zc cop ehs03 risk management

8/12/2019 ZC COP EHS03 Risk Management

1/117

CODE OF PRACTICE ONEHS RISK MANAGEMENTones orp COP EHS 3

APPROVED BY: DATE: Z1 SEP 8


2/117

CODE OF PRACTICE

EHS RISK MANAGEMENT

Document No ZC-COP-EHS03 Rev. No. 0 Date of Issue 21 Sept. 2008

Industrial Sector Environment Health & Safety Regulatory Framework Page 2 of 117

REVISION HISTORY

Rev. No. Issue Date Revised Section Revision Description

0 New Document

Copyright

The copyright and all other rights of a like nature in this document are vested in Higher Corporationfor Specialized Economic Zones (ZonesCorp), Abu Dhabi, United Arab Emirates. This document isissued as part of the Industrial Sector EHS Regulatory Framework and as guidance to IndustrialSector within the Abu Dhabi Emirates. Any party within Industrial Sector may give copies of the entireEHS Documents or selected parts thereof to their contractors/consultants for implementation of EHSManagement Standards. Such copies should carry a statement that they are reproduced bypermission of ZonesCorp and an explanatory note on the manner in which the document is to beused.

Disclaimer

No liability whatsoever in contract, tort or otherwise is accepted by ZonesCorp or any party whether ornot involved in the preparation of the EHS Management System Documents for any consequenceswhatsoever resulting directly or indirectly from reliance on or from the use of the ZonesCorp EHSDocuments or for any error or omission therein even if such error or omission is caused by a failure toexercise reasonable care.

All administrative queries should be directed to the ZonesCorp EHSMS Administrator HSE Division

Higher Corporation for Specialized Economic ZonesP.O. Box: 36000, Abu Dhabi,United Arab Emirates.

Telephone: (9712) 5073358Fax: (9712) 5073564Internet site: www.zonescorp.comE-mail: [email protected]


3/117


4/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



1. PURPOSE

This document provides guidance on the Environment Health & Safety (EHS)Risk Assessment and Management Techniques. The Code of Practice set outa generic framework for establishing the context, identifying, analysing,evaluating, treating, monitoring and communicating Risks.

This document presents a set of Techniques that shall be used as an integralpart of the entity approach to the identification, assessment and managementof the EHS Risks during Design / Construction / Operations and Maintenanceof Facilities including the Contractor activities.

Risk Assessment Methodologies, Techniques, Guidelines, Formats etc. givenin this document are for guidance purpose. Entities should judicially usetechniques Fit for the Purpose as required by specific Business / Activity /Operation.

Environment Agency Abu Dhabi (EAD) being the Competent Authority ofEHS Management within Abu Dhabi Emirate has designated HigherCorporation for Specialized Economic Zones ZonesCorp as the EHSRegulatory Authority for the Industrial Sector within Abu Dhabi Emirate.ZonesCorp in its Regulatory Role is the nodal agency for the Entities withinIndustrial Sector while interacting with the concerned Govt. Agencies (EAD,

Civil Defense etc.) for fulfilling the applicable regulatory requirements like EHSPermitting etc.

The Higher Corporation for Specialized Economic Zones ZonesCorp beingthe EHS Regulatory Authority for the Industrial Sector in the Emirate of AbuDhabi, has established the Environmental, Health & Safety RegulatoryFramework Codes of Practice to communicate the requirements of EHSmanagement as a key factor in successful business development to allindustries within the Emirate of Abu Dhabi. ZonesCorp considers theestablishment of priorities, programmes and practices as vital for integratinggood environmental, health & safety management into all entities business.

The Industrial Sector EHS Regulatory Framework has been established in linewith the requirements of UAE EHS Laws, Regulations and the Abu Dhabi(EAD) EHS Management System Framework Documents for the IndustrialSector. The system is also aligned with other international standards likeISO14001, OHSAS18001 and BS8800 for Occupational Health.


5/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



2. SCOPE

This document is applicable to all Entities within Industrial Sector in AbuDhabi Emirate. The Industrial Sector includes but is not limited to Entities inAbu Dhabi Industrial Cities (ICADs), Al-Ain Industrial Cities (AAICs), WesternRegion Industrial Complex, Mussafah Industrial Area and Workers Facilities(Labour Camps) for Industrial Sector within Abu Dhabi Emirate.

Wherever possible, and rather than providing detail within this document,reference is made to other, more detailed documents that have been providedin the ZonesCorp EHS Management System.

3. DEFINITIONS

3.1 Accident

An uncontrolled / unplanned / undesired / uncontrolled event that results inundesirable consequences to the personnel (injuries/illness) and/or to theassets (damage/loss) or to the neighbouring community and/or to theenvironment. The term Accident is synonymous with Incidentwherever usedin ZonesCorp EHS Management Framework

3.2 ALARP (As Low As Reasonably Practicable)a. To reduce a risk to a level which is ALARP involves balancing reduction in

risk against the time, trouble, difficulty & cost of achieving it.

b. This level represents the point, objectively assessed, at which the time,trouble, difficulty and cost of further reduction measures becomeunreasonably disproportionate to the additional risk reduction obtained.

3.3 Aspect

Element of an organisations activities products or services that can interactwith the environment (ISO 14001, 2003)

3.4 Barriers

a. Elimination and prevention measures that remove or reduce the likelihoodof realising a hazards potential for harm.

b. Barriers may be physical (materials, protective devices, segregation, etc.)or non-physical (procedures, inspection, training, drills, etc.)

3.5 COMAH: Control of Major Accident Hazards

3.6 COMAH Report: The Control of Major Accident Hazards Report is a reportcompiled by a major hazard site entity and submitted to ZonesCorp, as part ofthe EHSIA process that demonstrates that the entity has taken all steps

necessary to prevent major accidents and to reduce their consequences.


6/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



3.7 Consequence

The result of an accidental event sequence (fire, explosion, toxic gasdispersion, etc.) that could affect people, the environment, Entitys assets orreputation

3.8 Effect : An adverse impact on people, the environment, Entitys assets orreputation

3.9 EAD: Environmental Agency Abu Dhabi

3.10 EHS: Environment Health & Safety

3.11 EHSIA: Environment Health Safety & Impact Assessment

3.12 EHSMS: EHS Management System3.13 Entity: Facilities within Industrial Sector including Industrial, Commercial,

Residential and Welfare.

3.14 Hazard: The potential to cause harm, including ill health and injury, damageto property, products or the environment; production losses or increasedliabilities.

3.15 HRA: Occupational Health Risk Assessment

3.16 HSE Case: A demonstration of how the Entity HSE objectives are being metin a methodical and auditable reference document. A completed Case will

provide a reference document to all information relevant to the safety, andhealth of the operations personnel, environment and resources on aninstallation.

3.17 HSE Critical Activities

a. Activities that are important in preventing events with potential to causeserious harm to people, the environment, Entitys property and/orreputation and can reduce the impact of such an event.

b. The definition of serious harm includes the critical, severe and catastrophiccategories shown in the Risk Matrix as provided in this document.

3.18 ImpactAny change to the environment whether adverse or beneficial, wholly orpartially resulting from Entitys facilities, activities, products or services.

3.19 Incident: An uncontrolled / unplanned/undesired / uncontrolled event thatresults in undesirable consequences to the personnel (injuries/illness) and / orto the assets (damage/loss) or to the neighbouring community and/or to theenvironment. The term Incident is synonymous with Accident wherever usedin ZonesCorp EHS Management Framework


7/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



3.20 IndustrialSector: Industrial Sector within Abu Dhabi Emirate includes but not

limited to Entities (Industrial Units etc.) in Industrial Cities developed byZonesCorp, Industrial Areas like Mussafah, Mafraq, etc. and WorkersFacilities (Labour Camps) for Industrial Sector

3.21 Major Accident: An Uncontrolled Occurrence which leads to severe orcatastrophic effects to people, the environment, Entitys reputation or assets.Refer to Risk Matrix

3.22 Major Accident Hazard: A hazard that has the potential to result in a MajorAccident

3.23 Manual of Normal Operations (NOM): Defines the limit of safe operationpermitted for a particular asset if risk management measures are reducedand/or removed with the objective of maintaining a tolerable level of risk.

3.24 Manual of Emergency Operations (EOM): Considers combinations ofhazards and hazardous events caused by the need for simultaneousoperation and construction in order to maintain a tolerable level of risk

3.25 Risk: The product of the measure of the likelihood of an occurrence of anundesired event and the potential adverse effects that this event may have onpeople, the environment, Entitys assets or reputation

3.26 Risk Management Measures: A risk management hierarchy to eliminate,prevent and control HSE risks to a acceptable and ALARP level.

3.27 Self-Regulation is a concept designed to enhance protection of humanhealth and the environment by encouraging the regulated community tovoluntarily discover, disclose, correct, and prevent violations of relevant laws.

For the purpose of the EHSMS, self-regulation is defined as: Actionundertaken by entities to develop and implement an Environment, Health andSafety Management System that complies with the laws and policies of theEmirate of Abu Dhabi and international standards

3.28 Shall: The Term shall as used in this document is intended to describemandatory requirements.

3.29 Should: The term should is intended to designate optional or practices whichZonesCorp does not consider mandatory, but does recommend that Entitiesconsciously evaluate any deviation from these recommended practices

3.30 SIMOPS: Simultaneous Operations

3.31 Tenant: The Project Proponent/Lease Holder/Concession Agreement Holder/Owner/Operator of an Entity within the Industrial Sector in Abu Dhabi Emirate

3.32 Top Event: The release of a hazard. The undesired event at the end of thefault tree and at the beginning of the event tree. The centre point in the BowTie Diagram.


8/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



3.33 Threats: A possible cause that will potentially release a hazard and produce

an incident. Examples include damage caused by thermal (high temperature),chemical (corrosion), biological (bacteria), radiation (ultraviolet), kinetic(fatigue), climatic condition (poor visibility), uncertainty (unknowns) or humanfactors (competence).

3.34 Task Risk Assessment (TRA): A process of formal identification,assessment and recording of the risks involved in any particular operation sothat appropriate controls can be introduced. TRA is synonymous with jobsafety analysis (JSA).


9/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



4. EXISTING APPLICABLE LAWS

All Tenants shall ensure that their operations comply with all relevant UAEand Abu Dhabi Environmental, Health and Safety laws and regulations.Environmental, Health and Safety regulations in the UAE are gradually beingimplemented.

This Code of Practice has been developed to ensure compliance to or exceedthe requirements of all relevant legislative statutes and regulations,specifically including but not limited to:

4.1 Federal EHS Laws and Codes including UAE Standards Industrial Safety &

Health Regulations (Emirates Authority for Standardization & Metrology)

4.2 Local Law No. ( ) of 2008 concerning Environment Health & SafetyManagement System in Abu Dhabi Emirate

4.3 Local Law No. 16 of 2005; Article 14 Establishment or Individual is prohibitedto carry out any activity that could adversely affect the lives of human beingsand the safety of the environment before obtaining a license from the Agency.

4.4 Local Law No. 21 of 2005 on the Waste Management in Emirate of Abu Dhabi

4.5 Local Law No. 23 of 2005 and the Executive Regulations Regarding theHealth Insurance Scheme for the Emirate of Abu Dhabi

4.6 Federal Law No. 1 of 2002 Regarding Organisation & Monitoring the Use ofRadiation Resources and Protection

4.7 Federal Law No. 8 of 1980. The Labor Law (as amended 1986)

4.8 Federal Law No. 23 of 1999 Marine Bio-Resources in the UAE

4.9 Federal Law No. 24 of 1999 for the Protection & Development of theEnvironment

4.10 Regulations / Executive Ordersmade under the Federal Environment Law

a. Federal Bylaw; Protection of Air from Pollution (Ministerial Order # 12 of

2006)

b. Federal Bylaw; System for Protected Area

Ministerial Decree No. 37 of 2001 concerning the approval of the ExecutiveOrders for Law No. 24. It includes the following Regulations:

a. Environmental Impact assessment of Projects 2001

b. Assessment of Environmental Effects of Installations 2001

c. Protection of the Marine Environment 2001

d. Handling Hazardous Materials, Hazardous Wastes & Medical Wastes 2001

e. Pesticides, Agricultural Additives and Fertilizers 2001


10/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



4.11 Ministerial Decrees & Decisions:

a. Decree No. 50/2003 Basic Regulating Rules for Ionizing RadiationProtection

b. Decree No. 55/2004 Basic Regulations for Protection against IonizingRadiation.

c. Decree No. 56/2004 Basic Regulations for Safe Transport of RadioactiveMaterials

d. Decree No. 57/2004 Basic Regulations for Radioactive Waste Management

e. Decree No. 214/2004 on Use of Sludge on Land

f. Ministerial Order No.32/1982 on the Determination of Preventative

Methods and Measures for the Protection of Labor from Risks at Work4.12 Abu Dhabi Emirate Environment Protection Policies (EEPPs)

a. Part 1 Air Quality

b. Part 2 Water Quality

c. Part 3 Land Quality

d. Part 4 Noise

e. Part 5 Waste

f. Part 6 Hazardous Substances

g. Part 7 Occupational and Environmental Health & Safety

h. Part 8 Biodiversity and Conservation

4.13 Abu Dhabi Emirate Environment Protection Policies Standards

a. Part 1 Air Quality Standard

b. Part 2 Water Quality Standard

c. Part 3 Land Quality Standard

d. Part 4 Noise Quality Standard

4.14 Abu Dhabi Emirate EHS Management System Codes of Practices

a. Self Regulation

b. Roles & Responsibilities

c. Risk Management

d. Audits & Inspection

e. Emergency Management

f. Monitoring and Reporting

g. Management Reviews

4.15 EAD Regulations on Hazardous Material & Waste Permit

4.16 Industrial Safety and Health Regulations Occupational Health and

Environmental Control SSUAE No. 209 / 1995.


11/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



5. RESPONSIBILITIES

5.1 Competent Authority

The Competent Authority (EAD) in cooperation with the Regulatory Authority(ZonesCorp) shall approve the types of entities (targeted entities) that shoulddevelop & implement an EHSMS in accordance with the Abu Dhabi EmirateEHS Law.

The Competent Authority (EAD) shall set mechanisms for:

Reviewing and approving EHSMS developed by Entities to ensurecompliance with the requirements of the EHSMS at Abu Dhabi Emirate

level.

Auditing the EHSMS implemented by different entities.

The Competent Authority (EAD) shall promote the importance ofimplementing the EHSMS.

The Competent Authority (EAD) shall be responsible for reporting to theExecutive Council the performance of the EHSMS at Abu Dhabi Emirate level.

5.2 Regulatory Authority

Regulatory Authority shall administrate, advise and support the EHSMSFramework of Industrial Sector

The Regulatory Authority (ZonesCorp) in cooperation with the CompetentAuthority (EAD) shall:

Develop Industrial Sector EHS Policy and Establish EHS RegulatoryFramework including Codes of Practice & Guidelines

Identify the types of entities that should develop & implement an EHSMSin accordance with the Abu Dhabi Emirate EHS Law

Review and approve EHSMS developed by entities in compliance to therequirements of the Abu Dhabi Emirate EHSMS.

Audit the EHSMS implemented by different entities. Receive EHS Performance from Industrial Sector Entities

Compile and report EHS Performance of Industrial Sector to theCompetent Authority (EAD)

Promote the importance of implementing the EHSMS

5.3 Entities

5.3.1 Entities shall develop and implement an EHSMS within their areas ofjurisdiction to protect their employees, the community and the environmentfrom any adverse impacts arising from their activities.


12/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



5.3.2 Entities shall provide and maintain a safe environment for workers, avoid any

risk to human health, avoid adverse impact to environment and preventenvironmental pollution.

5.3.3 Entities having an EHSMS are required to audit their System in order toensure conformance with ZonesCorp EHSMS Requirements.

5.3.4 Entities having established an EHSMS are required to demonstrate selfregulation

5.3.5 Entities having an EHSMS are required to submit an annual report to theZonesCorp / EAD on the performance of their System as per the mechanismset by ZonesCorp.

5.4 Employers Duties5.4.1 Employers have the ultimate responsibility to ensure the health and safety of

their employees.

5.4.2 Employers have a general Duty of Care to take all practicable steps to ensurethe safety of their employees while at work, visitors and contractors.

In particular, they are required to take all practicable steps to:

Provide and maintain a Safe Working Environment;

Provide and maintain facilities for the Safety and Health of employees atwork;

Ensure that machinery and equipment are safe;

Ensure that working arrangements are not hazardous to employees; and

Ensure a Safe System of Work comprising at least of Procedure, Training,Communication & Supervision is in place

Ensure procedures are available to deal with emergencies that may arisewhile employees are at work.


13/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



6. EHS RISK ASSESSMENT & MANAGEMENT FRAMEWORK

6.1 The framework for carrying out a detailed Environment, Health and SafetyRisk Assessment & Management involves the following key stages:

a. Hazard Identification;

b. Hazard Assessment;

c. Exposure Assessment; and

d. Risk Characterisation

e. Risk Management (Elimination, Substitution, Control etc.).6.2 This framework provides for a qualitative and/or quantitative estimation of risk,

based on an estimated exposure to a workplace hazard or contaminant (ordose), and the likelihood that this will give rise to an adverse affect (i.e. thedose response).

6.3 The Risk Assessment and Management Framework is explained in Figure 6.1

Figure 6.1: Framework for EHS Risk Assessment and Risk Management


14/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



6.4 Hazard Identification and Risk Assessment involves a series of steps as

described below.Figure 6.2 - Four Steps to HSE Risk Evaluation and Management

IDENTIFY ASSESS MANAGE RECORD

HSE RISK EVALUATION AND MANAGEMENT

IDENTIFY ASSESS MANAGE RECORD

HSE RISK EVALUATION AND MANAGEMENT

1. Identification

Identification of hazards and aspects to People, Environment, Assets andReputation (PEAR), based upon consideration of factors such as the physicaland chemical properties of the fluids being handled, the arrangement ofequipment, operating and maintenance procedures and processing conditions.

2. Assessment

Assessment of the risk arising from the hazards and consideration of itstolerability to personnel, the facility, the environment and the Entity reputation.This normally involves a process of definition of initiating events, identification ofpossible accident sequences, estimation of the probability of occurrence ofaccident sequences and assessment of the consequences/ impact. Theacceptability of the estimated risk must then be judged based upon criteriaappropriate to the particular situation.

3. Management

Effective management of the risks to an acceptable and ALARP level. Thisimplies that where deemed necessary, the risks will need to be eliminated orreduced. This involves identifying opportunities to reduce the likelihood and/orconsequences of an accident.

4. Recording

Recording of HSE risk assessment studies and their findings in terms of the riskmanagement measures utilised to manage HSE risks to an acceptable andALARP level. Recommended method are HSE Case & Hazard & Effect Register


15/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7. RISK ASSESSMENT & MANAGEMENT BASIC APPROACH

7.1 The Risk Management Philosophy as outlined in this document provides anoverview of EHS Risk Assessment & Management requirements as shall beapplied by the Entities

7.2 Section 7 outlines the Risk Assessment & Management Process in detail.

7.3 Appendix 3, 4, 5 and 6 provides description of various Risk AssessmentTechniques, Methodologies and the Guidelines for conducting RiskAssessment

7.4 This document and other relevant Code of Practices as listed in Section 6 of

this document provide detailed methods, techniques and requirements forspecific EHS Risk Assessment categories.

7.5 Entities may develop their own procedures appropriate to their operations/activities provided that the legal requirements stipulated in Law concerningThe Management of Environment, Health and Safety in Abu Dhabi Emirateare met.

7.6 Risk Assessment & Management: The following flowchart shows the stepsinvolved in Risk Management. The Process is explained in further detail in thesubsequent sections.

Establish the contextEstablish the context

Establish the contextIdentity hazards

Establish the contextAssess risk

Establish the contextRisk control

Establis

hthe

context

Co

nsultation

Establish

thecontextReview


16/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7.7 DEFINE THE SCOPE (ESTABLISH THE CONTEXT)

The first step in the risk management process is to define the scope of the riskmanagement activity. The purpose of this step is to establish the parametersof the process including the criteria by which risks will be assessed.Therefore, this step defines the strategic and organizational context in whichthe remainder of the risk management process operates. This includes:

7.1.1 Defining the external and internal stakeholders and their objectives;

7.1.2 Defining the organizational context - this is the context within which the riskmanagement policy is to be implemented, including what each person'sresponsibilities are and what resources are required;

7.1.3 Establishing the risk management context including;

a. Defining the scope of the specific activity whose risks the process isintended to manage;

b. Setting an overall time frame for completion of the process;

c. Identifying the resources required and distributing the responsibilitiesfor conducting the remainder of the process;

d. Developing the risk evaluation criteria - these may be legal, social orfinancial;

e. Planning the structure of the risk management process into logicalelements.

7.8 HAZARDS IDENTIFICATION

7.8.1 EHS Regulations require that hazards are identified in the workplace andthat procedures are in place and are used to identify, assess and controlhazards:

a. Before setting up and using a workplace;

b. When planning work processes;

c. Before installing, commissioning or erecting plant;d. Whenever changes are made to:

The workplace;

The system or method of work;

The plant used;

The chemicals used;

e. Whenever new information regarding work processes becomesavailable.


17/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7.8.2 Hazard Identification consists of three main components listed below and

elaborated in subsequent sub-sections.a. Defining Risk Assessment Objectives;

b. Defining EHS Values to be protected; and

c. Developing the Conceptual Site/Project Model.

7.8.3 DEFINING RISK ASSESSMENT OBJECTIVES

a. Defining the objectives of the risk assessment is one of the mostimportant steps in the risk assessment process, as inappropriateobjectives may lead to important issues being excluded from the

assessment.b. The objectives of a risk assessment must be clearly defined prior to

any work, should be flexible, and may change during the course of theassessment.

c. When defining risk assessment objectives, consideration needs to begiven to:

Why risk assessment is required (project design, EHSIA process,EHSMS development etc);

The stage of the investigation (preliminary or detailed) and

associated limitations and uncertainties; The environmental values which need to be protected;

The health and safety values which need to be protected;

Environment, health and safety context;

The audience (land owner/occupier, regulator/auditor, planningauthorities, public);

Management decisions; and

Issues for which the risk assessment process cannot be of

assistance.d. The objectives of a preliminary assessment may be framed in broad

terms. Issues identified in the Projects Conceptual Planning Phase willhelp target environmental health and safety risks.

e. The objectives of a detailed risk assessment should be more specificand tailored to the issues identified at a site. For example, if thepreliminary risk assessment shows that only human health risk is anissue of concern, then ecological assessment may not be necessary.Likewise, the screening assessment may identify particular chemicalsof concern that the detailed assessment should focus on.


18/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7.8.4 EHS VALUES TO BE PROTECTED

Abu Dhabi Emirate Environment Health & Safety Protection Policies (EEPPs)define the environment, health and safety values, indicators and objectives tobe met, and must be referred to when undertaking a risk assessment.

a. For establishing a Risk Assessment & Management System, It isextremely important to first establish the environment health and safetyvalues that need to be protected for the site or activity.

b. In general, these values will reflect the existing uses of the land and theexisting and realistic future uses of the land surrounding thesite/project.

c. EHS values that are typically relevant for particular projects are listedbelow.

Human Health and Safety

Aesthetics

Ecological

Groundwater and Surface Water

Adjacent Land Values

7.8.5 CONCEPTUAL SITE/PROJECT MODEL

When developing the Conceptual Site/Project Model for hazardidentification, consideration needs to be given to:

a. Whether the hazard has a single or multiple source (e.g. pollutionand/or contamination of drinking water supply from a chemical spill, vs.particulates in the air arising from diesel engines, wood heaters andtobacco smoke);

b. Whether the emissions affects multiple environmental media (e.g.industry emissions contaminating air, soil, water and food);

c. Who will be affected by the hazard (e.g. employees, contractors,visitors);

d. How do stakeholders perceive the problem? Do different groups havedifferent perceptions? (e.g. a stakeholder group comprised of workersat a facility who are also nearby residents may have complexperceptions); and

e. How do the hazards compare to other environmental, health and safetyhazards affecting the community?

Section 8 elaborates Project Risk Management concepts.


19/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7.9 EVALUATE (ANALYZE & ASSESS) HAZARDS & ESTABLISH RISK

7.9.1 The main objectives for carrying out a risk assessment are to ensure thathuman health, assets, and the environment are protected, and that thenecessary resources are allocated in a prioritised and defensible manner toensure that any unacceptable risks identified will be reduced to acceptablelevels.

7.9.2 Where risk assessment identifies the potential for exposure to exceed thedetermined maximum permissible or allowable exposure, then riskmanagement is necessary to reduce the potential risk to human health, theenvironment or environmental values.

7.9.3 Risk assessment formalises the process of identification of the key issuesassociated with operating an industry or undertaking an activity in Abu DhabiEmirate, including the nature of the industry/activity, the potential expectedhazards, data gaps, and the level of uncertainty.

7.9.4 All identified hazards shall be subject to an evaluation for risk potential. Thismeans analyzing the hazard for its probability for a loss event to occur, as wellas the likely consequences of this event. ZonesCorp recommends,progressively, the use of following three risk assessment methods. Refer toTable 8.1 for brief explanation.

a. Qualitative

b. Semi-Quantitative

c. Quantitative

The basis of this process is the Risk Assessment Matrix (refer to Figure 8.1).

7.9.5 A critical element to each level of risk assessment is the development of aConceptual Site/Project Model that describes the pathways by whichexposure from pollution / contaminant / occupational health and safety hazardor incident / accident may occur (section 7.8.5). Refer to Section 8 for detailsabout Project Risk Management.

7.9.6 In general, environmental pollution / contamination is associated with air,noise, water, waste, and land. Occupational health and safety hazards aredetermined by the nature of the site and the work being performed (e.g.chemical exposure, fire and explosion, lack of oxygen, ionizing radiation,biological hazards, safety hazards, electrical hazards, heat stress, coldexposure, noise and ergonomics), they can be broadly classified as physical,chemical and biological hazards

7.9.7 Appendix 3, 4, 5 and 6 provides description of various Risk AssessmentTechniques, Methodologies and the Guidelines for conducting RiskAssessment


20/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



7.10 RISK MANAGEMENT & RECORDING

7.10.1 Risk assessment and management requires a high degree of objectivity andscientific skill.

7.10.2 Risk Management: To manage the Risk, the entity shall:

7.10.3 Identify the Risks associated with the activities of the organisation anddocument in the Hazard & Effect Register (detailed in Section 8); and

7.10.4 Evaluate the level of significance of the risk (e.g. Extreme Risk, High Risk,Moderate Risk and Low Risk basing on qualitative assessment, semi-quantitative or quantitative assessment, where appropriate (detailed inSections 9).

7.10.5 Reduce the Risk at an acceptable and as low as reasonably practicable risklevel via means of prevention, mitigation or recovering, where appropriate(detailed in Section 10 & 11 and Appendix 1 & 2).

7.10.6 It is vital that the operational programs and procedures which are assessedagainst risks are identified and managed. Continuous improvement is the keyto future HSE performance.

7.10.7 The identified risks (plus the associated risk level) shall be documented on anHazard & Effect Register (Appendix 7). The Register shall be reviewed andupdated at regular time intervals.


21/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



8. RISK ASSESSMENT METHODOLOGY

8.1 This section outlines the concepts and approach for Risk Assessmentincluding the Project Risk Assessment (Refer to Section 8.14)

8.2 The objective of a risk assessment is to filter the projects with minoracceptable risks from the projects with major non-acceptable risks. It involvesconsideration of the sources of risk, the consequences and the likelihood thatthose consequences may occur.

8.3 Risk analysis may be undertaken to various degrees of refinement dependingupon the risk information and data available. Analysis techniques include:

a. Qualitative assessment;

b. Semi-quantitative assessment; and

c. Quantitative assessment.

8.4 Appendix 3, 4, 5 and 6 provides description of various Risk AssessmentTechniques, Methodologies and the Guidelines for conducting RiskAssessment

8.5 In practice, a qualitative analysis is often used to first obtain a generalindication of the level of risk and then a more quantitative analysis is appliedto refine the risk.

8.6 A quantitative risk assessment can be undertaken based on statisticalanalysis when the qualitative assessment does not accurately determine thelevel of risk for various consequences and probabilities. In the absence ofstatistical data, an estimate may be made of the degree of the consequenceand frequency.

8.7 The risk assessment methodology provided in this code of practice uses asemi-quantitative process for determining risk. The semi-quantitative processestimates the degree of the consequence and probability and assigns a scoreto each. The score allocated does not have to bear an accurate relationshipto the actual magnitude of consequences or likelihood.

8.8 LEVELS OF RISK ASSESSMENT

8.8.1 Some form of risk assessment will be required for all industry or activities thatare to be licensed by the Environment Agency and/or others.

8.8.2 Depending on the site circumstances and the stage of the investigation, therisk assessment may involve different levels of assessment, ranging from asimple desktop study through to a detailed assessment as part of a formalEHSIA (Environment, Health and Safety Impact Assessment) process.

8.8.3 The goal of the Tiered approach is to use simple conservative assumptions in

preliminary assessments to identify which issues are likely to be most relevant


22/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



with respect to risk, allowing more detailed (site-specific) risk assessment to

focus on these issues.8.8.4 This approach allows resources to be focused on the more critical issues

associated with a site or project in a prioritised and defensible manner toensure that any unacceptable risks will be reduced to an acceptable level.

8.8.5 EHS Risk Assessments should be performed according to a Tiered RiskAssessment framework described in Table 8.1 below.

Table 8.1: Tiered HSE Risk Assessment Methodology

TIER DESCRIPTION

1 Tier 1 Qualitative Risk Assessment

Tier 1 risk assessment is an initial risk assessment process, based on theQualitative Risk Assessment Matrix (RAM) Figure 7.1, normally carried outby the Entity or Contractor(s) staffs who are non specialists. It shall beapplied to all construction & operation related activities using the QualitativeRisk Assessment Technique.

Task Risk Assessment (TRA) must also be carried out for tasks which willrequire a permit or for other HSE critical tasks carried out outside permitareas, e.g., office or workshops etc.

The Tier 1 screening process ensures that requirements for control measuresand HSE Management programmes are identified. These should reduce therisk to low on the RAM. Where risks cannot be reduced to low they shouldbe passed through to a more detailed Tier 2 assessment of risk andevaluation of control measures.

In principle, all events with a major accident hazard potential shall inaccordance with be directly passed to a Tier 2 Quantitative Risk Assessment(QRA).


23/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Table 8.1: Tiered HSE Risk Assessment Methodology

TIER DESCRIPTION

2 Tier 2 Quantitative Risk Assessment (QRA)

Tier 2 risk assessments are all other assessments that are applied to assessthe risk. These could be semi-quantitative (i.e. numerical scoring,engineering calculations, or simple modelling) in order to evaluate in greaterdetail and certainty the key HSE risk issues identified in a Tier 1 riskassessment and to evaluate suitable control procedures and HSEmanagement programmes. When uncertainties exist a reasonable level of

conservatism should be applied.Tier 2 risk assessment also includes the use of QRA techniques that may beapplied to H, S, or E risks.

8.8.6 In practice, a qualitative analysis is often used to first obtain a generalindication of the level of risk and then a more quantitative analysis is appliedto refine the risk.

8.8.7 A quantitative risk assessment can be undertaken based on statisticalanalysis when the qualitative assessment does not accurately determine thelevel of risk for various consequences and probabilities. In the absence of

statistical data, an estimate may be made of the degree of the consequenceand frequency.

8.8.8 The risk assessment methodology provided in this code of practice uses asemi-quantitative process for determining risk.

8.8.9 The semi-quantitative process estimates the degree of the consequence andprobability and assigns a score to each. The score allocated does not haveto bear an accurate relationship to the actual magnitude of consequences orlikelihood.

8.9 HAZARD IDENTIFICATION

8.9.1 A key element in identifyingand managing hazards in the facility (Entity) isa systematic approach to the identification of hazards and the assessment ofthe associated risk in order to provide information to aid decision-making onthe need to introduce risk reduction measures.

8.9.2 Hazard identification is the process of identifying the concerns that the riskassessment needs to address and establishes a context for the riskassessment. Hazard identification comprises four phases:

a. Identification of environment, health and safety hazards anddetermining whether they are hazards amenable to risk assessment;


24/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



b. Putting the hazards into their environment, health and safety context

(classification and prioritising of problems and hazards);c. Identification of potential interactions between agents; and

d. Defining the scope and objectives of the risk assessment.

8.9.3 The hazard identification process should be carried out for each level ofassessment. The level of detail required for the Hazard Identification dependson the level of assessment and the quality of the Issue Identification carriedout for any preceding assessments.

8.9.4 Hazard Identification should be carried out as part of the initial planning stageprior to design and construction, and then revisited as further information

becomes available and the pollution, contamination, and/or human health andsafety issues at the site are better understood. If a detailed risk assessment(Stage 3) is required, the Stage 1 and 2 assessments become inputs for theStage 3 assessment.

8.9.5 Hazard Identification consists of three main components listed below andelaborated in Sections 6 above.

d. Defining Risk Assessment Objectives;

e. Defining EHS Values to be protected; and

f. Developing the Conceptual Site/Project Model.

8.9.6 In general, EHS hazards can be identified from findings on:

a. National / International Legislation, Standards;

b. HSE Audits / Inspections / Walk Through

c. Peer reviews

d. Job Safety and Risk Analyses / Task Risk Assessment

e. Model Reviews

f. P&ID reviews

g. Accident/incident and near miss reportingh. Failures of software and hardware systems

i. Incidents of human error

j. Workplace surveys;

k. Incident analysis;

l. Personal observations;

m. Health & Safety Committee items or discussions;

n. Warning labels or sign (including HAZCHEM placard);

o. Material Safety Data Sheets;


25/117


26/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



8.10 EVALUATE IMPACTS AND CONSEQUENCES8.10.1 In order to conduct an initial project risk assessment for screening, impacts

(actual and potential) and where applicable potential incident events, are to beidentified for each aspect of the project. For example, the risk assessmentshould be completed for both construction and operation, and potentially forindividual elements of the project.

8.10.2 In this semi-quantitative level of analysis, a point score is used which rates theconsequences of the impact for each aspect.

8.10.3 For the discharge or emission of a pollutant, evaluating factors such as thoselisted below should help in the assessment of relative consequence:

a. Persistence;

b. Toxicity;

c. Health effects;

d. Concentration of chemical;

e. Volume discharged per event;

f. Duration of the discharge;

g. Proximity to water-bodies;

h. Potential dilution;

i. The area of land/marine waters affected; and

j. Taking into account secondary consequences and existing mitigationmeasures.

8.10.4 Regarding occupational health and safety, evaluating factors such as thoselisted below will help in the assessment of relative consequence:

a. Health effect (e.g. long / short term effects, fatality, degree of injury /illness, disability);

b. Damage to assets (e.g. plant, premises)

8.10.5 The potential consequences must be judged using all available information,this information may include, but not be limited to:

a. Control measures in place; written systems of work, permit-to-workprocedures for the tasks;

b. Monitoring data from within and outside the organisation;

c. Tasks being carried out, their duration and frequency and locations;

d. Plant, machinery, powered hand tools to be used;


27/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



e. Size, shape, surface character and weight of materials that may be

handled; distance and heights to which materials have to be moved byhand;

f. Service used (e.g. compressed gas), substances used or encounteredduring the work;

g. Parties carried out the tasks (training received); and

h. Legal requirements.

8.10.6 Table8.2provides a consistent method of assessment that can be applied bydifferent personnel and at different times.

8.10.7 For the project screening risk assessment, five levels of severity of

consequences have been used insignificant, minor, moderate, major andcatastrophic. Refer to Table 8.3below. The definitions used to assess relativeconsequences have been adopted from HB 203:2000 as recommended byAbu Dhabi Emirate EHS Management System Framework.

8.11 ESTIMATE PROBABILITY OF OCCURRENCE

8.11.1 The probability of occurrence then needs to be estimated. Table 8.2 belowprovides likelihood ratings with descriptions for estimating the likelihood ofeach occurrence.

8.11.2 Frequency descriptions have been split into Environment plus Health and

Safety for clearer explanation.

8.11.3 The probability of occurrence from any event, mode of occurrence or failuremechanism should be considered.

8.11.4 In addition to evaluating the frequency for normal operating conditions, thefollowing conditions could be considered:

a. Abnormal, start up and shutdown operating conditions;

b. Incidents, accidents and potential emergency situations; and

c. Current activities and planned future activities.


28/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Table 8.2: PROBABILITY OF OCCURRENCE

Descriptor Likely Frequency Probability

Environment Health and Safety

Frequent Continuous or willhappen frequently.

Occurs several times a yearat location.

5

Often 5 12 times per year. Occurs several times a yearin similar industries in UAE.

4

Likely 1 5 times per year. Has occurred at least oncein UAE.

3

Possible Once every 5 years. Has occurred in industry(Worldwide).

2

Rare Less than once everyfive years.

Never encountered inindustry.

1

8.12 RISK ESTIMATION

8.12.1 The level of risk is calculated by multiplying the Consequence Score and

Probability of Occurrence together:Risk = Consequence Score x Probability of Occurrence

8.12.2 The final outcome is in relative point scores, rather than actual risks.

8.12.3 Note that risk estimations should be carried out assuming a well-managedinstallation operating under normal conditions. Risk scores do not reflect thehighest risks under adverse conditions/worst-case scenarios.

8.13 RISK EVALUATION

8.13.1 The relative risk score estimated as defined in Section 8.9 enables definitionbetween those risks that are significant, and those that are of a lesser nature.This allows a better understanding of the least probable events with highconsequence against the highly probable low consequence events. Havingestablished the comparative risk level applicable to individual impacts, it ispossible to rank those risks.

8.13.2 Four risk categories have been used: Extreme, High, Moderate, and Low.

8.13.3 Risk Assessment Matrix (RAM) is given in Figure 8.1. The risk matrix providesa method for initially quantifying risks qualitatively (rated as Low, Moderate,High, or Extreme) and semi-quantitatively (with respect to assets lost figures).It is therefore also used as a screening process so that effort can beconcentrated on the higher levels of risks.


29/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



8.13.4 For higher-level risks acceptance criteria have been established and these

are described in Section.8.13.5 The Risk Matrix (RAM) is color-coded as follows for ease of use:

COLOUR RISK REQUIREMENT

RED Extreme Activity or industry should not proceed in current form

BEIGE HighActivity or industry should be modified to includeremedial planning and action and be subject todetailed EHS Assessment

YELLOW Moderate

Activity or industry can operate subject to management

and / or modification

GREEN Low No action required, unless escalation of risk is possible

a. Green Acceptable Risks

Recognized and need to be managed by procedures or safe systems ofwork and reduced further where possible

b. Yellow & Beige Area of Concern and ALARP

Shall be subject to further semi-quantitative assessment, e.g. bow tie orfailure modes analyses (refer to Appendix 3)

Risks in this area shall be subject to an ALARP demonstration and may bereduced or managed through design and management control (refer toAppendix 1 & 2)

c. Red Unacceptable

Must be subject to a full, quantified risk assessment, probably using aspecialist contractor, specific modelling and calculation techniques andprograms and recognized databases. Refer to Appendix 3

These risks shall preferably be eliminated but if this is not possible will bereduced by design, e.g.: Prevention / Control / Mitigation / EER

(Evacuation, Escape & Rescue)


30/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



FIG 8.1: RISK ASSESSMENT MATRIX (RAM)

Consequence2

Probability2 Insignificant(1)

Minor(2)

Moderate(3)

Major(4)

Catastrophic(5)

Rare (1) 1 2 3 4 5

Possible (2) 2 4 6 8 10

Likely (3) 3 6 9 12 15

Often (4) 4 8 12 16 20

Frequent (5)Almost Certain 5 10 15 20 25

15 25ExtremeRisk1

Activity or industry should not proceed in currentform

8 12 High RiskActivity or industry should be modified to includeremedial planning and action and be subject todetailed EHS Assessment

4 6ModerateRisk

Activity or industry can operate subject tomanagement and / or modification

1 3 Low Risk No action required, unless escalation of risk ispossible

1: Riskis the multiple of Probability & Severity of Consequence

2: Probability: Refer to Table 8.1 above for getting definition of Probability ofOccurrence

3: Consequence: Refer to Table 8.3 for Potential EHS Impact & Potential IncidentConsequence Rating


31/117

CODE OF PRACTICE

EHS RISK MANAGEMENT

Document No ZC-COP-EHS03 Rev. No. 0 Date of Issue

Industrial Sector Environment Health & Safety Regulatory Framework

TABLE 8.3: POTENTIAL EHS IMPACT AND POTENTIAL INCIDENT CONSEQUENCES

Area impacted InsignificantConsequences

MinorConsequences

ModerateConsequences Co

ENVIRONMENT

Land-based ecosystem Insignificantenvironmental impact.Occasional damage byerosion, or of flora andfauna. Some disruptionto flora or faunahabitats.

Minor impacts onfauna/flora andhabitat, but nonegative impacts onecosystem function.Limited damage to aminimal area of landof no significantvalue (i.e. no uniquehabitats).Temporary damage/disruption (


32/117

CODE OF PRACTICE

EHS RISK MANAGEMENT





MinorConsequences


disruption to aquaticflora and fauna.

including flora, faunaand habitat. Nosignificant impact onwater resources.

longer-term impacton aquaticecosystems, and/orshort term impactson water resources.

on p(e.g.shorplantgrou

ecosmod

Atmosphere/waste/other Temporary nuisancefrom noise, odour,dust, other airemissions, greenhousegases, vibration, visualimpact.Minor use of water,fuels and energy andother naturalresources.Results in the

generation ofsignificant quantities ofnon-hazardouswastes.

Minor environmentalimpact due tocontained release ofpollutant (includingodour, dust andnoise), fire orexplosion with nolasting detrimentaleffects. No outsideassistance required.Significant use of

water, fuels andenergy and othernatural resources.

Creation of noise,odour, dust, othercontrolled/uncontrolled airemissions,greenhouse gases,vibration, and visualimpact at significantnuisance levels.Results in thegeneration of

significant quantitiesof hazardous wastes.

MajoenviimpauncoreleaexpldetriOutsrequ

Cultural heritage Minor repairable Minor repairable Moderate damage to Majo


33/117

CODE OF PRACTICE

EHS RISK MANAGEMENT





MinorConsequences


(indigenous andmodern)

damage tocommonplacestructures.

damage tostructures/ items ofcultural significance,or minorinfringements ofcultural values.

structures/ items ofcultural significance,or significantinfringement ofcultural values/sacred locations.

struccultusignmajoof cusacr

HEALTH

Health Effects Insignificant impact onsurroundingcommunities.

Minor complaints orexposure duringplant shutdown ormaintenance.Maximum occurrencelimited to two timesper year

Ongoing complaintsfrom community.Significant emissionor discharge thatimpacts onsurroundingpopulation.

Majotermlikelysurrocomwork

SAFETY

Human Health and

Safety

Near miss incident or

trivial injuries, whichmay require self-administered first aid.Injured personnel cancontinue to performnormal duties.

Injuries requiring on-

site treatment bymedical practitioner.Personnel unable tocontinue to performduties.

Serious injuries

requiring off-sitetreatment by medicalpractitioner orimmediateevacuation tohospital. Potential

Sing


34/117

CODE OF PRACTICE

EHS RISK MANAGEMENT





MinorConsequences


long-term orpermanentlydisabling effects.

Production Loss Incident event withoutcausing productionloss.

Production loss ordelay up to oneweek.

Production loss ordelay of one week toone month.

Proddelamon

Total cost of impacts orincident event

Financial loss(compensation, fines,cost to repair, plantdamage) of less thanAED5,000

Financial loss(compensation, fines,cost to repair, plantdamage) ofAED5,000 -AED50,000.

Financial loss(compensation, fines,cost to repair, plantdamage) ofAED50,000 -AED500,000

Fina(comfinesplanAEDAED


35/117

CODE OF PRACTICE

EHS RISK MANAGEMENT

Document No ZC-COP-EHS03 Date of Issue 21 Sept. 2008


8.14 PROJECT RISK ASSESSMENT

Project Risk Management shall be ensured by conducting EHS ImpactAssessment along with all other applicable Risk Assessments as outlined inAppendix 3 & 4. The implementation of Risk Assessments Findings /Recommendations is the key to achieve the desired Risk Management

8.14.1 CONCEPTUAL SITE/PROJECT MODEL

a. A Conceptual Site/Project Model should be first developed as part of thescreening risk assessment, and then revised and improved as moredetailed information on the contamination becomes available and the

issues and nature of the site are better understood.

b. For exposure to occur, a complete pathway must exist between the sourceof pollution / hazard and the receptor (i.e. the person or ecosystemcomponents potentially affected). Where the exposure pathway isincomplete, there is no exposure and hence no risk via that pathway. Anexposure pathway will typically consist of the following elements:

Source of pollution or contamination / hazard (e.g. a spill; via theoperation of a piece of equipment; the size, shape, surface characterand weight of materials that may be handled; distances and heights towhich materials have to be moved by hand; the service used such as

gas supply);

Release mechanism (e.g. migration in soil, leaching to water, emissionto air);

Retention in the transport medium (e.g. soil, groundwater, surfacewater, air);

Exposure point (e.g. where a person comes in contact with pollution orcontamination; an unsafe act / incident / accident regardingoccupational health and safety may affect employees and even peoplewho may not be in the workplace all the time (e.g. visitors);

Exposure route (e.g. inhalation, ingestion, absorption through the skin).

c. When developing the Conceptual Site/Project Model for hazardidentification, consideration needs to be given to:

Whether the hazard has a single or multiple source (e.g. pollutionand/or contamination of drinking water supply from a chemical spill, vs.particulates in the air arising from diesel engines, wood heaters andtobacco smoke);

Whether the emissions affects multiple environmental media (e.g.industry emissions contaminating air, soil, water and food);


36/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Who will be affected by the hazard (e.g. employees, contractors,

visitors); How do stakeholders perceive the problem? Do different groups have

different perceptions? (e.g. a stakeholder group comprised of workersat a facility who are also nearby residents may have complexperceptions); and

How do the hazards compare to other environmental, health and safetyhazards affecting the community?

8.14.2 ENVIRONMENT HEALTH & SAFETY IMPACT ASSESSMENT (EHSIA)

a. An EHS Impact Assessment (EHSIA) Report is a living document that

considers the full lifecycle of project, facilities and operations. It mustaddress the HSE impacts in each of the life cycle phases i.e. projectconception, design, tender, construction, commissioning, operation,decommissioning, abandonment and site restoration of a project.ZonesCorp Code of Practice on EHSIA (ZC-COP-EHS04) provideguidance about the requirements for conducting EHS Impact Assessment

b. ZonesCorp requires the preparation of EHSIA Reports during theConceptual design and FEED (Front End Engineering & Design).stage.The report should address the potential impacts associated with the facilitythroughout the life cycle (design, construction, commissioning, operation,maintenance and de-commissioning) of the project.

c. The EHSIA Report must present an overview of anticipated HSE Hazards,impacts and associated levels which are based on analysis of relativelybroad HSE information of conceptual technical design and theenvironment in which the project will be located.

d. The report must make recommendations regarding HSE issues that mustbe addressed throughout the life cycle of the project i.e. issues to beincluded in the detailed design and studies/analysis that can only beconducted meaningful during or after detailed design.

e. The EHS Impact Assessment Report must demonstrate that:

All Accident Hazards have been systematically identified and recordedin a Hazard and Effects Register, including Risk Ranking as High,Medium or Low;

All Occupational Health Hazards have been systematically identified,risks assessed and suitable action to mitigate these risks and to protectemployees from these risks have been taken;

Major Accident Hazards (MAH) have been identified, and suitablecontrol, mitigation and recovery measures are proposed and will beimplemented;

The EHSIA Report must demonstrate that Project Proponent canconstruct and operate in line with ZonesCorp / EAD Criteria for Risk


37/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Tolerability and that risks are As Low As Reasonably Practicable

(ALARP); That there is an Implementation Plan that shows how control,

mitigation and recovery measures for MAH will be implemented andmanaged throughout the facility lifecycle;

That all HSE Risk including that resulting from Medium and LowAccident Hazards will be managed by the Projects Environment,Health & Safety Management System (EHSMS);

That Emergency Response Plans (on-site and off-site wherenecessary) in relation to Major Accident Hazard have been or will beprepared based on credible emergency scenarios, with necessary

stakeholder consultation.


38/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



9. RISK MANAGEMENT AND CONTROL

9.1 RISK MANAGEMENT

9.1.1 Risk Management measures should follow this hierarchy:

a. Elimination of the hazard, e.g., adoption of an alternative activity,

b. Prevention of incidents (i.e. reduction of the probability of occurrence)

c. Control of incidents (i.e. limit the extent and duration of a hazardousevent)

d. Mitigation of the effects (i.e. reduce the consequences / effects).

9.1.2 The hierarchy of Risk Management include:

Order No. Control Example

Firstly Eliminate Removing the hazardous piece ofequipment out of service.

Secondly Substitute Replacing a hazardous substance orprocess with a less hazardous one, eg

substituting a hazardous substance witha non-hazardous substance.

Thirdly Isolation Isolating the hazard from the person atrisk, eg using a guard or barrier.

Fourthly Engineering Redesign a process or piece ofequipment to make it less hazardous.

Fifthly Administrative Adopting safe work practices orproviding appropriate training,

instruction or information.

Sixthly Personal ProtectiveEquipment

The use of personal protectiveequipment could include using gloves,glasses, earmuffs, aprons, safetyfootwear, dust masks.

9.1.3 Elimination of the hazard should always be first choice, followed bypreventative measures, such as using inherently safer design or adopting safeoperating procedures. Mitigation of consequences, e.g., by use of appropriatePPE, should always be last choice.


39/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



9.1.4 Measures to recover from incidents should be provided based on risk

assessment and should be developed taking into account possible failures ofthe control and mitigation measures. Based on the findings of the evaluation,detailed health, safety and environmental objectives and managementprogrammes should be set at appropriate levels.

9.1.5 When the risk is categorised, the management shall identify the correctiveaction in order to manage the hazard at an acceptable and as low asreasonably practicable (ALARP) risk level. For hazard with low risk, actionsmay not be required. Refer Fig 9.2.

9.2 RISK CONTROL

9.2.1 Risk control must be achieved using a predetermined hierarchy of controls.The primary aim of risk control is to eliminate the risk, the best way ofachieving this being to remove the hazard. If this is not possible the risk mustbe minimised using one or more of the other control options from thehierarchy.

9.2.2 The risk control measure selected must be the highest possible option in thehierarchy to minimise the risk to the lowest level as reasonably practicable.

9.2.3 In many cases, it will be necessary to use more than one control method.Back-up controls, such as personal protective equipment, should only be usedas a last resort or as a support to other control measures.

9.2.4 While the risk control process concentrates on controlling the highest rankedrisks first, this does not mean that lower priority risks which can be controlledquickly and easily should not be controlled simultaneously. The best availablecontrol measures should be put in place as soon as possible.

9.2.5 In some cases it may be necessary to put temporary controls in place untilsuch time as the proper controls can be instituted. Wherever there is a highrisk and the control measures are not immediately available, temporarycontrols which reduce the risk(s) must be put in place or the activity mustcease until adequate controls are implemented.

9.2.6 During the risk assessment process, the effectiveness of existing controlsshould have been evaluated. The risk control phase must take account of anynecessary changes to existing control measures to ensure that the bestavailable protection is afforded. In doing so, it important to check currentcontrols against the hierarchy of risk controls to determine whether thehighest option on the list is used. Just because controls have been in place forsome time does not mean that they cannot be improved on. As with all stagesof the risk management process, consultation is required to ensure thatmanagement and staff at all levels can make a contribution to theidentification, assessment and control of the risks associated with hazards.

9.2.7 For specific EHS hazards, applicable legislation, codes of practice or

standards will provide the information on what controls are to be implemented.ZonesCorp EHS Documents are referred in Section 10 of this document.


40/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



9.2.8 Controlling hazards are critical to the success of reducing the risk of hazards

in the workplace. Based on the risk assessment, controls will need toimplement to reduce the risk to an acceptable level.

Risk Level Corrective Action Time Frame

Extreme Immediately

High 24 hours

Medium 14 days

Low 28 days

Negligible Not applicable

9.2.9 At least one control method in the corrective action plan is required to beimplemented within the specified time frame to reduce the risk to anacceptable level.

9.2.10 Upon the nature of the hazards, control measures shall be identified andimplemented (applicable to moderate risk, high risk and extreme risk). Thehierarchy of control shall be as follows:

a. Elimination of the hazard (where possible);

b. Substitution (e.g. use a less hazardous substance / environmentallyfriendly materials);

c. Engineering - for plant and equipment (e.g. exhaust ventilation);

d. Procedural (e.g. via improving work methods, housekeeping); and

e. Personal protective equipment (PPE) it is the last resort if the abovemeasures are not practicable.

9.2.11 In the evaluation of which measures shall be taken, consideration shall begiven to reducing risk to a level deemed ALARP. It is a consideration of thelegal requirements, international standard/guideline (e.g. exposure limit for

chemicals), balance amongst organizations HSE policy/objectives, publicawareness and its tolerance, availability of resources, cost and benefits, thestatus of scientific and technical knowledge. It shall be noted that the status ofthe said factors are changed from time to time.

9.2.12 To reduce a risk to an ALARP level (in fact, it is difficult to determine the exactlevel), it involves balancing reduction in risk to a level, objectively assessed,where the trouble, difficulty and cost of further reduction measures becomesunreasonably disproportionate to the additional risk reduction obtained. Todemonstrate ALARP, it requires consideration of different options to ensurethe organization gets best reward over the lifetime of the operation.

9.2.13 When the mitigation / recovering measures are identified, an action plan shallbe formulated addressing roles and responsibilities, training required for the


41/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



relevant parties, time frame for completing the actions, the required changes

for the EHSMS and its associated documents / procedures, the proceduresfor quality assurance, monitoring, maintenance and inspection (whereappropriate). More importantly, the action plan shall be followed up (e.g.progress) to ensure actions are closed per the plan.

9.2.14 Depending upon the magnitude of risks and the potential consequences ofhazards, risk assessment shall be periodically reviewed by competent staff(normally at annual intervals). The review shall verify if the base assumptionshave changed since the original design was implemented or since the riskswere reviewed previously (e.g. change of legal requirements, publicperception, whether the introduction of new technology could reduce theALARP level, whether the performance of the plant/equipment lived up to theexpectation of the original design in terms of accident and equipment uptime).

9.2.15 Safety procedures and risk control measures shall also be reviewed at regulartime intervals to ensure their effectiveness and coping with the change in thematters to which they relate.

9.2.16 Figure 9.1 and 9.2 elaborates concepts of Risk Acceptability, ALARP andHierarchy for Risk Management


42/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Figure 9.1: RISK ACCEPTABILITY

BroadlyAcceptableRegion

The ALARP

region

(risk is undertaken onlyif a benefit is desired)

Intolerableregion

Risk cannot be justified on anygrounds

Tolerable only if risk reduction isimpracticable or if its cost isgrossly disproportionate to theimprovement made

Tolerable if cost of reduction

would exceed the improvementgained

No need for detailed work todemonstrate ALARP

Negligible risk

BroadlyAcceptableRegion

The ALARP

region

(risk is undertaken onlyif a benefit is desired)

Intolerableregion

Risk cannot be justified on anygrounds

Tolerable only if risk reduction isimpracticable or if its cost isgrossly disproportionate to theimprovement made

Tolerable if cost of reduction

would exceed the improvementgained

No need for detailed work todemonstrate ALARP

Negligible risk

Figure 9.2 - Risk Management Hierarchy (UK Health & Safety Executive)

Alarms, guards and shields, fireand blast walls, safety valves,

separation, deluge, control ofrelease energy, secondary

containment, drain systems,

recovery (emergency response,

medivac, fire-fighting, clean-up,reinstatement), PPE, etc.

OVERVIEW

Permanently remove

or replace the hazard

Reduce the likelihoodof the hazard occurring

Reduce the consequenceand effects of the hazard

RISK MANAGEMENT

HIERARCHY

ELIMINATE

PREVENT

CONTROL

Permanently stop activity or

chemical usage, replace

chemical with less harmful

chemical, etc.

Risk assessment, inventory

reduction, design standards,

protective devices, drills, training,asset integrity (risk based

inspection and reliability centredmaintenance), incident

investigation, HSE audit,

competency assurance, etc.

EXAMPLES

Alarms, guards and shields, fireand blast walls, safety valves,

separation, deluge, control ofrelease energy, secondary

containment, drain systems,

recovery (emergency response,

medivac, fire-fighting, clean-up,reinstatement), PPE, etc.

OVERVIEW

Permanently remove




RISK MANAGEMENT

HIERARCHY

ELIMINATE

PREVENT

CONTROL




chemical, etc.







EXAMPLES

Permanently remove




RISK MANAGEMENT

HIERARCHY

ELIMINATE

PREVENT

CONTROL

ELIMINATE

PREVENT

CONTROL




chemical, etc.







EXAMPLES

ALARP


43/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



10. RISK RECORDING

Risk Records are always maintained as the LIVEDocuments.

10.1 Recordkeeping is essential for effective Risk Management through identifyingthe responsibilities, setting target dates tracking the recommendations,implementation follow-up, close-out etc.

10.2 Following are the recommended methods for Risk ManagementRecordkeeping

a. HSE Case

b. HAZOP / HAZID Recommendations & Close-out Sheetsc. Hazard & Effect Register (Appendix 7)

d. HSE Impact Assessment Action Plans

10.3 This section outlines the key requirements for HSE Case and Appendix 7provides guidance for developing the Hazard & Effect Register

10.4 Entities may use any Format for Hazard Management Recordkeepingsatisfying or exceeding the requirements of this document.

10.5 HSE CASE

A demonstration of how the Entity HSE objectives are being met in amethodical and auditable reference document. A completed Case will providea reference document to all information relevant to the safety, and health ofthe operations personnel, environment and resources on an installation

An HSE Case may be described in different ways but it is typically done in 7parts as follows:

10.5.1 Part 1: Management Summary and Introduction

This includes a summary of the Case objectives, the main findings and risks,and a brief introduction to the main document. Sometimes the managementsummary is extracted as an executive document for distribution to senior

managers, leaving Part 1 as the Introduction.10.5.2 Part 2: HSE MS for facility or operation.

A description of those elements of the HSE Management System that aredirectly applicable to the operation or facility.

10.5.3 Part 3: Activities Catalogue

A description of those HSE-critical activities which are applicable to theoperation of facility. This is recorded at a level, which shows that the controlsare in place, and that these are suitable and sufficient for the risks addressed.


44/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



10.5.4 Part 4: Description of Operation or Asset.

A description of the operation or facility, adequate to provide backgroundinformation to the hazards and effects analysis, to enable a clearunderstanding of EHS-critical aspects. This will include, for example,safeguarding systems and emergency response capabilities.

10.5.5 Part 5: Hazard and Effects Register

a. This contains a demonstration that all hazards and effects have beenidentified, and the necessary risk evaluation has been carried out andthat necessary controls to manage the causes and consequences arein place for those risks identified as significant through a process ofranking.

b. Significant environmental effects* will be included if the case is to beused for compliance with ISO-14001, (* For ISO 14001, this will includea description of those 'aspects' which result in environmental effects.)

c. Typically, the controls and procedures in place to manage HSEworkplace hazards, effects and aspects which occur across thecompany are described in one place and referred to from the HSECase. Those responsible on the facility for ensuring that theprocedures are followed are identified in the management system inParts 2 & 3 of the HSE Case.

10.5.6 Part 6: ShortfallsThis summarises any shortfalls identified, with a plan to resolve the findingsand thereby improve the operation.

10.5.7 Part 7: Statement of Fitness

The Statement of Fitness explains that the hazards and effects associatedwith the installation or operation have been evaluated and measures havebeen taken to reduce the risks to ALARP, the lowest level that is reasonablypracticable. The Statement of Fitness must affirm that conditions aresatisfactory to continue the operation.

10.5.8 Detailed guidance on how to prepare HSE or Safety Cases can be found inthe following documents:

a. Shell EP95-0310 Implementing and Documenting an HSE ManagementSystem and HSE Cases (Sept ember 1998)

b. Guidance documents by U.K. Health & Safety Executive


45/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



11. REFERENCES

11.1 Abu Dhabi Emirate EHS Management System Manual

11.2 ZonesCorp Code of Practice on EHS Management System Framework

11.3 ZonesCorp Code of Practice on EHS Compliance Enforcemet

11.4 ZonesCorp Code of Practice on EHS Audits & Inspections

11.5 ZonesCorp Code of Practice on EHS Impact Assessment (EHSIA)

11.6 ZonesCorp Code of Practice on EHS Risk Management

11.7 ZonesCorp Code of Practice on Integrity Assurance & Management

11.8 ZonesCorp Code of Practice on EHS Management of Contractors

11.9 ZonesCorp Code of Practice on EHS Performance Monitoring & Reporting

11.10 ZonesCorp Code of Practice on Waste Management

11.11 Australia/Standards New Zealand HB 203:2000, Environmental Risk

Management Principles and Process 2001, Appendix F and 4360: 1999,Risk Management 1999. For Potential EHS Impact and Potential IncidentConsequences

11.12 Shell EP95-0310 Implementing and Documenting an HSE ManagementSystem and HSE Cases (Sept ember 1998)

11.13 Risk Assessment and other guidance documents by U.K. Health & SafetyExecutive


46/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



Appendix 1

RISK ACCEPTANCE CRITERIA


47/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



RISK ACCEPTANCE CRITERIA

This Appendix is provided for guidance purpose only Entities may use anyinternationally acceptable Risk Acceptance Criteria.

In general, risks are expressed in terms of Individual Risk and Risk to a Group(Societal Risk) (Refer to Figure 1).

1. Societal (or Group) Risk

Societal or group risk measures the overall risk of an Operation to theEntity, the industry or a community. There are several ways of presentingsocietal risk, but the measures most used are Potential Loss of Life (PLL) and

fN Curve. PLL is defined as the long-term average number of fatalities per year due

to a specific cause. The PLL is a measure of the risk to a group of peopleas a whole and does not provide details on whether a particular categoryof personnel is more exposed than others. In measuring the effectivenessof various risks reducing measures, it is most appropriate to compare thePLL values. This approach gives an absolute measure of the benefit (orotherwise) of that particular option against a defined base case.

fN curve graphically depicts the number of fatalities as a function of theestimated frequency that those fatalities occur. The fN curve is cumulative,

i.e. the frequency for N fatalities is the frequency of N or more fatalities.This approach allows to differentiate between High Impact - LowFrequency events and Low Impact - High Frequency, even if the PLL isequivalent.

2. Individual Risk

Two measures are used: Location Specific Individual Risk (LSIR) andIndividual Risk Per Annum (IRPA).

The LSIR measure, expresses the risk exposure to any individual, ifinitially present, in a particular area for one whole year or for the fullduration of the activity. The risk exposure is calculated for all relevanthazards and summed to give the overall risk in particular areas of theplant. In the fatality estimation, the consequences of each outcome froman accidental event are represented by the probability of death for anindividual initially present in a particular area of the platform when theevent occurs.

The IRPA is a person specific individual risk. The Individual Risk PerAnnum takes the amount of time a person actually spends in a particulararea of the operation into account, e.g. 20% of 12-hour shift working in theUtility area. If risk could be measured by a risk meter carried byindividuals, than the risk measured would be the IRPA. IRPA is often used


48/117


49/117


50/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



APPENDIX 2

AS LOW AS REASONABLY PRACTICABLE ALARP


51/117

CODE OF PRACTICE

EHS RISK MANAGEMENT



AS LOW AS REASONABLY PRACTICABLE ALARP

ALARP is an abstract concept, which cann