Upload
stein-bakke
View
323
Download
46
Tags:
Embed Size (px)
DESCRIPTION
hse
Citation preview
1
TIT
OLO
PR
OC
ED
UR
A T
ITO
LO
P
RP
OC
ED
UR
A T
ITO
LO
PR
OC
ED
UR
A
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
REFERENCE MSG:
HSE
Professional Operating Instruction
HSE Risk Management and Reporting
opi sg hse 001 e&p r01
2
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
TITLE:
HSE Risk Management and Reporting
NOTE:
This document replaces the standard Doc. N° 1.3.0.10 “HSE RISK Management and Risk
Reporting”.
Once downloaded from the intranet this document is to be considered as an uncontrolled copy.
DATE OF ISSUE: EFFECTIVE DATE:
October 2013 October 2013
PREPARED BY: CHECKED BY: APPROVED BY:
SICI SICI
SICUR
SGIAQ
SAL/E&P
HSE IMS Management Representative
3
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
1. Objective ....................................................................................................... 4
2. Scope of application ........................................................................................ 5
3. Internal references ......................................................................................... 6
4. External references ......................................................................................... 7
5. Definitions ..................................................................................................... 8
6. Risk Management Process .............................................................................. 13
7. List of Appendices and Attachments ................................................................ 40
Indice
4
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
1. Objective
The primary objective of this document is to provide guidance for definition of risk
management process and risk tolerability criteria, in particular how HSE risks shall
be managed and how they shall be reported at periodical interval to eni e&p
division.
Risk management criteria shall be used only once all legislative prescriptions have
been properly applied. Where specific regulatory requirements exist in a particular
location, the most stringent requirements shall be applied.
In addition to the requirements set in the HSE IMS Directives and Application
Requirements, reference is also made to ISO 17776 “Petroleum and natural gas
industries – Offshore production installations – Guidelines on tools and techniques
for hazard identification and risk assessment”.
1.Objective
5
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
2. Scope of application
This Professional Operating Instruction applies to HSE professional family
pertaining to the eni e&p business area and it has been developed pursuant to the
HSE Management System Guideline.
In addition, each subsidiary shall record and report the risks from its affiliates and
from the joint-ventures where e&p division or subsidiary is the Operator.
2. Scope of application
6
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
3. Internal references
eni spa Code of Ethics available on website Myeni
eni spa Model 231, available on website Myeni.
msg sn eni spa - MSG “Sistema Normativo”
msg hse eni spa -MSG “HSE” and relatives annexes
pro sg hse 001 e&p r01 “Management method for regulatory instruments of
the HSE Integrated Management System of the e&p division.”
3. Internal References
7
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
4. External references
ISO 14001:2004 “Environmental Management System – Requirements with
guidance for use”
OHSAS 18001:2007 “Occupational Health and Safety Management System.
Requirements”
EN ISO 17776: 2000 – "Petroleum and natural gas industries - Offshore
production installations - Guidelines on tools and techniques for hazard
identification and risk assessment "
ISO 31000:2009 – “Risk Management – Principles and Guidelines”
IEC 61508 "Functional safety of electrical / electronic / programmable
electronic safety related system (all parts)
IEC 61511 "Functional safety instrumented systems for the process industry
sector (all parts)
"Task Risk Assessment Guide– A Step Change in Safety" UKOOA, IMCA, IADC,
IAGC OPITO, (August 2000)
E&P Forum QRA Data Sheet Directory 15/10/96
UKOOA – 95
OLF (1999) "OLF recommended method for environmental risk analysis "
OGP Report N° 415 December 2008 “Asset Integrity – thed key to managing
major incident risks”
UK HSE - (1989) "Quantified Risk Assessment an Input to Decision Making" –
ISBN 0 11 885499 2
UK Health and Safety Executive R2P2
NORSOK Standard Z-013 Rev.2 - (2002) "Risk and emergency preparedness
analysis"
4. External References
8
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
5. Definitions
For the purposes of this document, the following definitions apply:
e&p: exploration & production
ALARP: As Low As Reasonably Practicable
BPEO: Best Practicable Environmental Option
FMEA: Failure Mode and Effect Analysis
FTA: Fault Tree Analysis
HAZOP: HAZard and OPerability Analysis
HAZID: HAZard IDentification
IDLH: Immediately Dangerous for Life and Health
IEC: International Engineering Consortium (see http://www.iec.org/)
ISO: International Organization for Standardization (see http://www.iso.org/).
NORSOK: Norwegian Technology Centre standards
OGP: International Association of Oil & Gas Producers (see http://www.ogp.org.uk/)
OLF: Oljeindustriens Landsforening (see http://www.olf.no/)
OHSAS: Occupational Health & Safety Agency (see http://ohsas.org/)
OREDA: Offshore Reliability DAta (see http://www.sintef.org/)
QRA: Quantitative Risk Assessment
UKOOA: UK Offshore Operators Association (see http://www.ukooa.co.uk/)
AEA Safety Report Series 34 - Radiation Protection and the Management of Radioactive
Waste in the Oil and Gas Industry
Shall: Identifies a requirement which is mandatory
Should: Identifies a requirement which is recommended; deviation from this requirement
or different solution shall be justified.
Acceptable Risk / Acceptability: See “Tolerable Risk” (ISO 17776:2000).
5. Definitions
9
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Accident: Undesired event giving rise to death, ill health, injury, damage or other loss
(OHSAS 18002:2000). An alternative simpler definition: unplanned event giving rise to
undesired outcome (death, ill health).
ALARP: (As low As Reasonable Practical) The point at which the effort to introduce further
reduction measures become unreasonably disproportionate to the additional risk reduction
that will be obtained. The concept of ALARP may be qualitative or quantitative and, where
necessary, guidance notes issued by the Authorities for application should be adopted.
Barrier: measure which reduces the probability of realizing a hazards potential for harm
and which reduces its consequence. Barriers may be physical (materials, protective
devices, shields, segregation, etc.) or non-physical (procedures, inspection, training, drills,
etc.) - ISO 17776:2000
BPEO: (Best Practicable Environmental Option)suggested pragmatic approach for the
control of polluting effluents and emissions without penalizing the offending industry.
Based on the concept that the cost of pollution are at least partially offset by the economic
and social benefits of viable ( sustainable ) industry.
Company: An organization part of or connected to eni e&p division such as: Geographic
Unit, Affiliate, Subsidiary or Joint Venture under operational control.
Flash Fire: Combustion of a flammable vapour and air mixture in which flame passes
through that mixture at less than sonic velocity and for relatively short periods of time
(typically less than 3 seconds), such that negligible damaging overpressure is generated.
Hazard: Anything with the potential to cause harm, including ill health or injury, damage
to property, plant, products or the environment; production losses or increased liabilities.
(OGP report 6.36/210, 1994 ‘Guidelines for the development and application of health,
safety and environmental management systems’).
Hazardous event: A hazardous event is synonymous with a hazard.
IDLH: It is airborne contaminant concentration of a given contamination below which an
individual (unprotected by breathing apparatus or respirator) is able to escape without loss
of life or immediate or delayed irreversible health effects or severe eye or respiratory
irritation or other reactions that would hinder escape
Incident: work-related event(s) in which an injury or ill health (regardless of severity) or
fatality occurred or could have occurred (OHSAS 18001:2007). An accident is an incident
which has given rise to injury, ill health or fatality. An incident where no injury, ill health or
5. Definitions
10
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
fatality occurs may also be referred to as a “near miss”. An emergency situation is a
particular type of incident.
LC% hmn - LethalConcentration for Humans: A concentration by which a given percentage of
the exposed population will be fatally injured, following a certain period of exposure.
LFL - Lower Flammability Limit. The lowest concentration of the substance (vapour or gas)
in air that is known to produce a flash of fire when an ignition source is present.
Occupational illness: An occupational illness is any abnormal condition or disorder of an
employee, other than one resulting from an occupational injury, caused by exposure to
environmental factors associated with employment. (Record-keeping Guidelines for
Occupational Injuries and Illnesses, Occupational Safety and Health Act, OSHA, USA,
1986). This includes both acute and chronic illnesses or diseases. They may be caused by
inhalation, absorption, ingestion of or direct contact with the hazard, as well as exposure
to physical, psychological and biological hazards.
Occupational injury: An occupational injury (i.e. not an occupational illness) is caused by
a single incident and has immediate consequences.
Occupational medicine: The speciality concerned with the diagnosis, management and
prevention of diseases due to, or exacerbated by, workplace factors.
Qualitative Risk Assessment: Generic term used for techniques which allow the risk
associated with a particular activity to be estimated in relative terms such as “high” or
“low” (ISO 17776:2000).
Quantitative Risk Assessment: Generic term used for techniques which allow the risk
associated with a particular activity to be estimated in absolute quantitative terms rather
than in relative terms such as “high” or “low” (ISO 17776:2000).
Reliability: the probability that an item will perform a required function under stated
conditions for a stated period of time – IEEE 90. A barrier is highly reliable if:
the probability to fail in operation or on demand (either for equipment or
through human error) is low as per failure records;
it is covered by functional requirements/job specification (performs a
required function);
it is fit-for-purpose/a function of competence as demonstrated by review /
appraisal (performs the function under stated conditions);
5. Definitions
11
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
it is properly maintained / tested (physical test or via drill/exercise) in view
of its expected working life / working cycle (performs the function for a
stated period of time);
Where 1 or 2 of the above applicable features are missing, the level of control is
considered to be Medium. Where 3 or 4 controls are missing or where they are unknown,
the level of control is considered to be Low.
Risk: Combination of the likelihood of an occurrence of a hazardous event or exposure(s)
and the severity of injury or ill health that can be caused by the event or exposure(s)
(OHSAS 18001:2007).
Risk Analysis: Use of available information to identify hazards and to estimate risks (ISO
17776:2000). ( there is not a universally accepted distinction between risk analysis and
risk assessment).
Risk Assessment:
1. Overall process of risk analysis and risk evaluation (ISO 17776:2000);
2. The whole process of risk analysis and the evaluation of the results of the risk
analysis against technological and/or economic, social and political criteria (OGP report
11.1/98, 1984 ‘Applications and limitations of risk assessment in offshore exploration
and production’).
Risk Evaluation: Judgment, on the basis of risk analysis, of whether a risk is tolerable
(ISO 17776:2000).
Risk Register: Document proving a brief, but complete, overview of the identified
hazards, the relevant screening criteria and the measures necessary to manage them. Screening Criteria: Targets or standards used to judge the tolerability of an identified
hazard or effect (ISO 17776:2000). For the purpose of this document, they have been
developed by eni e&p division and are intended for use where not provided by regulators.
Societal Risk: The risks to society arising from operations; the term “society” in this
context include communities, residential areas and, in general, the “public
domain” which is not connected with those operations (the Canvey Study – HSE, 1978).
5. Definitions
12
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
TLV – Threshold Limit Value The time-weighted average concentration for a conventional
8-hour workday and a 40-hour workweek, to which it is believed that nearly all workers
may be repeatedly exposed, day after day, without adverse effect (TLV-TWA) (ACGIH).
Tolerable Risk / Tolerability: Risk which is accepted under definition of a tolerable
threshold, based upon the current state of science and technology and the general values
of society (ISO 17776:2000).
5. Definitions
13
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
6. Risk Management Process
Management of HSE risks is an integral part of the management of the business
and requires the total concerted effort of the organization, focused on the
objective of protecting people, the environment, assets, the business and earnings
from potential losses. The risk management criteria must be applied as part of a
broader risk management process within the organization.
In particular this document provides guidance for definition of risk management
process and risk tolerability criteria referred to:
People – the health protection and promotion and safety of people involved
in eni e&p division operations and activities or of other people who could be
affected by them
Critical Equipment Protecting Personnel - damage to or loss of
equipment and facilities playing a vital role in protecting personnel from
hazardous events
Environment – damage to the environment deriving from operational
activities or from incidents
Assets and Operations – damage to the Company’s assets and/or impacts
on projects and/or production losses
Reputation – damage to the business or to the ‘License to Operate’ or to
the overall value of the Company deriving from HSE risks; it includes, inter
alia, the image
Social context – damage to external stakeholders (international actors and
local communities mainly)
It is important to remember that most activities which carry some degree of risk
entail risk to more than one of the above areas. It is vital that all possible effects
of a hazard are considered together. For example an activity entailing risk to
company profits must not be considered in isolation to its effect on the HSE. It is
difficult to determine a hierarchy of importance in the risk effect areas mentioned
above, but by common consent the effect of a hazard on persons, including HSE
effects, carries most weight and the effect on assets and profits least weight.
The application of risk tolerability criteria as a management tool requires specifics
skills and expertise.
6. Risk Management Process
14
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Areas of Risks FULL QUALITATIVE APPROACH
Risk is a function of the likelihood of an event and the severity of its consequences.
The risk from a particular event is the HSE risk associated with a specific, discrete
scenario (such as helicopter crash, transport accident, oil spill, etc.) in terms of
effects on people, environment, assets and reputation and is usually assessed
qualitatively (see Appendix B1).
All the risks coming from external factors (e.g. geo political conditions, political
instability, earthquake, presence of closely plant/installation) shall be taken into
account in the this process. A specific application of the Full Qualitative Approach is
the assessment of personnel Risk. This is a non-specific term covering the risk of
injury, diseases or fatality to personnel from named tasks, or from routine or special
operations (occupational risk : see Appendix B2).
SEMI- QUANTITATIVE APPROACH
Risks to People (Health and Safety)
Hazardous activities may result in injury, fatality or diseases both to those personnel
engaged in work associated with the activity or to community. Risks to people may
be divided into:
a) Individual Risk - the total risk of death in a fixed time period (most often one
year) to which a worker or a member of the community may be exposed from all
credible hazards and sources of accidents (see Appendix B3).
b) Societal Risk- the risks to society arising from operations; the term “society”
in this context include communities, residential areas and, in general, the “public
domain” which is not associated to those operations ( see Appendix B4).
Environmental Risk
The Environmental Risk is the risk to the environment from different activities that
fall under the responsibility of the Company. As a consequence, environmental risk
management should take account of the exposure of the environmental resources
to a variety of activities which constitute, as a whole, the sustainable development of
the Company itself ( see Appendix B5).
6. Risk Management Process
15
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Asset Risk
The Asset Risk considers the probability of damage to Company’s physical assets,
impacts on projects (failure to meet project objectives) and operations in terms of
production loss, deferred production and costs of replacement of damaged
structures and equipment due to any incidents (see Appendix B6).
Reputation Risk
Reputation risk is the risk to the reputation of a Company as perceived by society
at large, or sometimes more specifically its “peers” (other oil companies), its
employees, its shareholders, the government or financial institutions.
The reputation of the Company is linked and can be affected by HSE incidents or
accidents of all types. Reputation consists of a combination of the characteristics,
performance and behaviour of a Company and importantly for risk management,
the perception of the Company. Although reputation can be considered as an
‘intangible’ asset, it is important because it can affect the ability of the Company
to establish or maintain business at all stages of the development cycle. Therefore,
actual or perceived HSE impacts can damage the reputation/the business of the
Company and in turn tangible Company assets ( see Appendix B7).
Risk Management Process
The Risk Management Process (see Figure 1) is a continuous, iterative process,
which typically consists of five major steps:
1. Establishing the context:
identification of internal and external factors that it is necessary to consider
in the risk management process. These shall include:
factors inside the organization such as corporate risk management
standard, internal organization and delegation of responsibilities and
internal capabilities of the persons who operate, maintain and
manage activities at the facilities.
factors outside the organization such as applicable legislations, codes
and standards and key stakeholders such as partners, regulators,
local communities, NGO, major contractors and suppliers;
6. Risk Management Process
16
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
2. Communication and consultation:
identification and management of any affected interested parties, key figures
within and outside the Company shall be identified to ensure their
consultation and involvement in the risk assessment process.
3. Risk assessment:
it includes the following sub-steps:
a) Risk Identification: Identification and definition of potential hazards
and their potential effects:
b) Risk Analysis: Evaluation of the risk arising from identified hazards
in terms of evaluation of the likelihood / probability / frequency of
occurrence of accident sequences, evaluation of severity of the
consequences and analysis of the preventive and recovery barriers
in place.
Such information can be retrieved from various sources, including:
internal knowledge and experience of line / project / department
managers and HSE experts;
industry frequency and failure rate databases and co-operative
research programmes;
relevant international, national and eni e&p Division standards
and codes of practice;
industry and trade association codes of practice and other
guidance.
The risk analysis is aimed at determining the number of barriers in place and
evaluating their reliability considering all factors that can affect its performance in
terms of functionality, availability, reliability and survivability (e.g. design
specifications, inspections, functional testing and maintenance requirements as well
as operational procedures, operator training and competence, management of
change).
6. Risk Management Process
17
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
c) Risk Evaluation: Assessment of tolerability of risk to people,
environment, assets and reputation by comparing risk level with
the relevant tolerability criteria
4. Risk treatment:
Identification of effective risk reduction measures needed to reduce the likelihood /
probability / frequency (prevention) and/or to control incidents (limiting the extent
and duration of a hazardous event) or to mitigate the consequence of an accident
(control and mitigation).
5. Monitoring and review:
Monitoring and review of the entire process to ensure it continues to be effective
and to verify whether the barriers continue to be effective. In particular, this
review is necessary every time a significant change occurs in the installation
which has the potential to affect its integrity.
18
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Figure 1 – Risk Management Process
Risk Identification and Analysis
A systematic approach to the identification of hazards and the evaluation of risk is
a key element of effective HSE management, providing information to support
decision-making on risk-reduction measures.
For new installations or activities hazards shall be identified as early as possible, in
order that sufficient time can be given to the most appropriate way to manage
them. It is always easier to make modifications early in the design stage of a
project, when changes can be made with minimal effect on cost and schedule.
6. Risk Management Process
19
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Risk analysis and risk assessment shall also be applied to existing facilities, but in
some cases changes that would be justified during design may not be practicable
for an existing facility. As an example, improvements in layout may not be
practicable for existing facilities. Also the work necessary in undertaking
modifications to an existing facility itself introduces an additional risk of accident.
Should such a situation occur, managerial and operational criteria (such as de-
manning) may be adopted instead of technical provisions.
Risk Identification
Risk identification includes:
A broad review of possible hazards and sources of accidents, with particular
emphasis on ensuring that relevant hazards are not overlooked.
A rough classification into critical hazards (as opposed to non- critical) for
subsequent analysis
Explicit statement of the criteria used in the screening of the hazards
Explicit documentation of the evaluation made for the classification of the
non-critical hazards.
Hazards can be identified and assessed in different ways using one of the
following tools and techniques:
- Experience from previous analyses, safety inspections and audits,
useful when the activity under consideration is similar to activities
undertaken previously in other locations. The approach is not suitable
when dealing with innovative systems or where local conditions
invalidate previous experiences
- Use of checklists and accident statistics. Checklists are normally
drawn up from standards and operational experience and ensure
that known hazards have all been identified and assessed. They are
easy to apply and can be used at any phase in the project life cycle.
Examples of Hazard checklists are provided in ISO 17776 (Ref.1)
- Codes and standards that reflect collective knowledge and experience,
accumulated on the basis of Company, national or international
6. Risk Management Process
20
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
operations. These documents incorporate the lessons learned from
previous design, from hazard and risk assessment and from accident
and incident investigation. The compliance with prescriptive
standards ensures the reduction of risks to a tolerable level.
The use of checklists based on requirements laid out in codes and
standards is an effective technique in identifying compliance with
standard practice and highlighting aspects which require further
investigations.
- Structured review techniques (HAZID, HAZOP), used to identify and
evaluate known and unforeseen hazards and unintended events that
are not adequately addressed by the previous methods.
More details about these techniques can be found in ISO 17776.
The selection of the appropriate hazard identification and risk evaluation tools and
techniques depends upon the nature and scale of the installation, the information
available, the phase of the project and experience of similar installations.
Risk Analysis
Frequency Evaluation
Frequency information may be obtained from
Experience
Company data and source including accident and incident data
Published data sources such as WOAD and OREDA.
Where data does not exist, it may be possible to derive it from more fundamental
data using the following methods:
- Fault Tree Analysis (FTA)
- Failure Mode and Effect Analysis (FMEA)
6. Risk Management Process
21
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
These are expected to provide estimates that may not be homogeneous with those
coming from experience, therefore, where possible, estimated frequency data for
initiating events should include an allowance for human and/or operational factors.
Frequency is usually expressed in occurrences per year.
Consequence Evaluation
Consequence analysis includes consequence modelling, for example estimation of
accidental loads, such as intensity of fires, modelling of escalation and estimation
of response to accidental loads.
Consequence analysis can be applied to assess HSE aspects for a range of
consequence scenarios and involves the use of predictive models. Consequence
scenarios may be developed in simple narrative form, using multiple branch event
trees and utilising more or less complex computerised modelling techniques.
Since the majority of models provides only an approximation of what might
happen, models should only be used when they are validated in a particular
application and their predictive capability is generally accepted.
Successful application requires use by personnel with adequate training and
experience.
As far as possible, consequence analysis should also assess the contribution to
failure from human and organisational factors, together with the contribution from
such failures to dependent failures (escalation).
The following analysis methods may be used for the escalation analysis:
Event Tree Analysis (ETA)
Simulation/ probabilistic analysis
More details about these techniques can be found in ISO 17776.
6. Risk Management Process
22
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Risk Evaluation
Measurement of risk is the preliminary phase of assessing its acceptability
(“tolerability”). It is necessary to compare risk figures with
acceptability/tolerability thresholds in order to determine whether the risk is fully
acceptable, completely intolerable or somewhere in between.
Measurement of Risk
In order to interpret risk to people, reputation etc. some means of measurement
of risk is required. Since risk is in its simplest terms consequences times frequency,
obvious types of measure may be:
Fatalities / occupational illness per year ( risk to people)
Spills per transfer operation (risk to the environment)
Financial losses per year (asset losses)
Apart from financial loss which is relatively easy to measure in risk terms, all other
areas present problems. Environmental risk is particularly difficult to define except
in terms of specific items such as spills as detailed above. Some of the problems
with the measurement of environmental risk are described below:
- Some environmental discharges are continuous but have indeterminate
effects
- Some environmental hazards are short term in duration but have long term
effects changing over time
- Some environmental hazards may have quite different effects on, for
example, air quality, water quality and ecology, making a global measure of
environmental risk difficult to define.
These problems make the use of matrices discussed later, particularly helpful for
environmental risk measurement. In assessing environmental risk one should pay
attention to separate risks from impacts. Risks refers to acute phenomena,
impacts normally refers to chronic effects ( that may be negative but also
positive).
6. Risk Management Process
23
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
In this view, a continuous environmental discharge constitutes a risk only if it is
limited in time ( contingency) or due to an upset condition.
Risk to reputation is also very difficult to measure, as reputation is an intangible
concept. The normal approach is to define the effect of a reputation hazard in
terms of significance to the news media and to assess its impact geographically
(e.g. very local, national or international). Given the difficulty of expressing this in
quantitative terms, a qualitative approach is always used in this area.
Risk to people can be measured in various ways according to the types of
individuals at risk and their exposure. A discussion of the ways of measuring risk
to people is given in Annex A.
All estimates of risk for people are based on either qualitative or quantitative
approaches.
Risk Matrix and criteria
Risk matrix is a tool, inspired to the ISO standard 17776, which shall be used as a
background for setting risk tolerability criteria. When used as a qualitative matrix,
it considers events that have been experienced by the Company or the Company
may expect in case of deterioration of such events.
In case Company history/experience is considered not consolidated (in terms of
No. of plants / operations), reference shall be made to e&p industry in the same
geographical area.
The risk matrices are reported in Appendix B.
The matrix axes, consistent with the definition of risk, are Consequences and
Likelihood / Probability or Frequency.
The vertical axis represents the measure of the potential consequences of credible
scenarios. A scale of consequences from ‘1’ to ‘5’ is used to indicate increasing
severity. The potential consequences of credible scenarios are considered as
6. Risk Management Process
24
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
consequences that could have resulted from the released hazard if circumstances
had been less favorable.
The horizontal axis represents the measure of likelihood / probability / frequency
of the occurrence of a hazardous event. Such a scale is defined in general terms
from ‘0’ to ‘E’ on the basis of historical evidence or experience that such
consequences have materialised within e&p industry or the Company.
The risk matrices are separated in four regions that identify the limit of risk
tolerability; such regions are:
1. Continuous improvement( Low tolerable risk area): The level of risk is
that requires continuous monitoring to prevent deterioration.
2. Risk reduction measure (Medium tolerable area ): The level of risks
that requires generic control measures.
3. Risk reduction measure (Medium–High; criticality area): The level of
risk shall be mandatorily reduced applying suitable corrective measures,
provided that is demonstrated that the implementation of such measures is
not disproportionate to the benefits (ALARP). A discussion of ALARP and
cost-benefits analysis is given in Annex C. For operating fields the risks could
be recovered in a maximum 4Y period.
4. High risk( criticality risk area): The level of risk is not acceptable and risk
control measures are required to move the risk figure to the previous
regions. For operating fields the risks could be recovered in a maximum 1Y
provided that interim Operational Measures are adopted.
Depending on the position of the intersection of a column with a row in the risk
matrix, it is possible to classify the risk.
For the same scenario (grouping all hazardous events which have the same
severity of consequences), a resulting likelihood / probability / frequency is
assigned or calculated, such that the risk can be classified. The classification is
6. Risk Management Process
25
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
repeated for all the risk areas (People, Environment, Assets and Reputation). The
overall risk of a hazard is classified according to which among consequences has
the highest rating.
Risk Screening Matrix
The Risk Screening Matrix is reported in Aooendix B1 and provides definition of
consequences and a range of qualitative criteria to estimate likelihood / probability
or frequency. This shall be used in the identification of high level HSE Risk during
risk screening (Major Hazard Analysis, Environmental Impact Assessment, etc.).
This matrix provides the basis to identify significant risks or areas of risk (for
example, transportation risk) and prioritise further assessment and management
efforts.
Risk screening matrices are suitable to be linked with other means of assessing
tolerability, especially when assessing human risk in high hazard scenarios, usually
connected with safety accidents. Risk Acceptability for these scenarios is discussed
in Appendix A.
Should the qualitative risk figure be intolerable, either a quantitative risk analysis
(QRA) or the adoption of fit-for-purpose and more effective risk-reduction
measures shall be required.
Personnel Risk (Task)
When considering Occupational Health and Safety Risk Assessment related to
specific tasks, a qualitative approach is preferred, since it is usually based on past
experience.
The Personnel (Task) Risk Assessment Matrix is based on the document “Task Risk
Assessment Guide - A step change in safety” and is reported in Appendix B2.
6. Risk Management Process
26
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
The occupational health risk (occupational illness or injury) is usually based on
“exposure” to hazardous agents (physical, chemical, etc.); this is covered by
specific Minimum Health Standards.
Risk to People (e&p operation)
Risk to People induced by e&p operations can be assessed both qualitatively and
quantitatively.
When performing Quantitative Risk Assessment (QRA) as a forecast of possible,
future events, fatalities have to be considered with care, avoiding a deterministic
approach; in this context, for example, to evaluate the risk of fatality, it is
necessary to consider not only the frequency (or probability) of the accidental load
(in terms of radiation from a fire, overpressure from an explosion, toxicity from a
toxic release etc.) but also the vulnerability of humans to this load.
The Risk to People (e&p operations) Assessment Matrix is reported in Appendix B3.
Societal Risk
The Societal Risk matrix to asses risk to society arising from e&p operations is
reported in Appendix B4.
Environmental Risk
The environmental risk matrix has been derived from a document prepared by the
OLF’s environmental committee for oil spill to sea and has been extended to
onshore activities too; it is reported in Appendix B5. This matrix essentially
provides an expansion of the definitions of environmental consequences included
in the Event Screening matrix.
As far as consequences are concerned, a list of options is shown; they are
intended not to be used contemporarily; for example, in sensitive areas, the
option based on amount of spilled oil is not suitable, and is preferable to adopt
options related to protection of fauna and flora.
6. Risk Management Process
27
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Asset Risk
The asset risk matrix is reported in Appendix B6. Even in this case, different
options are shown to describe consequences, based on times and costs for repair.
As far as probability / frequency is concerned, both quantitative and qualitative
criteria are shown, where the latter is based on reliability of technical / operational
protection systems, such as temporary refuges, control systems etc. The reliability
is expressed in terms of minimum number of failures needed for the hazard to be
realized (higher the number of failures, higher the number of barriers against the
hazardous event).
Reputation Risk
Reputation is essentially an intangible asset. However, HSE risks can have a
significant impact on reputation with serious consequences to the Company. It is
therefore advisable that the reputation aspect of any risk is properly evaluated
against the criteria in Appendix B7.
Risk Treatment
For any given risk there are four basic management approaches:
1. Take/Accept: the risk is tolerated in its basic state with no active controls
being applied;
2. Terminate: the factors which create the risk are eliminated (e.g.
replacement of dangerous chemicals)
3. Treat/Manage: apply controls in the form of hardware, software,
procedures with the effect of reducing the frequency or consequences of the
event
4. Transfer: Insure (only in case of risk for assets).
Risks are generally classified according to the controls that either are put in place
or must be implemented to reduce/control the risk.
6. Risk Management Process
28
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
The risk reduction measures should be identified through a Quantitative Risk
Assessment (QRA) based on the following steps:
1) Identify hazardous events, considering techniques such as Event Trees;
2) Consider the accidental loads (e.g. radiation from fires) and, hence, the
damage/harm deriving from the hazardous event to: an employee, a man of
the public (risk to people), a plant section (asset risk) etc;
3) Sum up frequencies of all hazardous events of the same nature (all gas
releases, all fires, all explosions etc.) with same consequences (harm to an
employee, a man of the public, a group of people, an area with a given
occupancy);
4) Enter the suitable risk matrix and verify tolerability;
5) If unacceptable, assess what controls are viable;
6) Determine if the risk, which is residual after controls, will be manageable;
7) If still unacceptable, consider further mitigating factors (reduction of % of
manning, chance of sheltered escape, favorable wind directions, extra
controls etc.) to re-conduct the event in the acceptable area;
8) If still unacceptable, consider the “zero option” (“terminate” the risk).
Identification, Development and Implementation of Controls
Risk reduction measures include preventative measures (reduction of likelihood /
probability / frequency) and mitigating measures (reduction of severity of
consequences). Mitigation measures include steps to prevent escalation of
developing abnormal situations and to lessen adverse effects on Health, Safety
and the Environment.
Risk reduction measures also include recovery preparedness measures, which
address emergency procedures as well as restoration and Company procedures to
recover.
In identifying control measures, consideration should be given to:
The activity
6. Risk Management Process
29
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
The people involved
What tools, equipment and materials are to be used
The working environment
The remedial measures needed to control each of the high risks should be based
on good safe working practice in order to reduce the residual risks to a level which
is practicable. If the identified remedial measures are not suitable to move into
the HIGH- MEDIUM Region, a detailed QRA , when applicable, shall be performed
in order to substantiate the final risk level.
The “hierarchy” principle shall be adopted, with the following priority list:
1) Avoid the risk
2) Replace hazardous devices/operations with less hazardous ones
3) Prefer collective safety measures to individual ones
4) Adopt alternative design/operations
5) Increase No./effectiveness of controls, supported by the best available
practices (HSE MSG) and technologies.
The process stops when efforts to introduce further reduction measures become
unreasonably disproportionate to the additional risk reduction that will be obtained.
An approach widely used is to evaluate the effort and cost involved in a number of
different risk-reducing measures and to estimate the risk-reducing effect of each.
By evaluating the cost or effort necessary to arrive at a common level of risk
reduction it is often possible to identify those measures which are clearly more
effective in risk reduction.
In case of asset risk, the following formula can be adopted for comparison:
(probability of the hazard) x (costs if it realizes) = expected cost from the risk
Evaluation of risk-reducing measures should always be based on sound
engineering principles and common sense. The following aspects should also be
6. Risk Management Process
30
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
observed: local conditions and circumstances, the state of scientific and technical
knowledge relating to the particular situation, and the estimated costs and
benefits. See Appendix C for further information on Costs-Benefits analyses.
It must be clear in any case that no level of risk of fatality for anyone person is
acceptable.
Risk Register
From the risk assessment process, each Company shall develop a Risk Register
which detail the main areas HSE risk associated with activities in all operating
unit/project (exploration/development/operation), including normal and temporary
activities (e.g. operation plant, warehouse, marine base, headquarter, guesthouse,
drilling activity, seismic).
The Risk Register shall record the most significant hazards (together with their
consequences and probability of occurrence) which, if realized, have the potential
to adversely affect the Company with consequential negative impacts on its HSE
performance and reputation.
The Risk Register should demonstrate that:
all hazards, effects and threats have been identified
the likelihood / probability / frequency and consequences of a hazardous
event have been assessed
controls to manage potential causes (threatened barriers) are in place
recovery preparedness measures to mitigate potential consequences have
been taken.
The Risk Register is a live document and it shall be updated at minimum
one per year and whenever change on process/project is highlighted.
The Risk Register format is free and can be replaced by the tool requested by local
legislation ( i.e DUVRI) but, as minimum, it shall contain the information that
6. Risk Management Process
31
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
need to be reported to the HQ. It is up to the reporting Company ( Geographic
Unit or GU) to use the Risk Report as a Risk Register template for internal usage.
Risk Reporting
The Risk Report is a tool that allows Company and eni e&p Division to be aware of
the main HSE risks associated with their operations and be informed about
progress in reduction of those risks classified as medium, high-medium, and high.
A copy of the Risk Report shall be sent to the eni e&p division SEQ/SICI
Department , by end of June each year.
An Action Plan related to the high risks, identified through the Risk Management
Process, shall be send to eni e&p division SEQ/SICI Dept within one month from
their identification.
A template for Risk Report is reported in Appendix D.
Four Areas of Risk have been identified. Risks associated to each area shall be
addressed, where applicable (see Table 1, 2, 3).
Other risk areas and categories may be added to the list depending on specific
local conditions.
6. Risk Management Process
32
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Table 1 – Risk Areas and Categories- social aspects and environment
RISK AREAS RISK CATEGORY
Soci
al A
spec
ts
1.1 Communities & Security
1.1.1 Hostile communities/media
1.1.2 Damage to cultural heritages
1.1.3 Terrorist Activity/Sabotage/Bunkering
1.1.4 Internal & external security threats
1.2 Workforce / Ethics
1.2.1 Stress/shift induced risk
1.2.2. Turnover risk
1.2.3. Inadequate level of indigenous training (local workforce/contractors)
1.2.4. Communication barriers
Envi
ronm
ent
2.1. Emissions
2.1.1 Continuous discharges to air (air quality requirements)
2.1.2 Emergency/Upset discharges (GHG emissions requirements)
2.2. Spills
2.2.1 Underground contamination
2.2.2 Surface contamination
2.2.3 Transportation by sea/land/internal water (including loading and unloading activities)
2.3. Wastes
2.3.1 Pollution from operational wastes
2.3.2 Pollution from domestic wastes
2.3.3 Pollution from sanitary wastes
2.3.4 Pollution from radioactive waste (TENORM or radioactive sources)
2.4. Production Water
2.4.1 Continuous discharge to water (legislative requirements, drainage systems, oil/water separation)
2.4.2 Continuous discharge to soil
2.5. Facility impact
2.5.1 Impacted area (footprint)
2.5.2 Pipeline routing impact
2.5.3 Previous land use
2.5.4 Vulnerable fauna and flora
2.5.5 Visual impact
2.6. Biodiversity 2.6.1 Reduction of indigenous biodiversity
2.7. Subsidence
2.7.1 Ground structure
2.7.2 Foundations
2.7.3 Reservoir depletion
6. Risk Management Process
33
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Table 2 – Risk Areas and Categories- safety
RISK AREAS RISK CATEGORY
Saf
ety
3.1. Process Safety
3.1.1 Loss of Primary Containment (lack of process control, erosion/corrosion, process stress)
3.1.2 Manning inconsistent with design and operations philosophy
3.1.3 Risk of stored flammables
3.1.4 Risk of ignition (fire, explosion, flash-fire)
3.1.5 Risk from layout (lack of containment, module proximity, unfavourable wind directions, wrong escape routes and mustering)
3.1.6 Blowout risk
3.1.7 Risk of inhibits/overrides of safety critical elements
3.2 Operations Safety
3.2.1 Air transportation and communication risk
3.2.2 Land transportation and communication risk
3.2.3 Marine/Internal waters transportation and communication risk (e.g. anchor handling activities + towing)
3.2.4 Heavy lifting
3.2.5 Maintenance hazards (access, override, bypasses, etc.)
3.2.6 Risk of substandard Contractors/ Subcontractors (contractual clauses and conditions, training and competency)
3.2.7 Concurrent/Simultaneous Operations
3.2.8 Construction, Commissioning, Start-up and Shutdown risks
3.2.9 Drilling operations risks
3.3 Emergency Response
3.3.1 Lack of emergency preparedness (firefighting, spill clean-up, security support, evacuation)
3.3.2 Lack of communication for emergency planning
3.4. Office Safety 3.4.1 Office-related risks
6. Risk Management Process
34
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
RISK AREAS RISK CATEGORY
Hea
lth
4.1. Work Environment
4.1.1 Chemical agent (including carcinogenics, toxics, hazardous sustances, asphyxiation agents)
4.1.2 Physical agent (noise, Vibration, barometric, Thermal, electricity, Electromagnetic Field, Optical Radiation, Ionizing Radiation, TENORM)
4.1.3 Ergonomic risk (Physical static load, Physical dinamic load, job place) Office comfort (Ventilation, illumination, temperature, etc)
4.1.4 Psychosocial risk (content of task, time organization, job charge, etc)
4.2. Medical Emergency
4.2.1 Site medical facilities
4.2.2 Medical emergency response capabilities (EG: major incidents)
4.2.3 Country & Regional medical support
4.2.4 Competence medical staff
4.2.5 Communication & response (EG; Planning, preparation, response, delay, etc)
4.3. Disease Risk
4.3.1 Endemic diseases and vector transmission diseases
4.3.2 Animal Contact
4.3.3 Social risk (HIV, STD, etc.)
4.3.4 Workplace transmission diseases - biosafety.
4.3.5 Catering risk (Food storage, handle, disposal; contamination, heat contact, food chain management)
4.3.6 Water risk (human consumption water and water disposal management)
4.3.7 Pandemic Disease
4.4 Remote Locations
4.4.1 Climate and Geography
4.4.2 Fitness to work
4.4.3 Exacerbation pre existing conditions.
4.4.4 Road accidents, drivers.
4.4.5 Remote site considerations (hig risk work, limited facilities, security, rotational work, cultural changes)
4.4.6 Location and logistics
Table 3 – Risk Areas and Categories- health
6. Risk Management Process
35
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Risk Categories have been identified for each Area, as well as potential areas of
impact. Potential impacts may be on People ‹P›, Environment ‹E›, Assets ‹A›,
Reputation ‹R› or more than one of these.
Risk Areas are numbered to allow a management summary to be developed in a
structured manner, which shows where the key risks are located.
Risk Ranking Matrices are used to rank the risks, according to the following
process. Upon selection of the Risk Areas (step 1), the Risk Category (step 2)
and the identification of potential areas of impact - P, E, A, R - (step 3), it is
necessary to associate a frequency (or probability) of occurrence to the events
being analysed (step 4).
This can be done by using the reference matrix in Appendix B.
Two different methods can be adopted to enter the proper frequency, depending
on whether or not such an event has already happened within the Company:
Reactive method: the frequency category of the event is identified by using
Table 4. Frequencies corresponding to 0 and A are not covered, as these
categories imply that the event has not happened within the Company, and
therefore the second method should be used.
Table 4 – Frequency Evaluation (reactive method)
6. Risk Management Process
36
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Predictive method: where there is no experience of any previous occurrence of
the event being analysed within the Company, the realisation of the hazard under
consideration is the result of potential failures or absence of relevant controls,
which may be hardware (HC) or operational (OC) in nature.
Table 5 shows how the level of risk is determined, based on the number of, and
reliability of the controls.
Table 5 – Frequency Evaluation (predictive method)
In either case a frequency category 0 to E (for reactive), or 0 to C (for predictive),
will be allocated to the event.
This parameter, together with the severity category of the event’s consequences,
will allow the risk figure to be entered in the matrix of Appendix B (step 5).
The risk may fall in the “red” region (High Risk); in the “orange” region (Medium-
High Risk), in the “yellow region” (Medium Risk) or in the “light blue” region (Low
Risk).
6. Risk Management Process
37
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
The next step (step 6) requires that measures are identified that allow the High
Risk events to be moved at least to the Medium Risk area and the Medium Risk
events to be moved, if practicable, as close as possible to the Low Risk area.
This can be done by taking measures which reduce the severity of the event or its
probability of occurrence.
An Action Plan shall be drafted to ensure that these measures are then
implemented in a controlled manner.
Examples of Hardware and Operational Controls are provided in Table 6 and Table
7 respectively.
6. Risk Management Process
38
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
HC4.3. Escape, Evacuation & Rescue Equipment
HC4.4. Medical Emergency Equipment
HC4. Emergency Equipment
HC3.7. Communication System (PA/GA)
HC3.8. Emergency Power Supply System
HC3.9. Medical Emergency Response Plan
HC3. Emergency System
HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency devices)
HC4.2. Collective / Personal Protective Equipment
HC3.1. Emergency isolation system (ESD) different from process / equipment control system
HC3.2. Emergency well isolation system (BOP, SSSV) different from process / equipment control
HC3.3. Emergency relief system (e.g: Emergency Blowdown System)
HC3.4. Emergency disposal system (e.g.: Flaring & Venting)
HC3.5. Gas Detection System
HC3.6. Fire Detection System
HC2.5. Temporary Refuges
HC2.6. Leak Containment System (blanketing, double seals)
HC2.7. Critical structures / foundations
HC2.8. Injury mitigation system (e.g. roll-bars, dual engines)
HC2.9. Store for medications and lab - X-ray reagents. X-Ray Isolation
HC2. Passive Protection
HC1.7. Health / Environment Technical provisions (e.g. treatment units, clinic, medical attentionequipment, specific equitment, etc.)
HC1. Equipment
HC2.1. Explosion containement system
HC2.2. HVAC (Ventilation, positive pressure systems)
HC2.3. Liquids containment and drainage system
HC2.4. Fire walls / passive fire protection
HARDWARE CONTROL (HC)
HC1.1. Item or assembly layout / route
HC1.2. Process Control Equipment/System
HC1.3. Pressure Protection System
HC1.4. Kick Control System
HC1.5. Risk monitoring (EG: black box, IVMS, flight follow, navaids)
HC1.6. Ignition Control
Table 6 – List of Hardware Controls
6. Risk Management Process
39
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
OC6. Training and CompetencyOC6.2. Assessment / Gaps Removal of supervisors' competency, conduct and motivation
OC6.3. Specific training for radiation protection specialist
OC6.1. Minimum level of staff (Company and Contractor) experience at all staff changes (turn over,shift, etc.)
OC4. Emergency PlanningOC4.1. Emergency Response Plan (e.g. Safety, spill, health)
OC4.2. Scenario-based Contingency Plans
OC4.3. Emergency Response team (e.g. Firefighting, first aid brigade)
OC5. Responsibility/CommittmentOC5.1. Line manager Leadership, Commitment and Accountability to recognise / remove the hazard
OC5.2. Contractor Leadership, Commitment and Accountability to recognise / remove the hazard
OC5.3. HSE Professionals availability on site
OC2.7. Incentive Scheme
OC2.8. EHS Impact Assessment
OC2.9. Audit / Review program
OC3. Process Safety Management
OC3.1. Process Safety culture
OC3.2. Process Safety audits
OC3.3. Safety Critical Elements management
OC3.4. Inspection & Testing program
OC3.5. Preventive Maintenance Management System
OC1.9. Training & Awareness
OC1.10. Staff/Contractor Competency
OPERATIONAL CONTROL (OC)
OC2. Hazard-specific formal protocols
OC2.1. Hazard & Risk Management
OC2.2. Safety Engineering Design
OC3.3. Safety Critical Elements management
OC2.4. Due Diligence Approach
OC2.5. Community program (education, dialogue, welfare, health)
OC2.6. Occupational Health & Medical Support program
OC1.3. HSE / Process Safety rules for Construction & Commissioning
OC1.4. Start-up, shut-down, operating procedures (e.g. Permit-to-Work System)
OC1.5. Procedures for non-routine / repetitive tasks (critical or driven by experienced errors or incidents
OC1.6. Procedures for management of TENORM and other radioactive sources
OC1.7. Management of Change procedures
OC1.8. Contract HSE Requirements
OC1. Safe Systems of Work
OC1.2. HSE / Process Safety rules for Well/Production/Logistics Operations/TENORM/Electromagnetic-optical radiation Monitoring
OC1.1. Activity / Product / Service information (process, design, changes, risk data, well monitoring)
Table 7 – List of Operational Controls
6. Risk Management Process
40
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
7. List of Appendices and Attachments
Appendices:
A – Measurement of Risk to People
B – Risk Matrix
C – ALARP and Cost Benefit Analysis
D – Risk Report Template and User’s Guide
Attachment:
A – Risk Report Checklist (opi sg hse 001 e&p r01 AttA)
7. List of Appendices and Attachments
41
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
A – Measurement of Risk to People
Risk to people (usually, personnel or, generally speaking, workers) can be measured in
terms of risk of exposure, risk of injury or risk of fatality. Normally in quantitative risk
assessments the fatality risk is considered, while for the other risks a qualitative
approach is adopted.
Risk can be measured in a generalised way such as “high”, “high- medium”, “medium”
and “low” where these terms refer to comparative indications of risk for the industry or
activity under review. Alternatively it can be measured in specific terms where an
attempt is made to calculate the average probability of injury or death in a specific time
period either to an individual or to a group of people.
To measure risk in general terms, risk matrices have becoming increasingly used. These
give a framework for both measuring risk and assessing its acceptability. Risk matrices
are discussed in detail elsewhere in the main text of this document and examples are
given in Appendix B.
Risk matrices are useful to determine risk to personnel or workers in (but not limited to)
the following situations:
1. Screening
2. Where options need to be compared and all information are not available for a
detailed Quantitative Risk Analysis
3. Where quantification is difficult or impossible, such as in short term tasks where the
main risk is personnel injury.
Specific Measurement of Risk
Risk to Individuals
The method of measurement, which has become increasingly used in recent years, is
individual risk (IR). This is the risk of fatality to any person exposed to a hazard normally
averaged over a year. Individual risk can be specific to a particular
individual, averaged over those individuals in a high risk group, or averaged across all
persons in a potentially high risk location (e.g. where high H2S levels are expected in
Appendix A
42
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
the reservoir). In measuring individual risk the changes in exposure of persons, for
example by moving away from or closer to the hazard over a period of time is taken
into account. Individual risk may also be assigned to specific locations.
Calculation of Individual Risk
Consider a particular location at risk from a hazardous event nearby. The individual
risk from the event following realisation of the hazard is calculated as follows.
To a specific individual whether a worker or external member of the public
IR = zp1p
2
where p1 = fatality probability
z = event frequency
and p2 = proportion of time for which the person is present in the location
If there are several locations where the individual could be present and still be at risk
from the hazardous event then the total risk from the event can be summed from the
risk at each location.
Should other information (such as % of success of escape or evacuation; % of
favourable winds etc.) become available, the overall IR figure can be progressively
refined to keep account of these parameters.
In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due
regards to availability and reliability of data.
To the average individual (normally this would be used for a typical worker on a
specified site such as an offshore platform)
IR = z(n/N)p1p
3
Appendix A
43
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
where p1 = fatality probability
z = event frequency
n = the average number of persons present at the affected location
N = the total workforce on site (all assumed to work for similar number of hours
per week)
and p3 = proportion of time for which the person is present on site
Should other information (such as % of success of escape or evacuation; % of
favourable winds etc.) become available, the overall IR figure can be progressively
refined to keep account of these parameters.
In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due
regards to reliability of available data.
Tolerability of Individual Risk
The tolerability of the Individual Risk deriving from above mentioned calculations
(both “coarse” and “refined”) is evaluated against the risk matrices in Appendix B.
In particular, it is compared with risk figures shown in the “row” 4 (single fatality)
of Matrix B3; such figures are different when considering a “worker” or a “third
party” (member of the public).
Should the IR figure fall within either the “red” or the “yellow” region of the matrix,
it is necessary to move it away or to reduce it respectively, by adopting risk
reduction measures (e.g. introducing new “barriers”, improving the integrity of
existing barriers, etc.).
Risk to Groups
Individual risk to specific persons may be low in particular situations but due to
the large number of persons exposed, the possibility of fatality may be significant.
In these situations it may be appropriate to determine the Potential Loss of
Life(PLL). This is a measure of how many persons would become fatalities from a
particular site or event, normally expressed over a period of time.
Appendix A
44
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Calculation of PLL
Consider a particular location at risk from a hazardous event nearby. The potential
loss of life (PLL) from the event following realisation of the hazard is calculated as
follows. The event frequency is z.
PLL = zp1n
where p1 = fatality probability ;z = event frequency and n = the average
number of persons present at the affected location
Tolerability of Risk to Groups
When using a “consequence” figure which implies more than a single fatality, the
“row” 5 (multiple fatalities) of Matrix B3 can be used as a reference for tolerability
of the group risk.
Societal Risk
Societal risk expresses the risk to persons not employed or present at a workplace.
The Societal Risk is usually taken into account once the Individual Risk
and the Group Risk have been evaluated and suitably re-conducted into
the “tolerability” area.
Once the Individual Risk figure is found to be “tolerable” in Matrix B3, the Societal
Risk can be assessed against “occupancy” levels of the area surrounding
plants/assets.
This is achievable by utilising the Matrix B4.
Appendix A
45
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B – Risk Matrix - B1. Basic Risk Screening Matrix (Full Qualitative Approach)
Consequence Increasing Annual Frequency
Severity
Peop
le
Environ.
Assets
Repu
tation
0 A B C D E
Practically non‐
credible occurrence
Rare occurrence
Unlikely occurrence
Credible occurrence
Probable occurrence
Likely/Frequent occurrence
Could happen in E&P industry
Reported for E&P industry
Has occurred at least once in Company
Has occurred several times in Company
Happens several times/y
in Company
Happens several
times/y in one location
1 Slight health effect /
Slight effect
Slight damage
Slight impact
Continuous Improvement
2 Minor health effect / injury
Minor effect
Minor damage
Minor
impact
Risk Reduction Measures
3 Major health effect / i j
Local
effect
Local damage
Local
impact
4 PTD or 1 fatality
Major effect
Major damage
National impact
High Risk
5 Multiple fatalities
Extensive effect
Extensive damage
International impact
Appendix B
46
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B2. Personnel (Task) Risk Assessment Matrix
Severity
Personnel (Task) Risk
0 A B C D E
Not Applicable
Not Applicable
Could occur, when
additional factors are present; otherwise unlikely.
Not certain to happen but an
additional factor may result in an accident/ exposure.
Almost inevitable than an accident/ exposure would result
Almost inevitable that more than one accident/ exposure would result
N/A N/A
Has occurred at least once in Company
Has occurred several times in Company
Happens several times a year in
Company
Happens several
times/y in one
location
1 (NOT APPLICABLE) Continuous Improvement
2
Minor health effect / injury: offsite medical treatment or LTA;
up to 10 days off. Agents have reversible effects to health.
Risk Reduction Measure
3
Major health effect / injury: more than 1 LTA; up to 30 days off. Agents have irreversible effects to
health: noise, manual handling, toxics, etc.
4
PTD or 1 fatality: agents are capable
of serious disability or death
5
Multiple fatalities
from an accident or occupational illness (e.g. chemical asphyxiation or cancer or
epidemic diseases)
High Risk
Appendix B
47
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B3. Risk to People (Operations) Assessment Matrix
Severity
People (Operations Risk) (usually in the open)
0 A B C D E
<10‐6 occ /y (1)
10‐6 to 10‐4 occ/y (1)
10‐4 to 10‐3 occ/y (1)
10‐3 to 10‐1 occ/y (1)
10‐1 to 1 occ/y (1)
>1 occ/y (1)
Could happen in
E&P industry
Reported for E&P industry
Has occurred at least once in Company
Has occurred several times in Company
Happens several
times/y in Company
Happens several
times/y in one location
1 Slight health effect / injury Continuous Improvement
2 Minor health effect / injury Risk Reduction Measures
3 Major health effect / injury Compulsory reduction measures
4 Permanent Total Disability or 1 fatality
(small exposed population)
High for 3rd parties onshore
5 Multiple fatalities
(exposed groups)
High Risk
(1) frequency expressed in occurrencies per year
Appendix B
48
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B4. Societal Risk Matrix
Severity
Societal Risk 0 A B C D E
Radiation
(kW/m2)
(assuming unobstructed escape to repair)
Flash Fire Overpres‐ sure
(mbar)
Toxicity
(ppm)
(based on 30 min event
duration)
<10‐6 occ/y
10‐6 to 10‐4 occ/y 10‐4 to 10‐3
occ/y N. A. N. A. N. A.
1 < 3 ‐ < 30 Up to TLV Continuous improvement
2 3 ‐ 30 TLV
No more than 500 people in the open or 100 if mobility is reduced. (*)
Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*)
Compulsory
Risk Reduction Measures
3 5 ‐ 70 IDLH
No more than 500 people in the open or 100 if mobility is reduced. (*)
Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*)
Up to 1m3/m2 in residential area. None in the open unless on monthly basis. (*)
4 7 ½ LFL 140 LC 1% hmn
Up to 500 people inenclosures, 100 at open, 1000 people/day max. at railway stations (*)
Up to 1m3/m2 in residential area. None in the open unless on monthly basis. (*)
5 12.5 LFL 300 LC 50% hmn
Up to 1m3/m2 in residential area. None in the open unless on monthly basis. (*)
Up to 0.5m3/m2 in residential area. (*)
High risk
(*) Industrial, agricultural, artesian areas admitted
Appendix B
49
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B5. Environmental Risk Matrix
Severity
Environment
0 A B C D E
<10‐6 occ/y
10‐6 to 10‐4 occ/y
10‐4 to 10‐3 occ/y
10‐3 to 10‐1 occ/y
10‐1 to 1 occ/y
> 1 occ/y
1
Slight effectNo stakeholder impact or temporary impact on
the area.
Involved area < 0.1 sq mile Spill (1)< 1 m3 – no sensitive impact on ground.
Continuous improvement
2
Minor effect
Some local stakeholder concern or 1 year for natural recovery or impact on small no. of not
compromised species.
Involved area < 1 sq mile Spill (1)< 10 m3 –impact on localised ground.
Risk reduction measures
3
Local effect
Regional stakeholder concern or 1‐2 years for natural recovery or 1 week for clean‐up or threatening to some species or impact on
protected natural areas.
Involved area < 10 sq miles – Spill (1)< 100 m3.
4
Major effect
National stakeholder concern or impact on licences or 2‐5 years for natural recovery or up to 5 months for clean‐up or threatening to
biodiversity or impact on interesting areas for
science.
Involved area < 100 sq miles – Spill (1)< 1000 m3.
5
Extensive effect
International stakeholder concern or impact on licences / acquisitions or > 5 years for natural
recovery or > 5 months for clean‐up or reduction of biodiversity or impact on special conservation areas.Involved area > 100 sq miles – Spill (1)>
1000 m3.
High risk
Appendix B
50
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B6. Asset Risk Matrix
Severity Risks to Assets/Project Objectives
• costs in USD • figures below shall not be
combined for deriving the value of a human life!
0 A B C D E
<10‐6 occ/y
10‐6 to 10‐4 occ/y
10‐4 to 10‐3 occ/y
10‐3 to 10‐1 occ/y
10‐1 to 1 occ/y
>1 occ/y
1 Slight damage
No disruption to operations/business. Continuous improvement
2
Minor damage
Possible short disruption of operations/business:
repair cost < 200000; production downtime < 1 day.
Risk reduction measures
3
Local damage
The unit has been repaired/replaced to resume operations:
repair cost < 2500000; production downtime < 1 week.
4
Major damage
Long time/Major change to resume operations/business:
repair cost < 25000000; production downtime < 3 months.
Major inquiry for the damage cost.
5
Extensive damage
Total loss of operations/business. Revamping necessary to resume the
process: repair cost > 25000000; production
downtime > 3 months. Extensive inquiry for the damage cost.
High risk
Appendix B
51
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
B7. Reputation Risk Matrix
Severity
Reputation
0 A B C D E
Could
happen
in E&P
industry
Reported
for E&P
industry
Has
occurred
at least
once in
Company
Has
occurred
several
times in
Company
Happens
several
times/y
in
Company
Happens
several
times/y in
one
location
Non‐credible
occurrence Rare occurrence
Unlikely occurrence
Credible Occurrence
Probable occurrence
Likely/ Frequent Occurrence
1
Slight impact Minor and short lived impact in the locality
Continuous improvement
2
Minor impact
Some loss of reputation in the area, which should be recovered
Risk reduction measures
3
Local impact
Significant potential damage to the regional reputation
4
Major national impact
Serious/permanent damage to the ability of the Company to sustain business position in the location, some broader implications for
the Company
5
Major international impact
Potential loss of future business position in the location/region and or lasting
significant damage to broader Eni image
High risk
Appendix B
52
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Note:
The reputation of the Company is linked and can be affected by HSE incidents or
accidents of all types. Reputation consists of a combination of the characteristics,
performance and behaviour of a Company and importantly for risk management,
the perception of the Company. Although reputation can be considered as an
‘intangible’ asset, it is important because it can affect the ability of the Company
to establish or maintain business at all stages of the development cycle. Therefore,
actual or perceived HSE impacts can damage the reputation/the business of the
Company and in turn tangible Company assets.
Appendix B
53
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
C – ALARP and Cost-Benefit Analysis
ALARP
Where risks are very low whether to personnel, the environment, assets or reputation
then the situation may be considered acceptable. On the other hand where risks are
high, good operating practices and often the law, requires that they be reduced.
Where risk exists in the region in between, normally called the ALARP region especially
where the risks are safety risks, a more structured approach is required. In the ALARP
region a reduction in risk is justified unless it is grossly disproportionate to the
benefits gained. In practice many risks fall in this region and so what is often known
as an ALARP case should be made for each of these. Sometimes this is possible by
discussion alone. For example, where hazardous activity is not known to have any
safer alternative and where personnel exposure cannot be further reduced, an ALARP
case may be presented in such terms without recourse to more detailed analysis.
However where a range of protective measures exists each entailing some cost, unless
the cost can be accepted, further analysis is required.
This analysis is usually based on a cost-benefits analysis described below.
Costs-Benefits Analyses
A costs-benefits analysis requires a comparison between the total costs of carrying out
an improvement to reduce or eliminate the risk, and the benefits gained. The costs
and benefits are normally considered over the lifetime of the development/operating
unit, or sometimes over the period for which the costs of the improvement can be
written off.
The costs of an improvement can normally be estimated with some accuracy. The
simplest way of doing this is to take the total cost as it is. This works well if the
development has a limited operating life. If the operating life is longer the true
Appendix C
54
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
cost of the improvement may include the effective cost of “borrowing” the money over
the relevant time period.
Benefits are effectively the losses that are, on average, avoided by implementing the
improvement. Benefits are harder to estimate than costs.
For risks to assets, the benefits may be easiest to judge. The losses that are avoided
include the capital losses of the damaged/destroyed facilities, reconstruction costs and
the loss of operating profits. For risks to personnel the easiest approach is to place a
monetary value on technical and operational efforts made to save human life.
It is implicit to this approach that low-cost measures are implemented in any case.
Costs-benefits analyses are very difficult to perform where the principal risks are to
the environment or to reputation due to the difficulties in estimating the benefits
obtained from improvements in these areas.
Limitations of Costs-Benefits Analyses
ALARP type arguments cannot and must not be made as a means of avoiding basic
levels of protection to personnel. It is a requirement of many laws and codes and
standards that some means are available to allow personnel who may be exposed to a
reasonably foreseeable hazard, of saving their life. Examples are lifejackets, lifeboats
and liferafts on boats and offshore installations, lifejackets and breathing masks on
airplanes, and fire alarm systems, and escape stairs in buildings.
In particular, ALARP type arguments cannot be used to avoid providing systems such
as these or to reduce the number of such systems/equipment items.
Appendix C
55
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
D- Risk Report User’s Guide
Here following a user’s guide on the Risk Report; the Risk Report Checklist is in the
Attachment A to the present Professional Operating Instruction (opi sg hse 001 e&p
r01 AttA).
Scope of this guide is to provide, by using a simplified approach, the main steps for
filling in the Risk Report form.
STEP 1: Selection of the Risk Areas
Four Areas of Risk have been identified:
1. Social Aspects
2. Environment
3. Safety
4. Health
For each Area of Risks, some sub-areas (e.g.: 1.1, 1.2, 1.3 …) have been identified.
The Areas of Risks are reported in the column A.
STEP 2: Selection of Hazard Category associated to the Areas of Risk
For each Risk Area, some Hazard Categories shall be addressed (in doing this use
the associated drop down menu in the column B).
Other risk areas and categories shall be added to the list, depending on specific local
conditions, selecting the line “Others” and writing directly in the relevant boxes.
It is important to fill in each Area of Risk (none shall be omitted) and their
associated Hazard Risk category; if some of them are not applicable, specify
the reasons.
Appendix D
56
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
STEP 3: Identification of Potential Impact
For each Risk Area, the Potential Impacts shall be defined.
Impacts could be on People ‹P›, Environment ‹E›, Assets ‹A›, Reputation
‹R› or more than one of these. Select in the drop down menu in the column C
the highest among these impacted objects.
STEP 4: Evaluation of Controls/Barriers in place
An exhaustive list of controls/barriers have been already identified.
They have been divided into hardware controls (HC) and operational controls (OC),
and in turn, into preventive and recovery controls. (see reference keywords sheet
in the form of Risk Report).
Once the controls/barriers have been identified and selected, note P (Preventive)
or R (Recovery) in the column D, and thick them in the drop down menu in
column E (describing them as a free text in the available box).
Appendix D
57
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
diked areas around tanks, hazardous drain systems different from non-hazardous ones-
fire detectors and gas detectors are linked to the ESD system (not in automatic mode)
firefighting system: ring main, fire hydrants, fire trucks
HC2.3. Liquids containment and drainage system
HC3.6. Fire Detection System
HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency de
STEP 5: Risk Analysis
For each identified hazard, the evaluation of the associated risk shall be addressed
in terms of frequency of occurrence and severity. The risk evaluation will be
carried out through analysis of the preventive and recovery barriers in place as
already selected in the previous step.
The Current Risk figure is expressed as “Frequency” x “Severity of
consequences”.
For the evaluation of Frequency, it is possible to apply one of the following:
1. Predictive Method: if no incident referred to the selected
hazard has been experienced in the last 3 yrs
2. Reactive Method: if an incident (real or potential) referred to
the selected hazard has been experienced in the last 3 yrs
Appendix D
58
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
THE PREDICTIVE METHOD IS BASED ON:
(Use the Table 1)
No. of risk frequency barriers (preventive barriers only)
Reliability of these barriers. The reliability is proven by three basic
elements: 1. its absence was a cause of accident in the past – if yes,
thick in the dedicated box G 2. it is standardized - if yes, thick in the dedicated box H 3. it is kept in good condition – if yes, thick in the
dedicated box I
From the combination of these three elements, it is possible to derive the probability
of occurrence of the selected hazard, as follow:
o No. 1 “yes” only: Low reliability
o No. 2 “yes”: Medium reliability
o No. 3 “yes” : High reliability
Table 1
When two barriers are not independent, the lowest reliability prevails.
Appendix D
59
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
The final evaluation of the frequency, as deriving from the Table 1, shall
be reported in column N of the form.
THE REACTIVE METHOD IS BASED ON:
(Use the Table 2)
Statistics of the last decade incidents related to your Company
Table 2
The frequencies, defined in table 2, are reported in J, K, L, M column of the form
respectively.
The final evaluation of frequency shall be reported in column N of the form.
The Predictive and Reactive Methods can be applied together (if justified) and the
worst figure be adopted.
Appendix D
60
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
For the evaluation of Severity of Consequences it is possible to proceed as
follows:
1. Define, with the help of Table 3, What could have happened in more
adverse conditions ( worst potential consequences rather than real
ones);
Has the event already occurred at least once in the last 10 years in the Company?
Probability = B
Has the event already occurred several times in the last 10 years in the Company?
Probability = C
Has the event already occurred several times a year in the Company?
Probability = D
Has the event already occurred several times a year in one facility?
Probability = E
In case there is no evidence of control in place - Reactive Method (see attached Risk Screening Matrix - Table 2)
Appendix D
61
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Table 3
2. Consider the risk severity mitigation barriers in place (recovery barriers
only) and evaluate their reliability.
The reliability of a recovery barrier is based on three basic elements:
1. its absence was a cause of escalation of an accident in the past - if
yes, thick in the dedicated box G
2. it is standardized for the specific risk( fit –for-purpose) – if yes, thick
in the dedicated box H
Appendix D
62
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Description Does 3 years accident records show failure of this control has been a contributor to an event?
Is this control covered by technical specifications/dedicated work instruction?
Is this control subject to periodical maintenance or periodical review/audit?
diked areas around tanks, hazardous drain systems different from non-hazardous ones
fire detectors and gas detectors are linked to the ESD system (not in automatic mode)
firefighting system: ring main, fire hydrants, fire trucks
HC2.3. Liquids containment and drainage system
HC3.6. Fire Detection System
HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency de
3. it is kept in good condition(ready to intervene)- if yes, thick in the dedicated
box I.
From the combination of these three elements, it is possible to derive the ability of
the barrier to reduce the severity of an accident, according to the following criteria:
• No. 1 “yes” only: Low reliability;
• No. 2 “yes”: Medium reliability;
• No. 3 “yes” : High reliability
No. 2 Medium reliability barriers are equivalent to 1 High reliability barrier.
When two barriers are not independent, the lowest reliability prevails.
An High reliability barrier only is able to reduce the severity by one order of
magnitude.
All other combinations have no effect.
The severity shall be reported in the column O of the form.
The Frequency and the Severity of the event’s consequences will allow, entering in
the Risk Matrix (Figure 1) to define the Risk Area.
Appendix D
63
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Consequence Increasing Annual Frequency
Severi
ty
Peo
ple
En
vir
on
.
Ass
ets
Rep
uta
tio
n
0 A B C D E
Practically non-
credible occurrence
Rare occurrence
Unlikely occurrence
Credible occurrence
Probable occurrence
Likely/Frequent occurrence
Could happen in E&P
industry
Reported for E&P industry
Has occurred at least once in
Company
Has occurred several times in
Company
Happens several times/y
in Company
Happens several
times/y in one location
1 Slight health effect / injury
Slight effect
Slight damage
Slight impact
Continuous Improvement
2 Minor health effect / injury
Minor effect
Minor damage
Minor
impact
Risk Reduction Measures
3 Major health effect / injury
Local
effect
Local damage
Local
impact
4 PTD or
1 fatality
Major effect
Major damage
National impact
High Risk
5 Multiple fatalities
Extensive effect
Extensive damage
International impact
Figure 1- Risk Matrix
The risk may fall in the “red region” (High Risk); in the “orange region” (Medium-
High); in the “yellow region” (Medium Risk) or in the “light blue” region (Low Risk).
In detail, the following definition/criteria shall be adopted:
Appendix D
64
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
1. High risk( criticality risk area): The level of risk is not acceptable and risk
control measures are required to move the risk figure to the previous
regions. For operating fields the risks could be recovered in a maximum 1Y
provided that interim Operational Measures are adopted.
2. Risk reduction measure (Medium–High; criticality area): The level of
risk shall be mandatorily reduced applying suitable corrective measures,
provided that is demonstrated that the implementation of such measures is
not disproportionate to the benefits (ALARP). A discussion of ALARP and
cost-benefits analysis is given in Annex C. For operating fields the risks could
be recovered in a maximum 4Y period.
3. Risk reduction measure (Medium tolerable area ): The level of risks
that requires generic control measures.
4. Continuous improvement( Low tolerable risk area): The level of risk is
that requires continuous monitoring to prevent deterioration.
Insert the color (RED, ORANGE, MEDIUM, and LIGHT BLUE) of the Risk, in the
column P of the form.
Frequency Severity Risk
Current Risk Figures
4C
Appendix D
65
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
STEP 6: Risk Treatment
Taking into consideration the Risk Area, mitigation measures shall be put in place
(in addition to controls/barriers in place).
It is mandatory to define the mitigation measures for High and High-Medium Risks;
the implementation of mitigation measures are recommended for Medium Risk if
they are effective to move the risk in “light blue” region ( Low risk).
Identification of effective risk mitigation measures (controls) are needed to reduce
the frequency (in case of preventive controls/barriers) or to mitigate the
consequence of an accident (in case of recovery controls/barriers).
Once the mitigation measures have been identified and selected, note P
(Preventive) or R (Recovery) in the column Q of the form. The description of
the mitigation measures selected in the drop down menu will be reported in
column R, specifying in column S if the mitigation measures are independent
from the previous (existing) controls.
Independence is granted if the new control has no element in common with the
previous ones, including the controls already in place.
Examples are:
• A fire emergency team is not independent from a firefighting system.
• An ESD system is not independent from a depressurization system in case of gas
release.
Preventive/Recovery
Description
Is the measure independent from the previous control/measures
Measures to be Implemented
Appendix D
66
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
Rupdate the contingency plans and reinforce the emergency drills; ensure follow-up from drills.
P review/upgrade of firefighting design and construction (in particular, relocation of Brass fire pump), assignment of relevant contracts and installation/commissioning.
OC4.2. Scenario-based Contingency Plans
OC2.2. Safety Engineering Design
NOTE: if a Preventive Measure is NOT independent from a Recovery Measure, the
prevailing purpose of the measure as a whole (either Preventive or Recovery) is
adopted.
STEP 7: Monitoring and follow up
For the implementation of the identified mitigation measures, it is mandatory to
assign:
1. Responsibility for the implementation of action – column T
2. Budget allocation- column U
3. D-line for the close out of the actions – Column V
4. KPI for the monitoring- Column W Budget AllocationResponsibility Assigned for
Measure Implementation (indicate Dept.)
KPI adopted to monitor progress?
Deadline for Close-out (dd/mm/yyyy)
CRV, EMENone
end 2012SHERPA Database
Project, ENG end 2013
Investment Database
Appendix D
67
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
For the evaluation of the residual Frequency and Severity of the risk, it is
essential to consider the effective date of actions close-out. Prior to that date,
the current risk does not change at all. Report the results in columns X and Y
of the form.
Frequency Severity Risk
Residual Risk @
30 / 06 / 2013
C 4
Once the mitigation measures have been fully implemented, it is necessary to re-
evaluate the risk. To do this, follow the same methodology described in steps 4
and 5:
Description Does 3 years accident records show failure of this control has been a contributor to an event?
Is this control covered by technical specifications/dedicated work instruction?
Is this control subject to periodical maintenance or periodical review/audit?
diked areas around tanks, hazardous drain systems different from non-hazardous ones
fire detectors and gas detectors are linked to the ESD system (not in automatic mode)
firefighting system: emergency preparedness has proven to be improved, fire pump in Brass has been relocated and firefighting network has been refurbished.
HC2.3. Liquids containment and drainage system
HC3.6. Fire Detection System
HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency de
Appendix D
68
HS
E
RIS
K M
AN
AG
EM
EN
T
AN
D
RE
PO
RT
ING
opi sg hse 001 e&p r01
This document is the property of eni spa. All rights reserved
and report the results in columns X and Y of the form. Include the evaluation of the
residual risk in the dedicated column Z, considering as D-line the date of the delivery of
next update of the Risk Report to SEQ/e&p.
Frequency Severity Risk
Residual Risk @
30 / 06 / 2014
C 3
Appendix D