The purpose of this document is to describe how the Competent Authority's Assessors test whether COMAH safety reports meet the criteria that apply to the predictive aspects of COMAH. It provides background information on hazards from chemical warehouses, and an interpretation of the criteria based on useful examples. The information supplements rather than supplants that in the safety report assessment manual.
It is assumed that the Assessor is fully familiar with:-
Before assessing a safety report an Assessor needs to be clear about:-
These issues are outlined in the remainder of this Introduction and are revisited as appropriate in later sections of the guidance.
The predictive assessment is pivotal to the demonstrations required under Section 4, Part 1, paragraph 2 of the COMAH Regulations; particularly the need to demonstrate that:-
The Assessor's role relates solely to the risks to people both on-site and off-site. Risks to the environment are for the Environment Agencies and are not addressed here.
When the assessment of the predictive aspects of a safety report is complete, the Assessor should return the completed assessment form to the Assessment Manager giving conclusions about whether:-
The assessment form allows Assessors to comment against each criterion and subcriterion. This guidance is designed to help provide consistent comments and conclusions and is structured in terms of questions which relate to the criteria and help to identify any weaknesses in the safety report. These should help Assessors to write succinct 'deficiency' statements and make clear what is required eg further information or analysis or both.
When filling in the assessment form the paragraph number and page number in the report should be shown for cross referencing purposes. For example:-
| Criterion | Safety report refs | Comments | Issue* category |
|---|---|---|---|
| 3.3 The safety report should identify all potential major accidents and define a representative and sufficient set for risk analysis | pxx
para yy |
The safety report does not identify catastrophic vessel failure leading to total loss of contents as a potential MA. The report fails to meet criterion 3.3; the Operator has to provide more information. | Decided by team at final meeting |
* The Issue category relates to the inspection plan only.
The assessor must also provide input to the assessment team conclusions on whether the prevention and mitigation measures make risks ALARP.
The assessment approach needs to be proportionate and consistent (HSC 1995; HSE 1999), therefore Assessors should come to a view on proportionality before starting to assess a report against the predictive criteria.
Consistency does not mean uniformity. It means taking a similar approach in similar circumstances to achieve similar ends. For some, professional judgement may need to be exercised in order to come to a decision on whether the demonstrations in the report are fit for purpose when assessed against the predictive criteria. The criteria and the associated guidance are designed to help Assessors exercise this judgement in a consistent way. Occasionally they may need to discuss some issues with HID colleagues who are familiar with the site, the land use planning situation, or the Operator's approach to discharging his Section 3 responsibilities, before reaching a decision.
The assessment team have a key role to play in achieving consistency in the overall assessment of safety reports and in the drawing of the Competent Authorities (CAs) conclusions. Other ways of achieving consistency include;
Proportionality is a fundamental consideration when exercising judgement on whether assessment criteria are met or not. HSE guidance (HSE 1999b) on the COMAH Regulations (paragraph 74) states that 'there must be some proportionality between the risk and the measures taken to control the risk. The phrase "all measures necessary" will be interpreted to include this principle'.
Proportionality is essentially determined by the severity of the worst possible consequences, ie those resulting from the worst case scenario, and the levels of risk (individual and societal), that remain after taking account of the prevention and mitigation measures the Operator has put in place. The following factors (see also paragraph 292 of HSG 190), are therefore important:-
Proportionality should influence the aspects on which Assessors focus the most attention ie the issues where the occupier is expected to provide convincing arguments to support the demonstrations. Information in the safety report should enable Assessors to fully understand site specific circumstances (on-site and off-site), so that a view on proportionality can be reached. The report should therefore describe the processes, the hazardous substances involved and their effects on people, the distribution of people off-site, and the numbers of people on-site and their distribution in relation to the various installations.
To reach a view on proportionality the Assessor needs to know the potential maximum injury toll. Schedule 4, Part 2, Paragraph 4(b) requires the Operator to determine the extent and severity of the consequences of identified major accidents. Schedule 7 defines injury severity that constitutes a major accident. The threshold is a single death, six persons on the establishment hospitalised for at least 24 hours; or 1 person off-site hospitalised for at least 24 hrs. Severity therefore includes fatal and serious injury (ie hospitalisations) as a minimum. Operators must include the severity of the consequences for the worst case event in terms of expected numbers of fatalities and serious injuries in their accident consequence analysis. Less severe injuries should also be considered eg minor injuries.
Proportionality should influence the aspects on which Assessors focus the most attention ie the issues where the occupier is expected to provide convincing arguments to support the demonstrations. Information in the safety report should enable Assessors to fully understand site specific circumstances (on-site and off-site), so that a view on proportionality can be reached. The report should therefore describe the processes, the hazardous substances involved and their effects on people, the distribution of people off-site, and the numbers of people on-site and their distribution in relation to the various installations.
To reach a view on proportionality the Assessor needs to know the potential maximum injury toll. Schedule 4, Part 2, Paragraph 4(b) requires the Operator to determine the extent and severity of the consequences of identified major accidents. Schedule 7 defines injury severity that constitutes a major accident. The threshold is a single death, six persons on the establishment hospitalised for at least 24 hours; or 1 person off-site hospitalised for at least 24 hrs. Severity therefore includes fatal and serious injury (ie hospitalisations) as a minimum. Operators must include the severity of the consequences for the worst case event in terms of expected numbers of fatalities and serious injuries in their accident consequence analysis. Less severe injuries should also be considered eg minor injuries.
Proportionality will influence the type and level of analysis detail that Assessors might expect to underpin the various demonstrations in the safety report (see paragraph 292 of HSG 190). HSG 190 gives the following RA definitions:-
Criterion 3.6 addresses the "all necessary measures" demonstration, which is essentially an ALARP demonstration. In general, decisions on whether risks are ALARP for major hazard installations are based on the generalised Tolerability of Risk (TOR) Framework (HSE 1992, HSE 1999 - the latter being referred to as R2P2 below). For nuclear hazards there is considerable experience in making such ALARP decisions, but the mechanisms for other hazards are still evolving (see HSE 1999). Nevertheless some companies have adapted the TOR framework to devise their own major hazard risk criteria. Whatever approach is used, professional judgement is usually needed; the team approach to assessment should help achieve consistency in such decisions for top-tier COMAH sites.
The Operator's ALARP demonstration should be founded on the degree to which good practice, engineering standards, recognised codes, guidance and standards, etc have been adopted. The control measures introduced by this process will be usually satisfactory for low hazard sites. In terms of the TOR framework this amount to using technology-based criteria for making ALARP decisions, ie qualitative risk assessment. Such criteria will usually be sufficient when inherently safe design principles have been adopted because then the scale of the hazard should have been drastically reduced. As the level of proportionality increases, a decision has to be made as to whether further risk reduction measures are reasonably practicable as required by the HSW Act. Basically, two questions have to be answered:-
If no further measures can be identified, the Operator must have all necessary controls in place; it is then a matter to verify by inspection that this is the case and that the measures are sufficiently reliable. To answer the second question some quantification and CBA is usually required. The degree and rigour of this quantification will depend on the level of proportionality and the site specific circumstances. Such ALARP decisions usually involve the application of the generalised TOR framework as outlined in R2P2. The ALARP band is defined by levels of individual fatality risk. For members of the public the corresponding fatality risk levels are 10-4 (upper limit of tolerability) to 10-6 (broadly acceptable level) per year.
Societal risks should meet the criterion in R2P2 ie the likelihood of a single major industrial activity producing 50 or more fatalities should be less than 1 in 5000 per year ie less than 2 x 10-4 per year. This is essentially an equity-based criterion for societal risk. If the criterion is met for a single plant it is still necessary to judge whether the risks are ALARP for the site, which may have several plants.
To assess whether the societal risks are ALARP utility-based criteria are usually applied. These are based on the individual risk levels and a cost benefit analysis to estimate what further risk reduction is costing for each life saved by the introduction of an additional measure. By comparing this 'value of preventing a fatality' to the value society puts on each life (eg £1M) an indication of the level of disproportion is obtained. Judgement on whether this is gross will depend on the site specific circumstances, in particular the nature of the hazard and the likely value of the number of fatalities from the worst case scenario (WCF).
In the case of societal risks, deciding whether the risks are ALARP can be quite onerous, particularly for complex sites. One of the earliest examples, which underlines the complexity of making ALARP decisions, is the Canvey Island Studies, which are documented in two Reports (HSE 1978; HSE 1981). The Canvey studies considered the risks to members of the public from a number of major hazard sites operated by different companies and a proposed new refinery.
Individual risk (aggregated for all sites), was predicted at a number of locations together with the Societal risk arising from all operations. The first assessment showed that the risks were unacceptable and Industry accepted that risk reduction measures were needed, despite the fact that no agreement had been reached on risk criteria that were appropriate for major hazards. A second study (about two years later), which took account of the proposed measures and advances in risk assessment methods showed that the risks were lower by about a factor of 20. The highest individual risk of fatality was about 3.5 x 10-5 ie close to the limit of tolerability. However, HSE decided that no further risk reduction was necessary. HSE's decision attracted criticism, which is encapsulated in this extract from the report:- "We have been criticised for seeming to adopt too high a level of acceptable risk in our conclusions. We concede that others may legitimately question our view of acceptable risk, but we would emphasise that in our opinion decisions about acceptable risks have to be made in the light of the facts of risk, consequences and costs in each individual case. We are not tied to a particular numerical level of acceptable risk, and inferences about what we have judged to be an acceptable risk in particular cases in the Canvey area should not automatically be applied elsewhere."
This extract from the second Canvey report underlines the site specific nature of ALARP decisions - a vital consistency consideration. An important point stemming from the Canvey studies and the 1992 TOR document is that when several sites contribute to the risk born by an off-site individual, the aggregated fatality risk must be ALARP and less than 10-4 per year. This has implications for multi-installation sites and multi-occupier sites, and for the assessment of safety reports at such sites. This issue is not addressed in R2P2. Should this type of situation arise in the assessment of COMAH safety reports the team should consult HID OPU on the way forward.
In the case of new plant, precedents have been set to apply more stringent ALARP criteria (HSE 1992). This precedent recognises that most risk reduction opportunities exist at the design stage, eg through the application of inherent safety principles and the application of new technology.
The purpose of HSE's assessment of a safety report against the criteria in the SRAM, is to come to a conclusion on whether the requirements and demonstrations in Schedule 4, Part 1 have been met. The extent of the information required for each demonstration to be made will depend on the level of proportionality considerations and the type of safety report required by COMAH Regs 7 or 8. The different report types include: the initial report for existing establishments, pre-construction (PCSR), pre-operation (POSR), modification and updated reports.
Operators will write the safety report in a structure that suits them. Whatever structure is adopted, the Operator should ensure that the information is linked to the required demonstrations in a transparent way. The Assessor should bear in mind that the same control measures and arguments may apply to more than one demonstration. This means that information to support a demonstration is likely to be found in different parts of a safety report.
The predictive criteria are designed to help you make consistent professional judgements about whether the demonstrations in a safety report are adequate. Such demonstrations need to be based on a suitable and sufficient risk assessment (EU 1998). The criteria are necessarily quite general, but sufficiently broad in nature to cover the various types of installation, the range of hazards to be encountered, and the types of risk assessment that might be employed. Therefore, not all the predictive criteria may need to be considered in the same detail by the Assessor, but all the top level criteria need to be applied. The issues identified in the assessment plan for close examination should help identify the predictive criteria that are key for a particular assessment. The extent to which the sub-criteria are applied should be proportionate. At the lowest level of proportionality a qualitative risk assessment based on recognised codes or guidance will suffice; no quantification of event probabilities may be needed so that the associated criteria need not be tested rigorously.
The criteria are provided as a guiding framework with in which professional judgements are made: they are not provided as a tick list. The assessment form should make clear that the Assessor has tested all the predictive criteria. The effort put into the assessment should be proportionate and sufficient to enable valid conclusions to be drawn; the reasons behind these conclusions need to be transparent ie recorded for auditing purposes.
Assessors should bear in mind that Operators may rely on published guidance or standards in seeking to demonstrate compliance. However, Operators who demonstrate compliance using company, or other non-published standards will have to show that they are fit for purpose, ie they need to be based on a risk assessment. They must also show that they have properly identified all foreseeable hazards and that they have implemented all necessary measures to prevent major accidents. This means that the Operator has to demonstrate that HSW Act Section 2 (on-site) and Section 3 (off-site) risks are ALARP. The report will therefore have to address any risks that remain after compliance with standards or guidance in order to demonstrate that all the necessary measures have been taken. For example, standards may only address risks to workers, in which case the Operator may (depending on the level of proportionality), need to justify their relevance to making off-site risks ALARP. It is then a matter of judgement whether the risks to people on and off site are ALARP. {Note that HSC's Enforcement Policy Statement (2002), emphasises that neither codes or guidance material are in terms which necessarily fit every case}.
The SRAM provides guidance on how to assess the various types of safety report. As a general guide, the Assessor should take a quick overview to gain insight into the sites activities, environs, the scale and nature of the hazards, the range of MAs, the controls in place, and the maximum casualty potential (WCF). This will enable a view to be taken on proportionality and the most important issues. Then the assessment criteria can be used in detail to draw conclusions on the report.
The following points are central to the assessment process:-
#1 - Societal risks considerations are implicit in b) and d) above. Although the risks may be ALARP, they could be towards the top end of the band. Such a site would require more evidence and arguments to support the various demonstrations and deserve more inspection/assessment resource than a similar plant where the risks to people were towards the bottom end of the ALARP band.
Page last updated: 14/05/2004