HID’s approach to 'As low As Reasonably Practicable' (ALARP) decisions

(SPC/Permissioning/09)

Purpose

This note summarises the approach that HID expects inspectors to take when making case-specific decisions on whether risks are as low as reasonably practicable (ALARP) during assessment of safety cases/reports (or other formal documents) or enforcing compliance with the law. This note does not cover the normal management arrangements (adequate supervision, peer review, etc.) that are in place to ensure that the approach is properly implemented.

Background

Hazardous Installations Directorate’s (HID’s) approach to ALARP decisions mirrors that explained in “Reducing Risks, Protecting People (R2P2); HSE’s decision-making process” and “Principles and Guidelines to assist HSE in its judgements that duty holders have reduced risks as low as reasonably practicable”.
R2P2 emphasises that people increasingly rely upon regulators like HSC/E as a source of reassurance about the arrangements put in place by duty holders for protecting people. If that trust is not to be threatened, HID must properly discharge its function to ensure that duty holders have put in place all necessary measures to prevent major accidents and limit their consequences.
HID’s approach to ensuring compliance with the requirements of the permissioning regimes within its remit needs to be fully consistent with the Governments Enforcement Concordat as amplified in HSC’s enforcement policy statement.
HID’s approach to ALARP decisions needs^[1] to ensure that all staff involved in case-specific ALARP decisions:

and proportionality issues); and
accept and share HSE’s approach to these matters.

Interpretation of the legal basis of ALARP judgements

Generic guidance on the legal basis for making ALARP judgements is given in the HSE principles and guidelines document. The main points are:

Reducing risks ‘so far as is reasonably practicable’ (SFAIRP) or ‘as low as is reasonably practicable’ (ALARP) call for the same tests to be applied. It follows that when risks are SFAIRP they are also ALARP.
It is the risk posed by reasonably foreseeable hazardous events from the duty holders’ work activities to employees and others not in their employ that have to be addressed.
On the basis of case law, ALARP decisions require an assessment of the risk that might be avoided;

an assessment of the sacrifice (in money, time and trouble) involved in taking further measures to avoid that risk;
the benefits derived from those further measures (in terms of fatalities, etc. avoided); and
a comparison of the two relative to the baseline risk.

The sacrifice (normally expressed in monetary terms) is that needed to implement additional measures to reduce risks. Benefits gained by duty holders (eg reduced plant replacement costs) should be offset against costs. The comparison is between the net sacrifice and the benefits of risk reduction (lives saved, reduced costs of the emergency services etc). The assessment needs to be proportionate (see sector specific guidance for further information on proportionality).

For a measure to be not reasonably practicable the degree of disproportion between costs and benefits must be gross ie the test of gross disproportion. The HSE ALARP guidelines states that in all cases ‘the disproportion must always be gross’ but does not define what is gross. However, it suggests an examination of what was done in comparable circumstances may be useful in coming to a view.
Both individual risk and societal risk (or societal concern in certain, well defined circumstances; (see Annex) should be considered when applying the test of gross disproportion. Individual Risk should be addressed in terms of hypothetical people at greatest risk. For onshore activities, this includes people off-site. Societal concern arises when an accident with adverse socio-political consequences occurs eg the Ladbroke Grove incident (30 fatalities) which resulted in a public inquiry, raised concerns about the performance of the rail industry and the regulator and lead to major cost and staffing repercussions for HSE. However, only societal risk should be taken into account when making the comparison for a particular ALARP demonstration. The other elements of societal concern are taken into account when developing the regulatory framework.
If a measure results in a transfer of risk to other people, the added risk to those people should be offset against the benefits the measures provide. For example, reducing the inventory of a hazardous substance by “just-in-time” delivery in road tankers rather than storage on site may be a transfer of risk. The added risk to those on the transportation route must be considered when making the ALARP decision but only to the extent over which the duty holder exercises control.
Relaxation of control measures will be exceptional, eg when new evidence shows that a substance is far less toxic than originally thought or when there is a significant reduction of the number of people at risk.
Inspectors should ensure that relevant good practice is in place. This can be found in Approved Codes of Practice (AcoPs), HSE guidance, recognised standards, and industry practice appropriate to the duty holders’ activities. This is the minimum compliance standard. Good practice may not exist for, or be relevant to, some hazards that are regulated through safety case regimes or may exist but be of insufficient scope to fully meet the ALARP standard e.g. for onshore industries, most guidance does not adequately deal with risks to the public.
Where good practice fully meets the ALARP requirements, the duty-holder is relieved of the need (but not the legal duty) to take explicit account of individual risk, costs, technical feasibility and the acceptability of residual risk, since these will have been considered when the good practice was established. The duty holder has to demonstrate that the good practice is relevant and up-to-date.
There is a continuing duty for duty holders to keep risks and possible risk reduction measures under review to take account of changing circumstances, advances in technology, new knowledge and information. Good practice may change over time; new technology may make a higher standard reasonably practicable. Application of the ALARP principle means challenging the adequacy of existing measures and considering any additional identified practicable measures.
When a number of options for risk reduction exist all options, or combination of options, that are reasonably practicable must be implemented. The legal requirement to reduce risks as low as is reasonably practicable rules out HSE accepting a less protected but significantly cheaper option. At the design stage a life-cycle approach should be adopted. (ALARP in Design – Policy and Guidance)
Evaluation of each of the different options, or combination of options, available for controlling a particular hazard should be made against the same baseline case.
It may not be reasonably practicable to retrospectively apply a measure to an existing plant, that would be required to reduce risks ALARP for a new plant (even if that measure has become, in effect, good practice for every new plant). Whether the measure can be applied, or not, will depend on the site-specific circumstances, the risk levels, and whether the costs of the measure are grossly disproportionate.

making ALARP judgements

HSE is only concerned with the risks to people although we should be mindful that measures intended to reduce risks to people may conflict with the need to reduce risks to the environment. For the risks to people to be reduced ALARP all necessary measures must be in place. HID will assess this by scrutinising the duty holders conclusions that:

the risks to workers – Health and Safety at Work (HSW) Act S2 risks – are ALARP; and
the risks to people not in their employ – HSW Act S3 risks – are ALARP.

Some duty holders may regard this as a new approach, but it is not; being inherent in the 1974 Health and Safety at Work Act.

Judging whether risks to people are ALARP

Under the legislation specific to HID, as for the HSW Act, it is for duty holders to demonstrate that the necessary measures are in place to reduce risks ALARP, and for HID to assess that demonstration and/or verify through inspection that duty holders are complying with their legal obligations. How duty holders make the demonstration is for them to decide, but clearly they, at least, need to address the arguments that are outlined in HSE’s approach (see R2P2, particularly Part 3) to decision taking in respect of tolerability of risk.
HID will therefore expect that:

both the level of individual risk and the societal risks created by the activity or process are taken into account – in a proportionate way - when deciding whether a risk is unacceptable, broadly acceptable, or tolerable if ALARP;
the decision-making process and criteria adopted by duty holders are such that action taken is inherently precautionary, i.e. when the degree of uncertainty is large or the consequences of the worst-case scenario give rise to significant societal risks, measures that are “prima-facie reasonable” should be implemented.

In the interests of transparency and consistency, HID Inspectors should consider HSW Act S2 and S3 risks separately (if appropriate) and proportionately. However, the approach for S2 and S3 risks is identical:

First consider the site-specific circumstances and decide whether the implementation of relevant good practice makes the risks ALARP; if so implementation of those requirements and those of COMAH (MAPP etc) will suffice.
When good practice is insufficient to make the risks ALARP, duty holders must consider all risk reduction options, and implement all those that are reasonably practicable or are necessary to reduce risks to a broadly acceptable level. Demonstrations that the costs of implementation are grossly disproportionate must be proportionate and consider both individual risk and societal concerns.

If neither HID nor the operator can identify further prima-facie risk reduction measures, over and above the measures described in the duty holders demonstrations, then the risks are ALARP. Views on options for risk reduction measures are a team effort; face-to-face discussions with the duty holder are required whenever the societal risks are appreciable.

Judging gross disproportion

HSE has not provided any specific guidance, but the disproportion must be gross for all possible options. Consistent and proportionate judgements can be supported by the R2P2 TOR framework (see R2P2 paragraphs 118 et seq.) by considering individual and societal risks separately. If either consideration indicates that a risk reduction option is reasonably practicable it must be implemented. The judgement on gross disproportion must be a collective one by the assessment team (AT) in the case of safety case/report assessment or by the Inspection team in the case of enforcement action.
Consideration of costs and benefits requires estimates of the likelihood and consequences of particular accidents. Both estimates involve uncertainty, which in the case of event frequency may be an order of magnitude or more. Many decisions can be made by exercising professional judgement based on estimates of the costs of a measure and the number of casualties saved by implementation, possibly informed by a crude cost benefit analysis (CBA).
R2P2 (paragraphs 101-108 and Annex 3), discusses CBA and the estimation of the cost of preventing a fatality (CPF, i.e. the total final cost of the risk reduction measure divided by the total fatalities prevented). By comparing this with the value of preventing a fatality (VPF, ~£1m) an estimate of the proportion factor i.e. CPF/VPF can be made (this should not be confused with proportionality which relates to depth of assessment, etc.). When the proportion factor is 1 or less (or even 2 or less)^[2] the measure must be implemented, even when the risks are close to being broadly acceptable. Judgement on whether the proportion factor is grossly disproportionate depends on the levels of individual and societal risks (and possibly the societal concern in certain circumstances). Inspectors should also consider the significance of uncertainties in the calculation of CPF.
Providing the risk analysis is based on cautious best estimates and the costs are realistic (not needlessly inflated beyond the provision of a fit for purpose solution), HID will use the following as the basis for exercising judgement:

The proportion factor is at least 1 (and possibly at least 2) for risks which are close to being broadly acceptable risks.
The proportion factor is at least 10 at the tolerable/unacceptable risk boundary.
For risks between these levels the proportion factor is a matter of professional judgement, but the disproportion between CPF and VPF must always be gross for a measure not to be reasonably practical.

HID will (see Principles and Guidelines document, paragraph 34) attach more weight to consequences where a hazard has attributes which makes it likely that it will give rise to societal risks, such as the potential for severe detriment, eg a major explosion in a built-up area. Other factors such as vulnerable groups where societal concerns have previously been expressed will also be considered as appropriate. For example, for Land Division sites, the number of children and elderly persons likely to be affected, and the presence of hospitals and schools may be an input to the ALARP decision.
HID will expect new technology to be implemented in line with HSC/E policy on harnessing new technology, unless gross disproportion can be demonstrated unequivocally (see R2P2, text box after paragraph 118).
The precautionary principle (see R2P2 paragraph 91) will be invoked where:

there is good reason, based on empirical evidence or plausible causal hypothesis, to believe that serious harm and societal risk might occur, even if the likelihood of harm is remote; and
the scientific information gathered during the risk assessment is sufficiently uncertain (see R2P2 paragraphs 86 et seq) to make it impossible to confidently rule out a particular measure by CBA considerations.

HID expect that the vast majority of decisions can be made relatively quickly once a safety case/report or other form of demonstration has been assessed. Risk reduction measures that are judged prima facie reasonable should be discussed with the duty holder and the way forward agreed. HID expects inspectors to take a “firm but fair” line to ensure that HID and HSC/E policy on enforcing what is required by the regulations is not compromised.
A significant shift in societal concern following the accident or the recommendations from a public inquiry could have financial consequences for HID regulated activities because measures which were deemed grossly disproportionate before the accident may no longer be considered to be so after the accident. An example may be the requirement to mound certain Liquefied Petroleum Gas (LPG) tanks where passive protection might previously have been considered adequate. A second example might be a requirement for dedicated stand-by vessels for offshore platforms where previously these had been shared between a number of installations.

Further information

For further information, please contact HID CD2.4 (0151 951 3411).

ANNEX

Societal concern and societal risk

(Adapted from R2P2, see paras. 25-27 and 134-136)

Societal concern is often associated with hazards that give rise to risks which, were they to materialise, could provoke a socio-political response, eg risk of events causing widespread or large scale detriment or the occurrence of multiple fatalities in a single event^[3]. Typical examples relate to large chemical plants, nuclear power generation, railway travel, or the genetic modification of organisms.
Duty holders’ action on societal concern is limited (see paragraph 7 of R2P2) to instituting the measures set out by HSC/E in the control regimes which are required by regulations enacted to address the hazard concerned, and in associated guidance. Societal concern is addressed by ensuring that societal risks are ALARP or broadly acceptable. This requires due weight to be given to societal concern when deciding whether the costs of further risk reduction are grossly disproportionate or not.
Hazards giving rise to societal concerns share a number of common features. They often give rise to risks which could cause multiple fatalities; where it is difficult for people to estimate intuitively the actual threat; where exposure involves vulnerable groups, eg children; where the risks and benefits tend to be unevenly distributed - for example between groups of people with the result that some people bear more of the risks and others less, or through time so that less risk may be borne now and more by some future generation. People are more averse to those risks and in such cases are therefore more likely to insist on stringent Government regulation. The opposite is true for hazards that are familiar, often taken voluntarily for a benefit, and individual in their impact. These do not as a rule give rise to societal concerns.
In addition to the direct societal concerns about the impact of the hazards on those affected, there is also, and importantly, a concern that, in the wake of an event giving rise to such concerns, confidence in the provisions and arrangements in place for protecting people against risks to health and safety, and the institutions responsible for setting out and enforcing these provisions and arrangements, would be undermined, however remote was the chance of the event happening in the first place. The result would be a consequential loss of trust by the public not only in the duty holders with the primary responsibility for reducing the risk, but also in the regulator and Government - even if current provisions and arrangements were very good.
HID attaches more weight to consequences where a hazard has attributes which makes it likely that it will give rise to societal risks, such as the potential for severe detriment, eg a major explosion in a built-up area. Gauging the extent of the societal risks caused by such a hazard is likely to be a major consideration when deciding whether the costs of risk reduction are grossly disproportionate or not.
When making comparisons with previous decisions on gross disproportion at a site, Inspectors need to consider whether changes are warranted and, if so, what. For example, levels of protection that were considered at the time to be good practice may no longer be regarded as such as a result of new knowledge, advances in technology or changes in the level of societal concerns.
Developing criteria on tolerability of risks for hazards giving rise to societal concerns is difficult. Hazards giving rise to such concerns often involve a wide range of events with a range of possible outcomes. Estimating the ‘cost’ of the detriment may call for the attribution of weighting factors for which, at present, no generally agreed values exist as, for example, the death of a child as opposed to an elderly person, dying from a dreaded cause, eg cancer, or the fear of affecting future generations in an irreversible way.
Nevertheless, HID has adopted the criteria below (see R2P2 paragraph 136) for addressing societal concerns arising when there is a risk of multiple fatalities occurring in one single event. These were developed through the use of so-called FN-curves (obtained by plotting the frequency at which such events might kill N or more people, against N). The technique provides a useful means of comparing the impact profiles of man-made accidents with the equivalent profiles for natural disasters with which society has to live. The method is not without its drawbacks but in the absence of much else it has proved a helpful tool if used sensibly^[4]. Moreover, the criteria are based on an examination of the levels of risk that society was prepared to tolerate from a major accident affecting the population surrounding the industrial installations at Canvey Island on the Thames. Reports on the risk from the installations at Canvey Island were discussed in Parliament, and (after improvements) the risk was deemed by Ministers to be just tolerable. The limit was subsequently endorsed by the HSC’s Advisory Committee on Dangerous Substances in the context of major hazards transport^[5]. These criteria are, however, directly applicable only to risks from major industrial installations.
Thus, where societal concerns arise because of the risk of multiple fatalities occurring in one event from a single major industrial activity^[6], HID proposes the following basic criterion for the limit of tolerability. HID proposes that the risk of an accident causing the death of fifty people or more in a single event should be regarded as intolerable if the frequency is estimated to be more than one in five thousand per annum. This enables criteria for case societal risk to be defined:

The unacceptable region: the region above the line of slope –1 through this point on the lnF v lnN plot; and
The broadly acceptable region: the region below a line two orders of magnitudes below and parallel to the above line.
The tolerable if ALARP region lies between these two lines.

When several sites contribute to the local societal risk, the unacceptable region will be taken as an order of magnitude above the corresponding line for case societal risk.

[1] See Civil Service Commission recommendations on the BG Armada safety case

[2] Bear in mind that the disproportion must always be gross, 2 may not be significantly different from 1 when uncertainty is considered.

[3] Societal risk results from the occurrence of multiple fatalities in a single event. Societal concern includes other issues as well as the numbers affected. Societal risk is therefore a subset of societal concerns.

[4] For a review of the merits and disadvantages of FN curves - see Ball D. J. and Floyd P J (1998), Societal risks. Report available from the Risk Policy Unit, HSE.

[5] HSC, Advisory Committee on Dangerous Substances, Major hazard aspects of the transport of dangerous substances, 1991, ISBN 0 11 885676 6.

[6]Here a single major industrial activity means an industrial activity from which risk is assessed as a whole, such as all chemical manufacturing and storage units within the control of one company in one location or within a site boundary, a cross-country pipeline, or a railway line along which dangerous goods are transported.

This guidance is issued by the Health and Safety Executive. Following the guidance is not compulsory and you are free to take other action. But if you do follow the guidance you will normally be doing enough to comply with the law. Health and safety inspectors seek to secure compliance with the law and may refer to this guidance as illustrating good practice.

COMAH home