adapt the information set forth in PTS to their o wn environment and requirements. When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the quality of work and the attainment of the required design and engineering standards. In particular, for those requ irements not specifically covered, the Principal will expect them to follow thos e design and engineering practices which will achieve the same level of integrit y as reflected in the PTS. If in doubt, the Contractor or Manufacturer/Supplier shall, without detracting from his own responsibility, consult the Principal or its technical advisor. The right to use PTS rests with three categories of users : 1) 2) 3) PETRONAS and its affiliates. Other parties who are authorised to use PTS subject to appropriate contractual arrangements. Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred to under 1) an d 2) which requires that tenders for projects, materials supplied or - generally - work performed on behalf of the said users comply with the relevant standards . Subject to any particular terms and conditions as may be set forth in specific a greements with users, PETRONAS disclaims any liability of whatsoever nature for any damage (including injury or death) suffered by any company or person whomsoe ver as a result of or in connection with the use, application or implementation of any PTS, combination of PTS or any part thereof. The benefit of this disclaim er shall inure in all respects to PETRONAS and/or any company affiliated to PETR ONAS that may issue PTS or require the use of PTS. Without prejudice to any spec ific terms in respect of confidentiality under relevant contractual arrangements , PTS shall not, without the prior written consent of PETRONAS, be disclosed by users to any company or person whomsoever and the PTS shall be used exclusively for the purpose they have been provided to the user. They shall be returned afte r use, including any copies which shall only be made by users with the express p rior written consent of PETRONAS. The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be held in safe custody and PETRONAS may at any time re quire information satisfactory to PETRONAS in order to ascertain how users imple ment this requirement.

AMENDMENT RECORD SHEET Chapter Section No. No. All All All All All All Description Original paper issue Conversion for CD-ROM New issue Correction/ Update Date Oct 91 Initials Reference Indicator Conversion Update Feb 95 Mar 96 NPC GvdG SMAD/23 EPS/HE

TABLE OF CONTENTS 1. 2. 3. 4. INTRODUCTION THE RISK ASSESSMENT MATRIX THE APPLIC ATION IN HSE RISK MANAGEMENT THE APPLICATION IN INCIDENT INVESTIGATION APPENDIX 1 APPENDIX 2 CONSEQUENCE CATEGORY DEFINITION RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

1. INTRODUCTION Management of HSE involves an assessment of the risks posed by inci dents* that can develop from the release of a hazard. A qualitative assessment o f the risk, rather than a quantitative one, is in many cases adequate to identif y an appropriate course of action for managing the risk. The potential risk of a n incident can be classified by the use of the Risk Assessment Matrix which is i ntended to replace the Risk Matrix and the Incident Potential Matrix. Historical ly the Risk Matrix and the Incident Potential Matrix were developed separately. The Incident Potential Matrix was developed first on the basis of earlier Operat ing Unit initiatives and published in 1991 as a Shell Safety and Health Committe e guide. It introduced the concept of "potential consequences", i.e. "what could have gone wrong" in slightly different circumstances, and was used together wit h a measure of exposure to assess the relative importance of incidents. The vert ical "potential consequence" axis of the Incident Potential Matrix has been wide ly adopted, whereas the horizontal axis has been variously interpreted by the Op erating Units with some using a measure of probability or likelihood of occurren ce, while others have used some measure of exposure. In some Operating Units, it is considered that only the potential consequence should determine the depth of investigation, without taking the likelihood of occurrence or exposure into con sideration. The Risk Matrix was developed later in conjunction with the developm ent of the Hazards and Effects Management Process (HEMP) of the HSE Management S ystem, as a tool to visibly express company policy and to demonstrate compliance with the risk tolerability criteria and the ALARP principle. The vertical axis of the Risk Matrix was identical to that of the Incident Potential Matrix. For t he horizontal axis, a qualitative description of probability was used. In order to promote a consistent approach, it is now recommended to use this horizontal p robability axis for all assessment of risks from incidents as it makes risk clas sification easier and takes into account all the elements used in various Operat ing Units (frequency of activity, number of people exposed to a hazard, likeliho od of release of the hazard and functioning of barriers, and other circumstances that may impact on the development of an incident).This guideline describes the Risk Assessment Matrix (defining the horizontal and vertical axes), and gives e xamples of its use. 2. THE RISK ASSESSMENT MATRIX Description The Risk Assessment Matrix (Figure 1) is a tool that standardises qualitative risk assessment and facilitates the categor isation of all threats to health, safety, environment and reputation. The matrix axes, consistent with the definition of risk, are Consequences and Probability (or Likelihood).

Figure 1 : Risk Assessment Matrix C o nse q u e n c e Inc re a sing Probability A B C D E Rating People No injury Slight injury Minor injury Major injury Single fatality Mutiple fatali ties Assets Environment Reputation Never heard Heard of of in --incident in -industry industry Incident has Happens Happens occurred in several times several times our company per year in co. per year in locn. 0 1 2 3 4 5 No damage No effect Slight damage Minor damage Localised damage Major damage Ext ensive damage Slight effect Minor effect Localised effect Major effect Massive e ffect No impact Slight impact Limited impact Considerable impact Major national Major international

A scale of consequences from "0" to "5" is used to indicate increasing severity. The consequences are those of credible scenarios (taking the prevailing circums tances into consideration) that can develop from the release of a hazard. The po tential consequences, rather than the actual ones, are used. These are defined a s the consequences that could have resulted from the released hazard if circumst ances had been less favourable. The probability on the horizontal axis is estima ted on the basis of historical evidence or experience that the identified conseq uences have materialised within the industry, the company or a smaller unit. Not e that this should not be confused with the probability that the hazard is relea sed: it is the probability of the estimated potential consequences occurring. Cl assification of Potential Consequences The consequences of the release of a haza rd or effect are identified in each of the four categories (harm to people, asse t damage, environmental effect and potential impact on the reputation of the com pany) by selecting an appropriate row description on the vertical axis of the ma trix. The definition of the categories is given in Appendix 1. Risk is described , not only in terms of risk to health, safety and the environment, but also in t erms of risk to reputation. Reputation is driven by perceptions and by societal issues. Risk in scientific terms may be reduced to the level reasonably practica ble (ALARP), yet the overall risk to reputation may still remain high. Risk to r eputation cannot be ignored and advice may be sought from Public Affairs experts . Consequences should be estimated on the basis of what might have resulted unde r slightly different circumstances. Examples are: Scenario A crane drops a load one meter besides a person. Car rolls over on a desert road. Operator opens wron g valve: diesel fuel polluting river; quickly spotted by someone else. Exposure to H2S: quickly rescued and resuscitated Exposure to benzene exceeding current o ccupational exposure limits Flare carries over some crude. Actual outcome Damage to load. Potential consequence Fatal injury if a person had been standing under the load. Damage to car, no injury (seat Serious injury. belt was worn). Minor pollution M ajor effect if the spill had not been noticed so quickly. in Fatal or permanent total/partial disability. Cancer (leukemia). 2 days observation hospital: minor injury. None. Sooting flare. Oil in flare pit. Pit on fire. Heavy smoke. Soot on nearby houses and cars. Comp laints. Media publicity. Damage claims. Assessment of Probability The horizontal axis represents the probability or the measure of likelihood of the occurrence of an undesired event following the rele ase of a hazard. The scale of the horizontal axis is indicatively defined : "A never heard of in the __ industry", "B - heard of in the __ industry", "C - has occurred in our company", "D - happens several times per year in company", and "E - happens several times per year in location". This assessment is based on ex perience and is indicative of the likelihood of undesired consequences materiali sing. Note again that this should not be confused with the probability that the hazard is released: it is the probability of the estimated potential consequence s occuring.

In smaller Operating Units or new ventures where experience is limited, it is re commended that the probability is assessed on the basis of knowledge from simila r operations in other Operating Units. In new ventures, the potential consequenc e scale only can be used and investigations carried out for all incidents with p otential higher than 3. By doing so, every opportunity is used for learning from the potentially serious incidents, no matter how unlikely their occurence may b e. Risk Classification Using the Risk Assessment Matrix, risk is classified by t hree characters made up as follows: the first character is a measure of the like lihood of an undesired event: A E the second character is the consequence severi ty that could occur with that event: 1 5, and the third character shows to which consequence category the assessment pertains People (P), Asset (A), Environme ntal (E) nature or Reputation (R). The intersection of the chosen column with the chosen row is the risk classifica tion. For the same scenario, different classifications may apply to P, A, E, and R. Some examples of incident classification are given in Appendix 2. 3. THE APP LICATION IN HSE RISK MANAGEMENT A suitable overlay for using the Risk Assessment Matrix as an element of the HSE management system to identify actions to reduce risk to ALARP is shown in Figure 2 below. Figure 2 : Risk Management Overlay (for expressing Company policy and strategic objectives) Increasing Probability A B C D E Rating

Incident has occurred in our company Happens several times per year in co. Happens several times per year in locn. 0 1 2 3 4 5 Manage for continuous improvement Incorporate Risk Reduction Measure s Intolerable Objective setting is at the heart of the HSE Management System and the Risk Asse ssment Matrix overlay format shown above is a useful tool that can help manageme nt in the interpretation of risk (expressed in the policy and strategic objectiv es of the company) and also help the line in understanding how this policy and t hese objectives are to be regarded (in terms of tolerable risk) in their day to day operations. The definition of tolerable risk should be derived from the poli cy and strategic objectives of the company and can be indicated on the Risk Asse ssment Matrix by company management by shading in the appropriate areas. The sha ding indicated in the matrix is recommended practice; deviations can be consider ed for small operating entities. The focus provided by using the Risk Assessment Matrix in this way enables company management to determine whether the risk lev els inherent in the company's operations are tolerable and whether they fit with current corporate policies and objectives. For example, if an operation would r esult in scenarios which lie

Heard of incident in

Never heard of in

industry industry

in an area on the Risk Assessment Matrix that the company would normally regard as "intolerable" in policy terms, then alternative ways of carrying out the oper ation should be investigated. If there are no alternative ways, then management must decide whether the operation should proceed or not. If it has to proceed th en special treatment in regard to the level of control must be implemented befor e the operation takes place. The Risk Assessment Matrix overlay may also be used on a scenario by scenario basis to prioritise risk reduction efforts. It is ada ptable to varying levels of information and depths of evaluation. It has a built in presentation format that lends itself to review. Because it is qualitative a nd the scales relative, instead of absolute, exact knowledge is not required and thus risk understanding can be reached fairly easily. Examples of risk determin ation using the Risk Assessment Matrix are included in Appendix 2. A company sho uld consider using the Risk Assessment Matrix as a part of its implementation of the HSE Management System and of HSE Cases (HSE Reports). The use of the Risk A ssessment Matrix will: 4. enhance the appreciation of HSE risk tolerability and ALARP at all levels in the company, assist in making the PETRONAS Group policy a nd standards and local company HSE policies relevant to day to day operations vi a the setting of clear risk based objectives that can be cascaded into the setti ng of individual tasks and targets, and provide the basis for the implementation of the risk based HSE Management System in accordance with PETRONAS Group Guide lines. THE APPLICATION IN INCIDENT INVESTIGATION For use in incident follow up, the mat rix can be used with an overlay as shown in Figure 3 to decide on depth of inves tigation, investigation team composition, reporting level, etc Figure 3 : Incide nt Follow up Overlay Increasing Probability A Never heard of in industry

C Incident has occurred in our company D Happens several times per year in co. E Happens several times per year in locn. Rating 0 1 2 3 4 5 to be investigated and discussed in depth analysis and discussion at management in depth analysis, level management involvement, voluntary reporting to service companies Suggestions for team composition, reporting and feedback to management are shown below. Company managements are encouraged to review and customise the table. Ri sk Rating Low risk (unshaded area) Medium Risk (lightly shaded area) High Risk ( heavily shaded area) Investigation team composition local supervisor + HSE focal point asset holder + other line staff as required + HSE advisor Member of Manag ement Team + asset holder + HSE advisor + independent person e.g. from corporate organisation + specialists as required Reporting/discussion reporting to depart ment head reporting to OU management reporting to CEO and voluntary reporting to Service Companies

B Heard of incident in

industry

The Incident Follow up Overlay is intended for use by location personnel after a n incident occurrence to: assess the significance of an incident in terms of its ultimate potential for injury, damage, environmental and reputation effects, pr ovide guidance in determining the depth or extent of an incident investigation a nd its follow up, and increase the awareness of Health, Safety and Environmental implications of any incident. Application of the tool is expected to: promote n ear miss reporting, improve knowledge of potentially serious incidents, enhance the direction of safety efforts and make more efficient use of investigation tim e, improve management of risk reduction efforts, and focus on where the greatest benefits can be achieved, provide a broad incident occurrence indicator, and as sist in media handling by the Public Affairs staff due to an improved insight in to the potential severity of an incident. APPENDIX 1 CONSEQUENCE CATEGORY DEFINITION Harm to People No. 0 1 2 Description No injury or damage to health. Slight injury or health effects (including first aid case and medical treatment case) Not affecting work performance or causing d isability. Minor injury or health effects (Lost Time Injury) Affecting work pe rformance, such as restriction to activities (Restricted Work Case) or a need to take a few days to fully recover (Lost Workday Case). Limited health effects wh ich are reversible, e.g. skin irritation, food poisoning. Major injury or health effects (including Permanent Partial Disability) Affecting work performance i n the longer term, such as a prolonged absence from work. Irreversible health da mage without loss of life, e.g. noise induced hearing loss, chronic back injurie s. Single fatality From an accident or occupational illness (poisoning , cance r). Multiple fatalities From an accident or occupational illness (poisoning, c ancer). 3 4 5 Asset Damage No. 0 1 2 3 4 5 Description (100% costs, USD) Zero damage Slight damage No disruption to opera tion (costs less than 10,000) Minor damage Brief disruption (costs less than 1 00,000) Local damage Partial shutdown (can be restarted but costs up to 500,00 0) Major damage Partial operation loss (2 weeks shutdown costs up to 10,000,00 0) Extensive damage Substantial or total loss of operation (costs in excess of 10,000,000)

Environmental Effect No. 0 1 2 Description Zero effect No environmental damage . No change in the environment. No financial consequences. Slight effect Local environmental damage. Within the fence and within systems. Negligible financial consequences. Minor effect Contamination. Damage sufficiently large to attack the environment. Single exceedance of statutory or prescribed criterion. Single complaint. No permanent effect on the environment. Localised effect Limited l oss of discharges of known toxicity. Repeated exceedance of statutory or prescri bed limit. Affecting neighbourhood. Major effect Severe environmental damage. The company is required to take extensive measures to restore the contaminated e nvironment to its original state. Extended exceedance of statutory or prescribed limits. Massive effect Persistent severe environmental damage or severe nuisa nce extending over a large area. In terms of commercial or recreational use or n ature conservancy, a major economic loss for the company. Constant, high exceeda nce of statutory or prescribed limits. 3 4 5 Impact On Reputation No. 0 1 2 3 Description No impact No public awareness Sli ght impact Public awareness may exist, but there is no public concern. Limited impact Some local public concern. Some local media and/or local political att ention with potentially adverse aspects for company operations. Considerable imp act Regional public concern. Extensive adverse attention in local media. Sligh t national media and / or local / regional political attention. Adverse stance o f local government and/or action groups. National impact National public conce rn. Extensive adverse attention in the national media. Regional / national polic ies with potentially restrictive measures and/or impact on grant of licences. Mo bilisation of action groups. International impact International public attenti on. Extensive adverse attention in international media. National / international policies with potentially severe impact on access to new areas, grants of licen ces and/or tax legislation. 4 5

APPENDIX 2 RISK ASSESSMENT MATRIX APPLICATION EXAMPLES Examples In HSE Risk Mana gement 1. Risk Scenario: All the tanks in a terminal are within bunds. One of th e tanks is receiving gasoline from a tanker. The operation is started at night. The storage tank is overfilled and a large vapour cloud is formed by vaporising gasoline. The vapour cloud is ignited by a passing vehicle. A major explosion an d fire develop which destroy 10 of the 15 tanks at the terminal, cause extensive damage, and result in multiple fatalities. Such an accident has not occurred pr eviously in the Operating Unit. C o n se q u e n c e A Never heard of in industry Inc re a sing Pro b a b ility B Heard of incident in industry C D E Rating People No injury Slight injury Minor injury Major injury Single fatality Mutiple fatali ties Assets Environment Reputation Incident has Happens Happens several occurred in several times times per year in our company per year in locn. co. 0 1 2 3 4 5 No damage No effect Slight damage Minor damage Localised damage Major damage Ext ensive damage Slight effect Minor effect Localised effect Major effect Massive e ffect No impact Slight impact Limited impact Considerable impact Major national Major international Demonstrate ALARP E R P A INTOLERABLE Using the Risk Assessment Matrix (see the figure above), this scenario for peopl e, assets and company reputation plots in the region categorised as Demonstrate ALARP by company management. This means that for this type of loss of containmen t event a cost benefit analysis should be undertaken to determine if there are a dditional cost effective measures that could be put in place to further reduce t he risks to people, assets and company reputation. The risk to the environment s hould be managed for continuous improvement. 2. A proposal for a new installatio n has two product movement scenarios: transport by truck or the installation of a pipeline. For the trucking scenario (indicated by a O on the matrix shown belo w), the following risk classifications were identified: C5(P), C2(A), D1(E), C1( R). The risk to people is categorised as "intolerable". For this scenario to be undertaken special treatment in regard to protecting people must be implemented. Cost effective measures to reduce the risk to people should be undertaken. For

the pipeline scenario (indicated by a on the matrix), the following risk classif ications were identified: B2(P), B3(A), B3(E), B1(R). The risks to people, asset s, environment and reputation are categorised as tolerable, and if the pipeline scenario is implemented, should be managed for continuous improvement in HSE per formance. Consequence Increasing Probability A

C D E Rating People Assets Environment Reputation

Happens Happens Incident has occurred in our several times several times company per year in co. per year in locn. 0 1 2 3 4 5 No injury No damage Slight damage Minor damage Localised damage Major damage No effect Slight effect Minor effect Localised effect Major effect Massive effec t No impact Slight impact Limited impact Considerable impact Major national Major international Slight injury Minor injury Major injury Single fatality R P AE R A E Demonstrate ALARP Extensive Mutiple fatalities damage P

Never heard of in

industry

B Heard of incident in

industry

INTOLERABLE

Examples of Incident Classification 1. During a weekly off loading operation fro m a supply vessel, a roof section of a container became detached and fell into t he sea striking the vessel on the port side. Containers containing chemicals are delivered once a month. The potential consequence to people from this incident is a single fatality. This corresponds to a severity rating code of 4. A similar incident with fatal consequences occurred 3 years ago. Several times per year l ocal damage occurs as a result of loose items falling during off loading. The In cident Potentials determined are: C4(P) fatality if a person was below falling roof. D3(A) equipment damage causes partial shutdown. C1(E) slight environm ental effect. 2. Bus carrying contract cleaning staff fails to stop at security check and hits the security gate. There were no injuries. There have been previo us occasions in company when sudden stops from hitting obstacles resulted in fra ctures or bruises. The following classifications are appropriate: D3(P) injuri es from sudden stop. D2(A) damage to vehicle or obstacles 3. Mechanical digger severed a live 415 Volt underground cable to a laboratory while excavating to l ay water pipes. There were no injuries. B4(P) possible electrocution of driver (one person). C2(A) loss of ongoing experiment and equipment. Radioactive con tamination found on work bench during routine monitoring. This incident would be classified: B4(P) internal contamination can lead to cancer; cases are known i n industry E3(E) repeated breach of statutory rules. 5. While trying to jump s tart a car (12V) with a crane battery (24V) the car battery exploded, spraying a cid on operator. Actual consequences : damage to clothing and car. C3(P) possi ble severe eye injury. C2(A) damage to car. 6. Filing cabinet drawers are open ed adjacent to a busy access route in an office. The cabinet overbalances and fa lls over, nobody is hurt but people could have been passing. It has occurred onc e before in the Operating Unit that someone was seriously hurt by such an accide nt. D3(P) major injury to person passing. 7. During "start up" an exchanger jo int fails releasing an estimated 5 tonne cloud of propane. The operator jumped a way and sprained his ankle. B5(P) possible multiple fatalities if the gas clou d had been ignited. B3(A) damage in case of gas cloud explosion. 8. During the loading of diesel from a tank, the ship's hose sprung a leak and the river was contaminated. The contamination was noted within minutes by an outsider who warn ed the loading master. The damage could have been much worse if it had not been spotted so quickly. Small leaks have occurred earlier in the company, but not a major one. B3 (E) or D2 (E) spills with minor effects have occurred, more seri ous local effect has not occurred previously in this company D2 (R) local popu lation gets worried about frequent minor spills 4.