Risk Assessment Matrix
March 2006 CONSEQUENCES
INCREASING LIKELIHOOD
Policy and strategic objectives Organisation, responsibilities resources, standards, documents
Reputation
Environment
Assets
People
Severity
A
0
No injury or health effect
No damage
No effect
No impact
1
Slight injury or health effect
Slight damage
Slight effect
Slight impact
2
Minor injury or health effect
Minor damage
Minor effect
Minor impact
3
Major injury or health effect
Moderate damage
Moderate effect
Moderate impact
4
PTD or up to 3 fatalities
Major damage
Major effect
Major impact
5
More than 3 fatalities
Massive damage
Massive effect
Massive impact
Never heard of in the Industry
B Heard of in the Industry
C
D
Has happened in the Organisation or more than onece per year in the Industry
Has happened at the Location or more than once per year in the Organisation
E Has happened more than once per year at the Location
Hazards and Effects Management
Planning and procedures
Corrective action
Implementation
Monitoring
Audit
Corrective action and improvement
Management review
Corrective action and improvement
Health, Safety and Environment
Shell Health, Safety and Environment Panel
HSE
Risk Assessment Matrix
The companies in which Royal Dutch Shell plc directly and indirectly owns investments are separate entities. In this guide, the expressions “Shell”, “Group” and “Shell Group” are sometimes used for convenience where references are made to Group companies in general. Likewise, the words “we”, “us” and “our” are also used to refer to Group companies in general or those who work for them. These expressions are also used where there is no purpose in identifying specific companies.” This document is prepared by Shell International B.V. (SI) as a service under arrangements in existence with companies of The Shell Group; it is issued for the guidance of these companies and they may wish to consider using it in their operations. Other interested parties may receive a copy of this document for their information. SI is not aware of any inaccuracy or omission from this document and no responsibility is accepted by SI or by any person or company concerned with furnishing information or data used in these guidelines, for the accuracy of any information or advise given in the guidelines or for any omission from the guidelines or for any consequences whatsoever resulting directly or indirectly from compliance with or adoption of guidance contained in the guideline even if caused by a failure to exercise reasonable care.
HEALTH, SAFETY AND ENVIRONMENT ADVISERS PANEL The copyright of this document is vested in Shell International B.V., The Hague, Netherlands. All rights reserved. March 2006
Risk Assessment Matrix, Issue 3.0, March 2006
c
Document History Date
Issue
Reason for change
Author
April 1996 April 1999 March 2006
1.0 2.0 3.0
First Issue Second Issue Third Issue
OGNL GSUK / SIEP
The electronic version of this document published on the Group HSE website is the controlled version. Superseded issues of this document should be destroyed.
Risk Assessment Matrix, Issue 3.0, March 2006
Table of Contents
Table of Contents Important Introductory Note on Interpretation and Use of the RAM
1
1
Background and Purpose
3
2
Scope and Application
4
3
Description of the RAM
5
4
Instructions for Use of the RAM
7
5
Applications of the RAM 5.1 HEMP – General 5.2 HEMP – Projects 5.3 HEMP – Documented Demonstration of Reduction of Risks to ALARP 5.4 HEMP – Workplace Hazard Control 5.5 HEMP – Chronic Effects 5.6 Incident Classification and Reporting 5.7 Incident Investigation 5.8 Classification of Audit Findings
9 9 10 10 11 11 12 13 13
6
References
15
Appendix 1
Consequence Categories And Severities
17
Appendix 2
Likelihood Scale
20
Appendix 3
Frequently Asked Questions
21
Appendix 4
Examples
26
Appendix 5
Glossary
34
Risk Assessment Matrix, Issue 3.0, March 2006
Risk Assessment Matrix, Issue 3.0, March 2006
Important Introductory Note on Interpretation and Use of the RAM
Important Introductory Note on Interpretation and Use of the RAM The Risk Assessment Matrix (RAM) is a tool designed to enable a consistent approach to qualitative risk assessment. It also establishes a common terminology to support communication about Risk throughout the Shell Group. To achieve this, the RAM shall be interpreted and used in accordance with certain fundamental principles: • Some of the terms used in this document may have special or specific meanings in some countries or contexts, but a different meaning in this document. In order to understand and use the RAM properly, it is essential that you read the Glossary carefully to make sure you understand what the specified terms mean here. • As Royal Dutch Shell plc is an English company, some concepts in the RAM are based on English law. In case of doubt this document should be interpreted in accordance with English law. • RAM assessment refers only to the analysis of specific risks to determine how to categorise them in RAM terms. A RAM assessment does not generate a decision about the action that should be taken in respect of any Risk or any financial or asset management issues. Consequently, a RAM assessment will always be only one step in a wider process of identification, control, mitigation or communication of Risk. Section 5 of this document mentions some of these processes to illustrate where the RAM may be used in practice. It is essential to follow the specific guidance for each such process.
Risk Assessment Matrix, Issue 3.0, March 2006
1
2
Risk Assessment Matrix, Issue 3.0, March 2006
1
1
Background and Purpose
Background and Purpose Applications of the Risk Assessment Matrix (RAM) have grown significantly in the six years since the previous version of this guide was issued. The RAM is now used in a wide range of HSE management processes either to support judgments about the significance of risks or to prioritise activities and allocate resources. It is particularly useful in enabling users to visualise and communicate the level of risks. A risk based approach is now applied to the management of issues, activities and resources at all levels in all Group Businesses and, as a result, the RAM is finding increasing application both in and outside the HSE field. It has become a key tool of the Shell Group. The objectives of the new RAM Guide are: • To enable users to understand the concepts of qualitative risk assessment and the RAM. • To achieve a consistent approach in the application of the RAM to HSE management processes. • To support the application of the RAM in the assessment of HSE risks and prioritisation of HSE issues.
Risk Assessment Matrix, Issue 3.0, March 2006
3
2
2
Scope and Application
Scope and Application This guide describes the RAM and the assessment process. It illustrates the application of the RAM in a range of HSE management processes with a number of examples and FAQs. The RAM is also applied in business strategy to assess and prioritise business risks. It is used in the asset integrity field where a number of derivative forms of the standard RAM have been developed. Non-HSE applications such as these are outside the scope of this guide. This guide replaces the previous version: Risk Assessment Matrix (1999).
4
Risk Assessment Matrix, Issue 3.0, March 2006
3
Description of the RAM The RAM is a 6 by 5 matrix that is used for qualitative assessments of Risk and for prioritisation of activities and resources. It is based on the concept of applying experience of events or incidents in the past to predict risks in the future. • The vertical axis represents increasing Consequences (Severity levels 0 to 5) in terms of harm to people, damage to assets, effect on the environment and impact on reputation (PAER categories). • The horizontal axis represents increasing likelihood (levels A to E) of the Consequence under consideration. • Boxes in the matrix represent levels of Risk, increasing from top left to bottom right corners of the matrix. • The matrix is divided into blue, yellow and red areas to illustrate the increasing level of Risk. CONSEQUENCES
INCREASING LIKELIHOOD
Reputation
Environment
Assets
People
A
Severity
3
Description of the RAM
0
No injury or health effect
No damage
No effect
No impact
1
Slight injury or health effect
Slight damage
Slight effect
Slight impact
2
Minor injury or Minor health effect damage
Minor effect
Minor impact
3
Major injury or health effect
Moderate damage
Moderate effect
Moderate impact
4
PTD or up to 3 fatalities
Major damage
Major effect
Major impact
5
More than 3 fatalities
Massive damage
Massive effect
Massive impact
Never heard of in the Industry
B Heard of in the Industry
C
D
E
Has happened in the Organisation or more than onece per year in the Industry
Has happened at the Location or more than once per year in the Organisation
Has happened more than once per year at the Location
Figure 1: Risk Assessment Matrix The meaning of blue, yellow and red is described in the sections on the specific applications of the RAM. In other Group HSE documents, such as the Health Risk Assessment Guide and the Incident Classification, Investigation and Reporting Guide, the blue, yellow and red areas are labelled Low, Medium and High to illustrate increasing level of Risk. The Consequence Severity (0-5) scales in the PAER categories - people, assets, environment and reputation - are defined in Appendix 1. These severities are consistent with the Group HSE Standard and related standards.
Risk Assessment Matrix, Issue 3.0, March 2006
5
3
Description of the RAM
The Consequence Severities (0-5) scales for each PAER category are not to be inferred as equal. In particular, they are not to be used to infer the value of a life. The likelihood levels A to E are defined in Appendix 2, which also includes guidelines on how to apply them to varying size and complexity of organisation.
6
Risk Assessment Matrix, Issue 3.0, March 2006
4
4
Instructions for Use of the RAM
Instructions for Use of the RAM The starting point for a RAM assessment is an understanding of the Hazard in its context (activity, location etc.), or an understanding of the particular incident being considered. An assessment consists of the following steps.
Step 1
Identify potential consequences
Identify the consequences that could develop from a release of the Hazard under the prevailing conditions. Ask the question: ‘What could happen if the controls don’t work or they fail?’ For example, the operation of a pump in crude oil service involves the potential for a release of crude oil in the event of a pump seal failure. Some of the consequences that could result are: a) Leak of crude oil into the drain system and then into the sea. b) Ignition of the crude oil resulting in a small fire around the pump. c) Inadequate fire fighting and escalation of the fire to the point where other process equipment fails and a major fire and explosion occurs. Refer to Appendix 3, FAQ 1 for further guidance on deciding potential consequences. Consequences identified in this step are equivalent to the several consequences in a bow-tie diagram that arise from a hazard release top event.
Step 2
Estimate the Severity of each potential Consequence
For each of the identified consequences assess the Severity (0 - 5) in the four Consequence categories - people, assets, environment and reputation (PAER). The severities for the PAER categories are defined in Appendix 1.
In the crude oil pump example above, for the consequence in which crude oil leaks from the pump seal and flows through the drain system into the sea, there could be impacts in 3 Consequence categories - asset, environment and reputation.
Step 3
Estimate the Likelihood
For each of the potential consequences make an estimate of the Likelihood of the Consequence in terms of the Likelihood levels A to E. The Likelihood level should be judged from past experience, by asking the question: ‘How often in the past has a hazard release resulted in a Consequence similar to the one that we are considering?’ The approach is one of applying history to predict the future.
Risk Assessment Matrix, Issue 3.0, March 2006
7
4
Instructions for Use of the RAM
The estimate of Likelihood should be based on the Likelihood of the particular Consequence under consideration, not on the Likelihood of the Hazard being realised or incident occurring.
In the example above an estimate should be made of the likelihood of the crude oil pump seal leak resulting in oil into the sea, not the likelihood that the pump seal will leak. Refer to Appendix 3, FAQ 2 for another example of the correct way of estimating Likelihood. The reliability of the Likelihood estimate, and therefore of the RAM assessment, depends to a large extent on the availability of data on previous incidents and on the knowledge and experience of the assessors. It is therefore important to maintain databases of previous incidents and make them available to everyone who will be making RAM assessments. The hazard release scenario or the incident under consideration will often not be identical to the previous incidents that are being used to predict likelihood. Also, detailed information on previous incidents outside the Organisation, or even outside the Location, may not be readily available in some companies. Therefore, a combination of available information and judgment from experience has to be applied to make a best estimate of the Likelihood level A to E. Refer to Appendix 3, FAQ 3, 4 and 5 for more detailed guidance on estimating Likelihood and the applicability of previous incidents.
Step 4
Estimate the risk rating
For each potential Consequence determine the risk rating for each of the applicable PAER categories in terms of the product of the Consequence Severity and the Likelihood. The risk ratings (up to 4 for each potential Consequence) can be plotted on the matrix to provide a visual representation of the risk profile of the hazard release scenario under consideration. Refer to Appendix 3, FAQ 6 for further explanation and to Appendix 4 examples 1 and 4 for the visual representation. The recommended convention for expressing risk ratings is in the form ‘People 2B’ or ‘Reputation 4C’. Risk ratings derived in this way reflect the controls that have typically been applied in the Location or Organisation over the period for which previous incidents were used to estimate Likelihood. There is normally insufficient data on these previous incidents to allow the Likelihood estimates, and therefore the RAM ratings, to be re-estimated for the situation with additional controls in place. It is therefore recommended not to use the RAM to assess the effect of additional controls on the level of Risk. The residual risk after applying additional controls should be judged against the applicable Tolerability Criteria.
8
Risk Assessment Matrix, Issue 3.0, March 2006
5
5
Applications of the RAM
Applications of the RAM Risk assessment is an important step in a number of processes used in the Group. Each of these processes is governed by its own detailed protocols, which specify how the RAM is to be used in that context. This section outlines some of these processes, and describes how the RAM fits into them. It also indicates where to find detailed guidance on these processes. It is essential to consult the detailed guidance and not to rely on the following descriptions.
5.1
HEMP - General The Hazards and Effects Management Process (HEMP) involves the three fundamental steps of identifying the hazards inherent in an activity, assessing the risks and implementing control measures. The RAM is used for the assessment step as it has proven to be an effective means of visualising the factors that determine Risk and of communicating the outcome of the assessment. When the RAM is applied in major projects or companies or at the site/facility level to assist in evaluating risks in light of the agreed risk Tolerability Criteria, the blue, yellow and red areas are normally described as follows: Blue - Manage for continuous improvement. Yellow - Incorporate risk reduction measures. Control to ALARP. Red Incorporate risk reduction measures. Control to ALARP. Tolerability of Risk to be endorsed by the line manager directly accountable for the Location or Organisation. Businesses may wish to show an area of lower Risk and a lower priority for actions and resources in the top left hand corner of the RAM (boxes 0(A-E), 1A, 2A and 1B). This area could be described “Manage in-line with business needs”. It is important to remember that a Risk assessed in the red area does not automatically mean that the Risk is intolerable. Nor does a Risk in the yellow area mean that the Risk is acceptable. It is still necessary for Management to be satisfied that all risks have been reduced to ALARP. Use of the boundary between red and yellow areas as a hard decision criterion should be avoided. Experience has shown that such use can lead to manipulation of data and decisions with a negative impact, e.g. on asset integrity. Appendix 3 and FAQ 7, 8 and 9 illustrate application of the RAM in risk-based decision making. A Risk assessed in the bottom left-hand corner of the RAM implies a) there are potentially major consequences and b) there is little history to guide us in judging the likelihood of these potential consequences. This situation can occur when applying novel technology or new substances. If insufficient knowledge and experience is available from similar processes it will be necessary to conduct a more detailed consequence analysis and risk assessment than can be achieved with the RAM. It is also necessary to adopt a conservative approach to the risk assessment, to recognise uncertainty in the level of Risk associated with new technology or new substances. Refer to Appendix 3,FAQ 10 for more detailed guidance.
Risk Assessment Matrix, Issue 3.0, March 2006
9
5
Applications of the RAM
Refer to Appendix 4, Example 1, which illustrates the application of the RAM in HSE risk management. The requirements for HEMP are detailed in the HEMP standards and guidance issued by the Group Businesses.
5.2
HEMP - Projects The RAM is applied during all phases of the life cycle of an oil production facility, refinery, chemical plant or other operation. During the design phases the focus is on the hazards inherent in the process or facility and in evaluating the adequacy of proposed designs and options available to the designers. In the early stages of design the risk of hazard release scenarios can be assessed using the RAM, with Consequence and Likelihood estimates that reflect Industry experience with standard controls in place. This assessment enables project managers to prioritise the design issues and to decide whether additional controls, over and above standard industry practice, are reasonably practicable and should be adopted. At the end of the design phase the risks are reassessed using the RAM with the additional design measures and controls in place. Where there is no historical incident data for the situation with additional controls, the estimated reduction in Consequence and/or Likelihood is based largely on the experience and judgment of the assessors supported by the quantitative and qualitative risk assessments performed during the design process. This assessment demonstrates the reduction in risks during the design process and provides an assessment of the residual risks in the design that can be passed on to the plant operator and managed through the operational HSE-MS and procedures. Refer to Appendix 4, Example 2, which illustrates the application of the RAM in projects. The application of HEMP to projects is detailed in guidance issued by the Group Businesses.
5.3
HEMP - Documented Demonstration of Reduction of Risks to ALARP The Group HSE-MS Procedure requires a documented demonstration that HSE risks in the red and yellow areas of the RAM have been reduced to ALARP. When the RAM is used for this purpose the three areas are typically described as follows: Blue - Apply controls that are specified in the HSE-MS. Yellow - Demonstrate control through the HSE-MS and hazard control sheets. Red Demonstrate control through an HSE Case. The requirements for a documented demonstration of reduction of risks to ALARP are described in the Group Procedure for an HSE Management System.
10
Risk Assessment Matrix, Issue 3.0, March 2006
5
5.4
Applications of the RAM
HEMP - Workplace Hazard Control The RAM is applied in the planning of non-routine operations, maintenance, shutdown and construction activities, to assess the risks of the proposed work as input to deciding the extent of analysis of the Hazards. After identifying the hazards of the proposed work the associated risks are assessed on the RAM. The resultant planning and control actions are typically as follows: Blue – Apply the Location controls, such as work instructions, permit to work, supervision and daily work team discussions. Yellow – Conduct a job hazard analysis (JHA). To be done by the supervisors and work team, to identify any controls needed in addition to the Location controls. The resulting controls and instructions are communicated to the work team before the work starts. Red – Conduct a detailed job hazard analysis. To be done by the supervisor controlling the work, supported by engineers and/or HSE specialists and endorsed by management. The resulting controls and instructions are communicated to the work team before the work starts. Any relevant health hazards, which have been identified and assessed through the Health Risk Assessment process, should be included in the JHA and resultant controls. The need and extent of hazard analysis will be determined not only by the RAM assessment but also by how non-routine and complex the work is and by whether procedures or an existing job hazard analysis are available for the proposed work. The application of HEMP to workplace hazard control is detailed in the EP guidance on Job Hazard Analysis and other Group Business guidance.
5.5
HEMP - Chronic Effects Many health and environmental Hazards have chronic effects. Evidence of actual harm to people or actual effect on the environment may not appear for many years after the exposure. For such Hazards the estimated Likelihood based on events or incidents in the past 2, 5, 10 years may not adequately reflect the Likelihood of harm or impacts in future. A precautionary approach is needed when assessing the Risk on the RAM. The process for assessing the chronic effects of health and environment Hazards comprises the following steps: 1 Define the hazard release scenario or incident in terms of exceeding a threshold above which there is the potential for adverse consequences. Examples are: • Occupational exposure limit (OEL) for health hazards. • Predicted No Effect Concentration (PNEC) for environmental hazards.
Risk Assessment Matrix, Issue 3.0, March 2006
11
5
Applications of the RAM
• Prescribed limits for environmental hazards. PNEC is usually related to the environmental receptor but is often reflected in a prescribed limit at a discharge point. The prescribed limit can then be taken as the threshold and the starting point for a RAM assessment. For example, the water outfall from a site may have an oil in water limit prescribed so as to prevent the PNEC for oil in the open sea being exceeded. 2. Estimate the potential consequences of exceeding the threshold in terms of the PAER Severity categories. For chronic health hazards the potential consequences can be estimated from an existing health risk assessment. For chronic environmental hazards the potential consequences can be estimated from either: • An existing environmental impact assessment, or • The extent, frequency or duration of exceeding the threshold, assuming that exceedances will or may lead to environmental damage. 3. Estimate the Likelihood of these potential consequences from historical evidence of the effects. Where necessary support the estimate by professional assessments based on literature and/or experimental data. Appendix 4, Example 3 illustrates the application of the RAM to the assessment of chronic hazards. The application of HEMP to chronic health and environmental hazards is detailed in the Group HSE guidance on Health Risk Assessment and Impact Assessment.
5.6
Incident Classification and Reporting The actual Consequence Severity on the RAM is used to determine the requirements for notification and reporting of incidents to Group Businesses. Refer to the Group HSE publication ‘Incident Classification, Investigation and Reporting’ for the applicable Group standard and guidelines (Currently incidents with an HSE Consequences Severity 4 or 5 have to be reported to the Group business). Actual RAM ratings of incidents should be expressed in the form ‘Assets 3’ or ‘Environment 4’. Note that incidents may have Consequences in more than one PAER category. When using the RAM diagram to display the actual RAM rating of an incident, it is recommended to show the ratings as boxes on the Consequence scale as shown in Appendix 4, Example 4.
For the example in Section 3 involving a leak of crude oil via the drain system into the sea the consequences might be the financial loss of crude oil not recovered and vaporised, environmental damage to the beach and adverse attention by the national media. The consequences might also extend to harm to the people clearing up the spill should they inhale vapours or come in contact with the crude oil. The RAM Consequence Severity might be People 3, Assets 2, Environment 3 and Reputation 4.
12
Risk Assessment Matrix, Issue 3.0, March 2006
5
5.7
Applications of the RAM
Incident Investigation The Risk rating of an incident is one of the factors that decide the level of investigation. The intention is to investigate thoroughly and maximise the learning from incidents where there was a risk of a much more serious consequence, by focusing more resources on the investigation and follow-up of higher risk incidents. Businesses should implement procedures that detail the extent of investigation and analysis, the methods to be used and the responsibilities for both investigation and follow-up for the three areas of the RAM. Typical criteria are as follows: Blue - Investigation to identify the causes and necessary corrective actions. The investigation method should allow for classification and trend analysis of causes. Follow-up is within the plant or area. Yellow - Full investigation to identify the underlying causes and any weaknesses in HSE management. Follow up is by Location or Organisation management. Red Full investigation and root cause analysis to establish the weaknesses in HSE management, including latent failures. Organisation management both sponsors the investigation and endorses the follow-up actions. The Risk rating of an incident is determined from Consequence and Likelihood, applying the normal RAM method described in Section 4. The incident that is being assessed should be counted in the Likelihood of the Consequence that happened in this particular incident. Appendix 3, FAQ 11 and 12 illustrate correct use of the RAM when assessing incidents. Risk ratings of incidents should be expressed in the form ‘Assets 3 D’ or ‘Environment 4 B’. When using the RAM diagram to display the Risk rating of an incident, it is recommended to show the ratings as boxes on the full matrix as shown in Appendix 4, Example 4. Refer to the Group HSE publication ‘Incident Classification, Investigation and Reporting’ for the recommended investigation and root cause analysis methods and follow-up.
5.8
Classification of Audit Findings The findings of HSE audits, including independent HSE-MS audits, are normally classified into four Severity levels – Serious, High, Medium and Low - using the normal RAM method with the following variations: • Consequence - potential consequences should an incident occur as a result of the control failure. • Likelihood - previous occurrence of this consequence due to this type of control failure. • Risk - resultant risk if the failure or weakness is allowed to continue. Appendix 4, Example 6 illustrates application of these variations when assessing an audit finding.
Risk Assessment Matrix, Issue 3.0, March 2006
13
5
Applications of the RAM
The resultant risk rating of the finding is plotted on the standard three area RAM and then classified as follows: Boxes 0(A-E), 1A, 2A and 1B - Low Blue except boxes 0(A-E), 1A, 2A and 1B - Medium Yellow - High Red - Serious Businesses may wish to show an area for Low findings in the top left hand corner of the RAM (boxes 0(A-E), 1A, 2A and 1B) shaded pale blue. Classification of audit findings in this way provides the basis for prioritisation of the resultant remedial and improvement actions. The requirements and guidance are described in detail in the Group HSE Auditing Guidelines.
14
Risk Assessment Matrix, Issue 3.0, March 2006
6
6
References
References 1. Group HSE publications: 1.1 Group Procedure for an HSE Management System, 1997 1.2 Group HSE Management System, HSE Advisers Panel, 2002 1.3 Health Risk Assessment, HSE Advisers Panel, 2001 1.4 Incident Classification, Investigation and Reporting, HSE Advisers Panel, 2002 1.5 Group HSE Auditing Guidelines, HSE Advisers Panel, 2001 http://sww05.europe.shell.com/hse/group/hse/hse_publications/publications.htm 2. EP 95000 and EP 2005 standards and guidance: 2.1 Job hazard analysis, EP95-0311 2.2 Standard: HSE HEMP and ALARP, EP 2005-0100 http://sww.shell.com/ep/corporate_support/eps_hsse/HSE Framework/ep business hse control framework.html 3. Project Guide 1, SGSI, 2003 4. Good Practice and Pitfalls in Risk Assessment, UK HSE, 2003
Risk Assessment Matrix, Issue 3.0, March 2006
15
16
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 1 Consequence Categories and Severities
Appendix 1 Consequence Categories and Severities The following tables contain the description and definition of the Severity levels in each of the PAER categories, followed by examples as bullet points.
Harm to People Level
Definition
0
No injury or health effect
1
Slight injury or health effect – Not affecting work performance and not affecting Daily Life Activities. Examples: • First aid cases and medical treatment cases. • Exposure to health hazards that give rise to noticeable discomfort, minor irritation or transient effects reversible after exposure stops.
2
Minor injury or health effect – Affecting work performance, such as restriction to work activities or need to take up to 5 days to fully recover. Or affecting Daily Life Activities for up to 5 days. Or reversible health effects. Examples: • Restricted work day cases or lost work day cases resulting in up to 5 calendar days away from work. • Illnesses such as skin irritation or food poisoning.
3
Major injury or health effect – Affecting work performance in the longer term, such as absence from work for more than 5 days. Or affecting Daily Life Activities for more than 5 days. Or irreversible damage to health. Examples: • Long term disabilities (previously called Permanent Partial Disabilities). • Illnesses such as sensitisation, noise induced hearing loss, chronic back injury, repetitive strain injury or stress.
4
Permanent total disability or up to three fatalities – resulting from injury or occupational illness. Examples: • Illnesses such as corrosive burns, asbestosis, silicosis, cancer and serious work related depression. • Car accident resulting in 1, 2 or 3 fatalities.
5
More than three fatalities – resulting from injury or occupational illness. Examples: • Multiple asbestosis cases traced to a single exposure situation. • Cancer to a large exposed population. • Major fire or explosion resulting in more than 3 fatalities.
Asset Damage and other Consequential Business Loss Level
Definition
0
No damage
1
Slight damage - Costs less than 10,000 US$. Example: • No disruption to operation.
2
Minor damage - Costs between 10,000 and 100,000 US$. Example: • Brief disruption to operation.
3
Moderate damage - Costs between 100,000 and 1 million US$. Example: • Partial shutdown.
4
Major damage - Costs between 1 and 10 million US$. Example: • Up to two weeks shutdown.
5
Massive damage - Costs in excess of 10 million US$. Example: • Substantial or total loss of operation.
Risk Assessment Matrix, Issue 3.0, March 2006
17
Appendix 1 Consequence Categories and Severities
Environmental Effect The bullet points in the environmental effect table are a mixture of: • Effects, e.g. groundwater contamination. • Events with the potential for environmental effect, e.g. exceeding a limit. • Indicators of potential effects, e.g. complaints. Level
Definition
0
No effect.
1
Slight effect Slight environmental damage – contained within the premises. Example: • Small spill in process area or tank farm area that readily evaporates.
2
Minor effect Minor environmental damage, but no lasting effect. Examples: • Small spill off-site that seeps into the ground. • On-site groundwater contamination. • Complaints from up to 10 individuals. • Single exceedance of statutory or other prescribed limit.
3
Moderate effect Limited environmental damage that will persist or require cleaning up. Examples: • Spill from a pipeline into soil/sand that requires removal and disposal of a large quantity of soil/sand. • Observed off-site effects or damage, e.g. fish kill or damaged vegetation. • Off-site groundwater contamination. • Complaints from community organisations (or more than 10 complaints from individuals). • Frequent exceedance of statutory or other prescribed limit, with potential long term effect.
4
Major effect Severe environmental damage that will require extensive measures to restore beneficial uses of the environment. Examples: • Oil spill at a jetty during tanker (off) loading that ends up on local beaches, requiring clean-up operations. • Off-site groundwater contamination over an extensive area. • Many complaints from community organisations or local authorities. • Extended exceedances of statutory or other prescribed limits, with potential long term effects.
5
Massive effect Persistent severe environmental damage that will lead to loss of commercial, recreational use or loss of natural resources over a wide area. Example: • Crude oil spillage resulting in pollution of a large part of a river estuary and extensive clean-up and remediation measures.
18
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 1 Consequence Categories and Severities
Impact On Reputation Level
Definition
0
No impact
1
Slight impact • Local public awareness but no discernible concern. • No media coverage.
2
Minor impact • Local public concern. • Local media coverage.
3
Moderate impact - Significant impact in region or country • Regional public concern. • Local stakeholders, e.g. community, NGO, industry and government, are aware. • Extensive attention in local media. Some regional or national media coverage.
4
Major impact - Likely to escalate and affect Group reputation • National public concern. • Impact on local and national stakeholder relations. National government and NGO involvement with potential for international NGO action. • Extensive attention in national media. Some international coverage. • Potential for regulatory action leading to restricted operations or impact on operating licences.
5
Massive impact - Severe impact on Group reputation • International public concern. • High level of concern amongst governments and action by international NGOs. • International media attention. • Significant potential for effect on national/international standards with impact on access to new areas, grants of licences and/or tax legislation.
Risk Assessment Matrix, Issue 3.0, March 2006
19
Appendix 2 Likelihood Scale
Appendix 2
Likelihood Scale
The scale of increasing Likelihood is intended to represent a range from highly unlikely to frequent. It is expressed in terms of frequency of events per period per Industry, Organisation or Location. These descriptions should be used in every application of the RAM so as to promote consistent assessment of risk. Increasing Likelihood A Never heard of in the Industry
B Heard of in the Industry
C
D
E
Has happened in the Organisation or more than once per year in the Industry
Has happened at the Location or more than once per year in the Organisation
Has happened more than once per year in the Location
The terms Industry, Organisation and Location are defined in the Glossary. Group Businesses will provide detailed guidance on the application of these terms to their organisations. They should update the guidance as the organisation changes. For most applications of the RAM it is recommended not to express Likelihood in terms of decimal or percentages, as this cannot be supported by the quality of the input data. For the few applications where historical incident or failure data is available to calculate Likelihood, e.g. quantified risk assessment (QRA) and layer of protection analysis (LOPA), caution must be exercised in using numerical Likelihood scales, for the following reasons: • Quantified risk assessments, and semi-quantitative risk determinations using the RAM can inform a decision, but it is still necessary to judge the acceptability of Risks against all the applicable Tolerability Criteria. • If the RAM is used for quantitative assessments ensure that the Likelihood ranges selected for each column are consistent with the Likelihood scale descriptions of the standard RAM and guidance from the Group Business on their application.
20
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 3 Frequently Asked Questions
Appendix 3 Frequently Asked Questions FAQ 1 Q. When we are assessing the potential consequences of an incident and trying to decide what could have happened, how much imagination should we use? A. You should ask the question: ‘What if?’ For example: • What if the gas had ignited? • What if the scaffolder had not been clipped on when he slipped? • What if it was raining or the wind was in a different direction? Wherever possible you should refer to incident reports and databases to find out what has happened previously in similar circumstance. You need to recognise that the circumstances of two incidents are never exactly the same; therefore experience and imagination also play a part. However, don’t be too imaginative: • Avoid ‘what ifs’ that could not occur under the circumstances of the particular incident. For example: if a person tripped and fell to the ground at the same level should this be considered as a potential fatality? It all depends. If it was possible to strike the head against a valve stem or concrete curb when falling, the answer is probably yes. (Although not common fatalities have resulted from falls at the same level) If there was no realistic possibility of a severe blow to the head when falling, the answer is probably no. • Avoid highly unlikely ‘what ifs’ such as amputation resulting from infection of a cut. • Avoid stringing too many ‘what ifs’ together to produce an incredible consequence. If two or more ‘what ifs’ are needed for a consequence to be realised, each should be challenged to establish that when they are combined, the overall consequence is credible.
FAQ 2 Q. People ride bicycles every day (Likelihood E). Falling off a bike could result in a broken arm (Severity 3). Does this mean that bike riding should be assessed as People 3E (red area of the RAM)? A. No. You need to find out or estimate how often in the past falls from a bike have resulted in broken arms. If the answer is that there have been no broken arms in our business but it must have happened somewhere in Industry, then the Likelihood should be B. The assessed Risk of riding a bike should therefore be People 3B (blue area of the RAM). The potential worst-case Consequence and potential worst-case Likelihood should not be combined when using the RAM because it will lead to an overestimate of the Risk.
Risk Assessment Matrix, Issue 3.0, March 2006
21
Appendix 3 Risk Assessment Matrix Application Examples
FAQ 3 Q. How do we know if something has happened before in Industry? Our incident databases are not very comprehensive when it comes to incidents outside our Organisation. A. Virtually all the possible task (workplace) related consequences have happened somewhere at some time. They may not have happened in our Organisation or even in the oil/petrochemical industry. But when we are looking at a common industry-wide situation such as working at height, an incident in a biscuit factory is just as relevant as an incident on an oil refinery. We can often apply our experience and judgment to conclude that ‘it must have happened’ and is therefore in column B. We may even find Industry data that indicates that similar incidents have happened more than once per year, in which case the Likelihood should be placed in column C. With process related hazards, which are generally high consequence and low likelihood, you cannot make the same assumption. It is essential to search incident databases or talk to HSE and technical specialists for data on previous incidents. You also have to decide if these are similar incidents in similar situations to the hazard release scenario under consideration and therefore valid precedents. If there is no evidence of previous incidents the scenario may be assessed ‘theoretical’ and put in column A.
FAQ 4 Q. We have suffered several serious spill incidents in the past but in recent years there have been none. Should we now estimate Likelihood on the basis of numbers of incidents in the recent years? A. No. The fact that there have been no spill incidents in the last few years does not mean that the Likelihood is now lower than it was previously. It could be pure chance or it could be that the controls have been applied more rigorously in the last few years. If it is the latter, the situation could easily reverse in the next few years. Don’t forget that “controls corrode faster than steel” and the hazard release potential is still there. By retaining a Likelihood estimate based on the longer-term history, you keep the pressure on to maintain adequate and effective controls in future. Another example: 10 years ago we set a requirement for window cleaners to work from scaffolds or with fall arrestors and have applied it rigorously ever since. As a result we have had no further falls. In the previous 10 years there were two falls in our Organisation. We should not conclude that the Risk of falling during window cleaning is now People 4B. The Risk is still People 4C.
22
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 3 Risk Assessment Matrix Application Examples
FAQ 5 Q. We used to transfer personnel to an offshore platform by helicopter. Following a number of helicopter incidents over the past 15 years, we have decided to make the transfers by ship in future. When we reassess the risks of personnel transfer should we take account of the earlier incidents? A. Probably not. If the previous incidents all related to the operation of helicopters they are not valid precedents for the new situation. The hazard release scenario has changed. You should seek data on incidents involving transfer of personnel by ship as basis for a Likelihood estimate of incidents in future. That was a clear-cut example. Now consider the window-cleaning example in FAQ 4. Suppose that 10 years ago we took the additional step of redesigning the windows so that they could be rotated though 180 deg. and washed from inside. But it is still necessary to lean out from the windowsill to reach some parts of the outside of the windowpane. Now it is less clear whether the inherent risk of falling is still 4C, or has reduced to 4B. A judgment has to be made whether the hazard release scenario is still essentially the same or has fundamentally changed.
FAQ 6 Q. When we look at several potential consequences from an incident or a hazard release scenario, will the Consequence with the highest Severity also have the highest RAM rating? A. Not necessarily. A Consequence that is assessed 3E will be in the red area whereas a Consequence assessed 5B will be in the yellow area. In general the high severity consequences tend to be infrequent and the lower severity consequences tend to happen more often. This means that if there are several possible consequences from an incident or hazard release scenario their respective Risk ratings will tend to be distributed across an equi-risk diagonal of the RAM, i.e. bottom left to top right. It is good practice to check out and document at least one high severity Consequence and one high frequency Consequence, to be sure that the Risk is properly characterised.
FAQ 7 Q. A risk assessment of all activities in our business unit (part of HEMP) has concluded that there are two major risks in the red area of the RAM: • Transfer of staff by road between the various plants. • Operation of one particular plant, which under certain operating conditions releases hydrogen sulphide to atmosphere.
Over the past 5 years we have implemented a programme of improvements to the hydrogen sulphide containing plant. This included both additional instrument safeguarding systems and improvements to the shutdown procedures and emergency response. The possibility of
Risk Assessment Matrix, Issue 3.0, March 2006
23
Appendix 3 Risk Assessment Matrix Application Examples
hydrogen sulphide being released has not been eliminated but the Risk of plant operators and contractors being affected has been significantly reduced. During the same period we have undertaken a couple of defensive driving campaigns but the driving standards are still not acceptable and there have been two more fatalities. In the RAM screening of potential activities for next year’s HSE Plan we show the hydrogen sulphide containing plant in the yellow. This emphasises that road transport is the top priority. Is this a correct use of the RAM? A. No. The potential for the plant to release hydrogen sulphide is still there and correct application of the RAM requires that the RAM rating remain in the red area. However, in an exercise to rank and prioritise a number of activities that are competing for the same resource, it is appropriate to use the RAM to visualise the alternatives. In this case you could show the plant operations Risk moving towards the top left hand corner of the RAM. You should not conclude from this movement that the plant operations Risk is now acceptable and that nothing further needs to be done. It is still necessary to assess whether the residual risks are ALARP.
FAQ 8 Q. There are many fatal road transport incidents each year in our Organisation. The Risks of transporting products by road is assessed People 4D. Does this mean that road transport of products is an intolerable risk and should be stopped? A. No. The RAM is a tool to help prioritise the risks and issues that need to be addressed as input to the decision on how to allocate resources. Road transport of products is in the red area and should therefore be a top priority for senior management. The RAM should not be used to decide if the Risk is acceptable. The applicable Tolerability Criteria and the ALARP process should be used to decide the acceptability of risks.
FAQ 9 Q. One of the scenarios we assessed in a HEMP study was the seal failure on a crude oil transfer pump and the associated Risk of the crude oil leak igniting and escalating to a major fire (Consequence Severity Assets 4). Our incident database revealed that there have been 2 incidents in our Organisation in the past 5 years in which crude oil pumps failed and the incidents escalated to major fires. Neither of these incidents was caused by pump seal failure. Is it correct to conclude that the Likelihood of this failure scenario is B? A. No. If you assess the Risk of failure of an individual component on the RAM, you are guilty of ‘salami-slicing’, which means cutting up the Risk into small components so that the assessed Risk of each component is lower. This practice commonly leads to an underestimate of the overall risks and too low a priority for the resulting actions.
24
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 3 Risk Assessment Matrix Application Examples
The intended use of the RAM is to assess the risks of failure of a whole system. In this example the scenario that should be assessed is failure of the crude oil pump escalating to a major fire, which is Likelihood C.
FAQ 10 Q. How should we assess the risks associated with a new business or a new plant design? We have no history as a guide to the future. What about the application of novel technology? A. A Likelihood estimate in columns C, D or E is not possible. We should therefore draw on the experience of all those involved in the design and operation of the new plant and their knowledge of incidents in similar situations. We may be able to look at similar operations in other companies. The idea is to create a synthetic history for the new plant. In the case of novel technology there may be no industry experience to draw on. For high hazard processes (lower left corner of the RAM) it is probably not appropriate to use the RAM to assess the Risk. It may be necessary to conduct detailed consequence or impact analysis and quantified risk assessments.
FAQ 11 Q. We suffered a serious injury incident (severity 3) yesterday but before that we have never had such an incident. Can we say that the Risk is People 3B because that was the rating before yesterday and the Risk has not changed as a result of the incident? A. The Risk has not changed but it may have been underestimated before the incident yesterday. There may have been near misses that luckily did not lead to serious injuries. Anyway, the correct use of the RAM is to include the incident yesterday in the Likelihood estimate. The RAM rating should be People 3D.
FAQ 12 Q. We have just had a serious incident that could have been a fatality but in fact was a minor injury requiring restricted work (Severity 2). We assessed it People 4C because we had an almost identical incident previously, which also could have been a fatality. Is this correct? A. No. As neither incident resulted in a fatality the RAM rating should be People 2D. If the two incidents happened in the same year the rating would be 2E. If a fatality is something that ‘must have happened in Industry’ then an alternative rating would be 4B. The purpose of the RAM assessment of the latest incident is to decide the level of investigation and follow-up. Management will also take into account other factors such as the complexity of the incident and how similar it is to the previous one when deciding how thorough an analysis is needed. It is clearly inappropriate to consider how effective the controls were in deciding the RAM rating, as this will not be known until the investigation has been carried out.
Risk Assessment Matrix, Issue 3.0, March 2006
25
Appendix 4 Examples
Appendix 4 Examples The following are hypothetical examples intended to illustrate and explain the RAM assessment process. They do not reflect actual experience or incidents in Shell Group Businesses.
Example 1 – Hazard and Effect Management A hazard identification exercise on a gas stabilisation unit establishes that one of the hazard release scenarios (top events) is a seal blow out on a gasoline pump. A serious leak of gasoline could ignite and, if the resulting fire is not controlled, it could escalate to an explosion in the plant area. A further possibility is that the gasoline could run off via the drain system into the plant interceptor. If the gasoline is not contained in the interceptor it could lead to pollution of the estuary.
Assess the Risk of this hazardous release scenario. Make use of the following information about earlier incidents. There was a similar incident 2 months ago and another 11 months ago. In both these incidents oil passed through the interceptor and polluted the estuary. Both incidents were reported to the Environmental Agency as a breach of consent. The estuary is an environmentally sensitive area and the incident 2 months ago was reported in the national media. The Organisation suffered an incident at another site 2 years ago in which a spill of gasoil in the tank area ignited. The fire was restricted to the one tank bund, but it resulted in US $ 3.5 M of equipment damage. No one was injured. There was an incident 7 years ago at another of the Organisation’s sites in which a similar spill of gasoline resulting from a pump failure in the stabilisation unit was allowed to get out of control. In this case fire damaged the stabiliser column, which eventually ruptured. The resulting explosion led to 2 operators being seriously injured (internal injuries and broken bones; off work for several months), US$ 50 M of equipment damage and the plant shutdown for 3 months. Answer Asking the question: ‘What if?’ reveals 3 distinct potential consequences – oil in the estuary, fire damage and escalation to a major explosion. Applying the knowledge of previous similar incidents at this Location and elsewhere in the Organisation we come to the following RAM ratings. Potential Consequence
People
Fire damage Major explosion Oil in the estuary
26
Assets
Environment
Reputation
3E
4D
4C 3C
5C
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 4 Examples
CONSEQUENCES
INCREASING LIKELIHOOD B
0
No injury or health effect
No damage
No effect
No impact
1
Slight injury or health effect
Slight damage
Slight effect
Slight impact
2
Minor injury or health effect
Minor damage
Minor effect
Minor impact
3
Major injury or health effect
Moderate damage
Moderate effect
Moderate impact
4
PTD or up to 3 fatalities
Major damage
Major effect
Major impact
5
More than 3 fatalities
Massive damage
Massive effect
Massive impact
Serious injury
C
D
E
Never heard of
Heard of in the
Has happened
Has happened
Has happened
in the Industry
Industry
in the
at the Location
more than once
Organisation
or more than
per year at the
or more than
once per
Location
onece per year
year in the
in the Industry
Organisation
Reputation
Environment
Assets
People
Severity
A
Pollution of estuary
National media attention
Fire damage
Major explosion damage
Comment: Fire damage. This previous incident was a spill of gasoil rather than gasoline, and it resulted from a pipe rupture in a tank bund rather than a pump seal blow out in the process area. Although the Consequence of a fire is credibly what could happen in the situation we are considering, the initiating incident was quite different. It is questionable whether this should be taken as a precedent for assessing the present situation. However, in this example a major explosion is the risk-determining scenario.
Example 2 – Project Hazard and Effect Management A project needs to transport 3300 pipe joints from the port of entry to the construction contractor’s coating facility. The distance is about 200km and the options are: • Transport by road on public highways – 5 joints per load. • Transport by barge through inland waterways. The region has significant security concerns with theft, piracy, hijacking and hostage taking commonplace within the oil field operations. The roads are generally single carriageway, of poor quality and can become very overcrowded in the vicinity of built up areas.
Assess the risks associated with the two transport options.
Risk Assessment Matrix, Issue 3.0, March 2006
27
Appendix 4 Examples
Road Transport The most significant hazard release potential is a road traffic accident. The potential consequences of this option are: • Injury to contractor personnel and third parties, including fatalities. • Community and environmental impact of substantial road transport operation. The Risk associated with a road traffic accident is assessed as People 4D, because there have been several fatal road accidents per year in this Organisation, although none on this project. Road transport of the pipe joints will have a considerable impact on third parties, primarily the local communities who live along the main roads, but also other road users. This Risk is assessed as Environment 2E, as 2-3 loads per day is considered to be continuous impact. Marine Transport The most significant hazard release potential is seizing of a barge by pirates and subsequent hostage taking. The potential consequences of this option are: • Injury and possible fatalities to contractor personnel. • Damage or loss of barge and pipe joints with impact on project schedule. The Risk of fatalities is assessed as People 4D as there have been several marine incidents per year in the Organisation in which hostages were taken. At least one per year resulted in fatalities. The estimated cost of losses in these marine incidents has been in the range US$ 2-500,000. The asset damage Risk is assessed as Assets 3D. Overall assessment The initial RAM assessment of both options is Red. The HSE objectives for the Project and the HSE standards of the Organisation require that additional measures have to be put in place to reduce high Risks to ALARP. Risk reduction The road proposed for the road transport option is a busy main thoroughfare crossing the region. In parts it is narrow and in need of repair, and it cuts through many towns and villages. It is impractical to improve the standard of road or to take other measures over and above the normal controls on vehicle standards, defensive driving and journey management. There are no alternative routes. The waterways between the port of entry and the construction contractor’s coating facility are prone to piracy and attacks from armed groups intent on stealing equipment or taking personnel hostage. The marine transport would therefore require comprehensive security protection in the form of escorts to mitigate this risk. The Organisation security adviser has confirmed that such measures would significantly reduce the risk. The risk of drowning also needs to be controlled by appropriate measures, such as certified vessels and equipment, no night sailing, route planning and life vests.
28
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 4 Examples
Residual Risk A reassessment of the two options with additional measures taken into account shows that the road transport option remains a significant risk, whereas the marine transport option can be been reduced by the additional security measures. The RAM can be used to visualise the change in Risk for the two options.
Example 3 – Incident with potential chronic health effect A spill of benzene on an Aromatics plant went into the normal plant drain system, instead of the closed benzene collection system. The total spill was 800kg, which was contained within the Aromatics plant and then pumped to the benzene collection system. Operations and emergency personnel involved in the clear-up wore suitable protective clothing and subsequent medical surveillance confirmed that no-one had received an excessive dose of benzene. Benzene in air measurements were in the range 10-20 ppm during the incident. (The OEL of benzene is 1ppm)
Make use of available information from previous incidents to assess this latest incident on the RAM. As the atmospheric concentration of benzene was above the OEL for benzene this should be treated as an incident and assessed on the RAM. There have been similar incidents previously – approximately one each year on this plant. In an incident 3 years ago two firemen involved in similar clear-up activities did not wear the correct protective equipment. Medical surveillance results indicated that they were exposed to benzene levels above the occupational exposure limit. There have been no cases in the Organisation concerned of benzene exposure leading to cancer, but there are known cases in the Industry. Answer There was no exposure to benzene in this latest incident therefore the actual RAM rating is People 0. As there have been no incidents in the Organisation in which benzene contamination has led to cancer, the potential of this incident should formally be rated People 4B. However, a check should be made with health specialists how frequently incidents of cancer due to benzene have occurred in Industry. If there has been more than one case per year the rating would be People 4C. The incident still rates in the Yellow area of the RAM.
Risk Assessment Matrix, Issue 3.0, March 2006
29
Appendix 4 Examples
Example 4 – Incident: fall from access platform A section of grating approximately 1 metre x 1 metre was removed from the top platform of a plant to allow maintenance work to be done. It was not replaced afterwards. An operator on his rounds on the night shift did not see the hole because the lighting was poor. He stepped into the hole but was able to hold onto the edge of the grating and stop himself from falling to the next platform four metres below. He climbed out and had only minor grazes and bruising.
Classify the actual Consequence and the Risk rating of this incident on the RAM. There have been several reports in the last year of grating not being replaced after maintenance work. There have been no cases in the Organisation of people falling from platforms at height, but there was a case last year in another plant in the Organisation where a technician fell one metre from a platform because a section of handrail was missing. This handrail had been removed to enable a heat exchange tube bundle to be removed and had not been replaced. The technician broke a leg and suffered concussion. Answer The actual injury is classified People 2 (Note that Likelihood is not used for actual Consequence) There are two potential consequences: • Fatal fall People 4B • Missing gratings People 0E CONSEQUENCES
INCREASING LIKELIHOOD
Reputation
Environment
Assets
People
Severity
A
0
No injury or health effect
No damage
No effect
No impact
1
Slight injury or health effect
Slight damage
Slight effect
Slight impact
2
Minor injury or health effect
Minor damage
Minor effect
Minor impact
3
Major injury or health effect
Moderate damage
Moderate effect
Moderate impact
4
PTD or up to 3 fatalities
Major damage
Major effect
Major impact
5
More than 3 fatalities
Massive damage
Massive effect
Massive impact
Actual injury
30
B
C
D
E
Never heard of
Heard of in the
Has happened
Has happened
Has happened
in the Industry
Industry
in the
at the Location
more than once
Organisation
or more than
per year at the
or more than
once per
Location
onece per year
year in the
in the Industry
Organisation
Missing gratings - no injury
Fatal fall
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 4 Examples
Comment: Although there have been no incidents in our Organisation where a worker fell through a grating resulting in a fatality, falls of this type must have happened in the Industry (falls are one of the most frequent causes of industrial fatalities). This leads to an assessment of People 4B for the worstcase scenario. When looking for previous incidents to estimate Likelihood you have to decide if for the identified previous incidents are similar enough to the facts of the incident under consideration. It is questionable whether the incident in which a section of handrail was missing and a technician fell 1 metre is similar enough. It was a fall from height but it resulted from a different equipment failure, on the other hand the basic cause of both incidents was a failure of Maintenance to complete the job. If included this incident would result in a RAM rating of 3C (yellow area on the RAM), which does not affect the overall RAM rating of the present incident.
Example 5 – Incident: Road Transport 1 – A road tanker contracted to the Organisation was on its way to deliver 30,000 litres of gas oil to a mining customer. The tanker rolled over after swerving to miss a pedestrian, who suddenly moved into the path of the vehicle. One tank compartment split and 8,000 litres was spilt to ground. Two further compartments leaked from the manhole covers due to poor seal integrity. In total 12,000 litres went to ground. The driver, who was wearing his seatbelt, cut his head above the right eye and received 6 stitches. He returned to work two weeks after the incident after receiving counselling and refresher training. The tanker was scrapped (replacement cost $US 70K) and repairs to the prime mover cost $US 20K. Total clean up costs were $US 20K and loss of product was $US 10K. 2 – This was the second rollover in the past 12 months for the Organisation in this country. An incident occurred 6 months previously in another part of the country when a driver approached a corner at high speed, lost control and crashed into a barrier before rolling over. The tanker full of motor gasoline caught fire and the driver’s mate died at the scene. The driver was able to get out of the cabin and into a safe area. He received minor bruising to his chest. The prime mover and tanker (replacement value $US 300K) were completely destroyed and the full load of 35,000 litres of gasoline was lost (value $US 30K). Being an unpopulated area there was no impact on any other people. An area of vegetation caught fire. The incident was covered in the evening news and in the daily papers on the following day but there was no reference to the company as the tanker was unbranded. 3 – There have been at least 10 tanker rollovers in the past 12 months in the oil industry in this country. Several of these incidents resulted in fires and multiple deaths. In one incident, oil ran into a local water supply affecting a village with a population of 100. 4 – Another oil company had a major tanker rollover incident in a neighbouring country two months previously when a tanker carrying gasoline rolled over in a village area just after
Risk Assessment Matrix, Issue 3.0, March 2006
31
Appendix 4 Examples
midnight. Product leaked from the tanker and local villagers gathered around and began filling containers with product. A fire broke out in which 42 people lost their lives and 20 more suffered injuries ranging from major to minor burns. The fire was thought to be caused by a man carrying a kerosene lamp. The standard of equipment, the transport infrastructure and the driving behaviour in this neighbouring country is very similar to the country under consideration.
What is the RAM rating of this incident? Answer The actual classification of the incident was People 3 (one Lost Workday Case more than 5 days) and Assets 3 (total cost greater than US$ 100K). For the purpose of assessing the potential of this incident the oil product distribution operation in this country is considered as a Location. There are a number of potential consequences and RAM ratings for this incident. Applying the information from recent incidents we come to the following RAM ratings. Major Fire People 5B A rollover in another oil company that resulted in a major fire where there were multiple fatalities is the basis for this Risk rating. (In the Industry, More than three fatalities; paragraph 4) People 4C
Multiple incidents that have occurred in the Industry are the basis for this Risk rating. (More than once in the Industry per year with up to 3 fatalities; paragraph 3)
People 4D
A fatality that occurred six months ago in our company in this country (Location) is the basis for this Risk rating. (In this Location, up to 3 fatalities; paragraph 2)
Product to Ground / Water Enviro. 4B An incident in another oil company with an impact to the village drinking water is the basis for this Risk rating (In the Industry, major impact to the environment – offsite groundwater contamination; paragraph 3). Damage to Tanker and loss of Product Assets 3D This Risk rating is based on the $300K US loss to replace the tanker plus $US 30K loss of product in an incident at the Location. (In the Location, $100K - $1M US financial impact, paragraph 2) The highest risk Consequence was the fatal incident experienced by our company in this country (Location). Therefore, the Risk rating is People 4D (red area on the RAM).
32
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 4 Examples
Example 6 – Audit finding A refinery HSE audit found that the water deluge systems on the propane and butane storage spheres are not regularly inspected and tested. A live test established that the deluge system on one of the butane spheres did not work.
Classify this finding on the RAM Answer Without a proper deluge system it is predictable that a fire around a sphere will escalate to a BLEVE before emergency response personnel can respond. A BLEVE would probably lead to multiple fatalities and asset damage over $10MM and to public concern that the facilities were being operated without proper fire protection. There have been several incidents in the oil and petrochemical industry over the years where a BLEVE has occurred because of inadequate fire fighting and has resulted in multiple fatalities. There have been no such incidents in our Organisation. The consequence severities should be assessed as People 5 and Asset Damage 5. The Environmental Severity would be lower and the Reputation Severity would be in the range 4 to 5. The absence of previous incidents in the Organisation with this worst-case Consequence leads to a Likelihood of B. This audit finding should be classified as People/Assets 5B. (High in audit finding classification) CONSEQUENCES
INCREASING LIKELIHOOD B
0
No injury or health effect
No damage
No effect
No impact
1
Slight injury or health effect
Slight damage
Slight effect
Slight impact
2
Minor injury or health effect
Minor damage
Minor effect
Minor impact
3
Major injury or health effect
Moderate damage
Moderate effect
Moderate impact
4
PTD or up to 3 fatalities
Major damage
Major effect
Major impact
5
More than 3 fatalities
Massive damage
Massive effect
Massive impact
C
D
E
Heard of in the
Has happened
Has happened
Has happened
in the Industry
Industry
in the
at the Location
more than once
Organisation
or more than
per year at the
or more than
once per
Location
onece per year
year in the
in the Industry
Organisation
Reputation
Environment
Assets
People
Severity
A Never heard of
Finding - deluge system not working
Risk Assessment Matrix, Issue 3.0, March 2006
33
Appendix 5 Glossary
Appendix 5
Glossary
ALARP ALARP is short for As Low As Reasonably Practicable. Reducing Risks to ALARP means reducing the Risks to a level at which the cost and effort (time and trouble) of further Risk reduction are grossly disproportionate to the Risk reduction achieved. Consequence Impact on People, Assets, Environment and Reputation if a Hazard is released. In this guide the term Potential Consequence is used when looking at what might happen or what might have happened. Consequential Business Loss (CBL) The indirect loss associated with incidents that result in harm to people, asset damage, environmental impact or impact on reputation. Consequential Business Loss comprises elements such as loss of production, process unit downtime, product quality costs, cost of environmental clean up, cost of recovery/disposal of waste, cost of reprocessing off-grade material and fines. It may also include losses associated with customer impact and loss of market share. Refer to Group HSE publication ‘Incident Classification, Investigation and Reporting’ for more detail. Daily Life Activities Performance of basic self-care activities during rehabilitation. These include dressing, bathing, going to the toilet, ambulation and eating. Group Business An organisation denominated a Group Business in the Group Control Framework. Currently there are six Group Businesses: Exploration & Production, Downstream, Gas and Power, Renewables and Hydrogen, Shell Trading, and Shell Global Solutions. Hazard The potential to cause harm to people, damage to assets, business loss and impact on the environment or reputation. Industry This usually means the oil, gas and petrochemical industry. However in some instances the comparable industry may be based on the Hazard being assessed. For example, if a site is assessing the Risk associated with electrical work on power lines it is reasonable to consider Industry as the electrical distribution or power industry. Likelihood Chance that a specified Consequence will happen. In this guide Likelihood is expressed qualitatively in terms of events that have happened in the particular Industry, Organisation or Location.
34
Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 5 Glossary
Location The smallest organisational unit that is used in the Likelihood scale of the RAM. Examples in the Group Businesses are: • Exploration and Production – offshore production platform, onshore flow station, drilling rig, seismic unit. • Gas and Power - gas processing plant, LNG plant, LNG import terminal, GTL plants, pipeline companies, local distribution companies, power stations, coal gasification plants. • Downstream – refinery, chemical plant, distribution terminal, road transport operation, pipeline system, bitumen plant, luboil/grease blending plant, crude oil, refined product or chemicals carrier (ship). For smaller or less hazardous units, e.g. retail stations or road tankers, the Group Business should define the aggregation of units that is equivalent to a Location for the purpose of RAM assessment. Organisation In this Guide Organisation means an organisational unit 5 to 10 times smaller than the larger Group Businesses (currently Exploration & Production and Downstream). An Organisation is either a Group Business (in the case of smaller Group Businesses) or an organisational unit smaller than a Group Business, e.g. a Class of Business in Downstream or a Region in Exploration and Production. Organisation is used in the description of Likelihood levels on the RAM. Each Group Business should provide detailed guidance on what the term Organisation means for its organisation. Permanent Total Disability (PTD) Any work related injury that permanently incapacitates an employee and results in the termination of employment. Risk Risk is the Likelihood that a specific undesired event will occur within a specified period. Risk is therefore a function of both the Likelihood and the Consequence of a specific Hazard being released. When applying the RAM to assess the Risk rating (RAM rating) of a specific Hazard release scenario, Risk is a function of the Likelihood of Consequence and Severity of Consequence. A Risk Rating is normally expressed in the form ‘People 3B’ or ‘Reputation 4C’. Risk Assessment (UK HSE terminology) The process of estimating the Likelihood of occurrence of specific undesirable events, and the Severity of harm or damage caused, together with a value judgment concerning the significance of the results. Risk assessment therefore has two distinct elements - risk estimation and risk evaluation.
Risk Assessment Matrix, Issue 3.0, March 2006
35
Appendix 5 Glossary
Risk Assessment Matrix (RAM) A practical tool that is used to qualitatively assess HSE and other business risks. The result is referred to as a Risk rating or RAM rating. Severity Level of Consequence on a scale 0 to 5. Tolerability criteria Tolerability criteria include laws and regulations, company standards, and the HSE premises for projects. They may also include stakeholder expectations.
36
Risk Assessment Matrix, Issue 3.0, March 2006
H S & E Publications Issued under the Auspices of the Shell HSE Committee/HSE Advisers Panel Royal Dutch/Shell Group Health, Safety and the Environment Commitment and Policy (1997), reviewed 2000 Royal Dutch/Shell Group Procedure for HSE Management Systems (1997) Competence Assurance of HSSE Critical Positions (2004) Group Health, Safety and Environmental (HSE) Auditing Guidelines (2001) Group HSE Management System (2002) Group HSE Performance Monitoring and Reporting (2004) only elec. HSE Management System, Integrating HSE into the Business (1994) only elec. Impact Assessment (2004) Risk Assessment Matrix (1999) Occupational Health Guidelines Asbestos (1986) Chemical Hazards: Health Risk Assessment and Exposure Evaluation (1995) Fitness to Work – Management Process (2003) Health Guidelines for Catering (1995) Health Risk Assessment (2001) Human Factors Engineering (HFE) in New Facilities Projects (2003) An Introduction to Health Risk Assessment: Training Package (2002), available through Open University, see: http://sww-openuniversity.shell.com/scripts/dlmisapi.dll/GET?file=frameset.jsm&rshost=sww-openuniversity.shell.com&rsport=1564 Go to e-learning and then HSE and S Legionella – Management Process (2004) Management Guide to Thermal Stress (1991) Management Guidelines for Hearing Conservation (1991) Man Made Vitreous Fibres (2002) Medical Emergency Guidelines for Management (2001) Noise Guide (1991) Personal Protective Equipment Guide (1989) Repetitive Strain Injury (RSI) in the Office Environment (2002) The Use of Contact Lenses in Industry (1984) leaflet Safety Guidelines Company-Organised or Supported Social Events - Safety Considerations (1990) leaflet Confined Space Entry (2004) Contractor Safety (1987) Electrical Safety (1986) Enhanced Safety Management (1985) Enhanced Safety Management Checklist (1989) Gas-freeing and Cleaning of Storage Tanks (2003) Guidelines for Laboratory Safety (1989) Hand Tools and Sparking Hazards (1982) leaflet Hotel Fires, Plan for Survival (1988) leaflet Hydrogen Sulphide (1986) Incident Classification, Investigation and Reporting (2002) Ionising Radiation Safety Guide (1993) Office Safety (1987) Oxygen - A Hazard (1982) leaflet Permit to Work Systems (2003) Personal Protection of Helicopter Passengers in the Event of Ditching (1995) Road Transportation of Goods, Equipment and Product (2003) Safety Features of Light Vehicles and Mini Buses (1997) Safety Signs and Colour Coding (1981) leaflet Scaffolding Safety (1987) The Secondary Use of Containers (1978) leaflet Tripod-BETA (Incident Analysis EP 95-0321, to be ordered through Library, Library, Rijswijk SIEP-EPT-CSG) Underwater Operations Management Guidelines (2004) Unsafe Act Auditing (1987) The Use of Small Marine Craft by Group Companies (1992) Welding and Cutting (1976) Environmental Guidelines Guide for the Risk-Based Management of Potentially Contaminated Land (2000) Recommendations for Alternatives to Fire Fighting Halons (1994) Safe Handling and Disposal of PCBs (1985) Technical Guide for the Investigation of Potentially Contaminated Land (2004) Volatile Organic Compounds (1996) Waste Management Guide (1996)
These publications can be ordered from SI The Hague; CAE Division via E-mail: GUIDES, Internet address:
[email protected] March 2006
H S & E Publications Issued under the Auspices of the Shell HSE Committee/HSE Advisers Panel
Graphic Media & Publications, Rijswijk, Netherlands P03821
