Risk Management for Catastrophes Risk of Catastrophic Incidents Is Becoming Manageable Neal Walters Despite a strong focus on personnel safety and an increasing focus on process safety, serious safety incidents continue to occur in oil and gas, petrochemicals, power generation, and other asset-intensive industries. Headline-grabbing examples from the past couple of years include the following: The Kleen Energy explosion killed six workers and injured 50 in February 2010 in Middletown, Connecticut. The Occupational Safety and Health Administration (OSHA) issued its third-largest fine ever to the three construction companies building the plant for 371 safety violations, totaling $16.6 million in penalties. OSHA officials believe that the companies were attempting to earn a $19 million incentive for early completion, and reports state that employees had been working seven-day, 84-hour weeks. The primary upgrader at CNRL s Horizon site at Fort MacKay suffered an explosion in January 2011, injuring five workers. The Horizon site also experienced fatalities in 2007 and 2008. The 2007 incident resulted in 53 occupational and health safety charges, the most charges ever in a workplace incident in Alberta. Neal Walters is a partner in A.T. Kearney s energy and process industries practice. Based in the Toronto and Calgary offices, he can be reached at neal.walters@atkearney.com. He wishes to acknowledge the contribution to this article of Brent Ross, a principal in A.T. Kearney s energy and process industries practice and Saurabh Tejwani, a manager in A.T. Kearney s energy and process industries practice. The Macondo well explosion in March 2010 that killed 11 before triggering the largest offshore oil spill in US history, and ultimately resulted in over $20 billion in claims and remediation payments by BP. The Enbridge pipeline leak near Marshall, Michigan, in 2010, releasing nearly 20,000 barrels of oil into sensitive waterways and resulting in claims and remediation costs approaching $800 million. In fact, major incidents are occurring with increasing frequency. As a recent report by Marsh s Energy Practice highlights, more than one-third of the 100 most costly property losses of the past four decades have occurred within the past nine years (see Exhibit 1). This trend of increased major incident frequency has severe implications, as the cost of a single catastrophic event can reach upwards of $1 billion in damage and opportunity costs, with significant environmental impact, serious injuries, and loss of life. This same trend is also occurring in the gas transmission sector: although the number of pipeline leak incidents has remained relatively constant over the past decade (see Exhibit 2), the total cost to the industry is increasing substantially, driven by a relatively small number of catastrophic (high-impact, high-cost) incidents (see Exhibit 3). Over the past decade, of the total costs of all pipeline leaks experienced by the midstream industry in the United States, the two largest single incidents resulted in more than 25 percent of the total costs. Our analysis of data from selected companies in the refining, petrochemicals, gas and oil transmission, and power generation industries found that while most companies do not suffer catastrophic events, loss of containment (LOC) incidents could account for more than half of an asset or production site s 8 2013 Wiley Periodicals, Inc. / DOI 10.1002/gas.21658 Natural Gas & electricity January 2013
Exhibit 1. Major Incidents Occurring With Increasing Frequency total capacity or opportunity loss. In other words, LOC-related process safety incidents, whether catastrophic or not, can result in more capacity or opportunity losses than planned and unplanned downtime from all other sources combined. While most companies do not suffer catastrophic events, loss of containment incidents could account for more than half of an asset or production site s total capacity or opportunity loss. catastrophic incidents and, consequently, need to augment their longer-term PSM programs with specific short-term actions to identify and mitigate the highest immediate-risk exposures. Doing this effectively involves first understanding and assessing underlying risk factors and predictors of catastrophic incidents, then quickly identifying areas where immediate mitigating actions are required, and developing and prioritizing appropriate mitigation plans. In response, many oil, gas, chemical, and power generation companies are implementing rigorous process safety management (PSM) programs that seek to reduce significantly the probability of catastrophic events by instituting long-term sustainable improvements in fundamental operating discipline. Some are even going beyond PSM and implementing holistic risk management systems (e.g., ExxonMobil s Operations Integrity Management System). These actions are appropriate and commendable. In many cases, such actions have led to dramatic improvements in process safety performance. However, many companies face (sometimes unknowingly) immediate risks of major or Many companies face (sometimes unknowingly) immediate risks of major or catastrophic incidents and, consequently, need to augment their longerterm PSM programs. Measuring Immediate Risk Exposure Our experience working with both highly reliable and high-risk sites has led to a conclusion that an understanding of the immediate risk of a major incident at a given operating site can be obtained by evaluating four critical dimensions: 1. Work-practice maturity in a limited number of critical areas related to fundamental operating discipline january 2013 Natural Gas & electricity DOI 10.1002/gas / 2013 Wiley Periodicals, Inc. 9
Exhibit 2. Pipeline Leak Incidents Relatively Constant Over Last Ten Years 2. Key quantitative risk predictors that are highly correlated with elevated process safety risk 3. Recent LOC incident frequency (across all severity levels), including an assessment of recurring themes across incidents and of how effectively current processes identify true root causes 4. The rigor (and completeness) of LOC incident follow-up Work-Practice Maturity An effective PSM program covers a wide range of operating processes. Our experience reveals that process maturity in a critical few areas (that are correlated with fundamental operating discipline) are a strong predictor of immediate major or catastrophic incident risk. Concern areas include maintenance and integrity management, people management, and site leadership. Evidence of problems in maintenance and integrity management include ad hoc or weak systems to ensure compliance to equipment and unit inspection standards, ad hoc or weak systems to ensure equipment integrity, poorly defined or loosely adhered to operating envelopes, and poor processes for understanding true root causes of reliability incidents. People management issues include ineffective training and succession planning programs for critical operating positions as well as limited experience and tenure in critical operating positions (generally also associated with high turnover in these positions). Another area for concern are ineffective standards or processes for avoiding consistent excess overtime. Site or asset leadership is another category of incident risk. This category includes lack of technical competence, lack of leadership and visibility in driving performance improvements, and lack of focus (too many priorities). In our experience, capturing a true picture of work-practice maturity in critical areas requires an experienced team (with a mixture of site and off-site personnel) conducting cross-functional interviews coupled with validation in the field. Key Quantitative Risk Predictors A high risk of a major incident is typically correlated with weaker performance in fundamental operating discipline. Therefore, while lagging indicators such as recent incident history (both occurrence and severity) are clear predictors of elevated risk, leading indicators associated with fundamental operating discipline are also effective. Among the most relevant leading indicators are the following: 10 2013 Wiley Periodicals, Inc. / DOI 10.1002/gas Natural Gas & electricity january 2013
Exhibit 3. Less than 4 Percent of Pipeline (Liquid and Gas) Leaks Account for More Than 80 Percent of Losses Procedure discipline critical operating procedures out of date Equipment inspection discipline the number of equipment inspections overdue Safety system management discipline alarms disabled or inhibited, and safety information systems bypassed without an approved management of change (MOC) LOC and MOC follow-up discipline (i.e., completion/overdue status) HR management discipline competency (experience and depth in critical positions) and loading (overtime and other overload measures) The categories above include a combination of both direct and indirect measures of risk. Operating procedure discipline is an example of a direct measure if procedures are not updated and followed, there is clearly a higher risk of a major incident. However, it is important to balance these direct measures with indirect measures of the degree of process safety rigor and risk taking at a site. Examples of indirect measures include the rigor and discipline regarding equipmentinspection schedules and safety-system adherence. Poor performance in these areas is often indicative of a broader laxness in fundamental operating discipline and, as a result, higher-incident risk. Recent LOC Incident Frequency and Underlying Root Causes The recent incident history at a site is certainly an important predictor of major incidents, but the effectiveness of incident investigations is also a critical factor. Ineffective investigations often suffer from common flaws, such as treating incidents independently, and thereby potentially missing recurring themes across incidents. There is often a bias toward technical root causes and solutions, and superficial and incomplete root cause identification. Another incident investigation issue is too many follow-up actions, leading to a higher potential that the true critical few issues are lost among the many trivial actions. If investigations fail to look holistically and historically across a site or even a company for commonalities, systemic root cause trends january 2013 Natural Gas & electricity DOI 10.1002/gas / 2013 Wiley Periodicals, Inc. 11
may be overlooked. Often, these trends are complex (e.g., poor or not followed procedures, ineffective communication between operations and maintenance) and are almost impossible to identify when looking at incidents individually. Incident investigations often conclude that technical factors such as design error and equipment failure are at fault, and result in follow-up actions that are primarily technical in nature, for example, adding interlocks to prevent certain actions from occurring. However, we have found that, when incidents are assessed as a set rather than individually, the systemic underlying root causes are related to human factors (as opposed to technical or equipmentrelated factors) at least 90 percent of the time. These human factor root causes include inadequate or not followed maintenance/ operating procedures, poor interface between maintenance and operations (particularly regarding equipment commissioning), and lack of appropriate escalation processes for dealing with nonstandard conditions. If technical factors are the primary focus of follow-up actions, the result may be preventing a specific initiating event that has an infinitesimal probability of recurring, while not addressing a holistic underlying risk factor that may lead to another major incident in the near future. Superficial and incomplete root cause identification disguises the true root cause and prevents implementation of the right corrective actions. For example, when an incident is attributed to a procedure not being followed, the remedial action is often a mandate that procedures must be followed (with significant consequences if they are not). While this is certainly an appropriate long-term end state, in many cases it will not address the true underlying issue. To be effective, the underlying reason why procedures are not being followed must be identified and corrected before a contract for compliance can be forged between site management and operations and maintenance personnel. People will not consistently follow procedures they do not believe in and trust. If incident response teams do not focus on distinguishing the critical from the trivial, they can create a seemingly endless number of follow-up actions. These follow-up actions overload the site s ability to respond and can result in the most critical actions not being executed. LOC Incident Follow-Up The effectiveness of a site in implementing mitigating actions is critical to preventing recurrence. A large and growing number of open action items suggest that there is often a laxness in operating discipline, an absence of a single point of accountability for incident follow-up, and weak management and IT systems that are difficult to use at the operator or mechanic level. In summary, predicting elevated risk of major operating incidents can be enhanced through implementation of a relatively simple, straightforward risk scorecard that tracks key predictors across four critical elements: workpractice maturity in areas critical to fundamental operating discipline, key quantitative predictors of elevated risk, recent incident history, and the robustness of incident follow-up. Mitigating Risk Exposure The combination of qualitative and quantitative measures included in the risk scorecard not only identifies areas of significant risk, but also points to specific areas where immediate action is warranted to reduce that risk. These actions should complement rather than replace existing (or developing) PSM systems that are critical to obtaining a stable, manageable risk profile in the longer term. Improving process safety must remain an urgent and primary priority, with the majority of available discretionary resources allocated to these efforts. Resources should only be reallocated to higher-order optimization activities when acceptable PSM performance and LOC incident frequencies are attained. Successful change begins with the appropriate engagement model for assessment and implementation. In our experience, this includes the following four critical aspects. Assessment Independence Having parties external to the site (but not necessarily external to the company) participate in the assessment typically results in greater assurance that true root causes are being identified and eliminates the potential for sites to be overly reliant on lagging measures and therefore declaring victory too early. While it is critical that a site buys into and is given full responsibility for implementing a mitigation plan, the role of measuring that plan s progress 12 2013 Wiley Periodicals, Inc. / DOI 10.1002/gas Natural Gas & electricity january 2013
Exhibit 4. Example: Loss of Containment Incidents Reduced by About 50 Percent Within Six Months and effectiveness should rest with parties external to the site itself. Assessment Validation Validating findings regularly (particularly in the areas of practice maturity and incident root causes) may be contentious, but it can greatly improve the accuracy of findings and site buy-in. Collaborative Solution Development In order to be effective, solution development should be collaborative with the receiving site and, while the objectives can be mandated top down, specific actions and changes are more effective if they are developed collaboratively. Line Ownership of Implementation To be effective, accountability for implementation must be through the line organization (i.e., by the site, not for the site). In addition, the site s (and the broader organization s) capacity to assimilate the recommended change should be assessed regularly. Effective implementation must take the form of a consolidated program rather than a series of independent actions. The program must focus on the critical few and drive to completion, while avoiding early declaration of victory. While site accountability to execute and sustain improvement is crucial, guidance and tracking external to the site is necessary. To be effective, accountability for implementation must be through the line organization (i.e., by the site, not for the site). Companies that have implemented a programmatic approach along the lines described above have seen dramatic short-term improvements while maintaining progress toward longer-term process safety management objectives. Exhibit 4 presents a case example where a company was able to reduce loss of containment incident frequency, across all severity levels, by close to 50 percent over a six-month period. A Call to Action Measuring and addressing the risk of catastrophic incidents is more important than ever. The immediate level of risk can be measured with a limited number of qualitative and quantitative indicators. These can be summarized in simple dashboards that enhance visibility, support and accelerate existing PSM programs, and clearly identify priority areas for immediate action. january 2013 Natural Gas & electricity DOI 10.1002/gas / 2013 Wiley Periodicals, Inc. 13