managing risk guide - gltplusgoalzero.com · hazid process and experts in the following areas: •...

Text in grey boxes is quoted from the manual section. Terms in green are included in the HSSE & SP Control Framework Glossary. Terms in blue reference manuals and manual sections in the HSSE & SP Control Framework and associated materials.

Managing Risk Guide

Shell HSSE & SP Control Framework

HSSE & SP Management System Manual

Guidance

Restricted

Version 3, July 2016

Contents

PURPOSE OF THE GUIDE 1

PURPOSE OF THE MANUAL SECTION 1

WHO IS THIS FOR? 1

WHAT SITUATIONS ARE COVERED? 2

GUIDANCE ON MANUAL SECTION REQUIREMENTS 2

APPENDICES 11

Purpose of the guide

The purpose of guides is to communicate the recommendations of the manual custodian and

Subject Matter Experts (SMEs) from the Businesses (e.g. Global Expertise Teams (GETs)) for meeting the requirements of the HSSE & SP Control Framework manuals. They are intended to serve as a recommended basis for local procedures, competence requirements, learning

material and contract requirements and to support those responsible for and/or supporting implementation.

This guide provides recommendations based on proven practices, but these are not mandatory. The guidance is a preferred way to fulfil the manual requirements, but it is not the only way, and the requirements may be fulfilled by other means.

This guide describes the recommended way to meet the requirements of the HSSE & SP

Control Framework Managing Risk Manual Section.

Purpose of the manual section

To establish a process to identify HSSE & SP Hazards and to reduce the Risks to As Low As Reasonably Practicable (ALARP).

Who is this for?

• Business Leaders; and

• Managers.

• People who own or develop documents such as local procedures, competence requirements and learning material or contract requirements for managing risk.

• Other staff involved with risk management and incident investigation:

o SMEs



Guidance

Restricted

July 2016

Managing Risk Guide 2/34

What situations are covered?

This manual section applies to:

• Managing HSSE & SP Risks in Assets, facilities, operations, projects and activities where the HSSE & SP Control Framework applies.

• The use of the Risk Assessment Matrix (RAM) for incidents. Specifically using the RAM for incident investigation and assessment of incident potential risk.

Guidance on manual section requirements

REQUIREMENT PAGE

1. Establish and maintain an effective Hazards and Effects Management Process. 2

2. Identify HSSE & SP Hazards in the Business and document their effects on people, Assets… 2

3. Assess all the Risks of identified Hazards for Worst-Case Credible Scenarios using the RAM… 4

4. Manage Risks in the light and dark blue areas of the RAM. 7

5. Manage Risks in the yellow (non 5A/B) areas of the RAM. 7

6. Manage Risks in the yellow 5A/5B and red areas of the RAM as per requirement 5 and in… 9

7. Review Hazards and Risks and maintain documentation. 10

1. Establish and maintain an effective Hazards and Effects Management Process.

WHO: The Business Leader is Accountable.

• Hazards and Effects Management Process (HEMP) Downstream

• HEMP on a page

2. Identify HSSE & SP Hazards in the Business and document their effects on people, Assets, the

community and the environment in a Hazards And Effects Register.

2.1 Provide information, instruction, training and supervision so that people are competent to apply the HSSE & SP Risk Assessment Matrix (RAM) rating in their area of responsibility. Refer to Figure 1.

WHO: The Manager is Accountable.

Training in identifying and assessing Risk is provided through the following courses:

• Placeholder for Master Class (under development) • SOU Course 00130215

• SOU Course 00005440 • SOU Course 00810884

Personnel who are involved in assessing risks using the RAM should have successfully completed at least two of the courses listed above and have the requisite competences with regard to assessing the potential consequences as noted under requirement 2.

Hazards are identified through processes such as the Hazards Identification Process (HAZID), or other equivalent processes.

• Hazards – agent with the potential to cause harm

• Consequences - effect on People, Asset, Community and Environment (P, A, C, E) as a result of the Hazard being released

People refers to employee and contractor health and safety impacts and community safety (e.g. road traffic collisions involving 3rd parties, or third party fatalities or injuries as a result of operational incidents).



Guidance

Restricted

July 2016


Assets refers to damage to Shell, SOV and NOV assets without consideration of Consequential Business Losses (i.e. does not include loss of business, loss of product or resulting revenue, and inability to do other work which has associated costs or loss of revenue).

Community refers to people, resources and assets impacted outside of the facility.

Environment refers to air, water and land impacts both internal and external to the facility in

question.

Hazard identification is carried out with a team of people knowledgeable in the process or activity under consideration, the hazards associated with the activity or process, the Potential Consequences and likelihoods with respect to P, A, C, E. hazards, consequences and

likelihoods are identified based on the experience of the assembled team and through the use of existing catalogues and guidewords.

An example of the membership of a HAZID team: HAZID Facilitator, knowledgeable in the HAZID process and experts in the following areas:

• Harm to People – Health and Safety and Process Safety

• Damage to Assets – Engineering & Maintenance SME

• Harm to Environment – Environmental SME

• Harm to Community – Social Performance SME

• Operations Representative or staff familiar with the operation of the activity or process

• Technology or staff familiar with the function and design of the activity or process

SMEs with direct experience at the site or specific business experience should be included in the discussion for insight on relevant hazards and effects.

The Hazards and Effects Register documents the identified hazards, potential consequences

and method by which risks are being managed. The HAZID process has template formats for the Hazard and Effects Register; however, other equivalent formats can be used.

Reference to and content of specific environmental risk assessment reports, studies and environmental aspects registers/inventories (e.g. ISO 14001) may be used as input to Hazards

and Effects register to inform an understanding of potential environmental risks (e.g. biodiversity, water, soil and groundwater and air).

Example: A release of gasoline from a pipe could ignite and cause damage to assets and injury to people as well as environmental damage and negative effects on community livelihoods and wellbeing. These consequences are captured and recorded in a Hazards and Effects Register.

See the Use of the RAM section for more detailed instructions on how to assess consequence.

Examples

• Hazards and Effects Registers:

o Downstream Manufacturing

o Downstream Chemicals

o P&T Shell Technology Centre Amsterdam

o Upstream

• HAZID:

o HAZID Protocol Learning Slides

o HAZID Protocol

o HAZID Master Capture Sheet



Guidance

Restricted

July 2016


3. Assess all the Risks of identified Hazards for Worst-Case Credible Scenarios using the RAM, and document the assessment of all these Risks in the Hazards And Effects Register.

3.1 Analyse the following specific Hazards by using the referenced methodology:

• health as per the Health Hazard Management Manual Section;

• security as per the Security Manual; and

• environmental, social and health impacts of a project, as per the Impact Assessment Manual Section.


Description of the Risk Assessment Matrix (RAM)

The RAM is a 6 by 5 matrix that is used for qualitative assessments of risk. (Refer to Figure 1.) It is based on the concept of applying experience of events or incidents in the past to provide insight in how these risks can be managed into the future. The RAM is also used for incident

classification and reporting, per the Incident Investigation and Learning Manual Section.

The vertical axis represents increasing Consequences (Severity levels 0 to 5) in terms of harm to people, damage to assets, effect on the environment and communities (P, A, C, E categories).

• The horizontal axis represents increasing Likelihood (levels A to E) of the Consequence under consideration.

• Boxes in the matrix represent levels of Risk, increasing from top left to bottom right corners of the matrix.

• The matrix is divided into light blue, blue, yellow and red areas to illustrate the increasing level of Risk.

Figure 1 - Risk Assessment Matrix (RAM)

The following diagram (Figure 2) illustrates where the RAM is applied in the Managing Risk Process. Note that the RAM is used without the consideration of Barriers (Unmitigated Risk).



Guidance

Restricted

July 2016


Figure 2 - Where the RAM is applied in the Managing Risk Process

Severity

The Consequence Severity (0-5) scales in the P, A, C, E categories - people, assets, community and environment - are defined in Appendix 1.

The Consequence Severity (0-5) scales for each P, A, C, E category are not to be inferred as equal. In particular, they are not to be used to infer the value of a life.

Likelihood

The Likelihood levels A to E are defined in Appendix 2, which also includes guidelines on how to apply them to varying size and complexity of Organisations.

3.1 Analyse the following specific Hazards by using the referenced methodology:

• health as per the Health Hazard Management Manual Section;

• security as per the Security Manual; and

• environmental, social and health impacts of a project, as per the Impact Assessment Manual Section.


Analysing Health Hazards

Health Risk assessment is part of the Health Hazard Management Manual Section.

Example of Health Risk Assessment Template for a RAM red health hazard:

Example Health Risk Assessment for RAM

Health Hazard Inventory

Analysing Security Hazards

Refer to the Security Manual.

Analysing Health, Social and Environmental impacts

For Community Risks, refer to the SP SharePoint site for further guidance and examples.

Use of the RAM

The starting point for a RAM assessment is identifying the hazards with an understanding of the context (hazard release scenario, activity, location etc.), or a description of the particular incident being considered with an understanding of the actual and potential consequences. The RAM assessment then consists of the following steps.



Guidance

Restricted

July 2016


Step Action

1 Identify potential consequences: Identify the “worst case credible” consequences that could develop from the hazard under the prevailing conditions. Ask the question “What could happen if the controls don’t work or are not in place?‟

Example, the operation of a pump in crude oil service involves the potential for a release of crude oil in the event of a pump seal failure. Potential Consequences:

a) Leak of crude oil into the drain system and then into the sea in a busy fishing area: Community and Environment

b) Ignition of the crude oil resulting in a small fire around the pump: Assets, Environment

c) Worst Case Credible: Escalation of the fire to the point where other process equipment fails and a major fire and explosion occurs: People, Assets, Community and Environment.

Refer to Appendix 3 for further guidance on identifying potential Consequences.

2 Estimate the Severity of each potential Consequence: For each of the identified Consequences assess the Severity (0 - 5) in the four Consequence categories - People, Asset, Community and Environment (P, A, C, E). The severities for the P, A, C, E categories are defined in the Consequence Descriptions in Appendix 1.

In the crude oil pump example above, for the Worst Case Credible Consequences: “Escalation of the fire to the point where other process equipment fails and a major fire and explosion occurs”, here are potential severities:

• People: 4-5 as People may be injured or killed by a Major fire or the explosion. The number of people impacted is based on the possible number of people that could be affected not the number of people that are normally in the affected area. Consider people who may not normally work in an area such as maintenance staff or specialty contractors. Also consider Emergency Response or other people who may enter an area in response to the incident which may put them at Risk of harm.

• Asset: 3-4 as the location of the pump will have an effect on the outcome. The pump is in a remote location or the pump is very near other process equipment.

• Environment: 3-4 depending on volume of spill, ecology effects, potential persistence of impact and requirements for clean-up. More severe impacts requiring extensive measures will typically be 4.

• Community 3-4, proximity to local rural subsistence community increases severity with potential effects on community livelihoods (fishing), community health (drinking, bathing, diet (fish), fear of health effects), concern likely to be limited to local community and local government.

3 Estimate the Likelihood: For each of the potential Consequences make an estimate of the Likelihood of the Consequence in terms of the Likelihood levels A to E.

The Likelihood level is judged from past experience, by asking the question ”How often in the past has a hazard release resulted in a Consequence similar to the one that we are considering?‟. The approach is one of referring to history to determine what actions can or should be taken to manage the risk into the future.

The estimate of Likelihood is based on the Likelihood that the particular Consequence under consideration occurred, not on the Likelihood of the Hazard being released. For incidents this means that when assessing Worst Credible Consequence the Likelihood of the Consequence is what is considered, not the Likelihood of the initial incident occurring.

For the example above, an estimate is made of the Likelihood of the Consequences, e.g. the likelihood that fishing livelihoods will be materially impacted, not the Likelihood that the pump seal will leak. Refer to Appendix 3, for an example of estimating Likelihood.

The reliability of the Likelihood estimate, and therefore of the RAM assessment, depends to a large extent on the availability of data on previous incidents and on the knowledge and experience of the assessors. It is therefore important to maintain databases of previous incidents and make them available to people making RAM assessments and to have competent people in attendance that are able to cover the range of potential Consequences for the specific categories (SMEs can provide data on historical consequences from releases). The team assigned for estimating likelihood should also have competency in using the RAM, see section 2.1.

The hazard release scenario or the incident under consideration will often not be identical to the previous incidents that are being used to determine Likelihood. Also, detailed information on previous incidents outside the Organisation, or even outside the Location, may not be readily available. Therefore, a combination of available information and judgment from experience has to be applied to make a best estimate of the Likelihood level A to E.

Refer to Appendix 2 for a more detailed definition of Location and Appendix 3, FAQ 3, 4 and 5 for more detailed guidance on estimating Likelihood and the applicability of previous incidents.

4 Estimate the RAM risk rating: For each potential Consequence determine the RAM risk rating for each of the applicable P, A, C, E categories in terms of the product of the consequence severity and the likelihood. The risk ratings (up to 5 for each potential consequence) can be plotted on the matrix to provide a visual representation of the risk profile of the hazard release scenario under consideration. Refer to Appendix 4 for examples for the visual representation.

The convention for expressing RAM severity rating (actual consequence) is in the form of “People 2” or “Community 4” and the convention for expressing RAM risk ratings (potential consequence) is in the form of “People 2B‟ or “Community 4C‟.

Note that once the hazard risk has been assessed it does not change with the application of Barriers. In other words, the RAM risk cannot be reduced by applying barriers.



Guidance

Restricted

July 2016


Example: In Downstream Manufacturing, the RAM Risk rating for Naptha has been assessed as People 5B due to the fact that there have been incidents in industry where a Fire and Explosion involving Naptha has resulted in more than 3 fatalities. Manufacturing locations have

implemented Barriers to prevent an occurrence at the location however this does not change the RAM Risk rating as the unmitigated risk has not changed.

The underlying principle at work is that for worst credible consequence to have occurred, barriers were either not in place or the barriers failed. This provides the justification for

implementing and maintaining barriers to prevent the historical worst credible consequence.

4. Manage Risks in the light and dark blue areas of the RAM.

• Light Blue: Manage for continuous improvement through effective implementation of the HSSE & SP Management System. Businesses may set lower priority for further Risk reduction.

• Dark Blue: Manage for continuous improvement through effective implementation of the HSSE & SP Management System.

Who: The Manager is Accountable.

Examples of HSSE Management Systems and Guidance on creating a HSSE Management System:

• HSSE-MS (HSSE Management System) Downstream

• HSSE-MS Shell Technology Centre Houston

• Guidance on how a Health Assessment aligns with the HSE Management System

• Social Performance Planning

5. Manage Risks in the yellow (non 5A/B) areas of the RAM.

5.1 Where Reasonably Practicable, eliminate Hazards or

5.2 Substitute Hazards with ones having lower Risk.

5.3 Identify and implement Controls and Recovery Measures to reduce the Risks to ALARP.

5.4 Maintain a Hazards and Effects Register that includes a reference to the Shell HSSE & SP Control Framework requirements, legislation, or industry codes used to determine ALARP, or a reference to the process by which ALARP is determined.


Eliminating or Substituting Hazards

Elimination (avoidance) or substitution of Hazards is the most effective means of managing risk. When a Hazard with a RAM red or RAM yellow risk is identified, a first step in the Hierarchy of Control (refer to Figure 3) is to investigate opportunities to eliminate the Hazard or Substitute with a Hazard having a lower Risk.

Figure 3: Hierarchy of Controls



Guidance

Restricted

July 2016


Examples

• Example: Gaseous Chlorine is used in cooling water towers to prevent bacterial growth. The RAM Risk rating associated with Chlorine is yellow; People 4C. It is reasonable to assess the use of an alternative chemical leading to the same effect in the process; however with a lower RAM Risk rating such as Sodium Hypochlorite which has a BLUE RAM Risk ranking of

People 3B.

• People: Concentrated Hydrochloric Acid (30%) is used as a process chemical. The RAM Risk

rating associated with this strong acid is yellow: People 4B. It is reasonable to assess if hydrochloric acid could also be used in a lower concentration, thus leading to less harmful health effects. Concentration ranges lower than 20% HCl will have lower, blue, RAM Risk ranking of People 2B.

• Environment & Community: A proposed crude oil pipeline route runs through a Natural World Heritage Site, identified as “In Danger” by UNESCO. As the area is subject to ongoing

conflict between local tribal groups the potential likelihood of a spill is high, with severe consequences for the site. The potential Risk can be evaluated as Environment 5C (due to vulnerability, rarity and value of the site) and Community 4C (due to the high level of concern amongst governments and NGOs). By selecting a different route this potential Risk

can be avoided (Eliminate) resulting in Community 2/3 B/C.

Identifying/implementing Controls and Recovery Measures and Maintaining a

Hazards and Effects Register

Establish a Hazard and Effects Register that includes a reference to:

• HSSE & SP Control Framework requirements which used to determine ALARP

• Legislation or regulatory requirements which used to determine ALARP

• Shell or Industry codes used to determine ALARP or

• The process by which ALARP is determined.

Establish documentation that demonstrates how the Risks identified in the Hazard and Effects

Register are being reduced to ALARP.

• Once the level of documentation to demonstrate ALARP is defined in the Hazards and

Effects Register, these documents must be created and maintained.

• The Shell ALARP Guide provides guidance on demonstrating and documenting ALARP

Examples

• DS Manufacturing Model Bowties



Guidance

Restricted

July 2016


6. Manage Risks in the yellow 5A/5B and red areas of the RAM as per requirement 5 and in addition, apply a Bow-Tie or equivalent methodology which must include the following:

6.1 Identify Barriers to prevent a Top Event, to prevent Escalation Factors and to reduce the Consequences should the Top Event occur.

6.2 Identify at least one HSSE Critical Activity to maintain each Barrier.

6.3 Assign HSSE Critical Activities to the designated HSSE Critical Positions or within HSSE Critical Processes.

6.4 Identify HSSE Critical Equipment and performance criteria for assigned HSSE Critical Activities.

6.5 Assign maintenance through HSSE Critical Activities or within HSSE Critical Processes.

6.6 Identify criteria for ALARP determination and consistently apply these criteria.

6.7 Provide a Documented Demonstration Of ALARP for the Bow-Tie or equivalent methodology with details of:

• Hazards, Threats, Events, Consequences, Controls and Recovery Measures, performance criteria and Monitoring method.

• HSSE Critical Activities, HSSE Critical Positions or HSSE Critical Processes, and a list of identified corrective/improvement actions.

• The results of ALARP determinations, criteria by which Risk reduction to ALARP is achieved, and any required corrective actions to reduce Risk to ALARP.

• A Remedial Action Plan to close identified gaps.


Requirements 6.1 – 6.3

Identifying Barriers

• Information on Barriers (see section 2.5)

• Process Safety Narrative

Identifying/Assigning Critical Activities

Set the methodology for identifying HSSE Critical Positions if not derived through a Bow-Tie or equivalent methodology. HSSE Critical Positions are those positions which have the responsibility to design, implement or maintain Controls or Recovery Measures identified in

requirement 6.1.

Requirements 6.4–6.7

For Environment (e.g. biodiversity, water, SGW and Air) Bow-Tie equivalent methodologies

may include specific Environmental Risk assessment methodologies and environmental monitoring methods combined with assessment and recommendations of cost effective risk management options (including but not restricted to barriers and HSSE & SP Critical activities)

reducing the Risk to As Low As Reasonably Practicable (ALARP).

These methodologies may also document the ALARP determinations, required corrective actions and remedial action plans to close identified gaps.

Refer to: • ALARP Guide for Documented Demonstration of ALARP

• Explanation of HSE Case, Demonstration of ALARP, HAZID, HAZOP and PHA, HEMP, LOPA



Guidance

Restricted

July 2016


7. Review Hazards and Risks and maintain documentation.

7.1 Review the content of the Hazards And Effects Register and the Documented Demonstration Of ALARP when existing operations/activities are changed in a way that would change the Hazards or reduce the effectiveness of Controls and Recovery Measures.

WHO: The Manager is Accountable for requirements 2–7.

Identifying changes in the operations/activities

Set the methodology for identifying changes/activities, which require review of Hazards And

Effects Register and ALARP, if not derived through the Management of Change, Learning From Incident or equivalent process.

Recognise the need for review of Hazards And Effects Register or ALARP to maintain the liveliness. As a good practice, set-up a periodical review mechanism for Hazards And Effects

Register and ALARP to update the risks and controls time to time.

Managers may use this HEMP on a page in the review as a framework/agenda.

Discuss the review of the Hazards And Effects Register and ALARP process:

1. as part of the agenda in annual Management Review to make it more robust and in the line

of sight;

2. as part of the investigation of Incidents at the location, Learning From Incidents (LFI),

where there is possibility of impact on RAM risk ranking; and

3. as part of any changes proposed by the business in the RAM risk ranking criteria for specific activities.



Guidance

Restricted

July 2016


Appendices

APPENDIX 1: Consequence Categories and Severities

The following tables, one for each of the Consequence categories (People, Assets, Community and Environment), show the Severity levels and definitions.

People

Level Definition

0 No injury or health effect

1 Slight injury or health effect

No Treatment Case or First Aid Case

Illnesses that result in noticeable discomfort, minor irritation or transient effects that are reversible after exposure stops

2 Minor injury or health effect

Medical Treatment Case

Lost Workday Case or Restricted Work Case, where either has a duration of up to and including 5 days

Illnesses with reversible health effects such as food poisoning and dermatitis

3 Major injury or health effect

Lost Workday Case or Restricted Work Case, where either has a duration exceeding 5 days

Illnesses with irreversible health effects such as sensitisation, noise induced hearing loss, chronic back disorders or repetitive strain injury

Mental illness due to stress with reversible health effects

4 Permanent total disability or up to three fatalities

Illnesses with irreversible health effects such as corrosive burns, asbestosis and silicosis

Cancer

Mental illness due to stress with irreversible health effects

5 More than three fatalities

Illnesses with irreversible health effects such as multiple asbestosis cases traced to a single exposure situation

Cancer in a large exposed population

NOTES: This Guide is aligned with the Incident Classification and Reporting Rules and Group Parameters for HSSE & SP Performance Monitoring and Reporting Specification (PMR) section

of the HSSE & SP Management System Manual.

The PMR is in turn aligned with the Occupational Safety & Health Administration (OSHA) Standard 29 CFR 1904, issued by the United States Department of Labor



Guidance

Restricted

July 2016


Assets

Level Definition

0 No damage

1 Slight damage

Costs less than US $100,000

2 Minor damage

Costs between US $100,000 and US $1 million

3 Moderate damage

Costs between US $1 million and US $10 million

4 Major damage

Costs between US $10 million and US $100 million

5 Massive damage

Costs in excess of US $100 million

When assessing RAM asset consequence, include only direct damage to assets; do not include Consequential Business Loss (CBL).

CBL is the indirect loss due to asset damage, environmental impact or impact on the community. It comprises losses such as lost production (expressed as profit margin), process

unit downtime, product quality costs, cost of environmental clean-up, cost of recovery/disposal of waste and cost of reprocessing off-grade material.

Example: Naphtha is being stored in a tank. There is a risk of fire leading to the loss of the tank (Impact to Assets). In this case the Asset is the tank. The loss of the stored product is not considered when using the HSSE RAM.

Example: Propane is produced in a Hydrocracking operation. There is a Risk of fire and

explosion associated with the Propane. Such an event would obviously impact the Hydrocracking unit resulting in a loss of production. This loss of production is not considered when assessing the Consequence to Assets and does not factor in to the damage estimate.

Do not consider damage to 3rd party assets. These consequences are covered under the

Community Severity column.



Guidance

Restricted

July 2016


Community

Level Definition

0 No effect

1 Slight effect, indicated by: • Infrequent slight nuisance. (Nuisance to include interference with reasonable comforts and

enjoyments of life, general inconvenience relating to day to day activities or enjoyment of land).

• No observable adverse or perceived effect on livelihood, social and cultural assets, community security, community health, vulnerable or Indigenous People.

• Local public awareness but no discernible concern.

2 Minor effect, indicated by: • Limited short term nuisance • Limited effects on livelihood and/or social or cultural assets, community health. • No observable adverse effect on community security, vulnerable or Indigenous Peoples.

• Local public concern.

3 Moderate effect, indicated by: • Persistent nuisance. • Effects on livelihood and/or social and cultural assets, community health. • Limited observable effects on community security, vulnerable or Indigenous Peoples. • Local or Regional public concern.

• Local stakeholders, e.g. community, NGO, industry and government, are aware.

4 Major effect, indicated by: • Persistent effects on livelihood and/or social and cultural assets, community health. • Effects on community security, vulnerable or Indigenous Peoples and/or human rights

infringements, that are serious and/or at a community level. • Mitigation is complex or protracted. • National public concern.

• Impact on local and national stakeholder relations.

• National government and/or NGO involvement with potential for international NGO action.

5 Massive effect, indicated by: • Persistent, severe impact on livelihood, social and cultural assets, community security,

community health, vulnerable or Indigenous Peoples and/or human rights infringements. • Impact may affect a large geographic area or population. • Mitigation is complex or protracted, and of limited effectiveness. • International public concern. • High level of concern and action(s) by governments and/or by international NGOs.

The RAM consequence scale for Community is to a large extent qualitative and not quantitative. Use competent professionals in Social Performance (e.g. Authorised Person in

Social Performance) and in Community Health (e.g. Health Project Officers). These practitioners will have a good overview of the impact of Shell activities on the surrounding communities. They will be able to combine this with a good understanding of relevant

stakeholder perceptions of Community consequences and effects.

The Community column contains generic descriptors, and in relation to Consequences, the Community context within which the risk is being evaluated will vary with each project and asset. To assist in the interpretation of these Consequence descriptions, a number of illustrative examples are provided for each of the Severity levels. For more examples and

further support see the Social Performance SharePoint site.



Guidance

Restricted

July 2016


Environment

Level Definition

0 No Effect

No Impact to the Environment

1 Slight Effect

Slight environmental damage contained within the premises.

Examples include but are not limited to:

• A small spill in a process area or tank farm area that readily evaporates.

2 Minor Effect

Minor environmental damage, but no lasting effect.


• A small on-site spill with potential to harm the environment that has no off-site impact.

• On-site groundwater contamination with no potential for off-site contamination.

• A single exceedance of statutory or other prescribed limit.

3 Moderate Effect

Limited environmental damage that will persist or require cleaning up. Examples include but are not limited to:

• A spill with potential to harm the environment that requires removal and disposal of over 100 m3 of impacted soil/sand.

• A spill with potential to harm the environment which reaches surface water off-site.

• Off-site groundwater contamination.

• Off-site habitat and/or ecology effects or damage, e.g. fish kill or damaged vegetation.

• Repeated exceedance of statutory or other prescribed emission limit for longer than 3 months and/or, with potential long-term effect.

4 Major Effect

Severe environmental damage that will require extensive measures to restore beneficial uses of the environment.


• A spill to water with potential to reach a shore and cause harm to the environment. Off-site contamination of surface or groundwater over an extensive area.

• Requirement for Tier 2 oil spill emergency response.

• Off-site habitat and/or ecology effects or damage for greater than 1 year.

• Extended exceedances of statutory or other prescribed emission limits for greater than 1 year and/or with potential long-term effect.

5 Massive Effect

Persistent severe environmental damage that will lead to loss of natural resources over a wide area.


• A spill resulting in pollution of a large tract of wetlands, ocean, part of a river estuary or beach/coastal habitat

• Requirement for Tier 3 oil spill emergency response.

• Persistent off-site habitat and/or ecology effects or damage with proven long-term effect.

The RAM consequence scale for Environment is to a large extent qualitative and not quantitative. Use environmental professionals competent in their respective discipline areas for

assessing severities who have a good overview of local, national and regional environmental issues, regulations and focus areas including a good overview of sensitive areas, habitats and species combined with a good understanding of relevant stakeholder and NGO perceptions of environmental consequences and impacts.

The consequence severities should not be interpreted as being limited to spills and should also be used to assess other examples of consequences in an area including but not limited to



Guidance

Restricted

July 2016


overuse/overexploitation of water, operational discharges/emissions to sea and air, chronical leakages from waste sites and damage to flora and fauna from construction activities. Some lines of businesses and regions have developed very useful and more detailed documentation which provides additional real business examples to help people to assess actual and worst credible consequences and their associated severities (see Appendix 5).

When assessing Environment RAM consequence for repeated exceedances of statutory or other prescribed limits between the quantitative criteria windows defined for minor, moderate and major effects also take into account other factors like regulatory policy, focus and feedback, mediation/frequency of the emission/discharge limit and to what extent the exceedance(s) represent and actual impact on the environment.

For Environmental Consequences not covered by this RAM, such as business-time loss costs associated with onsite and/or off-site clean up, here it is necessary to communicate these consequences and associated Risks to the Business. In these cases an SME should be consulted.



Guidance

Restricted

July 2016


APPENDIX 2: Likelihood Scale The scale of increasing Likelihood is intended to represent a range from highly unlikely to

frequent. It is expressed in terms of frequency of historical events per period per Industry, Organisation or Location. These descriptions are used in every application of the RAM so as to promote consistent assessment of Risk.

Increasing Likelihood

A B C D E

Never heard of in the Industry

Heard of in the Industry

Has happened in the Organisation or more than once

per year in the Industry

Has happened at the Location or more than once

per year in the Organisation

Has happened more than once per year in the Location

The terms Industry, Organisation and Location are defined in the Glossary. Shell Businesses provide detailed guidance on the application of these terms to their Organisations. This guidance can be updated if the Organisation changes. The RAM Likelihood scale is qualitative

not quantitative. Use a competent HSSE & SP professional for the few applications where historical incident or failure data is available to numerically calculate Likelihood, e.g. quantified Risk assessment (QRA) and layer of protection analysis (LOPA).

Reference Industry Organisation Location

Downstream Oil and Gas

Industry

Global Manufacturing Refinery or Chemical Plant

Global Retail Retail region

Global Commercial GC Sub Business (i.e. Lubes Supply Chain; LNG; Specialties; Aviation Marketing;

Global T&S T&S Maritime

Global T&S TSO Distribution Region

US Pipeline Specific Pipeline or Region

Global Chemicals Region

Upstream Oil and Gas industry Upstream Organisation is defined as a specific global Line of Business

A large self-contained worksite or a cluster of small self-contained worksites which carry out the same activity. Examples are: an offshore production platform, or a flow station, drilling rig, seismic unit,

gas processing plant or a LNG terminal.

LNG Industry Integrated Gas Organisation is defined as a specific global Line of Business



Guidance

Restricted

July 2016


APPENDIX 3: Frequently Asked Questions

FAQ 1

Q. When we are assessing the potential Consequences of an incident and trying to decide what

could have happened, how much imagination do we use?

A. Determine the “worst case credible” potential Consequences. To do this, the following guidance is provided:

1. Ask the question “What if?‟ For example:

• What if the gas had ignited?

• What if the person working at height had not been clipped on when they slipped?

• What if it was raining or the wind was in a different direction?

• What if the oil spill had contaminated the drinking water aquifer?

• What if the oil spill had contaminated a nearby sensitive area or habitat?

• What if the oil spill had contaminated a community recreational area, beach or site of cultural importance?

• What if the Environment Regulatory non-compliances had resulted in regulatory body filing charges against the company?

• What if person inhaled H2S?

• What if the oil spill had contaminated agricultural land or a fishing area?

2. Wherever possible refer to incident reports, incident databases (both internal and external to Shell) or business hazard registers (if they exist) to find out what has happened

previously in similar circumstance. Recognise that the circumstances of two incidents are never exactly the same; therefore experience and critical thinking also play a part.

3. Be credible but not too imaginative with potential Consequences scenarios:

• Avoid “what ifs‟ that could not occur under the circumstances of the particular incident.

o For example: if a person tripped and fell to the ground at the same level is this considered to be a potential fatality? It all depends. If it was possible to strike the head against a valve stem or concrete curb when falling, the answer is possibly yes. (Although not common, fatalities have resulted from falls at the same level) If there

was no realistic possibility of a severe blow to the head when falling (i.e. walking over soft, open grass area) the answer is probably no.

• Avoid highly unlikely “what ifs‟ such as amputation resulting from infection of a cut.

• Avoid stringing too many “what ifs‟ together to produce an incredible Consequence.

o If two or more “what ifs‟ are needed for a Consequence to be realised, challenge each to establish that when they are combined, the overall Consequence is credible.



Guidance

Restricted

July 2016


FAQ 2

Q. People across the world ride bicycles every day in workplaces or during their leisure time. Falling off a bicycle could result in a broken arm (Severity 3). Does this mean that bicycle riding is assessed as People 3E (red area of the RAM)?

A. No. You need to first identify the potential Consequences of riding a bicycle and then the Severity and likelihood of these potential Consequences. If a broken arm is one of the worst case credible Consequences, you need to estimate how often in the past falls from a bicycle have resulted in broken arms. To analyse this we begin at the far right column of the RAM:

• Start by determining if there have been bicycling incidents resulting in broken arms at our Location several times a year. If the answer is yes then the Likelihood is E. People 3E (Red area of the RAM). If this is not the case look to the next column to the left.

• Continue with the same question but now consider has a broken arm happened once at our Location or multiple times per year in the Organisation. If the answer to this question is yes then the Likelihood is D. People 3D (Yellow Area of the RAM) If this is not the case look to the next column to the left.

• Continue with the same question but now consider has a broken arm happened once in our Organisation or multiple times per year in the Industry. If the answer to this question is yes then the Likelihood is C. People 3C (Yellow area of the RAM) If this is not the case look to the next column to the left.

However a broken arm may have happened somewhere in Industry, then the Likelihood is B. Then the assessed Risk of riding a bicycle is People 3B (dark blue area of the RAM).

Note that two of the Risk assessments People 3D and People 3C have the same RAM Ranking, Yellow. The Risk mitigation requirements for both of these Risks are the same. It is not productive in this case to spend significant resource debating if the Risk is 3D or 3C and the effort required to mitigate the risk is the same.

FAQ 3

Q. How do we know if something has happened before in the Industry? Our incident databases are not very comprehensive when it comes to incidents outside our Organisation.

A. You can assume that virtually all the possible task (workplace) related Consequences have happened somewhere at some time. We can often apply our experience and judgment to conclude that “it may have happened‟ and is therefore in column B.

With respect to common industry-wide situations such as working at height, an incident in a biscuit factory is just as relevant as an incident on an oil refinery. These incidents may not have happened in our Organisation or even in the oil/petrochemical industry. It is important to look broadly for these common situations to have a good understanding of the true Likelihood. We may even find when we do this that the broader industry data indicates that similar incidents have happened more than once per year, in which case the Likelihood is placed in column C. Community impacts which are common industry wide include land acquisition and resettlement in the agricultural sector, impacts on fishery livelihood due to infrastructure development etc.

Process related hazards, which are more specific to a type industry or business (e.g. Chemicals Manufacture) and generally have high Consequences and lower Likelihoods. It is essential to search incident databases or talk to HSSE and technical specialists for data on previous incidents. You also have to determine if these are similar incidents in similar situations with similar hazard release scenarios and therefore valid precedents. Only if there is no evidence of previous incidents may the scenario be assessed as “theoretical‟ and put in column A. It is important to note that the “possibility” of something occurring does not make it credible. When identifying the Likelihood an “A” validate through conversations with HSSE and technical specialists that what is “possible” has not been confused with what is “credible”.



Guidance

Restricted

July 2016


FAQ 4

Q. We have suffered several serious spill incidents in the past but in recent years there have been none. Do we now estimate Likelihood on the basis of numbers of incidents in the recent years?

A. No. The fact that there have been no spill incidents in the last few years does not mean that the Likelihood is now lower than it was previously. You always need to consider the past spill incidents when determining Likelihood. There are many factors that explain that there

have been no recent spills. One reason could be that the controls have been applied and maintained more rigorously. Another reason could be that activities associated with higher risk of spills have not been carried out in the last few years. If that is the case, the situation

could easily reverse in the next few years. The hazard release potential is still there and by extension the Risk still exists. By retaining a Likelihood estimate based on the longer-term history, the Risk Ranking is a more accurate representation of the Risk the Location, Business or Organisation faces.

Example: 10 years ago our Organisation set a requirement for window cleaners to work

from scaffolds or with fall arrestors and have applied it rigorously ever since. As a result there have been no further falls. In the preceding 10 years there were two falls in our Organisation. We do not conclude that the Risk of falling during window cleaning is now

People 4B. The Risk is still People 4C.

FAQ 5

Q. There are only two modes of transport to transfer people to an offshore platform - helicopter or ship. Following a number of helicopter incidents over the past 15 years, we have decided to make the transfers by ship in future. When we reassess the Risk of

transferring people do we take account of the earlier Helicopter incidents?

A. Probably not. If the previous incidents all related to the operation of helicopters they are not valid precedents for the new situation. The hazard release scenario has changed. The basis for the Likelihood estimate should involve transfer of people by ship.

Example: Consider the window-cleaning example in FAQ 4. Suppose that 10 years ago our

Organisation took the additional step of redesigning the windows so that they could be rotated though 180 deg. and washed from inside. However it is still necessary to lean out from the windowsill to reach some parts of the outside of the windowpane. Now it is less clear whether the inherent Risk of falling is still 4C, or has reduced to 4B as the Hazard

Release Scenario may have changed (falling out a window versus falling from a suspended platform) A judgment has to be made whether the hazard release scenario is still essentially the same or has fundamentally changed.

FAQ 6

Q. When we look at several potential Consequences from an incident or a hazard release

scenario, will the Consequence with the highest Severity also have the highest RAM rating?

A. Not necessarily. A Hazard with a Consequence of 3 and a Likelihood of E is assessed 3E and will be in the Red area of the RAM. Whereas a Hazard with a Consequence of 4 and a Likelihood of B Yellow area of the RAM. In general the high Severity Consequences tend to

be infrequent and the lower Severity Consequences tend to happen more often. This means that if there are several possible Consequences from a hazard release scenario, the respective Risk ratings will tend to be distributed across an equi-Risk diagonal of the RAM, i.e. bottom left to top right. It is good practice to evaluate at least one high Severity

Consequence and one high frequency Consequence, to be sure that the Risk is properly characterised.



Guidance

Restricted

July 2016


FAQ 7

Q. A Risk assessment of all activities in our business unit (part of HEMP) has concluded that there are two hazards with a RAM red Risk:

• Transfer of people by road between the various plants

• Operation of one particular plant, which under certain operating conditions releases hydrogen sulphide to atmosphere

Over the past 5 years we have implemented a programme of improvements to the hydrogen

sulphide containing plant. This included both additional instrument safeguarding systems and improvements to the shutdown procedures and emergency response. The possibility of hydrogen sulphide being released has not been eliminated but the Risk of plant operators and

contractors being affected have been significantly reduced. During the same period we have undertaken a couple of defensive driving campaigns, but the driving standards are still not acceptable and there have been two more fatalities. In the RAM screening of potential activities for next year’s HSSE Plan we show the hydrogen sulphide containing plant in the

yellow. This emphasises that road transport is the top priority. Is this a correct use of the RAM?

A. No. While the improvement efforts at the location have reduced the Residual Risk (risk that remains after controls and recovery measures have been introduced), the RAM Risk (Risk

with no controls in place) has not changed. The potential for the plant to release hydrogen sulphide is still there and the correct application of the RAM requires that the RAM Risk rating remain in the red area, not the yellow area.

The example above is referred to a “box hopping”. This is not permitted. The RAM Risk is associated with the Hazard and not the system in place.

FAQ 8

Q. There are many fatal road transport incidents each year in our Organisation. The Risk of transporting products by road is assessed People 4D (red area of the RAM). Does this mean that road transport of products is an intolerable Risk and to be stopped?

A. No. The RAM is not be used to decide if the Risk does not meet tolerability. The RAM Risk is

used to determine the level of Risk Mitigation required. Once Risk Mitigations have been implemented, then it is possible to determine if the Residual Risk meets Tolerability Criteria and is being managed to ALARP. Refer to the ALARP Guide for information on determining ALARP.

FAQ 9

Q. One of the scenarios assessed in a HEMP study was the seal failure on a crude oil transfer pump and the Risk of the crude oil leak igniting and escalating to a major fire (assume RAM Severity rating Assets 4). Our incident database revealed that there have been 2 incidents in our Organisation in the past 5 years in which crude oil pumps failed and the incidents

escalated to major fires (Likelihood C). Neither of these incidents was caused by pump seal failure. Is it correct to conclude that the Likelihood of this failure scenario is thus B and not C?

A. No. If you assess the Risk of failure of an individual component to reduce the Risk assessed

on the RAM, you are guilty of “salami-slicing‟, which means cutting up the Risk into small components so that the assessed Risk of each component is lower. This practice commonly leads to an underestimate of the overall Risk and too low a priority for the resulting actions. The intended use of the RAM is to assess the Risk of failure of a whole system. In this

example the scenario to be assessed is failure of the crude oil pump escalating to a major fire, which is Likelihood C.



Guidance

Restricted

July 2016


FAQ 10

Q. How do we assess the Risk associated with a new business or a new plant design? We have no history on which to assess Likelihood. What about the application of novel technology or a new or novel product/chemical?

A. A Likelihood estimate in columns D or E is not possible. Use the following techniques to estimate Likelihood:

o Draw on the experience of all those involved in the design and operation of the new plant and their knowledge of incidents in similar situations.

o Look at similar operations in other companies.

o Look at similar operations in other industries where there may be some common frame of reference.

The intent is to create a synthetic history for the new plant. In the case of novel technology where there is no industry experience to draw on, It is not appropriate to use the RAM to assess the Risk. Conduct a detailed consequence or impact analysis and quantified risk assessments.

FAQ 11

Q. We previously assessed the Risk of a particular hazard release scenario as People 3B, on the basis that it had never happened in our Organisation before, only the Industry. However, yesterday we had an actual incident involving the release of this hazard in our Organisation that resulted in injury with Severity 3. Can we still say that the RAM Risk rating is People 3B because that was the rating before yesterday?

A. No. The correct use of the RAM is to include the incident yesterday in the Likelihood estimate. The RAM Risk rating is now People 3C.

FAQ 12

Q. We have just had a serious incident that could have been a fatality but in fact was a minor injury requiring restricted work, RAM Severity rating of People 2. We assessed the RAM Risk rating as People 4C because we had an almost identical incident previously, which also could have been a fatality. Is this correct?

A. Mainly Yes. However depending on where the previous incident occurred, in the Organisation, or at the same location and its frequency, the RAM Risk could be 4C to 4E. As a reminder, when the HSSE RAM is used as an assessment of an incident the purpose is to decide the level of investigation and follow-up that is required. There are two activities that take place:

• Assessment of the Actual Consequence of the incident. o In this first step no likelihood is applied as the incident has happened and there is no

need in reviewing historical incidents. The consequence should be identified exactly as it occurred.

• Assessment of the Potential Risk

o In this step the Incident is assessed for the Potential Consequences.

o Worst Credible Consequence that could have been the result of the incident.

o After determining the Worst Credible Consequence, determine the Likelihood as outlined in the Guide.

o Determine the Potential Risk of this Incident by combining the Potential Consequence and the Likelihood.

o Based on the Potential Risk Ranking, Determine if this is a High Potential Incident which has additional investigation and reporting requirements.

NOTE: Management will take into account other factors such as the complexity of the incident and how similar it is to the previous one when deciding on type of investigation and follow-up.



Guidance

Restricted

July 2016


FAQ 13

Q: Why are we including “perceptions” in the Community column?

A: Community health effects include perceived health effects, as well as measurable actual effects. Perceived effects have material effects on people health (anxiety, fear etc.) and have material impacts on the business (long term costs, litigation, lost permits).

FAQ 14

Q: Can we use the HSSE & SP RAM to evaluate significance of environmental, social and

community health impacts - in Impact Assessments (IAs) or in specific Environmental Risk assessments (Biodiversity, water, SGW and Air)?

A: No, the HSSE & SP RAM should not be used to evaluate the significance of impacts in an Impact Assessment. Evaluating significance is about answering the IA question: Is this impact important? Which leads into the question: What will we do about this impact? Hence it is both

about analysing impacts and the associated actions. The RAM is not an appropriate tool for this because:

• The RAM is too generic for use in project IAs as significance criteria, which typically contain project and local community specific information and references.

• The RAM is not suitable for assessing/differentiating significance of (potential) positive impacts.

• The likelihood scale is not readily applicable in Impact Assessment, because many of the impacts are certain to happen.

• The ranking and inclusion of Asset criteria (in the RAM) are inappropriate for an IA, not least because they relate to the impact on the business (not relevant for receptors) and not suitable for external publication.

However, Risks are identified by the IA process, and should recognise if the project has potentially significant and/or difficult to manage potential impacts that should be avoided in

early project decisions.

For more information on significance criteria for Impact Assessment, see the IA SharePoint site.

FAQ 15

Q: Regarding Consequence Severity tables for in Appendix 1 - can we use the tables for

assessing other consequences than the examples listed under the Severity descriptions?

A: Yes, the list of examples is not a complete inventory. The Severity scale should be used for assessing other examples as well. See Appendix 5 for additional examples.

Some lines of businesses and regions have developed very useful and more detailed documentation which provides additional real business examples to help people to assess actual and worst credible consequences and their associated severities.

Consult with SMEs when determining what Severity of the specific consequences. The SMEs

should have a good overview of the issues involved. (E.g. Environmental SMEs have a good understanding of local, national and regional environmental issues, regulations and focus areas, relevant sensitive areas, habitats & species combined with a good understanding of

relevant stakeholder and NGO perceptions of environmental consequences and impacts.)



Guidance

Restricted

July 2016


APPENDIX 4 – Examples

The following examples are intended to illustrate and explain the RAM assessment process. They do not necessarily reflect actual experience or incidents in the company.

Example 1 – Risk Assessment: Hazard and Effect Management existing facility

A hazard identification exercise on a gas stabilisation unit establishes that one of the hazard release scenarios (top events) is a seal blow out on a gasoline pump with three subsequent threat to consequence lines:

1. A gasoline loss of containment leading to a liquid pool.

2. A gasoline loss of containment leading to a vapour cloud.

3. A gasoline loss of containment leading to gasoline entering the local estuary.

Assess the Risk associated with the Hazard of Gasoline:

Assessing Worst Credible Consequence

Asking the question “What if?‟ reveals three distinct worst case credible potential Consequences:

1. Ignition of the pool of gasoline leading to Asset damage

2. Ignition of the vapor cloud leading to a major explosion, with possible Asset Damage and Fatalities

3. Gasoline reaching the estuary resulting in contamination of the estuary where people fish for recreation leading to temporary reduction of fish populations

Assess Likelihood

Make use of the following information about earlier incidents.

• At our Location There were 3 spill incidents 2 months ago and another single spill incident 11 months ago.

o In two of these incidents oil passed through the interceptor and polluted the estuary. These incidents were reported to the Environmental Regulatory Agency as a breach of the local regulations.

o The estuary is an environmentally sensitive area and one of the incidents 2 months ago was reported in the national media.

• In our Organisation there was an incident at another site 2 years ago in which a rupture of a pipe in a tank bund. This resulted in a spill of gasoil in the tank area and the gasoil ignited.

o The fire was restricted to the one tank bund, but it resulted in US $3.5 million of equipment damage.

o No one was injured.

• In our Organisation there was an incident 7 years ago at another site in which a spill of

gasoline resulting from a pump failure in the ignited, resulting in a fire.

o This fire damaged the stabiliser column, which eventually ruptured.

o The resulting explosion led to 2 operators being seriously injured (internal injuries and broken bones; requiring off work for several months), US $50 million of equipment

damage and the plant shutdown for 3 months.

• In the Industry there was an incident 5 years ago involving a pump failure which resulted in

a fire leading to an explosion. There is no information on the Asset damage but there was the report of 1 fatality.

Applying the knowledge of previous similar incidents at this Location and elsewhere in the Organisation we come to the following RAM ratings:



Guidance

Restricted

July 2016


RAM Assessment

Putting the information on Consequence and Likelihood together:

• Fire leading to Asset damage.

o The previous incident resulting in a fire involved a spill of gasoil rather than gasoline. The cause was identified as a pipe rupture in a tank bund rather than a pump seal blow out in the process area. Although the Consequence of a fire is a credible Consequence for the

situation we are considering, the Hazards and the initiating events are different. There should be further understanding of the gasoil incident before this incident is taken as a precedent for assessing the Hazard of gasoline.

• Explosion leading to Potential Fatalities and Asset Damages

o There are two incidents that are used to determine the RAM Risk Ranking.

� In the incident that occurred in our Organisation there was Asset Damage of $50 million = Asset 4C

� In the incident that occurred in our Organisation there was People Consequence of two people with Loss Time Injuries = People 3C

� In the incident that occurred in Industry there was a fatality = People 4B

• Spill leading to contamination of the estuary affecting recreational fishing activities and temporary reduction of fish populations:

o There is more than 1 incident this year at our Location involving pollution of the estuary. In this case the Consequences of these incidents are:

� Multiple violations of a regulation

� Effects on recreational livelihoods and regional public concern.

o The RAM score for these Consequences = Environment 3D and Community 3D.

The final RAM Risk rating for gasoline using the historical information available is:

People 4B (RAM Yellow)

Asset 4C (RAM Yellow)

Environment 3D (Yellow)

Community 3D (Yellow)

Note that all of the available information should be used to determine the final RAM Risk rating. All four aspect People, Assets, Community and Environment are considered.



Guidance

Restricted

July 2016


Example 2 – Risk Assessment: Transportation of Project Resources

A project needs to transport 3,300 pipe joints from the port of entry to the construction contractor’s coating facility. The distance is about 200 km and the options are:

• Transport by road on public highways – 5 joints per load

• Transport by barge through inland waterways

The region has significant security concerns with theft, piracy, hijacking and hostage taking

commonplace within the oil field operations. The roads are generally single carriageway, of poor quality and can become very overcrowded in the vicinity of built up areas.

Assess the Risk associated with the two transport options.

Assessing Worst Credible Consequence

Asking the question “What if?‟ reveals two distinct worst credible Consequences:

i. Road Transport

The most significant hazard release potential is. The worst case credible potential Consequences for this scenario are:

• A road traffic accident resulting in injury to contractors, communities and third parties, including multiple fatalities.

• Community and environmental impact of substantial road transport operation.

ii. Marine Transport

The worst credible Consequence for people is deemed to be the seizing of a barge by pirates and subsequent hostage taking. There is also the worst credible Consequence of the barge sinking during a routine operation. Resulting in:

• Injury and possible fatalities to contractors

• Damage or loss of barge and pipe joints with impact on project schedule.

The asset damage RAM Severity rating is assessed as Assets 3D.

Assess the Likelihood.

Make use of the following information about earlier incidents.

• Traffic accidents involving fatalities occur multiple times per year in our Industry and our Organisation. An incident occurred 2 years ago in the Industry which resulted in 4 Fatalities.

• There are several events per year where the pipe joints fall off the vehicle with no impact. •

• There have been several marine incidents per year in the Organisation in which hostages were taken. More than one incident per year results in fatalities.

• There was an incident in the industry several years ago where an entire barge of pipe joints sank. This was reported in the local media.

• The estimated cost of losses in marine incidents has been in the range US $200,000 -$500,000.



Guidance

Restricted

July 2016


Assess the Risk associated with the two transport options

Initial assessment

In looking at the historical data the initial RAM Risk rating of both options is People 4D Red. Note that the incident involving more than 3 fatalities is a People 5C Red. The RAM Ranking is:

Road Transport People 4D (Red) or People 5C

As no other data was available for Asset, Environment, or Community no RAM Risk rating will be assessed at this time. It is not appropriate to provide a RAM Risk rating of 0 to represent the lack of information.

Marine Transport People 4D (Red)

Community 2B (Blue)

No other data is available therefore no RAM Rank is given.

The requirements for RAM Red and 5A/B Risks are that Control and recovery measures are required to be put in place to reduce the Risk to ALARP.

Risk reduction

Road Transportation

The road proposed for the road transport option is a busy main thoroughfare crossing the region. In parts it is narrow and in need of repair, and it cuts through many towns and villages. It is impractical to improve the standard of road or to take an alternative route. Local

road transport contractors are unable to meet mandatory company requirements for vehicle standards, defensive driving and journey management within the project timeframe.

Marine Transportation

The waterways between the port of entry and the construction contractor’s coating facility are prone to piracy and attacks from armed groups’ intent on stealing equipment or taking people hostage. The Organisation security and marine transport advisor has confirmed that implementing the following measures; comprehensive security protection in the form of

escorts, use of certified vessels and equipment, prohibiting sailing at night, Journey Management Planning and the use of appropriate Safety Equipment in the event the vessel is sunk (e.g. life vests) would reduce the Risk to ALARP.

Overall assessment

Since the Risk associated with the road transport option cannot be reduced to ALARP whereas the marine transport option can be, the marine transport option is selected.



Guidance

Restricted

July 2016


Example 3 – Incident:

Exposure to benzene with potential chronic health effect

A spill of benzene on an aromatics plant went into the normal plant drain system, instead of

the closed benzene collection system. The total spill was 800 kg, which was contained within the aromatics plant and then pumped to the benzene collection system. People from operations and on-site emergency response involved in the clean-up wore suitable protective

clothing (including respiratory protection) and subsequent medical surveillance confirmed that no-one had been exposed to an excessive dose of benzene. Benzene in air measurements were in the range 10–20 ppm during the incident. (The OEL of benzene is 0.5 ppm).

Assess Actual Incident Impact

In this incident there were no impacts to People, Asset, Environment or Community. Since Likelihood is not assessed for such incidents, only the Severity is reported. The RAM Severity rating for this incident is 0.

Despite the absence of consequence, the information does allow an assessment of the Severity

for People, Assets, Community and Environment for this incident.

Assess Potential Impact and the RAM Risk rating of this incident. Make use of

information from earlier incidents to in order to assess this latest incident and

provide a Potential RAM Risk rating.

• There have been a similar spills of benzene at this location approximately once per year.

• In an incident 3 years ago two firemen involved in the response and clean-up activities did not wear the correct protective equipment. Medical surveillance results indicated that they were exposed to benzene levels above the occupational exposure limit.

• There have been no reported cases in the Organisation concerned of benzene exposure leading to cancer

• There are known cases in the Industry of benzene exposure leading to cancer

Assess Potential Risk for this Incident

There have been no incidents in the Organisation in which benzene contamination has led to

cancer, however these are incidents in industry where benzene exposure has led to cancer. For this reason the potential of this incident is RAM Risk rating People 4B.

When evaluating incidents involving chronic Health effects it is necessary to check with the appropriate health specialists to assure that the current Organisation and Industry data is being

used. If the data showed that there has been more than one case per year of benzene exposure leading to cancer, the Incident Potential Impact and RAM Risk rating would be People 4C.

Note that both 4B and 4C potential of this incident still are assessed in the yellow area of the RAM. Similar Risk Mitigations would be required.



Guidance

Restricted

July 2016


Example 4 – Incident: Fall from access platform

A section of grating approximately 1 metre x 1 metre was removed from the top platform of a plant to allow maintenance work to be done. It was not replaced afterwards. An operator on his rounds on the night shift did not see the hole because the lighting was poor. He stepped into the hole but was able to hold onto the edge of the grating and stop himself from falling to

the next platform four meters below. He climbed out and had only minor grazes and bruising.


In this incident, the impact was to the Operator. The operator received minor cuts and bruises

as a result of the incident but nothing more serious. Since only Severity is assessed the RAM Severity rating of this incident is People 1.




There have been several reports in the last year of grating not being replaced after

maintenance work. There have been no cases in the Organisation of people falling from platforms at height, but there was a case last year in another plant in the Organisation where a technician fell one meter from a platform because a section of handrail was missing. The technician broke a leg and suffered concussion.

There was no Industry data available on this specific type of incident where a grating was left

open.

There is industry data indicating a fall from heights resulting in a fatality occurs multiple times per year in the broader industry.


A review of the information provides use with two possible Risk Rankings.

When looking for previous incidents to estimate Likelihood it is necessary to consider if the previous incidents are similar enough to the facts of the incident under consideration. In this



Guidance

Restricted

July 2016


case it is appropriate to consider all incidents as the fundamental causes are similar (e.g. missing protective equipment).

The data from the Organisation indicates that the fall resulting in a broken leg has a RAM Risk rating of People 3C.

The data from the industry indicates that falls from height can result in fatalities. Since this

happens multiple times per year, the RAM Risk rating is People 4C.

It is appropriate to choose the higher ranking RAM Risk rating which describes the potential impact of a fall.

While the Risk Mitigation requirements as the same for 3C and 4C, Management may request a higher level of Risk Mitigation.

Example 5 Incident: Road tanker rollover

A road tanker contracted to the Organisation was on its way to deliver 30,000 litres of gasoil to a mining customer. The tanker rolled over after swerving to miss a pedestrian, who suddenly moved into the path of the vehicle. One tank compartment split and 8,000 litres was spilt to

ground. Two further compartments leaked from the manhole covers due to poor seal integrity. In total 12,000 litres went to ground. A field was affected and a farmer lost a crop worth $30,000, for which compensation was paid. The driver, who was wearing his seatbelt, cut his head above the right eye and received 6 stitches. He returned to work two weeks after the

incident after receiving counselling and refresher training. The tanker was scrapped (replacement cost US $70,000) and repairs to the prime mover cost US $20,000. Total cleanup costs were US $20,000 as over 100m3 of soil had to be removed.


In this incident we need to consider the impact to People, Assets, Community and the Environment since all four were impacted by the incident.

People

The driver was injured in the incident and required medical attention and was away from work for two weeks. The RAM Severity rating is considered People 3.



Guidance

Restricted

July 2016


Asset

The asset damage includes the damage to the tanker and the truck. The damage to both totaled $90,000. This is assessed as a RAM Severity rating Asset 2.

Community

The impact on the local farmers livelihood was temporary and readily remediated (soil clean

up) and compensated for. Local community and NGOs were aware. The RAM Severity rating of this incident is Community 3.

Environment

The cleanup effort required a large amount of soil to be removed (>100 m3). The RAM Severity rating of this incident is Environment 3.




• An incident involving the Organisation occurred 6 months previously in another part of the

country when a driver approached a corner at high speed, lost control and crashed into a barrier before rolling over.

o The tanker full of motor gasoline caught fire and the driver’s mate died at the scene. The driver was able to get out of the cabin and into a safe area. He received minor bruising to his chest.

o The truck and tanker (replacement value US $300,000) were completely destroyed

o There was no impact on any other people.

o The release first spread to the nearby fields.

o The incident was covered in the evening news and in the daily papers on the following day but there was no reference to the company as the tanker was unbranded.

• There have been at least 10 tanker rollovers in the past 12 months in the oil industry in this country.

o Four of these incidents resulted in fires and >3 fatalities.

o In one incident, oil ran into a local water supply affecting a village.

• Another oil company had a major tanker rollover incident in a neighbouring country two months previously when a tanker carrying gasoline rolled over in a village area. The standard of equipment, the transport infrastructure and the driving behaviour in this neighbouring country is very similar to the country under consideration.

o Product leaked from the tanker and local villagers gathered around and began filling containers with product.

o A fire broke out in which 42 people lost their lives and 20 more suffered injuries ranging from major to minor burns.

o A man carrying a kerosene lamp was believed to be the cause of the fire.


For the purpose of assessing the potential of this incident the oil product distribution operation in this country is considered as a Location.



Guidance

Restricted

July 2016


There are a number of potential Consequences and hence, RAM Risk ratings for this incident. Applying the information from recent incidents we come to the following RAM Risk ratings.

People

Several incidents have involved injury to People or Fatalities.

People 5B A rollover in another oil company that resulted in a major fire with multiple fatalities is the basis for this RAM Risk rating.

People 4C Multiple incidents that have occurred in the Industry are the basis for this RAM Risk

rating.

People 4D A fatality that occurred six months ago in our company in this country (Location) is the basis for this RAM Risk rating.

Asset Assets 2D

This RAM Risk rating is based on the US $300,000 loss to replace the tanker in an incident at the Location.

Community Community 2B

This RAM Risk rating is based on the incident where there was local public concern.

Community 4B An incident in another oil company with an impact to the village drinking water. This is the basis for this RAM Risk rating.

When assessing the potential consequence, all aspects, P, A, C, E are considered and the highest ranking RAM Risk rating from each aspect is chosen. In this example the Potential

Incident RAM Risk Ranking is: People 5B, this is due to the multiple incidents involving fatalities occurring in 12 months.

People 5B Community 4B

Assets 2D Community 2B



Guidance

Restricted

July 2016


APPENDIX 5 – Illustrative Examples of Community Consequence

Severity Examples

0 No Effect

1 Slight Effect, examples:

• Noisy onsite activities that are audible in the community but do not cause inconvenience and are within standards.

• Unplanned event: small oil spill confined on-site that doesn’t affect community water resources (e.g. drinking water, fisheries), and evaporates or dissipates naturally.

• Failure to engage early, leading to need to increased engagement later in the project.

2 Minor Effect, examples: • Unplanned: Oil spill with potential social impacts off-site that are easily addressed and have no lasting effects. • Short-term economic displacement (e.g. loss of access to grazing land, farming land or fishing sites),

resulting in short-term, reversible effect on income that does not affect quality of life. • Nuisance from traffic, dust, noise, vibration, odour, that is easily addressed. • Local content: failure to include clauses in EPC contract in relation to local content delivery means delay of 2

months for local community suppliers whilst contracts are amended. • Community health: transient health anxiety derived from perceptions of health risks due to elevated levels

of traffic (nuisance) that are known to be temporary.

3 Moderate Effect, examples:

• Unplanned: oil spill that affects community water resources, requiring substantial company resources to remedy.

• Unplanned: interference or injury to livestock or loss of a significant proportion of subsistence farmers’ harvest (e.g. oil spill, truck damage).

• Failure to manage noise associated with increasing helicopter and aircraft traffic in the vicinity of a remote onshore supply base, for an offshore facility, noise levels are regularly 6-9 dBA over previous baseline levels at a number of houses in the local community.

• Measurable effects of local price inflation/deflation. • Physical damage to a site, object or amenity of local cultural importance. • Land acquisition and/or involuntary resettlement in which mitigation is poorly executed (e.g. delays in

compensation), with potential health consequences (quality of housing, access to medical facilities etc.). • Local content: Failure to deliver contracts to local suppliers due to onerous and complex contracting

procedures, and, unable to rectify due to short construction period (e.g. insufficient broadband capacity to enable online applications).

• Community health: health anxiety derived from perceptions of health risks due to effects of long term operations (e.g. Health Impact Assessment of long term effects of fracking in NY State) (note, can result in lost permits, capture under “Asset” and “Community”).

• Community health: more difficult access to specialists (longer waiting times, inflated prices, etc.).

4 Major Effect, examples:

• Oil spill affecting community water resources requiring extensive company resources (e.g. large scale clean up and compensation), complex and protracted to manage.

• Measurable effects of local price inflation/deflation, resulting in limited secondary negative effects, e.g. food shortage.

• Recorded increase in crime and disorder attributable to company/contractor staff/presence. • Allegations of human rights abuses resulting in multiple police investigations but no charges • Damage to site, object or amenity of national cultural importance. • Land acquisition and/or involuntary resettlement (dwellings or livelihoods) without appropriate

compensation e.g. cash instead of in-kind compensation for land based livelihoods in developing countries. • Local content: inconsistent delivery of benefits with regard to jobs and contracts in local community with

high unemployment, low incomes and political instabilities • Community health: overwhelmed local health infrastructure, e.g. ambulances unable to meet demand. • Community health: community wide perceived health risk due to land contamination, requiring significant

mitigation, i.e. company provision of life long healthcare (“Asset” and “Community” implications).

5 Massive Effect, examples:

• Oil spill affecting regional water resources, with some significant, long lasting and extensive impacts (e.g. Loss of regional fishery or loss through contamination of drinking water source).

• Destruction to site, object or amenity of national/international cultural importance. • Land acquisition and/or involuntary resettlement (dwellings or livelihoods) without any compensation or

livelihood restoration. • Local content: failure to deliver sufficient local content benefits to comply with national legislation or to

meet local community expectations, leads to local conflict and a break down in social cohesion. • Recorded increase in crime and disorder directly attributable to company/contractor staff/presence resulting

in breakdown in social cohesion. • Allegations of human rights abuses resulting in police investigations and criminal prosecution. • Community health: multiple fatalities and serious exposures due to leak of methyl-isocyanate, e.g. Bhopal.



Guidance

Restricted

July 2016


APPENDIX 6 Illustrative examples of Environment Consequences (Offshore Gulf of Mexico (GoM) and Alaska venture)

Severity Examples

0 No Effect

1 Offshore

GoM

Slight Effect, examples: • Hydrocarbon spill < 1 bbl or chemical < RQ • 30-42 mg/l oil and grease in produced water/completion fluid • Flaring/venting event < 10% of facility target (as defined in Business Plan)

• Small spill including Loss of Primary Containment below Reportable Quantity that is contained within

secondary containment. (<49 CFR 172 appendix A federal and <CERCLA reportable quantity) • Wildlife-Bird strike of non-protective species. • Unauthorized vessel (emission source) within 25 miles of the MODU (Mobile Offshore Drilling Unit)

Alaska

2 Offshore

GoM

Minor Effect, examples: • 1-6 bbls spill of hydrocarbons • PW Sheen < 3 days or PW/completion fluid and grease of result of 43-100 mg/l (PNC) • Emergency sump sheen or static sheen failure (PNC) • SBM & Cuttings PNC (RPE failure and GC/MS failure or ROC failure) • Sanitary waste chlorine failure or floating solids observed (PNC) • Failure to meet regulatory or permit requirement (failure to sample, follow required protocol, report or monitor) • Flaring/venting 10-25% of facility target (as defined in Business Plan) • NORM Management non-conformance or loss of radioactive marker tag • Complaints from up to 10 individuals • Single exceedance of regulatory or other prescribed limit

• Spill-Small spill including Loss of Primary Containment outside of secondary containment below

Reportable Quantity • Wildlife- Single unauthorised level B take. (harassment), Not reporting with in time wildlife interactions. • Waste- nonconformance in manifesting waste (caught before leaving site) example: aerosol cans not

disposed of properly. • Miss a required sample per permit. • Loss of emission control device for short duration (SCR) within 25 miles of the rig • Offload of RCRA hazardous waste without notification from the generating vessel or onshore facility.

Alaska

3 Offshore

GoM

Moderate Effect, examples: • Hydrocarbon spill > 6 bbl or chemical spill > RQ • Observed off-site effects or damage (e.g. fish kill or damaged vegetation) • Off-site groundwater contamination • PW sheen >3 days or PW/completion fluid oil & and grease result greater than 100 mg/l (PNC) • Any toxicity failure (PNC) • Flaring/venting event 25-50% of facility target (as defined in business plan) • Unauthorised discharge of whole SBM (no cuttings) or well fluids containing priority pollutants (PNC) • Complaints from community organisations, or from > 10 individuals • DOT paperwork non-conformance • Multiple exceedances of regulatory or other prescribed limits with potential long term effects • Any incident of non-conformance (INC) issued by BOEM relating to environmental effects • Loss of Primary Containment above Reportable Quantity outside of secondary containment • Failure of fecal coliform test. • Wildlife - Level A take resulting Injury of marine mammal. • Waste- noncompliance in manifesting waste (left site) improper waste characterisation on the waste

manifest or failure to properly report to regulators. • Black/Grey water bypassing MSD, no test failure, no chlorination.

Alaska

4 Offshore

GoM

Major Effect, examples: • Oil spill that ends up on land areas requiring clean-up operations • Significant deployment of oil spill response equipment or oil spill dispersant application • Offsite groundwater contamination over an extensive area • Flaring/venting event > 50% of facility target, or 10% of UPD target (as defined by Business Plan) • Many complaints from community organisations or local authorities • Extended exceedance of regulatory or other prescribed limits, with potential long-term effects

• Wildlife- Fatality of marine mammal or multiple non protective species during single event. • Multiple Loss of Primary Containments or failures of compliance equipment.

Alaska

5 Offshore

GoM

Massive Effect, examples: • Crude oil spillage requiring extensive clean-up and remediation measures (e.g. blowout type scenario,

tanker collision with platform or pipeline

• Wildlife- Multiple Fatalities of marine mammal. • Worse case discharge (WCD) release- well blow out.

Alaska



Guidance

Restricted

July 2016


APPENDIX 1 - Revision Log

Date Revision Version

October 2009 Guide published 1

April 2011 Addition of Documented Demonstration of

ALARP Guide: Preparing an HSSE Case in section 7

2

March 2016 Guide rewritten and reformatted 3

July 2016 Purpose of the guide text updated, other minor

formatting updates, typos corrected, Revision Log added.

3

managing risk guide - gltplusgoalzero.com · hazid process and experts in the following areas: •...

Documents