SPC/TECH/OSD/15
To supplement the guidance provided by Assessment Principles for Offshore Safety Cases (APOSC) in generating a common understanding within OSD of what constitutes a safety management system and a common approach to the assessment of the elements of a safety management system in safety cases.
This guidance is to be used for safety case SMS assessment.
1 The key features of a safety management system, namely establishing a policy, setting linked objectives, making arrangements for delivering the policy and objectives and measuring performance are discussed in APOSC paragraphs 14-19. It is possible to split these down into subsets or different elements. For the purposes of OSD the breakdown into elements has been chosen to reflect the safety management issues given prominence in the Cullen Report and the circumstances of the offshore industry. The elements themselves should not be seen as discrete since there is much interaction between them, for example, the monitoring element can be applied to all other elements.
2 What follows does not contradict the publication Successful Health and Safety Management, HS(G)65, but reference to particular issues in the Cullen Report means that for OSD purposes certain items covered in the generality of elements in HS(G)65 have to be given specific attention by OSD.
3 APOSC identifies the following elements within the SMS:
Organisation
4 Under section 2(3) of HSWA employers are required to have an up to date written statement of their general policy for ensuring the health and safety of their employees and indicating the arrangements for implementing that policy. This should be the starting point of any safety management system. It should embrace all offshore activities including the relationship with contractors. In addition to setting out the broad corporate intentions and attitudes towards health and safety, the policy should be expanded in the safety management systems to include some measurable corporate objectives and performance standards against which the overall achievement levels can be measured. Good measures create progressive improvement in health and safety performance by generating a culture of self challenge and shared values throughout the workforce.
5 The policy and overall objectives need to be set at the highest level within an organisation. For a UK owned company this will be at the board of directors level, for an overseas based company at the most senior level of management within the UK. They should be in clear terms that demonstrate corporate acceptance of the responsibility for health and safety and establish the manner in which the objectives and performance standards are to be developed as they progress down the management chain. The policy and overall objectives need to be formally issued by the most senior level of management and given prominence and force so that there is no doubt about the commitment.
6 It is not sufficient for an organisation to simply issue fine words of intent in respect of health and safety. Corporate management must make resources available and must make arrangements to monitor performance. Part of this will involve senior managers showing an active interest in health and safety, including making site visits, enquiring about performance issues and attending safety meetings and functions.
7 A clear line of responsibility and accountability for the control of health and safety standards needs to be established from the highest level of management down to every employee and contractor. This should be identical with that for controlling the business activities of the organisation concerned. Different organisations might have different approaches to the management of their businesses and so the lines of command and accountability might differ from company to company. However, from the health and safety standpoint, they will be required to have the same effect. As a project passes through its various stages the line of command and accountability might change to reflect the changing circumstances. This is acceptable but the basis for changes and the arrangements for bringing it about should be set out in the safety management system.
8 Line managers and supervisors should be aware of their health and safety remits and responsibilities including those for expanding the corporate policies and objectives to make them relate to their own part of the overall activities. Periodically the health and safety performance of managers should be appraised in the same way and with the same vigour as is done for their commercial and business areas of responsibility. The links between successful business performance and successful health and safety performance are so strong that there should be little difference between the two aspects of accountability.
9 Safety management systems should indicate how health, safety and welfare issues are to be communicated up and down the management line and, where appropriate, laterally amongst those having a legitimate interest in the subject in question. These arrangements should include the manner in which detailed procedures and documents are to be made available to those who need them, and for monitoring that they are available and understood.
10 The aim should be to generate a positive safety culture within an organisation whereby all involved are motivated to do everything possible to look after the health and safety of themselves and others. The emphasis should be on involvement and team work. Management should create a climate in which people wish to be involved and respond positively to the avoidance of harm. The aim should be to allow all persons to operate up to the limits of their competency and vision and not to be constrained for artificial reasons. More and more supervision does not necessarily mean higher standards of health and safety. On the contrary, it can lead to a lack of a sense of responsibility amongst the workforce and in turn to lower levels of safety performance.
11 Organisations having overall control of offshore installations (it will be the operator for a producing platform), will have to decide how much control to reserve to themselves over health and safety and how much is to be within the scope of their contractors. The respective limits will need to be well defined in the safety management system and should be clear to all parties. However, it must be stressed that contractors will have duties as employers or as self employed persons under HSWA and it is not possible for these to be transferred from one party to another by means of a contract.
12 Health and safety controls over the initial specification, design, construction and on-going structural integrity will no doubt take a different form to those over the commissioning, operation, modification, maintenance and demolition. Much of the first group fall into the scope of the certifying authorities who act as agents of OSD and whose performance is monitored through OSD's certifying authorities' auditing arrangements. These matters will be addressed in the design safety cases for new installations.
13 Safety management systems should set out the arrangements for providing professional occupational health and safety advice to line managers. The role of such advisers should be made clear. Health and safety is a line management responsibility and safety professionals should not be used in a way that undermines this position. However, they play an important part in generating good performance and they should be afforded the appropriate status and have communication conduits to all levels of management.
14 The safety professionals themselves need to be organised into a structure and be given sufficient resources and freedom to enable them to perform effectively. From time to time they will need support from, and to make contact with outside agencies so that they can bring to bear the most up to date thinking. Part of their responsibilities should be keeping a watchful eye on the workings of safety management systems, and using their contacts in the management chain to give early warnings of problems. Amongst other things this will include reviewing and being the custodians of accident and incident reports, and ensuring that any lessons to be learnt from individual accidents or incidents or trends are brought to the attention of the appropriate line management.
15 The safety management system should set out the procedures to be followed for involving the workforce in health and safety. Statutory safety committees should be consulted about the safety management system. In the event of the preparatory work being done before the workforce comes into existence it might be possible to consult with workforce representatives drawn from another part of the company's activities. The safety management system should lay down these arrangements and those for communicating the system to the workforce and for ensuring that it is understood.
16 Information should be passed to the workforce on the risks identified, precautions taken, emergency procedures and the identity of staff designated to assist in any evacuation. The information must be understandable and relevant.
17 The safety management system should specify the arrangements for communicating safety related information to the workforce including that obtained from accident and incident investigations. Safety committees play an important role in furthering the interests of health and safety and should be given an opportunity to discuss and comment on accidents and incidents.
18 The safety management system should lay down the procedures adopted for the systematic appraisal of the hazards associated with the activities being managed and for the ranking of these according to the risks. One or more of the standard process hazard analysis tools should be applied to those parts of plants handling hydrocarbons. Consideration should be given to the quality of this appraisal and ranking exercise, and to the value of the quality control arrangements in place to ensure on going confidence in the results. An important facet of this work should be the identification of the events that would impact heavily on the safety of persons or their escape routes so that these can be passed on to the managers, supervisors and workforce responsible for preventing such occurrences.
19 In broad terms the risk control measures within a safety management system can be divided into two areas. First, there are those measures which are concerned primarily with the major accident risks and second there are those primarily concerned with risks faced by personnel on an individual basis.
20 Having identified the major accident risks, priority should be given to the possibility of their elimination. When this cannot be achieved then the respective elements of the safety management system should give specific attention to the management competencies and procedures necessary to minimise the possibility of these events, and if any were to occur, to limit their potential for causing harm. The safety management system should set out the management control and monitoring procedures to be followed in these critical areas.
21 For the non-major accident hazards more reliance can be placed on generic management controls and procedures. However, making judgements on the division between issues requiring particular control and those that can be left to more general instructions and training is no easy matter.
22 A permit to work scheme is a formalised and documented management procedure for exercising control over certain tapes of work which are potentially hazardous and which may impinge on other activities. Any such schemes forming part of a safety management system should comply with the OIAC publication on permit to work and should take account of the work that has been undertaken to establish some common industry standards.
23 A permit to work should be required for all activities that have important safety implications or where misunderstandings are possible which could give rise to danger. Deciding on what should be included is not easy. If too many low key activities are captured then the procedures become extremely cumbersome and the more important can get subsumed in a mountain of control documents dealing with very low risk activities. Safety management systems should set down the criteria for deciding whether or not a task should be included or otherwise.
24 Companies in control of offshore activities should make sure that their own employees and their contractors are competent and trained to the appropriate degree in the application of their permit to work schemes.
25 Safety management systems should specify the arrangements for secure isolation and immobilisation of plant using locks or tagging facilities. Once in place effective control over the lock keys or tags needs to be maintained. Electrical and mechanical isolators should be equipped so that the locks or tags can be readily applied.
26 Permit to work schemes should lay down the status of persons authorised to issue and receive permits and the arrangements for ensuring that others who need to know about the work being undertaken are informed. Attention should be given to the limits that apply to the scope of the work being undertaken, and to the procedures for revalidating and suspending permits.
27 The safety management systems should cover the arrangements for ensuring that all persons have the competency levels that match the tasks that they are expected to carry out both in normal and foreseeable abnormal circumstances. This applies to the direct and contractor workforce alike.
28 There are two aspects to competency and training. First, the tasks to be performed have to be analysed to obtain a picture of what skills and attributes are required. Second, assessments have to be carried out of the individuals expected to fill these jobs to see if they possess the appropriate skill levels. Training is a subset of competency and can play a central role in establishing and maintaining skill levels in personnel.
29 It should always be remembered that training in itself is no guarantee of competency. Where training is given provision should be made to assess its quality.
30 The safety management system should lay down the emergency command attributes expected in offshore installation managers and other key personnel and the criteria to be applied for assessing whether or not these attributes are present in the individuals concerned. Issues such as experience, maturity, reliability under pressure and technical competence should be taken into account. The role of emergency simulation exercises in the ongoing training of key personnel should be specified.
31 Companies need to have in place systems for ensuring that process and equipment modifications, including the use of components having different specifications and management system changes, are properly evaluated before their introduction. Not only should there be a formal procedure for controlling change but there should also be arrangements aimed at educating people of the dangers that might arise as a result of uncontrolled change. Change needs to be communicated to those who need to know.
32 Arrangements need to be in place to ensure that adequate control is exercised over controlled documents so as to ensure that they are updated in line with any design or other changes introduced.
33 The large number of contractors used in the offshore industry means that their competency, behaviour and integration into the operation as a whole can have a major impact on health and safety.
34 The safety management system should set out the procedures to be followed in selecting contractors that are suitable for work offshore. Particular attention should be given to the way potential contractors would integrate into the organisation of the host company. Pre-contract assessments should cover such matters as technical and managerial abilities, the competency and training of the staff to be used, the quality and state of repair of any equipment to be provided and the way in which the line of management command and accountability for health and safety might pass from one organisation to the other. Particular attention should be given to whether or not the safety management systems of clients and contractors are capable of dovetailing together and whether or not conflicts are likely to arise. Clients should avoid the total imposition of their safety management arrangements on their contractors since this would force contractors to follow a style of management which may not fit easily with that developed within their own organisations.
35 Dovetailing safety management systems together, among other things, should bring the decision making process between the parties into sharp relief. Clear understandings need to be established between the contracting parties on their respective decision areas and these should be classified into:
36 Once selected, contractors should be made aware of those parts of the host company's safety management system that impinge on them and of the competency and training requirements they have to meet. Amongst other things, clients should set out as part of their safety management systems:
37 Where contractors are used on a long term basis they should identify with the line of supervision and organisation of the installation concerned. Short term contractors are more of a problem. They too will be subject to the authority of the host company and the safety management system should set out the arrangements for such contractors to be adequately briefed to ensure their own safety and that of others who might otherwise be affected by their actions.
38 The safety management system should specify the arrangements for dealing with emergencies, including a formal trained command organisation spanning both the offshore and onshore domains. The emergency scenarios that need to be addressed will come from the outcome of the hazard analysis element.
39 Having identified all emergency events, plans and procedures should be prepared for dealing with these. A central part of the plans and procedures will be the management command structure for assessing and decision making on the situation. All personnel need to be familiar with how they are expected to behave in the event of an emergency.
40 The safety management system should set out the type and frequency of drills and exercises to be carried out to both test and enhance the familiarity of personnel with the plans and procedures.
41 Most companies now recognise that the workforce is their major asset - without them the company cannot produce. Moral or legal issues apart, it pays to keep the workforce healthy. Attention to occupational health should therefore be an integral part of any management system.
42 Occupational health can be said to be the creation of a state of physical, mental, and social well-being of the workers in the working environment. The aims should be to promote, protect and maintain the physical and mental health, and welfare of the workforce. This is achieved by ensuring their fitness for the job; protecting them from exposure to factors, or conditions, which could lead to ill-health; monitoring of health; and provision of health promotion, first-aid, counselling and rehabilitation services.
43 Many different specialisms may need to be involved in delivering such a package, including occupational medicine, occupational health nursing, occupational hygiene, ergonomics, occupational psychology, health physics etc. Also, occupational, environmental and community health blend imperceptibly into each other. Occupational health thus involves much more than the common perception of it as just being pre-employment medicals and the provision of first aid.
44 The essential requirements for managing occupational health are just the same as those for any management system. Any sub-system for managing occupational health functions should therefore have the same key features as those already discussed for the system as a while under the headings of policy, organisation, planning and setting standards, performance measures and auditing and review.
45 The safety management system should make arrangements for accidents and incidents, including those which can be described as near miss events, to be competently and authoritatively investigated. Those required to undertake these duties should be formally nominated for these tasks and adequately trained in investigation techniques. The circumstances surrounding any of these should be brought to the attention of senior management so that action can be taken to prevent recurrences and to promulgate the lessons learnt.
46 Investigations should be thorough so as to discover both immediate causes and the wider causes. The way the aftermath was dealt with should also be subject to scrutiny. This should include an appraisal of the route to the resumption of normal activities and the precautions taken to ensure that no additional hazards are introduced during this process. Some accidents and incidents will be required to be reported to the regulatory authority. The responsibility for this reporting should be clearly defined.
47 The results of accident and incident investigations should be tabulated in a manner which allows trends to be discerned.
48 It is not sufficient to have safety policies, safety procedures and a line of command and accountability for applying these. It is necessary to measure whether or not the expected performance is being achieved and to seek progressive improvement. This is done by a combination of monitoring and auditing.
49 It is difficult to directly measure health and safety performance since the numbers of disasters, accidents and incidents are usually too small to be statistically significant. However, the risk levels they represent may well be above industry averages and may be beyond what would be deemed to be acceptable. Therefore resort has to be made to measuring compliance with provisions set out in the safety management system of the company concerned. These provisions are surrogate measures of performance and form part of the safety management system performance standards. In essence this boils down to measuring the effectiveness of management at identifying and controlling risks.
50 All the workforce has a responsibility to follow the safe working practices in the safety management system. Self-monitoring plays an important part in this and may be encouraged by such techniques as peer review and safety circles. In addition line managers, supervisors and safety professionals need to monitor, (often on a selective basis) the degree of compliance with safe working practices and the procedures laid down in the safety management system are being applied. It might start with a look at the general standards of husbandry and expand to include checks on the application of procedures and whether or not the personnel involved understand the health and safety significance of what they are expected to follow. It should be carried out at prescribed intervals which might range from every shift for some critical activities and workplaces to longer intervals for others. The results should be recorded and feedback given.
51 Auditing is a more strategic in-depth exercise. It is aimed at testing that the laid down health and safety performance standards are being applied and are delivering the expected outputs. It also is aimed at questioning the worth and relevance of the performance standards themselves.
52 Auditing should be conducted by a team of people having managerial independence from the activities or workplace being scrutinised. Collectively the team should possess a range of competencies and sufficient maturity to enable them to present their findings and suggestions for progressive improvement in an effective way.
53 The audit scheme and its frequency of application should be specified as part of the safety management system. It is open to companies to use a proprietary scheme or develop its own auditing procedures. Some proprietary schemes have been well developed and tested and can be used to good effect. However, all are necessarily underpinned by a view on how health, safety and welfare should be managed. They then go on to measure, usually though a weighted scoring system, how well management systems compare with their version of the ideal. A company adopts a different philosophy than that underpinning the audit scheme may not score well but may achieve acceptable levels of health, safety and welfare.
54 The results of accident investigating and monitoring and auditing exercises should be reviewed so that the lessons learnt can be applied.
Further Information can be obtained from OSD 3.5 (VPN 522 6685)
