OPI.sg.HSE.001.E&P_HSE Risk Management and Risk Reporting - Rev. 01

Professional Operating Instruction

A R U D E O L C O O T R I P T O A L R O U T I D E T C A R O R U P D E O L C O O T P I R T P

HSE Risk Management and Reporting

REFERENCE MSG: HSE

hser01 001 e&p r01 opi sg hse opi 001sg e&p

This document is the property of eni spa. All rights reserved

1

T N E M E G G A N N I A T R M K O S P I E R R E D S N H A

TITLE:


NOTE:

This document replaces the standard Doc. N° 1.3.0.10 “HSE RISK Management and Risk Reporting”. Once downloaded from the intranet this document is to be considered as an uncontrolled copy.

DATE OF ISSUE:

EFFECTIVE DATE:

October 2013

October 2013

PREPARED BY: SICI

CHECKED BY:

APPROVED BY:

SICI SICUR

HSE IMS Management Representative

SGIAQ SAL/E&P

opi sg hse 001 e&p r01


2


TITLE:


NOTE:

This document replaces the standard Doc. N° 1.3.0.10 “HSE RISK Management and Risk Reporting”. Once downloaded from the intranet this document is to be considered as an uncontrolled copy.

DATE OF ISSUE:

EFFECTIVE DATE:

October 2013

October 2013

PREPARED BY: SICI

CHECKED BY:

APPROVED BY:

SICI SICUR

HSE IMS Management Representative

SGIAQ SAL/E&P



2

Indice


1.

Objective ....................................................................................................... 4

2.

Scope of application ........................................................................................ 5

3.

Internal references ......................................................................................... 6

4.

External references ......................................................................................... 7

5.

Definitions ..................................................................................................... 8

6.

Risk Management Process .............................................................................. 13

7.

List of Appendices and Attachments ................................................................ 40



3

1.Objective


1. Objective

The primary objective of this document is to provide guidance for definition of risk management process and risk tolerability criteria, in particular how HSE risks shall be managed and how they shall be reported at periodical interval to eni e&p division. Risk management criteria shall be used only once all legislative prescriptions have been properly applied. Where specific regulatory requirements exist in a particular location, the most stringent requirements shall be applied. In addition to the requirements set in the HSE IMS Directives and Application Requirements, reference is also made to ISO 17776 “Petroleum and natural gas industries – Offshore production installations – Guidelines on tools and techniques for hazard identification and risk assessment”.



4

2. Scope of application


2. Scope of application

This Professional Operating Instruction applies to HSE professional family pertaining to the eni e&p business area and it has been developed pursuant to the HSE Management System Guideline. In addition, each subsidiary shall record and report the risks from its affiliates and from the joint-ventures where e&p division or subsidiary is the Operator.



5

3. Internal References


3. Internal references



eni spa Code of Ethics available on website Myeni



eni spa Model 231, available on website Myeni.



msg sn eni spa - MSG “Sistema Normativo”



msg hse eni spa -MSG “HSE” and relatives annexes



pro sg hse 001 e&p r01 “Management method for regulatory instruments of the HSE Integrated Management System of the e&p division.”



6

4. External References


4. External references



ISO 14001:2004 “Environmental Management System – Requirements with guidance for use”



OHSAS 18001:2007 “Occupational Health and Safety Management System. Requirements”



EN ISO 17776: 2000 – "Petroleum and natural gas industries - Offshore production installations - Guidelines on tools and techniques for hazard identification and risk assessment "



ISO 31000:2009 – “Risk Management – Principles and Guidelines”



IEC 61508 "Functional safety of electrical / electronic / programmable electronic safety related system (all parts)



IEC 61511 "Functional safety instrumented systems for the process industry sector (all parts)



"Task Risk Assessment Guide– A Step Change in Safety" UKOOA, IMCA, IADC, IAGC OPITO, (August 2000)



E&P Forum QRA Data Sheet Directory 15/10/96



UKOOA – 95



OLF (1999) "OLF recommended method for environmental risk analysis "



OGP Report N° 415 December 2008 “Asset Integrity – thed key to managing major incident risks”



UK HSE - (1989) "Quantified Risk Assessment an Input to Decision Making" – ISBN 0 11 885499 2



UK Health and Safety Executive R2P2



NORSOK Standard Z-013 Rev.2 - (2002) "Risk and emergency preparedness analysis"



7

5. Definitions


5. Definitions For the purposes of this document, the following definitions apply: e&p: exploration & production ALARP: As Low As Reasonably Practicable BPEO: Best Practicable Environmental Option FMEA: Failure Mode and Effect Analysis FTA: Fault Tree Analysis HAZOP: HAZard and OPerability Analysis HAZID: HAZard IDentification IDLH: Immediately Dangerous for Life and Health IEC: International Engineering Consortium (see http://www.iec.org/) ISO: International Organization for Standardization (see http://www.iso.org/). NORSOK: Norwegian Technology Centre standards OGP: International Association of Oil & Gas Producers (see http://www.ogp.org.uk/) OLF: Oljeindustriens Landsforening (see http://www.olf.no/) OHSAS: Occupational Health & Safety Agency (see http://ohsas.org/) OREDA: Offshore Reliability DAta (see http://www.sintef.org/) QRA: Quantitative Risk Assessment UKOOA: UK Offshore Operators Association (see http://www.ukooa.co.uk/) AEA Safety Report Series 34 - Radiation Protection and the Management of Radioactive Waste in the Oil and Gas Industry Shall: Identifies a requirement which is mandatory Should: Identifies a requirement which is recommended; deviation from this requirement or different solution shall be justified. Acceptable Risk / Acceptability: See “Tolerable Risk” (ISO 17776:2000).



8

5. Definitions


Accident: Undesired event giving rise to death, ill health, injury, damage or other loss (OHSAS 18002:2000). An alternative simpler definition: unplanned event giving rise to undesired outcome (death, ill health). ALARP: (As low As Reasonable Practical) The point at which the effort to introduce further reduction measures become unreasonably disproportionate to the additional risk reduction that will be obtained. The concept of ALARP may be qualitative or quantitative and, where necessary, guidance notes issued by the Authorities for application should be adopted. Barrier: measure which reduces the probability of realizing a hazards potential for harm and which reduces its consequence. Barriers may be physical (materials, protective devices, shields, segregation, etc.) or non-physical (procedures, inspection, training, drills, etc.) - ISO 17776:2000 BPEO: (Best Practicable Environmental Option)suggested pragmatic approach for the control of polluting effluents and emissions without penalizing the offending industry. Based on the concept that the cost of pollution are at least partially offset by the economic and social benefits of viable ( sustainable ) industry. Company: An organization part of or connected to eni e&p division such as: Geographic Unit, Affiliate, Subsidiary or Joint Venture under operational control. Flash Fire: Combustion of a flammable vapour and air mixture in which flame passes through that mixture at less than sonic velocity and for relatively short periods of time (typically less than 3 seconds), such that negligible damaging overpressure is generated. Hazard: Anything with the potential to cause harm, including ill health or injury, damage to property, plant, products or the environment; production losses or increased liabilities. (OGP report 6.36/210, 1994 ‘Guidelines for the development and application of health, safety and environmental management systems’). Hazardous event: A hazardous event is synonymous with a hazard. IDLH: It is airborne contaminant concentration of a given contamination below which an individual (unprotected by breathing apparatus or respirator) is able to escape without loss of life or immediate or delayed irreversible health effects or severe eye or respiratory irritation or other reactions that would hinder escape Incident: work-related event(s) in which an injury or ill health (regardless of severity) or fatality occurred or could have occurred (OHSAS 18001:2007). An accident is an incident which has given rise to injury, ill health or fatality. An incident where no injury, ill health or



9

5. Definitions


fatality occurs may also be referred to as a “near miss”. An emergency situation is a particular type of incident. LC% hmn - LethalConcentration for Humans: A concentration by which a given percentage of the exposed population will be fatally injured, following a certain period of exposure. LFL - Lower Flammability Limit. The lowest concentration of the substance (vapour or gas) in air that is known to produce a flash of fire when an ignition source is present. Occupational illness: An occupational illness is any abnormal condition or disorder of an employee, other than one resulting from an occupational injury, caused by exposure to environmental factors associated with employment. (Record-keeping Guidelines for Occupational Injuries and Illnesses, Occupational Safety and Health Act, OSHA, USA, 1986). This includes both acute and chronic illnesses or diseases. They may be caused by inhalation, absorption, ingestion of or direct contact with the hazard, as well as exposure to physical, psychological and biological hazards. Occupational injury: An occupational injury (i.e. not an occupational illness) is caused by a single incident and has immediate consequences. Occupational medicine: The speciality concerned with the diagnosis, management and prevention of diseases due to, or exacerbated by, workplace factors. Qualitative Risk Assessment: Generic term used for techniques which allow the risk associated with a particular activity to be estimated in relative terms such as “high” or “low” (ISO 17776:2000). Quantitative Risk Assessment: Generic term used for techniques which allow the risk associated with a particular activity to be estimated in absolute quantitative terms rather than in relative terms such as “high” or “low” (ISO 17776:2000). Reliability: the probability that an item will perform a required function under stated conditions for a stated period of time – IEEE 90. A barrier is highly reliable if: 

the probability to fail in operation or on demand (either for equipment or through human error) is low as per failure records;



it is covered by functional requirements/job specification (performs a required function);



it is fit-for-purpose/a function of competence as demonstrated by review / appraisal (performs the function under stated conditions);



10

5. Definitions




it is properly maintained / tested (physical test or via drill/exercise) in view of its expected working life / working cycle (performs the function for a stated period of time);

Where 1 or 2 of the above applicable features are missing, the level of control is considered to be Medium. Where 3 or 4 controls are missing or where they are unknown, the level of control is considered to be Low. Risk: Combination of the likelihood of an occurrence of a hazardous event or exposure(s) and the severity

of injury or ill health that can be caused by the event or exposure(s)

(OHSAS 18001:2007). Risk Analysis: Use of available information to identify hazards and to estimate risks (ISO 17776:2000). ( there is not a universally accepted distinction between risk analysis and risk assessment). Risk Assessment: 1.

Overall process of risk analysis and risk e valuation (ISO 17776:2000);

2.

The whole process of risk analysis and the evaluation of the results of the risk

analysis against technological and/or economic, social and political criteria (OGP report 11.1/98, 1984 ‘Applications and limitations of risk assessment in offshore exploration and production’). Risk Evaluation: Judgment, on the basis of risk analysis, of whether a risk is tolerable (ISO 17776:2000). Risk Register: Document proving a brief, but complete, overview of the identified hazards, the relevant screening criteria and the measures necessary to manage them. Screening Criteria: Targets or standards used to judge the tolerability of an identified hazard or effect (ISO 17776:2000). For the purpose of this document, they have been developed by eni e&p division and are intended for use where not provided by regulators. Societal Risk: The risks to society arising from operations; the term “society” in this context include communities, residential areas and, in general, the “public domain” which is not connected with those operations (the Canvey Study – HSE, 1978).



11

5. Definitions


TLV – Threshold Limit Value The time-weighted average concentration for a conventional 8-hour workday and a 40-hour workweek, to which it is believed that nearly all workers may be repeatedly exposed, day after day, without adverse effect (TLV-TWA) (ACGIH). Tolerable Risk / Tolerability: Risk which is accepted under definition of a tolerable threshold, based upon the current state of science and technology and the general values of society (ISO 17776:2000).



12

6. Risk Management Process


6. Risk Management Process Management of HSE risks is an integral part of the management of the business and requires the total concerted effort of the organization, focused on the objective of protecting people, the environment, assets, the business and earnings from potential losses. The risk management criteria must be applied as part of a broader risk management process within the organization. In particular this document provides guidance for definition of risk management process and risk tolerability criteria referred to: 

People – the health protection and promotion and safety of people involved in eni e&p division operations and activities or of other people who could be affected by them



Critical Equipment Protecting Personnel - damage to or loss of equipment and facilities playing a vital role in protecting personnel from hazardous events



Environment – damage to the environment deriving from operational activities or from incidents



Assets and Operations – damage to the Company’s assets and/or impacts on projects and/or production losses



Reputation – damage to the business or to the ‘License to Operate’ or to the overall value of the Company deriving from HSE risks; it includes, inter alia, the image



Social context – damage to external stakeholders (international actors and local communities mainly)

It is important to remember that most activities which carry some degree of risk entail risk to more than one of the above areas. It is vital that all possible effects of a hazard are considered together. For example an activity entailing risk to company profits must not be considered in isolation to its effect on the HSE. It is difficult to determine a hierarchy of importance in the risk effect areas mentioned above, but by common consent the effect of a hazard on persons, including HSE effects, carries most weight and the effect on assets and profits least weight. The application of risk tolerability criteria as a management tool requires specifics skills and expertise.



13



Areas of Risks FULL QUALITATIVE APPROACH Risk is a function of the likelihood of an event and the severity of its consequences. The risk from a particular event is the HSE risk associated with a specific, discrete scenario (such as helicopter crash, transport accident, oil spill, etc.) in terms of effects on people, environment, assets and reputation and is usually assessed qualitatively (see Appendix B1). All the risks coming from external factors (e.g. geo political conditions, political instability, earthquake, presence of closely plant/installation) shall be taken into account in the this process. A specific application of the Full Qualitative Approach is the assessment of personnel Risk. This is a non-specific term covering the risk of injury, diseases or fatality to personnel from named tasks, or from routine or special operations (occupational risk : see Appendix B2). SEMI- QUANTITATIVE APPROACH Risks to People (Health and Safety) Hazardous activities may result in injury, fatality or diseases both to those personnel engaged in work associated with the activity or to community. Risks to people may be divided into: a)

Individual Risk - the total risk of death in a fixed time period (most often one year) to which a worker or a member of the community may be exposed from all credible hazards and sources of accidents (see Appendix B3).

b)

Societal Risk- the risks to society arising from operations; the term “society” in this context include communities, residential areas and, in general, the “public domain” which is not associated to those operations ( see Appendix B4). Environmental Risk The Environmental Risk is the risk to the environment from different activities that fall under the responsibility of the Company. As a consequence, environmental risk management should take account of the exposure of the environmental resources to a variety of activities which constitute, as a whole, the sustainable development of the Company itself ( see Appendix B5).



14



Asset Risk The Asset Risk considers the probability of damage to Company’s physical assets, impacts on projects (failure to meet project objectives) and operations in terms of production loss, deferred production and costs of replacement of damaged structures and equipment due to any incidents (see Appendix B6). Reputation Risk Reputation risk is the risk to the reputation of a Company as perceived by society at large, or sometimes more specifically its “peers” (other oil companies), its employees, its shareholders, the government or financial institutions. The reputation of the Company is linked and can be affected by HSE incidents or accidents of all types. Reputation consists of a combination of the characteristics, performance and behaviour of a Company and importantly for risk management, the perception of the Company. Although reputation can be considered as an ‘intangible’ asset, it is important because it can affect the ability of the Company to establish or maintain business at all stages of the development cycle. Therefore, actual or perceived HSE impacts can damage the reputation/the business of the Company and in turn tangible Company assets ( see Appendix B7).

Risk Management Process The Risk Management Process (see Figure 1) is a continuous, iterative process, which typically consists of five major steps: 1. Establishing the context: identification of internal and external factors that it is necessary to consider in the risk management process. These shall include: 

factors inside the organization such as corporate risk management standard, internal organization and delegation of responsibilities and internal capabilities of the persons who operate, maintain and manage activities at the facilities.



factors outside the organization such as applicable legislations, codes and standards and key stakeholders such as partners, regulators, local communities, NGO, major contractors and suppliers;



15



2. Communication and consultation: identification and management of any affected interested parties, key figures within and outside the Company shall be identified to ensure their consultation and involvement in the risk assessment process. 3. Risk assessment: it includes the following sub-steps: a) Risk Identification: Identification and definition of potential hazards and their potential effects: b) Risk Analysis: Evaluation of the risk arising from identified hazards in terms of evaluation of the likelihood / probability / frequency of occurrence of accident sequences, evaluation of severity of the consequences and analysis of the preventive and recovery barriers in place. Such information can be retrieved from various sources, including: 

internal knowledge and experience of line / project / department managers and HSE experts;



industry frequency and failure rate databases and co-operative research programmes;



relevant international, national and eni e&p Division standards and codes of practice;



industry and trade association codes of practice and other guidance.

The risk analysis is aimed at determining the number of barriers in place and evaluating their reliability considering all factors that can affect its performance in terms

of

functionality,

availability,

reliability

and

survivability

(e.g.

design

specifications, inspections, functional testing and maintenance requirements as well as operational procedures, operator training and competence, management of change).



16


c) Risk Evaluation: Assessment of tolerability of risk to people, environment, assets and reputation by comparing risk level with the relevant tolerability criteria 4. Risk treatment: Identification of effective risk reduction measures needed to reduce the likelihood / probability / frequency (prevention) and/or to control incidents (limiting the extent and duration of a hazardous event) or to mitigate the consequence of an accident (control and mitigation). 5. Monitoring and review: Monitoring and review of the entire process to ensure it continues to be effective and to verify whether the barriers continue to be effective. In particular, this review is necessary every time a significant change occurs in the installation which has the potential to affect its integrity.



17



Figure 1 – Risk Management Process

Risk Identification and Analysis A systematic approach to the identification of hazards and the evaluation of risk is a key element of effective HSE management, providing information to support decision-making on risk-reduction measures. For new installations or activities hazards shall be identified as early as possible, in order that sufficient time can be given to the most appropriate way to manage them. It is always easier to make modifications early in the design stage of a project, when changes can be made with minimal effect on cost and schedule.



18



Risk analysis and risk assessment shall also be applied to existing facilities, but in some cases changes that would be justified during design may not be practicable for an existing facility. As an example, improvements in layout may not be practicable for existing facilities. Also the work necessary in undertaking modifications to an existing facility itself introduces an additional risk of accident. Should such a situation occur, managerial and operational criteria (such as demanning) may be adopted instead of technical provisions. Risk Identification Risk identification includes: 

A broad review of possible hazards and sources of accidents, with p articular emphasis on ensuring that relevant hazards are not overlooked.



A rough classification into critical hazards (as opposed to non- critical) for subsequent analysis



Explicit statement of the criteria used in the screening of the hazards



Explicit documentation of the evaluation made for the classification of the non-critical hazards. Hazards can be identified and assessed in different ways using one of the following tools and techniques:

-

Experience from previous analyses, safety inspections and audits, useful when the activity under consideration is similar to activities undertaken previously in other locations. The approach is not suitable when dealing with innovative systems or where local conditions invalidate previous experiences

-

Use of checklists and accident statistics. Checklists are normally drawn up

from standards and operational experience and ensure

that known hazards have all been identified and assessed. They are easy to apply and can be used at any phase in the project life cycle. Examples of Hazard checklists are provided in ISO 17776 (Ref.1)

-

Codes and standards that reflect collective knowledge and experience, accumulated on the basis of Company, national or international



19



operations. These documents incorporate the lessons learned from previous design, from hazard and risk assessment and from accident and

incident

investigation.

The

compliance

with

prescriptive

standards ensures the reduction of risks to a tolerable level. The use of checklists based on requirements laid out in codes and standards is an effective technique in identifying compliance with standard practice and highlighting aspects which require further investigations.

-

Structured review techniques (HAZID, HAZOP), used to identify and evaluate known and unforeseen hazards and unintended events that are not adequately addressed by the previous methods. More details about these techniques can be found in ISO 17776.

The selection of the appropriate hazard identification and risk evaluation tools and techniques depends upon the nature and scale of the installation, the information available, the phase of the project and experience of similar installations.

Risk Analysis Frequency Evaluation Frequency information may be obtained from 

Experience



Company data and source including accident and incident data



Published data sources such as WOAD and OREDA.

Where data does not exist, it may be possible to derive it from more fundamental data using the following methods:

-

Fault Tree Analysis (FTA) Failure Mode and Effect Analysis (FMEA)



20



These are expected to provide estimates that may not be homogeneous with those coming from experience, therefore, where possible, estimated frequency data for initiating events should include an allowance for human and/or operational factors. Frequency is usually expressed in occurrences per year.

Consequence Evaluation Consequence analysis includes consequence modelling, for example estimation of accidental loads, such as intensity of fires, modelling of escalation and estimation of response to accidental loads. Consequence analysis can be applied to assess HSE aspects for a range of consequence scenarios and involves the use of predictive models. Consequence scenarios may be developed in simple narrative form, using multiple branch event trees and utilising more or less complex computerised modelling techniques. Since the majority of models provides only an approximation of what might happen, models should only be used when they are validated in a particular application and their predictive capability is ge nerally accepted. Successful application requires use by personnel with adequate training and experience. As far as possible, consequence analysis should also assess the contribution to failure from human and organisational factors, together with the contribution from such failures to dependent failures (escalation). The following analysis methods may be used for the escalation analysis: 

Event Tree Analysis (ETA)



Simulation/ probabilistic analysis

More details about these techniques can be found in ISO 17776.



21



Risk Evaluation Measurement of risk is the preliminary phase of assessing its acceptability (“tolerability”).

It

is

necessary

to

compare

risk

figures

with

acceptability/tolerability thresholds in order to determine whether the risk is fully acceptable, completely intolerable or somewhere in between. Measurement of Risk In order to interpret risk to people, reputation etc. some means of measurement of risk is required. Since risk is in its simplest terms consequences times frequency, obvious types of measure may be: 

Fatalities / occupational illness per year ( risk to people)



Spills per transfer operation (risk to the environment)



Financial losses per year (asset losses)

Apart from financial loss which is relatively easy to measure in risk terms, all other areas present problems. Environmental risk is particularly difficult to define except in terms of specific items such as spills as detailed above. Some of the problems with the measurement of environmental risk are described below:

-

Some environmental discharges are continuous but have indeterminate effects

-

Some environmental hazards are short term in duration but have long term effects changing over time

-

Some environmental hazards may have quite different effects on, for example, air quality, water quality and ecology, making a global measure of environmental risk difficult to define.

These problems make the use of matrices discussed later, particularly helpful for environmental risk measurement. In assessing environmental risk one should pay attention to separate risks from impacts. Risks refers to acute phenomena, impacts normally refers to chronic effects

( that may be negative but also

positive).



22



In this view, a continuous environmental discharge constitutes a risk only if it is limited in time ( contingency) or due to an upset condition. Risk to reputation is also very difficult to measure, as reputation is an intangible concept. The normal approach is to define the effect of a reputation hazard in terms of significance to the news media and to assess its impact geographically (e.g. very local, national or international). Given the difficulty of expressing this in quantitative terms, a qualitative approach is always used in this area. Risk to people can be measured in various ways according to the types of individuals at risk and their exposure. A discussion of the ways of measuring risk to people is given in Annex A. All estimates of risk for people are based on either qualitative or quantitative approaches. Risk Matrix and criteria Risk matrix is a tool, inspired to the ISO standard 17776, which shall be used as a background for setting risk tolerability criteria. When used as a qualitative matrix, it considers events that have been experienced by the Company or the Company may expect in case of deterioration of such events. In case Company history/experience is considered not consolidated (in terms of No. of plants / operations), reference shall be made to e&p industry in the same geographical area. The risk matrices are reported in Appendix B. The matrix axes, consistent with the definition of risk, are Consequences and Likelihood / Probability or Frequency. The vertical axis represents the measure of the potential consequences of credible scenarios. A scale of consequences from ‘1’ to ‘5’ is used to indicate increasing severity. The potential consequences of credible scenarios are considered as



23



consequences that could have resulted from the released hazard if circumstances had been less favorable. The horizontal axis represents the measure of likelihood / probability / frequency of the occurrence of a hazardous event. Such a scale is defined in general terms from ‘0’ to ‘E’ on the basis of historical evidence or experience that such consequences have materialised within e&p industry or the Company. The risk matrices are separated in four regions that identify the limit of risk tolerability; such regions are: 1.

Continuous improvement( Low tolerable risk area): The level of risk is that requires continuous monitoring to prevent deterioration.

2.

Risk reduction measure (Medium tolerable area ): The level of risks that requires generic control measures.

3.

Risk reduction measure (Medium–High; criticality area): The level of risk shall be mandatorily reduced applying suitable corrective measures, provided that is demonstrated that the implementation of such measures is not disproportionate to the benefits (ALARP). A discussion of ALARP and cost-benefits analysis is given in Annex C. For oper ating fields the risks could be recovered in a maximum 4Y period.

4.

High risk( criticality risk area): The level of risk is not acceptable and risk control measures are required to move the risk figure to the previous regions. For operating fields the risks could be recovered in a maximum 1Y provided that interim Operational Measures are adopted.

Depending on the position of the intersection of a column with a row in the risk matrix, it is possible to classify the r isk. For the same scenario (grouping all hazardous events which have the same severity of consequences), a resulting likelihood / probability / frequency is assigned or calculated, such that the risk can be classified. The classification is



24



repeated for all the risk areas (People, Environment, Assets and Reputation). The overall risk of a hazard is classified according to which among consequences has the highest rating. Risk Screening Matrix The Risk Screening Matrix is reported in Aooendix B1 and provides definition of consequences and a range of qualitative criteria to estimate likelihood / probability or frequency. This shall be used in the identification of high level HSE Risk during risk screening (Major Hazard Analysis, Environmental Impact Assessment, etc.). This matrix provides the basis to identify significant risks or areas of risk (for example, transportation risk) and prioritise further assessment and management efforts.

Risk screening matrices are suitable to be linked with other means of assessing tolerability, especially when assessing human risk in high hazard scenarios, usually connected with safety accidents. Risk Acceptability for these scenarios is discussed in Appendix A. Should the qualitative risk figure be intolerable, either a quantitative risk analysis (QRA) or the adoption of fit-for-purpose and more effective risk-reduction measures shall be required. Personnel Risk (Task) When considering Occupational Health and Safety Risk Assessment related to specific tasks, a qualitative approach is preferred, since it is usually based on past experience. The Personnel (Task) Risk Assessment Matrix is based on the document “Task Risk Assessment Guide - A step change in safety” and is reported in Appendix B2.



25



The occupational health risk (occupational illness or injury) is usually based on “exposure” to hazardous agents (physical, chemical, etc.); this is covered by specific Minimum Health Standards. Risk to People (e&p operation) Risk to People induced by e&p operations can be assessed both qualitatively and quantitatively. When performing Quantitative Risk Assessment (QRA) as a forecast of possible, future events, fatalities have to be considered with care, avoiding a deterministic approach; in this context, for example, to evaluate the risk of fatality, it is necessary to consider not only the frequency (or probability) of the accidental load (in terms of radiation from a fire, overpressure from an explosion, toxicity from a toxic release etc.) but also the vulnerability of humans to this load. The Risk to People (e&p operations) Assessment Matrix is reported in Appendix B3. Societal Risk The Societal Risk matrix to asses risk to society arising from e&p operations is reported in Appendix B4.

Environmental Risk The environmental risk matrix has been derived from a document prepared by the OLF’s environmental committee for oil spill to sea and has been extended to onshore activities too; it is reported in Appendix B5. This matrix essentially provides an expansion of the definitions of environmental consequences included in the Event Screening matrix. As far as consequences are concerned, a list of options is shown; they are intended not to be used contemporarily; for example, in sensitive areas, the option based on amount of spilled oil is not suitable, and is preferable to adopt options related to protection of fauna and flora.



26



Asset Risk The asset risk matrix is reported in Appendix B6. Even in this case, different options are shown to describe consequences, based on times and costs for repair. As far as probability / frequency is concerned, both quantitative and qualitative criteria are shown, where the latter is based on reliability of technical / operational protection systems, such as temporary refuges, control systems etc. The reliability is expressed in terms of minimum number of failures needed for the hazard to be realized (higher the number of failures, higher the number of barriers against the hazardous event). Reputation Risk Reputation is essentially an intangible asset. However, HSE risks can have a significant impact on reputation with serious consequences to the Company. It is therefore advisable that the reputation aspect of any risk is properly evaluated against the criteria in Appendix B7.

Risk Treatment For any given risk there are four basic management approaches: 1. Take/Accept: the risk is tolerated in its basic state with no active controls being applied; 2. Terminate:

the

factors

which

create

the

risk

are

eliminated

(e.g.

replacement of dangerous chemicals) 3. Treat/Manage:

apply

controls

in

the

form

of

hardware,

software,

procedures with the effect of reducing the frequency or consequences of the event 4. Transfer: Insure (only in case of risk for assets).

Risks are generally classified according to the controls that either are put in place or must be implemented to reduce/control the risk.



27



The risk reduction measures should be identified through a Quantitative Risk Assessment (QRA) based on the following steps: 1) Identify hazardous events, considering techniques such as Event Trees; 2) Consider the accidental loads (e.g. radiation from fires) and, hence, the damage/harm deriving from the hazardous event to: an employee, a man of the public (risk to people), a plant section (asset risk) etc; 3) Sum up frequencies of all hazardous events of the same nature (all gas releases, all fires, all explosions etc.) with same consequences (harm to an employee, a man of the public, a group of people, an area with a given occupancy); 4) Enter the suitable risk matrix and verify tolerability; 5) If unacceptable, assess what controls are viable; 6) Determine if the risk, which is residual after controls, will be manageable; 7) If still unacceptable, consider further mitigating factors (reduction of % of manning, chance of sheltered escape, favorable wind directions, extra controls etc.) to re-conduct the event in the acceptable area; 8) If still unacceptable, consider the “zero option” (“terminate” the risk).

I d e n t i f i ca t i o n , D e v e l o p m e n t a n d I m p l e m e n t a t i o n o f Co n t r o l s

Risk reduction measures include preventative measures (reduction of likelihood / probability / frequency) and mitigating measures (reduction of severity of consequences). Mitigation measures include steps to prevent escalation of developing abnormal situations and to lessen adverse effects on Health, Safety and the Environment. Risk reduction measures also include recovery preparedness measures, which address emergency procedures as well as restoration and Company procedures to recover. In identifying control measures, consideration should be given to: 

The activity



28





The people involved



What tools, equipment and materials are to be used



The working environment

The remedial measures needed to control each of the high risks should be based on good safe working practice in order to reduce the residual risks to a level which is practicable. If the identified remedial measures are not suitable to move into the HIGH- MEDIUM Region, a detailed QRA , when applicable, shall be performed in order to substantiate the final risk level. The “hierarchy” principle shall be adopted, with the following priority list: 1)

Avoid the risk

2)

Replace hazardous devices/operations with less hazardous ones

3)

Prefer collective safety measures to individual ones

4)

Adopt alternative design/operations

5)

Increase No./effectiveness of controls, supported by the best available practices (HSE MSG) and technologies.

The process stops when efforts to introduce further reduction measures become unreasonably disproportionate to the additional risk reduction that will be obtained. An approach widely used is to evaluate the effort and cost involved in a number of different risk-reducing measures and to estimate the risk-reducing effect of each.

By evaluating the cost or effort necessary to arrive at a common level of risk reduction it is often possible to identify those measures which are clearly more effective in risk reduction. In case of asset risk, the following formula can be adopted for comparison: (probability of the hazard) x (costs if it realizes) = expected cost from the risk

Evaluation

of

risk-reducing

measures

should

always

be

based

on

sound

engineering principles and common sense. The following aspects should also be



29



observed: local conditions and circumstances, the state of scientific and technical knowledge relating to the particular situation, and the estimated costs and benefits. See Appendix C for further information on Costs-Benefits analyses. It must be clear in any case that no level of risk of fatality for anyone person is acceptable.

Risk Register

From the risk assessment process, each Company shall develop a Risk Register which detail the main areas HSE risk associated with activities in all operating unit/project (exploration/development/operation), including normal and temporary activities (e.g. operation plant, warehouse, marine base, headquarter, guesthouse, drilling activity, seismic). The Risk Register shall record the most significant hazards (together with their consequences and probability of occurrence) which, if realized, have the potential to adversely affect the Company with consequential negative impacts on its HSE performance and reputation. The Risk Register should demonstrate that: 

all hazards, effects and threats have been identified



the likelihood / probability / frequency and consequences of a hazardous event have been assessed



controls to manage potential causes (threatened barriers) are in place



recovery preparedness measures to mitigate potential consequences have

been taken. The Risk Register is a live document and it shall be updated at minimum one per year and whenever change on process/project is highlighted. The Risk Register format is free and can be replaced by the tool requested by local legislation ( i.e DUVRI)

but, as minimum, it shall contain the information that



30



need to be reported to the HQ. It is up to the reporting Company ( Geographic Unit or GU) to use the Risk Report as a Risk Register template for internal usage.

Risk Reporting The Risk Report is a tool that allows Company and eni e&p Division to be aware of the main HSE risks associated with their operations and be informed about progress in reduction of those risks classified as medium, high-medium, and high. A copy of the Risk Report shall be sent to the eni e&p division SEQ/SICI Department , by end of June each year. An Action Plan related to the high risks, identified through the Risk Management Process, shall be send to eni e&p division SEQ/SICI Dept within one month from their identification. A template for Risk Report is reported in Appendix D. Four Areas of Risk have been identified. Risks associated to each area shall be addressed, where applicable (see Table 1, 2, 3). Other risk areas and categories may be added to the list depending on specific local conditions.



31



Table 1 – Risk Areas and Categories- social aspects and environment RISK AREAS

1.1 s t c e p s A l a i c o S

Communities & Security

RISK CATEGORY 1.1.1

Hostile communities/media

1.1.2

Damage to cultural heritages

1.1.3

Terrorist Activity/Sabotage/Bunkering

1.1.4

Internal & external security threats

1.2.1

Stress/shift induced risk

1.2.2. Turnover risk 1.2

Workforce / Ethics

1.2.3. Inadequate level of indigenous training (local workforce/contractors) 1.2.4. Communication barriers 2.1.1 Continuous discharges to air (air quality requirements)

2.1. Emissions

2.2.

Spills

2.1.2 Emergency/Upset discharges (GHG emissions requirements) 2.2.1

Underground contamination

2.2.2

Surface contamination

2.2.3 Transportation by sea/land/internal water (including loading and unloading activities)

2.3. t n e m n o r i v 2.4. n E

2.5.

2.6.

2.7.

Wastes

2.3.1

Pollution from operational wastes

2.3.2

Pollution from domestic wastes

2.3.3

Pollution from sanitary wastes

2.3.4 Pollution from radioactive waste (TENORM or radioactive sources) Production Water

Facility impact

Biodiversity

Subsidence



2.4.1 Continuous discharge to water (legislative requirements, drainage systems, oil/water separation) 2.4.2

Continuous discharge to soil

2.5.1

Impacted area (footprint)

2.5.2

Pipeline routing impact

2.5.3

Previous land use

2.5.4

Vulnerable fauna and flora

2.5.5

Visual impact

2.6.1

Reduction of indigenous biodiversity

2.7.1

Ground structure

2.7.2

Foundations

2.7.3

Reservoir depletion

32


RISK CATEGORY

RISK AREAS


3.1.1 Loss of Primary Containment (lack of process control, erosion/corrosion, process stress) 3.1.2 Manning inconsistent with design and operations philosophy

3.1. Process Safety

3.1.3

Risk of stored flammables

3.1.4

Risk of ignition (fire, explosion, flash-fire)

3.1.5 Risk from layout (lack of containment, module proximity, unfavourable wind directions, wrong escape routes and mustering)

y t e f a S

3.1.6

Blowout risk

3.1.7

Risk of inhibits/overrides of safety critical elements

3.2.1

Air transportation and communication risk

3.2.2

Land transportation and communication risk

3.2.3 Marine/Internal waters transportation and communication risk (e.g. anchor handling a ctivities + towing)

3.2

Operations Safety

3.2.4

Heavy lifting

3.2.5 etc.)

Maintenance hazards (access, override, bypasses,

3.2.6 Risk of substandard Contractors/ Subcontractors (contractual clauses and conditions, training and competency) 3.2.7

Concurrent/Simultaneous Operations

3.2.8 Construction, Commissioning, Start-up and Shutdown risks 3.2.9

3.3

Emergency Response

3.4.

Office Safety

Drilling operations risks

3.3.1 Lack of emergency preparedness (firefighting, spill clean-up, security support, evacuation) 3.3.2

Lack of communication for emergency planning

3.4.1

Office-related risks

Table 2 – Risk Areas and Categories- safety



33



RISK AREAS

RISK CATEGORY 4.1.1 Chemical agent (including carcinogenics, toxics, hazardous sustances, asphyxiation agents) 4.1.2 Physical agent (noise, Vibration, barometric, Thermal, electricity, Electromagnetic Field, Optical Radiation, Ionizing Radiation, TENORM)

4.1.

Work Environment

4.1.3 Ergonomic risk (Physical static load, Physical dinamic load, job place) Office comfort (Ventilation, illumination, temperature, etc) 4.1.4 Psychosocial risk (content of task, time organization, job charge, etc) 4.2.1 Site medical facilities 4.2.2 Medical emergency response capabilities (EG: major incidents)

4.2.

4.2.3 Country & Regional medical support

Medical Emergency

4.2.4 Competence medical staff 4.2.5 Communication & response (EG; Planning, preparation, response, delay, etc)

h t l a e H

4.3.1 Endemic diseases and vector transmission diseases 4.3.2 Animal Contact 4.3.3 Social risk (HIV, STD, etc.) 4.3.

4.3.4 Workplace transmission diseases - biosafety.

Disease Risk

4.3.5 Catering risk (Food storage, handle, disposal; contamination, heat contact, food chain management) 4.3.6 Water risk (human consumption water and water disposal management) 4.3.7 Pandemic Disease 4.4.1 Climate and Geography 4.4.2 Fitness to work 4.4.3 Exacerbation pre existing conditions. 4.4 Remote Locations

4.4.4 Road accidents, drivers. 4.4.5 Remote site considerations (hig risk work, limited facilities, security, rotational work, cultural changes) 4.4.6 Location and logistics

Table 3 – Risk Areas and Categories- health



34



Risk Categories have been identified for each Area, as well as potential areas of impact. Potential impacts may be on People ‹P›, Environment ‹E›, Assets ‹A›, Reputation ‹R › or more than one of these.

Risk Areas are numbered to allow a management summary to be developed in a structured manner, which shows where the key risks are located. Risk Ranking Matrices are used to rank the risks, according to the following process. Upon selection of the Risk Areas (step 1), the Risk Category (step 2) and the identification of potential areas of impact - P, E, A, R - ( step 3), it is necessary to associate a frequency (or probability) of occurrence to the events being analysed (step 4). This can be done by using the reference matrix in Appendix B. Two different methods can be adopted to enter the proper frequency, depending on whether or not such an event has already happened within the Company: Reactive method: the frequency category of the event is identified by using Table 4. Frequencies corresponding to 0 and A are not covered, as these categories imply that the event has not happened within the Company, and therefore the second method should be used.

Table 4 – Frequency Evaluation (reactive method)



35



Predictive method: where there is no experience of any previous occurrence of the event being analysed within the Company, the realisation of the hazard under consideration is the result of potential failures or absence of relevant controls, which may be hardware (HC) or operational (OC) in nature. Table 5 shows how the level of risk is determined, based on the number of, and reliability of the controls.

Table 5 – Frequency Evaluation (predictive method)

In either case a frequency category 0 to E (for reactive), or 0 to C (for predictive), will be allocated to the event. This parameter, together with the severity category of the event’s consequences, will allow the risk figure to be entered in the matrix of Appendix B (step 5).

The risk may fall in the “red” region (High Risk); in the “orange” region (MediumHigh Risk), in the “yellow region” (Medium Risk) or in the “light blue” region (Low Risk).



36



The next step (step 6) requires that measures are identified that allow the High Risk events to be moved at least to the Medium Risk area and the Medium Risk events to be moved, if practicable, as close as possible to the Low Risk area. This can be done by taking measures which reduce the severity of the event or its probability of occurrence. An Action Plan shall be drafted to ensure that these measures are then implemented in a controlled manner. Examples of Hardware and Operational Controls are provided in Table 6 and Table 7 respectively.



37



HARDWARE CONTROL (HC ) HC1.1. Item or assembly layout / route HC1.2. Process Control Equipment/System HC1.3. Pressure Protection System HC1. Equipment

HC1.4. Kick Control System HC1.5. Risk monitoring (EG: black box, IVMS, flight follow, navaids) HC1.6. Ignition Control HC1.7. Health / Environment Technical provisions (e.g. treatment units, clinic, medical attention equipment, specific equitment, etc.) HC2.1. Explosion containement system HC2.2. HVAC (Ventilation, positive pressure syst ems) HC2.3. Liquids c ontainment and drainage syst em HC2.4. Fire walls / passive fire protection

HC2. Passive Protec tion

HC2.5. Temporary Refuges HC2.6. Leak Containment System (blanketing, double seals) HC2.7. Critical structures / foundations HC2.8. Injury mitigation system (e.g. roll-bars, dual engines) HC2.9. Store for medications and lab - X-ray reagents. X-Ray Isolation HC3.1. Emergency isolation system (ESD) different from process / equipment control system HC3.2. Emergency well isolation syst em (BOP, SSSV) different f rom process / equipment c ontrol HC3.3. Emergency relief syst em (e.g: Emergency Blowdown Syst em) HC3.4. Emergency disposal syst em (e.g.: Flaring & Venting)

HC3. Emergency Syst em

HC3.5. Gas Detection System HC3.6. Fire Detection System HC3.7. Communication System (PA/GA) HC3.8. Emergency Power Supply System HC3.9. Medic al Emergency Response Plan HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency devices

HC4. Emergenc y Equipment

HC4.2. Collective / Personal Protective Equipment HC4.3. Escape, Evacuation & Rescue Equipment HC4.4. Medical Emergency Equipment

Table 6 – List of Hardware Controls



38



OPERATIONAL CO NTROL (OC ) OC1.1. Act ivity / Product / Service information (process, design, changes, risk data, well monitoring) OC1.2. HSE / Process Safety rules for Well/Production/Logistics Operations/TENORM/Electromagneticoptical radiation Monitoring OC1.3. HSE / Process Safety rules for Construction & Commissioning OC1.4. Start-up, shut-down, operating procedures (e.g. Permit-t o-Work System) OC1. Safe Systems of Work

OC1.5. Procedures for non-routine / repetitive tasks (critical or driven by experienced errors or incidents OC1.6. Procedures for management of TENORM and other radioactive sources OC1.7. Management of Change procedures OC1.8. Contract HSE Requirements OC1.9. Training & Awareness OC1.10. Staf f/Contractor Competency OC2.1. Hazard & Risk Management OC2.2. Safety Engineering Design OC3.3. Safety Critical Elements management

OC2.4. Due Diligence Approach OC2. Hazard-spec ific formal protoc ols OC2.5. Community program (education, dialogue, welfare, health) OC2.6. Occupational Health & Medical Support program OC2.7. Incentive Sc heme OC2.8. EHS Impact Assessment OC2.9. Audit / Review program OC3.1. Process Safety culture OC3.2. Process Safety audits OC3. Process Safe ty Management

OC3.3. Safety Critical Elements management OC3.4. Inspection & T esting program OC3.5. Preventive Maintenance Management Syst em OC4.1. Emergency Response Plan (e.g. Safety, spill, health)

OC4. Emergency Planning

OC4.2. Scenario-based Contingency Plans OC4.3. Emergency Response team (e.g. Firefighting, first aid brigade) OC5.1. Line manager Leadership, Commitment and Accountability to recognise / remove the hazard

OC5. Responsibility /Committment

OC5.2. Contractor Leadership, Commitment and Accountability to recognise / remove the hazard OC5.3. HSE Professionals availability on site

OC6. Training and Competency

OC 6. 1. M in imum le ve l o f s t af f ( Co mp an y a nd C ont ra c t or) e xp erie nc e a t a ll s t af f c h an ge s ( tu rn o ve r, shift, etc .) OC6.2. Assessment / Gaps Removal of supervisors' competenc y, c onduct and motivation OC6.3. Specific training for radiation protect ion specialist

Table 7 – List of Operational Controls



39

7. List of Appendices and Attachments


7. List of Appendices and Attachments

Appendices: A – Measurement of Risk to People B – Risk Matrix C – ALARP and Cost Benefit Analysis D – Risk Report Template and User’s Guide

Attachment: A – Risk Report Checklist (opi sg hse 001 e&p r01 AttA)



40

Appendix A


A – Measurement of Risk to People Risk to people (usually, personnel or, generally speaking, workers) can be measured in terms of risk of exposure, risk of injury or risk of fatality. Normally in quantitative risk assessments the fatality risk is considered, while for the other risks a qualitative approach is adopted. Risk can be measured in a generalised way such as “high”, “high- medium”, “medium” and “low” where these terms refer to comparative indications of risk for the industry or activity under review. Alternatively it can be measured in specific terms where an attempt is made to calculate the average probability of injury or death in a specific time period either to an individual or to a group of people. To measure risk in general terms, risk matrices have becoming increasingly used. These give a framework for both measuring risk and assessing its acceptability. Risk matrices are discussed in detail elsewhere in the main text of this document and examples are given in Appendix B. Risk matrices are useful to determine risk to personnel or workers in (but not limited to) the following situations: 1.

Screening

2.

Where options need to be compared and all information are not available for a

detailed Quantitative Risk Analysis 3.

Where quantification is difficult or impossible, such as in short term tasks where the

main risk is personnel injury. Specific Measurement of Risk Risk to Individuals The method of measurement, which has become increasingly used in recent years, is individual risk (IR). This is the risk of fatality to any person exposed to a hazard normally averaged over a year. Individual risk can be specific to a particular individual, averaged over those individuals in a high risk group, or averaged across all persons in a potentially high risk location (e.g. where high H2S levels are expected in



41

Appendix A


the reservoir). In measuring individual risk the changes in exposure of persons, for example by moving away from or closer to the hazard over a period of time is taken into account. Individual risk may also be assigned to specific locations. Calculation of Individual Risk Consider a particular location at risk from a hazardous event nearby. The individual risk from the event following realisation of the hazard is calculated as follows. To a specific individual whether a worker or external member of the public IR = zp p

1 2

where p1 = fatality probability z = event frequency and p = proportion of time for which the person is present in the location 2

If there are several locations where the individual could be present and still be at risk from the hazardous event then the total risk from the event can be summed from the risk at each location. Should other information (such as % of success of escape or evacuation; % of favourable winds etc.) become available, the overall IR figure can be progressively refined to keep account of these parameters. In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due regards to availability and reliability of data. To the average individual (normally this would be used for a typical worker on a specified site such as an offshore platform) IR = z(n/N)p p

1 3



42

Appendix A


where p1 = fatality probability z = event frequency n = the average number of persons present at the affected location N = the total workforce on site (all assumed to work for similar number of hours per week) and p = proportion of time for which the person is present on site 3

Should other information (such as % of success of escape or evacuation; % of favourable winds etc.) become available, the overall IR figure can be progressively refined to keep account of these parameters. In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due regards to reliability of available data. Tolerability of Individual Risk The tolerability of the Individual Risk deriving from above mentioned calculations (both “coarse” and “refined”) is evaluated against the risk matrices in Appendix B. In particular, it is compared with risk figures shown in the “row” 4 (single fatality) of Matrix B3; such figures are different when considering a “worker” or a “third party” (member of the public). Should the IR figure fall within either the “red” or the “yellow” region of the matrix, it is necessary to move it away or to reduce it respectively, by adopting risk reduction measures (e.g. introducing new “barriers”, improving the integrity of existing barriers, etc.). Risk to Groups Individual risk to specific persons may be low in particular situations but due to the large number of persons exposed, the possibility of fatality may be significant. In these situations it may be appropriate to determine the Potential Loss of Life(PLL). This is a measure of how many persons would become fatalities from a particular site or event, normally expressed over a period of time.



43

Appendix A


Calculation of PLL Consider a particular location at risk from a hazardous event nearby. The potential loss of life (PLL) from the event following realisation of the hazard is calculated as follows. The event frequency is z. PLL = zp n 1

where p1 = fatality probability

;z = event frequency

and n = the average

number of persons present at the affected location Tolerability of Risk to Groups When using a “consequence” figure which implies more than a single fatality, the “row” 5 (multiple fatalities) of Matrix B3 can be used as a reference for tolerability of the group risk. Societal Risk Societal risk expresses the risk to persons not employed or present at a workplace. The Societal Risk is usually taken into account once the Individual Risk and the Group Risk have been evaluated and suitably re-conducted into the “tolerability” area. Once the Individual Risk figure is found to be “tolerable” in Matrix B3, the Societal Risk can be assessed against “occupancy” levels of the area surrounding plants/assets. This is achievable by utilising the Matrix B4.



44

Appendix B


B – Risk Matrix - B1. Basic Risk Screening Matrix (Full Qualitative Approach)

Consequence

Increasing Annual Frequency 0

A

B

C

Rare

Unlikely

Credible

D

E

Practically y t i r e v e S

e l p o e P

. n o r i v n E

s t e s s A

n o i t a t u p e R

non‐

credible occurrence occurrence occurrence occurrence

Slight

Slight

Slight

Slight

health

effect

damage

impact

Reported for E&P industry

Has occurred at least once in Company

Has occurred several times in Company

Happens several times/y in Company

Happens several times/y in one location

Continuous Improvement

effect /

2

occurrence

occurrence Could happen in E&P industry

1

Probable Likely/Frequent

Minor health

Minor

Minor

effect /

effect

damage

Local

Local

Minor

Risk Reduction Measures impact

injury

3

4

Major health

damage

Local

effect /

effect

impact

PTD or 1

Major

Major

National

fatality

effect

damage

impact

High Risk 5

Multiple Extensive Extensive International fatalities

effect

damage

impact



45

T N E M E G G A N N I A T R M K O S P I E R R

Appendix B

E D S N H A

B2. Personnel (Task) Risk Assessment Matrix

y t i r e v e S

0

A

B

C

D

E

Not Applicable

Not Applicable

Could occur, when additional factors are present; otherwise unlikely.

Not certain to happen but an additional factor may result in an accident/ exposure.

Almost inevitable than an accident/ exposure would result

Almost inevitable that more than one accident/ exposure would result

Has

Has

Happens

Happens

occurred

occurred

several

several

at least

several

times a

times/y in

once in

times in

year in

one

Company

Company

Company

location

Personnel (Task) Risk

N/A

1

(NOT APPLICABLE)

N/A


Minor health effect / injury: offsite medical treatment or LTA;

2

up to 10 days off.

Risk Reduction Measure

Agents have reversible effects to health. Major health effect / injury: more than 1 LTA; up to 30 days off.

3

Agents have irreversible effects to health: noise, manual handling, toxics, etc. PTD or 1 fatality:

4

agents are capable of serious disability or death Multiple fatalities

5

from an accident or occupational illness

High Risk

(e.g. chemical asphyxiation or cancer or epidemic diseases)



46


Appendix B

E D S N H A

B3. Risk to People (Operations) Assessment Matrix

0

D

E

10‐6 to 10‐4 10‐4 to 10‐3 10‐3 to 10‐1 occ/y (1) occ/y (1) occ/y (1)

10‐1 to 1 occ/y (1)

>1 occ/y (1)

Could Reported for Has occurred Has occurred happen in E&P industry at least once several times E&P industry in Company in Company

Happens several times/y in Company

Happens several times/y in one location

<10‐6 occ /y (1) y t i r e v e S

1

People (Operations Risk) (usually in the open)

A

Slight health effect / injury

2

Minor health effect / injury

3

Major health effect / injury

B

C


Risk Reduction Measures

Compulsory reduction measures

4

Permanent Total Disability or 1 fatality

rd

High for 3 parties

(small exposed population)

onshore

Multiple fatalities

5

High Risk (exposed groups)

(1) frequency expressed in occurrencies per year



47


Appendix B

E D S N H A

B4. Societal Risk Matrix

Societal Risk

y t i r e v e S

1

0

A

B

(mbar) (based on

unobstructed

30 min

escape to

event

repair)

duration)

‐

< 30

Up to TLV

3

‐

30

‐6

<10 occ/y

‐4

‐

70

at railway stations

140

LC 1% hmn

Compulsory Risk Reduction Measures

(*)

No more than 500

in enclosures, 100

people in the open

at open, 1000

or 100 if mobility is people/day max. at railway stations

3

in enclosures, 100 people/day max.

mobility is

(*)

½ LFL

N. A.

Up to 500 people at open, 1000

open or 100 if

reduced. (*)

7

N. A.

occ/y

Continuous improvement

TLV

IDLH

N. A.

10 to 10 occ/y

Up to 500 people

5

‐3

10 to 10 ‐6

(assuming

<3

‐4

(ppm)

reduced. (*)

4

E

sure

2

(kW/m )

people in the

3

D

Radiation Flash Fire Overpres‐ Toxicity

No more than 500

2

C

3

2

Up to 1m /m in residential area. None in the open unless on monthly basis. (*)

2

Up to 500 people in Up to 1m /m in enclosures, 100 at residential area. None in the open

open, 1000

people/day max. at unless on monthly railway stations (*) basis. (*) 3

2

Up to 1m /m in

5

12.5

LFL

300

LC 50% hmn

residential area.

Up to 0.5m /m in

None in the open

residential area.

unless on monthly

(*)

3

2

High risk

basis. (*)

(*) Industrial, agricultural, artesian areas admitted



48

Appendix B


B5. Environmental Risk Matrix

y t i r e v e S

Environment

0

A

B

C

D

<10‐6 occ/y

10‐6 to 10‐

10‐4 to 10‐3

10‐3 to 10‐1

10‐1 to 1

occ/y

occ/y

occ/y

4 occ/y

E > 1 occ/y

Slight effect No stakeholder impact or temporary impact on


the area.

1

Involved area < 0.1 sq mile 3

Spill (1)< 1 m – no sensitive impact on ground.

Minor effect Some local stakeholder concern or 1 year for

2

natural recovery or impact on small no. of not

Risk reduction measures

compromised species. Involved area < 1 sq mile 3

S ill 1 < 10 m –im act on localised round.

Local effect Regional stakeholder concern or 1‐2 years for

3

natural recovery or 1 week for clean‐up or threatening to some species or impact on protected natural areas. 3

Involved area < 10 sq miles – Spill (1)< 100 m .

Major effect National stakeholder concern or impact on licences or 2‐5 years for natural recovery or up

4

to 5 months for clean‐up or threatening to biodiversity or impact on interesting areas for science. Involved area < 100 sq miles – Spill (1)< 1000 3

m.

Extensive effect International stakeholder concern or impact on

5

licences / acquisitions or > 5 years for natural recovery or > 5 months for clean‐up or reduction

High risk

of biodiversity or impact on special conservation areas.Involved area > 100 sq miles – Spill (1)> 3

1000 m .



49

Appendix B


B6. Asset Risk Matrix

Risks to Assets/Project Objectives y t i r e v e S

• •

costs in USD figures below shall not be combined for deriving the value of a human life!

0 ‐6

<10 occ/y

Slight damage

1

No disruption to operations/business.

A ‐6

B ‐4

‐4

C ‐3

D

‐3

‐1

E

‐1

10 to 10

10 to 10

10 to 10

10 to 1

occ/y

occ/y

occ/y

occ/y

>1 occ/y


Minor damage

2

Possible short disruption of operations/business:


repair cost < 200000; production downtime < 1 day. Local damage

3

The unit has been repaired/replaced to resume operations: repair cost < 2500000; production downtime < 1 week. Major damage Long time/Major change to resume

4

operations/business: repair cost < 25000000; production downtime < 3 months. Major inquiry for the damage cost. Extensive damage Total loss of operations/business.

5

Revamping necessary to resume the process:

High risk

repair cost > 25000000; production downtime > 3 months. Extensive inquiry for the damage cost.



50

Appendix B


B7. Reputation Risk Matrix

0

y t i r e v e S

Reputation

C

D

E

Reported

Has

Has

Happens

Happens

happen

for E&P

occurred

occurred

several

several

in E&P

industry

at least

several

times/y

times/y in

industry

once in

times in

in

one

Company

Company

Company

location

Non‐

Likely/

credible

Frequent Rare

Unlikely

Credible

Probable

occurrence

occurrence

Occurrence

occurrence

Slight impact

Continuous

Minor and short lived impact in the locality

improvement

Minor impact

2

B

Could

occurrence

1

A

Some loss of reputation in the area, which

Occurrence


should be recovered Local impact

3

Significant potential damage to the regional reputation Major national impact Serious/permanent damage to the ability of

4

the Company to sustain business position in the location, some broader implications for the Company Major international impact

5

Potential loss of future business position in

High risk

the location/region and or lasting significant damage to broader Eni image



51

Appendix B


Note: The reputation of the Company is linked and can be affected by HSE incidents or accidents of all types. Reputation consists of a combination of the characteristics, performance and behaviour of a Company and importantly for risk management, the perception of the Company. Although reputation can be considered as an ‘intangible’ asset, it is important because it can affect the ability of the Company to establish or maintain business at all stages of the development cycle. Therefore, actual or perceived HSE impacts can damage the reputation/the business of the Company and in turn tangible Company assets.



52

Appendix C


C – ALARP and Cost-Benefit Analysis ALARP Where risks are very low whether to personnel, the environment, assets or reputation then the situation may be considered acceptable. On the other hand where risks are high, good operating practices and often the law, requires that they be reduced. Where risk exists in the region in betw een, normally called the ALARP region especially where the risks are safety risks, a more structured approach is required. In the ALARP region a reduction in risk is justified unless it is grossly disproportionate to the benefits gained. In practice many risks fall in this region and so what is often known as an ALARP case should be made for each of these. Sometimes this is possible by discussion alone. For example, where hazardous activity is not known to have any safer alternative and where personnel exposure cannot be further reduced, an ALARP case may be presented in such terms without recourse to more detailed analysis. However where a range of protective measures exists each entailing some cost, unless the cost can be accepted, further analysis is required. This analysis is usually based on a cost-benefits analysis described below. Costs-Benefits Analyses A costs-benefits analysis requires a comparison between the total costs of carrying out an improvement to reduce or eliminate the risk, and the benefits gained. The costs and benefits are normally considered over the lifetime of the development/operating unit, or sometimes over the period for which the costs of the improvement can be written off. The costs of an improvement can normally be estimated with some accuracy. The simplest way of doing this is to take the total cost as it is. This works well if the development has a limited operating life. If the operating life is longer the true



53

Appendix C


cost of the improvement may include the effective cost of “borrowing” the money over the relevant time period. Benefits are effectively the losses that are, on average, avoided by implementing the improvement. Benefits are harder to estimate than costs. For risks to assets, the benefits may be easiest to judge. The losses that are avoided include the capital losses of the damaged/destroyed facilities, reconstruction costs and the loss of operating profits. For risks to personnel the easiest approach is to place a monetary value on technical and operational e fforts made to save human life. It is implicit to this approach that low-cost measures are implemented in any case. Costs-benefits analyses are very difficult to perform where the principal risks are to the environment or to reputation due to the difficulties in estimating the benefits obtained from improvements in these areas. Limitations of Costs-Benefits Analyses ALARP type arguments cannot and must not be made as a means of avoiding basic levels of protection to personnel. It is a requirement of many laws and codes and standards that some means are available to allow personnel who may be exposed to a reasonably foreseeable hazard, of saving their life. Examples are lifejackets, lifeboats and liferafts on boats and offshore installations, lifejackets and breathing masks on airplanes, and fire alarm systems, and escape stairs in buildings. In particular, ALARP type arguments cannot be used to avoid providing systems such as these or to reduce the number of such systems/equipment items.



54

Appendix D


D- Risk Report User’s Guide Here following a user’s guide on the Risk Report; the Risk Report Checklist is in the Attachment A to the present Professional Operating Instruction (opi sg hse 001 e&p r01 AttA). Scope of this guide is to provide, by using a simplified approach, the main steps for filling in the Risk Report form. S TE T EP 1 : S e l e c t i o n o f t h e R i s k A r e a s

Four Areas of Risk have Risk have been identified: 1. Social Aspects 2. Environment 3. Safety 4. Health For each Area of Risks, some sub-areas (e.g.: 1.1, 1.2, 1.3 …) have been identified. The Areas of Risks are reported in the column A. A. S TE TE P 2 : S e l e c t i o n o f H a z a r d C a t e g o r y a s s o c i a t e d t o t h e A r e a s o f R i s k

For each Risk Area, some Hazard Categories Categories shall be addressed (in doing this use the associated drop down menu in the column B). B). Other risk areas and categories shall be added to the list, depending on specific local conditions, selecting the line “Others “ Others”” and writing directly in the relevant boxes. It is important to fill in each Area of Risk (none shall be omitted) and their associated Hazard Risk category; if some of them are not applicable, specify the reasons.



55

Appendix D


S TE T E P 3 : I d e n t i f i ca ca t i o n o f P o t e n t i a l I m p a c t

For each Risk Area, the Potential Impacts shall Impacts shall be defined. Impacts could be on People ‹P›, Environment ‹E›, Assets ‹A›, Reputation ‹R› ‹R› or more than one of these. Select in the drop down menu in in the column C the highest among these impacted objects.

S TE T E P 4 : Ev Ev a l u a t i o n o f C o n t r o l s / B a r r i e r s i n p l a c e

An exhaustive list of controls/barriers have been already identified. They have been divided into hardware controls (HC) and operational controls (OC), and in turn, into preventive and recovery controls. controls. (see reference keywords sheet sheet in the form of Risk Report). Once the controls/barriers have been identified and selected, note P (Preventive ( Preventive) ) or R (Recovery) (Recovery) in the column D, D, and thick them in the drop down menu in column E (describing E (describing them as a free text in the available box).



56

Appendix D


HC2.3. Liquids containment and drainage sys tem diked areas around tanks, hazardous drain syst ems different from non-hazardous ones HC3.6. Fire Detection Sys tem fire detectors and gas detectors are linked to the ESD system (not in automatic mode) HC4.1. Act ive emergency equipment (firefighting, anti-pollution, standing-by emergency d firefighting system: ring main, fire hydrants, fire trucks

S TEP 5 : R i s k A n a l y s i s

For each identified hazard, the evaluation of the associated risk shall be addressed in terms of frequency of occurrence and severity. The risk evaluation will be carried out through analysis of the preventive and recovery barriers in place as already selected in the previous step. The

Current

Risk

figure

is

expressed

as

“Frequency”

x

“Severity

of

consequences”. For the evaluation of Frequency, it is possible to apply one of the following: 1. Predictive Method: if no incident referred to the selected hazard has been experienced in the last 3 yrs 2. Reactive Method: if an incident (real or potential) referred to the selected hazard has been experienced in the last 3 yrs



57

Appendix D


THE PREDICTIVE METHOD IS BASED ON: (Use the Table 1) 

No. of risk frequency barriers (preventive barriers only)



Reliability of these barriers. elements: 1. 2. 3.

The reliability is proven by three basic

its absence was a cause of accident in the past – if yes, thick in the dedicated box G it is standardized - if yes, thick in the dedicated box H it is kept in good condition – if yes, thick in the dedicated box I

From the combination of these three elements, it is possible to derive the probability of occurrence of the selected hazard, as follow:

o

No. 1 “yes” only: Low reliability

o

No. 2 “yes”: Medium reliability

o

No. 3 “yes” : High reliability

Table 1

When two barriers are not independent, the lowest reliability prevails.



58

Appendix D


The final evaluation of the frequency, as deriving from the Table 1, shall be reported in column N of the form. THE REACTIVE METHOD IS BASED ON: (Use the Table 2)



Statistics of the last decade incidents related to your Company

Table 2 The frequencies, defined in table 2, are reported in J, K, L, M column of the form respectively. The final evaluation of frequency shall be reported in column N of the form. The Predictive and Reactive Methods can be applied together (if justified) and the worst figure be adopted.



59

Appendix D


In case there is no eviden ce of control in pl ace - Reactive Method (see attached Risk Screening Matrix Table 2)

Has the event al ready Has the event al ready Has the event a lready Has the event already occurred at least once in occurred several times in occurred several times a occurred several times a the last 10 years in the the last 10 years in the year in the Company? year in one facility? Company? Company? Probability = D Probability = E Probability = B Probability = C

For the evaluation of Severity of Consequences it is possible to proceed as follows: 1.

Define, with the help of Table 3, What could have happened in more adverse conditions ( worst potential consequences rather than real ones);



60

Appendix D


Table 3

2.

Consider the risk severity mitigation barriers in place (recovery barriers only) and evaluate their reliability.

The reliability of a recovery barrier is based on three basic elements: 1.

its absence was a cause of escalation of an accident in the past - if yes, thick in the dedicated box G

2.

it is standardized for the specific risk( fit –for-purpose) – if yes, thick in the dedicated box H



61

Appendix D


3.

it is kept in good condition(ready to intervene)- if yes, thick in the dedicated box I.

From the combination of these three elements, it is possible to derive the ability of the barrier to reduce the severity of an accident, according to the following criteria: •

No. 1 “yes” only: Low reliability;

•

No. 2 “yes”: Medium reliability;

•

No. 3 “yes” : High reliability

Description

Does 3 years accident records show failure of this control has been a contributor to an event?

Is this control covered by technical specifications/dedicated work instruction?

Is this control subject to periodical mai ntenance or periodical review/audit?

HC2.3. Liquids containment and drainage system diked areas around tanks, haz ardous drain systems different from non-hazardous ones HC3.6. Fire Detection System fire detectors and gas detectors are linked to the ESD system (not in automatic mode) HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency d firefighting system: ring main, fire hydrants, fire trucks

No. 2 Medium reliability barriers are equivalent to 1 High reliability barrier. When two barriers are not independent, the lowest reliability prevails. An High reliability barrier only is able to reduce the severity by one order of magnitude. All other combinations have no effect. The severity shall be reported in the column O of the form. The Frequency and the Severity of the event’s consequences will allow, entering in the Risk Matrix (Figure 1) to define the Risk Area.



62

Appendix D


Co n s e q u e n c e

I ncreasing Annu al Frequency

0

y t i r e v e S

e l p o e P

. n o r i v n E

s t e s s A

n o i t a t u p e R

A

B

2

3

4

5

Slight health effect / injury Minor health effect / injury Major health effect / injury PTD or 1 fatality

Slight effect

Slight damage

Minor effect

Minor damage

Local effect

Major effect

Local damage

Major damage

D

E

Practically nonRare Unlikely Credible Probable Likely/Frequent credible occurrence occurrence occurrence occurrence occurrence occurrence

Could

Reported

Has

Has

Happens

Happens

happen

for E&P

occurred

occurred

several

several

in E&P

industry

at least

several

times/y

times/y in

once in

times in

in

one location

Company

Company

Company

industry

1

C

Slight impact

Co n t i n u o u s I m p r o v e m e n t

Minor R i sk R e d u c t i o n M e a s u r e s

impact

Local impact

National impact

High Risk

Multiple Extensive Extensive International fatalities effect damage impact

Figure 1- Risk Matrix

The risk may fall in the “red region” (High Risk); in the “orange region” (MediumHigh); in the “yellow region” (Medium Risk) or in the “light blue” region (Low Risk). In detail, the following definition/criteria shall be adopted:



63

Appendix D


1.

High risk( criticality risk area): The level of risk is not acceptable and risk control measures are required to move the risk figure to the previous regions. For operating fields the risks could be recovered in a maximum 1Y provided that interim Operational Measures are adopted.

2.

Risk reduction measure (Medium–High; criticality area): The level of risk shall be mandatorily reduced applying suitable corrective measures, provided that is demonstrated that the implementation of such measures is not disproportionate to the benefits (ALARP). A discussion of ALARP and cost-benefits analysis is given in Annex C. For oper ating fields the risks could be recovered in a maximum 4Y period.

3.

Risk reduction measure (Medium tolerable area ): The level of risks that requires generic control measures.

4.

Continuous improvement( Low tolerable risk area): The level of risk is that requires continuous monitoring to prevent deterioration.

Insert the color (RED, ORANGE, MEDIUM, and LIGHT BLUE) of the Risk, in the column P of the form.

Current Risk Figu res

Frequency

Severi ty

C

4



Ri sk

64

Appendix D


S TEP 6 : R i s k T r e a t m e n t

Taking into consideration the Risk Area, mitigation measures shall be put in place (in addition to controls/barriers in place). It is mandatory to define the mitigation measures for High and High-Medium Risks; the implementation of mitigation measures are recommended for Medium Risk if they are effective to move the risk in “light blue” region ( Low risk). Identification of effective risk mitigation measures (controls) are needed to reduce the frequency (in case of preventive controls/barriers) or to mitigate the consequence of an accident (in case of recovery controls/barriers). Once the mitigation measures have been identified and selected, note P (Preventive) or R (Recovery) in the column Q of the form. The description of the mitigation measures selected in the drop down menu will be reported

in

column R , specifying in column S if the mitigation measures are independent from the previous (existing) controls.

Independence is granted if the new control has no element in common with the previous ones, including the controls already in place. Examples are: •

A fire emergency team is not independent from a firefighting system.

•

An ESD system is not independent from a depressurization system in case of gas release. Measures to be Impl emented

Preventive/ Recovery

Description Is the measure independent from the previous control/measures



65

Appendix D


OC4.2. Scenario-based Contingency Plans R update the contingency plans and reinforce the emergency drills; ensure follow-up from drills. OC2.2. Safety Engineering Design P

review/upgrade of firefighting design and construction (in particular, relocation of Brass fire pump), assignment of relevant c ontracts and installation/commissioning.

NOTE: if a Preventive Measure is NOT independent from a Recovery Measure, the prevailing purpose of the measure as a whole (either Preventive or Recovery) is adopted.

S T EP 7 : M o n i t o r i n g a n d f o l l o w u p

For the implementation of the identified mitigation measures, it is mandatory to assign: 1.

Responsibility for the implementation of action – column T

2.

Budget allocation- column U

3.

D-line for the close out of the actions – Column V

4.

KPI for the monitoring- Column W

Responsibil ity Assigne d for Measure Impl ementation (indicate Dept.)

Budget Allocation

CRV, EME

Deadlin e for Close-out (dd/mm/yyyy)

KPI adopted to monitor progress?

end 2012 None

Project, ENG

SHERPA Database end 2013 Investment Database



66

Appendix D


For the evaluation of the residual Frequency and Severity of the risk, it is essential to consider the effective date of actions close-out. Prior to that date, the current risk does not change at all. Report the results in columns X and Y of the form. Residual Risk @

30 / 06 / 2013 Frequency

Severi ty

C

Ri sk

4

Once the mitigation measures have been fully implemented, it is necessary to reevaluate the risk. To do this, follow the same methodology described in steps 4 and 5: Description

Does 3 years accident records show failure of this control has been a contributor to an event?

Is this control covered by technical specifications/dedicated work instruction?

Is this control subject to periodical maintenance or periodical review/audit?

HC2.3. Liquids containment and drainage system diked areas around tanks, hazardous drain systems different from non-hazardous ones HC3.6. Fire Detection System fire detectors and gas detectors are linked to the ESD system (not in automatic mode) HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency d firefighting system: emergency preparedness has proven to be improved, fire pump in Brass has been relocated and firefighting network has been refurbished.



67

OPI.sg.HSE.001.E&P_HSE Risk Management and Risk Reporting - Rev. 01

Recommend Documents