PURPOSE OF THE GUIDE 1 PURPOSE OF THE MANUAL SECTION 1 WHO IS THIS FOR? 1 WHAT SITUATIONS ARE COVERED? 2 GUIDANCE ON MANUAL SECTION REQUIREMENTS 2

Transcription

1 Managing Risk Guide Shell HSSE & SP Control Framework Version 3, Contents PURPOSE OF THE GUIDE 1 PURPOSE OF THE MANUAL SECTION 1 WHO IS THIS FOR? 1 WHAT SITUATIONS ARE COVERED? 2 GUIDANCE ON MANUAL SECTION REQUIREMENTS 2 APPENDICES 11 Purpose of the guide The purpose of guides is to communicate the recommendations of the manual custodian and Subject Matter Experts (SMEs) from the Businesses (e.g. Global Expertise Teams (GETs)) for meeting the requirements of the HSSE & SP Control Framework manuals. They are intended to serve as a recommended basis for local procedures, competence requirements, learning material and contract requirements and to support those responsible for and/or supporting implementation. This guide provides recommendations based on proven practices, but these are not mandatory. The guidance is a preferred way to fulfil the manual requirements, but it is not the only way, and the requirements may be fulfilled by other means. This guide describes the recommended way to meet the requirements of the HSSE & SP Control Framework Managing Risk Manual Section. Purpose of the manual section To establish a process to identify HSSE & SP Hazards and to reduce the Risks to As Low As Reasonably Practicable (ALARP). Who is this for? Business Leaders; and Managers. People who own or develop documents such as local procedures, competence requirements and learning material or contract requirements for managing risk. Other staff involved with risk management and incident investigation: o SMEs Text in grey boxes is quoted from the manual section. Terms in green are included in the HSSE & SP Control Framework Glossary. Terms in blue reference manuals and manual sections in the HSSE & SP Control Framework and associated materials.

2 What situations are covered? This manual section applies to: Managing HSSE & SP Risks in Assets, facilities, operations, projects and activities where the HSSE & SP Control Framework applies. The use of the Risk Assessment Matrix (RAM) for incidents. Specifically using the RAM for incident investigation and assessment of incident potential risk. on manual section requirements REQUIREMENT PAGE 1. Establish and maintain an effective Hazards and Effects Management Process Identify HSSE & SP Hazards in the Business and document their effects on people, Assets 2 3. Assess all the Risks of identified Hazards for Worst-Case Credible Scenarios using the RAM 4 4. Manage Risks in the light and dark blue areas of the RAM Manage Risks in the yellow (non 5A/B) areas of the RAM Manage Risks in the yellow 5A/5B and red areas of the RAM as per requirement 5 and in 9 7. Review Hazards and Risks and maintain documentation Establish and maintain an effective Hazards and Effects Management Process. WHO: The Business Leader is Accountable. Hazards and Effects Management Process (HEMP) Downstream HEMP on a page 2. Identify HSSE & SP Hazards in the Business and document their effects on people, Assets, the community and the environment in a Hazards And Effects Register. 2.1 Provide information, instruction, training and supervision so that people are competent to apply the HSSE & SP Risk Assessment Matrix (RAM) rating in their area of responsibility. Refer to Figure 1. WHO: The Manager is Accountable. Training in identifying and assessing Risk is provided through the following courses: Placeholder for Master Class (under development) SOU Course SOU Course SOU Course Personnel who are involved in assessing risks using the RAM should have successfully completed at least two of the courses listed above and have the requisite competences with regard to assessing the potential consequences as noted under requirement 2. Hazards are identified through processes such as the Hazards Identification Process (HAZID), or other equivalent processes. Hazards agent with the potential to cause harm Consequences - effect on People, Asset, Community and Environment (P, A, C, E) as a result of the Hazard being released People refers to employee and contractor health and safety impacts and community safety (e.g. road traffic collisions involving 3rd parties, or third party fatalities or injuries as a result of operational incidents). Managing Risk Guide 2/34

3 Assets refers to damage to Shell, SOV and NOV assets without consideration of Consequential Business Losses (i.e. does not include loss of business, loss of product or resulting revenue, and inability to do other work which has associated costs or loss of revenue). Community refers to people, resources and assets impacted outside of the facility. Environment refers to air, water and land impacts both internal and external to the facility in question. Hazard identification is carried out with a team of people knowledgeable in the process or activity under consideration, the hazards associated with the activity or process, the Potential Consequences and likelihoods with respect to P, A, C, E. hazards, consequences and likelihoods are identified based on the experience of the assembled team and through the use of existing catalogues and guidewords. An example of the membership of a HAZID team: HAZID Facilitator, knowledgeable in the HAZID process and experts in the following areas: Harm to People Health and Safety and Process Safety Damage to Assets Engineering & Maintenance SME Harm to Environment Environmental SME Harm to Community Social Performance SME Operations Representative or staff familiar with the operation of the activity or process Technology or staff familiar with the function and design of the activity or process SMEs with direct experience at the site or specific business experience should be included in the discussion for insight on relevant hazards and effects. The Hazards and Effects Register documents the identified hazards, potential consequences and method by which risks are being managed. The HAZID process has template formats for the Hazard and Effects Register; however, other equivalent formats can be used. Reference to and content of specific environmental risk assessment reports, studies and environmental aspects registers/inventories (e.g. ISO 14001) may be used as input to Hazards and Effects register to inform an understanding of potential environmental risks (e.g. biodiversity, water, soil and groundwater and air). Example: A release of gasoline from a pipe could ignite and cause damage to assets and injury to people as well as environmental damage and negative effects on community livelihoods and wellbeing. These consequences are captured and recorded in a Hazards and Effects Register. See the Use of the RAM section for more detailed instructions on how to assess consequence. Examples Hazards and Effects Registers: o Downstream Manufacturing o Downstream Chemicals o P&T Shell Technology Centre Amsterdam o Upstream HAZID: o HAZID Protocol Learning Slides o HAZID Protocol o HAZID Master Capture Sheet Managing Risk Guide 3/34

4 3. Assess all the Risks of identified Hazards for Worst-Case Credible Scenarios using the RAM, and document the assessment of all these Risks in the Hazards And Effects Register. 3.1 Analyse the following specific Hazards by using the referenced methodology: health as per the Health Hazard Management Manual Section; security as per the Security Manual; and environmental, social and health impacts of a project, as per the Impact Assessment Manual Section. WHO: The Manager is Accountable. Description of the Risk Assessment Matrix (RAM) The RAM is a 6 by 5 matrix that is used for qualitative assessments of risk. (Refer to Figure 1.) It is based on the concept of applying experience of events or incidents in the past to provide insight in how these risks can be managed into the future. The RAM is also used for incident classification and reporting, per the Incident Investigation and Learning Manual Section. The vertical axis represents increasing Consequences (Severity levels 0 to 5) in terms of harm to people, damage to assets, effect on the environment and communities (P, A, C, E categories). The horizontal axis represents increasing Likelihood (levels A to E) of the Consequence under consideration. Boxes in the matrix represent levels of Risk, increasing from top left to bottom right corners of the matrix. The matrix is divided into light blue, blue, yellow and red areas to illustrate the increasing level of Risk. Figure 1 - Risk Assessment Matrix (RAM) The following diagram (Figure 2) illustrates where the RAM is applied in the Managing Risk Process. Note that the RAM is used without the consideration of Barriers (Unmitigated Risk). Managing Risk Guide 4/34

5 Severity Figure 2 - Where the RAM is applied in the Managing Risk Process The Consequence Severity (0-5) scales in the P, A, C, E categories - people, assets, community and environment - are defined in Appendix 1. The Consequence Severity (0-5) scales for each P, A, C, E category are not to be inferred as equal. In particular, they are not to be used to infer the value of a life. Likelihood The Likelihood levels A to E are defined in Appendix 2, which also includes guidelines on how to apply them to varying size and complexity of Organisations. 3.1 Analyse the following specific Hazards by using the referenced methodology: health as per the Health Hazard Management Manual Section; security as per the Security Manual; and environmental, social and health impacts of a project, as per the Impact Assessment Manual Section. WHO: The Manager is Accountable. Analysing Health Hazards Health Risk assessment is part of the Health Hazard Management Manual Section. Example of Health Risk Assessment Template for a RAM red health hazard: Example Health Risk Assessment for RAM Health Hazard Inventory Analysing Security Hazards Refer to the Security Manual. Analysing Health, Social and Environmental impacts For Community Risks, refer to the SP SharePoint site for further guidance and examples. Use of the RAM The starting point for a RAM assessment is identifying the hazards with an understanding of the context (hazard release scenario, activity, location etc.), or a description of the particular incident being considered with an understanding of the actual and potential consequences. The RAM assessment then consists of the following steps. Managing Risk Guide 5/34

6 Step Action 1 Identify potential consequences: Identify the worst case credible consequences that could develop from the hazard under the prevailing conditions. Ask the question What could happen if the controls don t work or are not in place? Example, the operation of a pump in crude oil service involves the potential for a release of crude oil in the event of a pump seal failure. Potential Consequences: a) Leak of crude oil into the drain system and then into the sea in a busy fishing area: Community and Environment b) Ignition of the crude oil resulting in a small fire around the pump: Assets, Environment c) Worst Case Credible: Escalation of the fire to the point where other process equipment fails and a major fire and explosion occurs: People, Assets, Community and Environment. Refer to Appendix 3 for further guidance on identifying potential Consequences. 2 Estimate the Severity of each potential Consequence: For each of the identified Consequences assess the Severity (0-5) in the four Consequence categories - People, Asset, Community and Environment (P, A, C, E). The severities for the P, A, C, E categories are defined in the Consequence Descriptions in Appendix 1. In the crude oil pump example above, for the Worst Case Credible Consequences: Escalation of the fire to the point where other process equipment fails and a major fire and explosion occurs, here are potential severities: People: 4-5 as People may be injured or killed by a Major fire or the explosion. The number of people impacted is based on the possible number of people that could be affected not the number of people that are normally in the affected area. Consider people who may not normally work in an area such as maintenance staff or specialty contractors. Also consider Emergency Response or other people who may enter an area in response to the incident which may put them at Risk of harm. Asset: 3-4 as the location of the pump will have an effect on the outcome. The pump is in a remote location or the pump is very near other process equipment. Environment: 3-4 depending on volume of spill, ecology effects, potential persistence of impact and requirements for clean-up. More severe impacts requiring extensive measures will typically be 4. Community 3-4, proximity to local rural subsistence community increases severity with potential effects on community livelihoods (fishing), community health (drinking, bathing, diet (fish), fear of health effects), concern likely to be limited to local community and local government. 3 Estimate the Likelihood: For each of the potential Consequences make an estimate of the Likelihood of the Consequence in terms of the Likelihood levels A to E. The Likelihood level is judged from past experience, by asking the question How often in the past has a hazard release resulted in a Consequence similar to the one that we are considering?. The approach is one of referring to history to determine what actions can or should be taken to manage the risk into the future. The estimate of Likelihood is based on the Likelihood that the particular Consequence under consideration occurred, not on the Likelihood of the Hazard being released. For incidents this means that when assessing Worst Credible Consequence the Likelihood of the Consequence is what is considered, not the Likelihood of the initial incident occurring. For the example above, an estimate is made of the Likelihood of the Consequences, e.g. the likelihood that fishing livelihoods will be materially impacted, not the Likelihood that the pump seal will leak. Refer to Appendix 3, for an example of estimating Likelihood. The reliability of the Likelihood estimate, and therefore of the RAM assessment, depends to a large extent on the availability of data on previous incidents and on the knowledge and experience of the assessors. It is therefore important to maintain databases of previous incidents and make them available to people making RAM assessments and to have competent people in attendance that are able to cover the range of potential Consequences for the specific categories (SMEs can provide data on historical consequences from releases). The team assigned for estimating likelihood should also have competency in using the RAM, see section 2.1. The hazard release scenario or the incident under consideration will often not be identical to the previous incidents that are being used to determine Likelihood. Also, detailed information on previous incidents outside the Organisation, or even outside the Location, may not be readily available. Therefore, a combination of available information and judgment from experience has to be applied to make a best estimate of the Likelihood level A to E. Refer to Appendix 2 for a more detailed definition of Location and Appendix 3, FAQ 3, 4 and 5 for more detailed guidance on estimating Likelihood and the applicability of previous incidents. 4 Estimate the RAM risk rating: For each potential Consequence determine the RAM risk rating for each of the applicable P, A, C, E categories in terms of the product of the consequence severity and the likelihood. The risk ratings (up to 5 for each potential consequence) can be plotted on the matrix to provide a visual representation of the risk profile of the hazard release scenario under consideration. Refer to Appendix 4 for examples for the visual representation. The convention for expressing RAM severity rating (actual consequence) is in the form of People 2 or Community 4 and the convention for expressing RAM risk ratings (potential consequence) is in the form of People 2B or Community 4C. Note that once the hazard risk has been assessed it does not change with the application of Barriers. In other words, the RAM risk cannot be reduced by applying barriers. Managing Risk Guide 6/34

7 Example: In Downstream Manufacturing, the RAM Risk rating for Naptha has been assessed as People 5B due to the fact that there have been incidents in industry where a Fire and Explosion involving Naptha has resulted in more than 3 fatalities. Manufacturing locations have implemented Barriers to prevent an occurrence at the location however this does not change the RAM Risk rating as the unmitigated risk has not changed. The underlying principle at work is that for worst credible consequence to have occurred, barriers were either not in place or the barriers failed. This provides the justification for implementing and maintaining barriers to prevent the historical worst credible consequence. 4. Manage Risks in the light and dark blue areas of the RAM. Light Blue: Manage for continuous improvement through effective implementation of the HSSE & SP Management System. Businesses may set lower priority for further Risk reduction. Dark Blue: Manage for continuous improvement through effective implementation of the HSSE & SP Management System. Who: The Manager is Accountable. Examples of HSSE Management Systems and on creating a HSSE Management System: HSSE-MS (HSSE Management System) Downstream HSSE-MS Shell Technology Centre Houston on how a Health Assessment aligns with the HSE Management System Social Performance Planning 5. Manage Risks in the yellow (non 5A/B) areas of the RAM. 5.1 Where Reasonably Practicable, eliminate Hazards or 5.2 Substitute Hazards with ones having lower Risk. 5.3 Identify and implement Controls and Recovery Measures to reduce the Risks to ALARP. 5.4 Maintain a Hazards and Effects Register that includes a reference to the Shell HSSE & SP Control Framework requirements, legislation, or industry codes used to determine ALARP, or a reference to the process by which ALARP is determined. WHO: The Manager is Accountable. Eliminating or Substituting Hazards Elimination (avoidance) or substitution of Hazards is the most effective means of managing risk. When a Hazard with a RAM red or RAM yellow risk is identified, a first step in the Hierarchy of Control (refer to Figure 3) is to investigate opportunities to eliminate the Hazard or Substitute with a Hazard having a lower Risk. Figure 3: Hierarchy of Controls Managing Risk Guide 7/34

8 Examples Example: Gaseous Chlorine is used in cooling water towers to prevent bacterial growth. The RAM Risk rating associated with Chlorine is yellow; People 4C. It is reasonable to assess the use of an alternative chemical leading to the same effect in the process; however with a lower RAM Risk rating such as Sodium Hypochlorite which has a BLUE RAM Risk ranking of People 3B. People: Concentrated Hydrochloric Acid (30%) is used as a process chemical. The RAM Risk rating associated with this strong acid is yellow: People 4B. It is reasonable to assess if hydrochloric acid could also be used in a lower concentration, thus leading to less harmful health effects. Concentration ranges lower than 20% HCl will have lower, blue, RAM Risk ranking of People 2B. Environment & Community: A proposed crude oil pipeline route runs through a Natural World Heritage Site, identified as In Danger by UNESCO. As the area is subject to ongoing conflict between local tribal groups the potential likelihood of a spill is high, with severe consequences for the site. The potential Risk can be evaluated as Environment 5C (due to vulnerability, rarity and value of the site) and Community 4C (due to the high level of concern amongst governments and NGOs). By selecting a different route this potential Risk can be avoided (Eliminate) resulting in Community 2/3 B/C. Identifying/implementing Controls and Recovery Measures and Maintaining a Hazards and Effects Register Establish a Hazard and Effects Register that includes a reference to: HSSE & SP Control Framework requirements which used to determine ALARP Legislation or regulatory requirements which used to determine ALARP Shell or Industry codes used to determine ALARP or The process by which ALARP is determined. Establish documentation that demonstrates how the Risks identified in the Hazard and Effects Register are being reduced to ALARP. Once the level of documentation to demonstrate ALARP is defined in the Hazards and Effects Register, these documents must be created and maintained. The Shell ALARP Guide provides guidance on demonstrating and documenting ALARP Examples DS Manufacturing Model Bowties Managing Risk Guide 8/34

9 6. Manage Risks in the yellow 5A/5B and red areas of the RAM as per requirement 5 and in addition, apply a Bow-Tie or equivalent methodology which must include the following: 6.1 Identify Barriers to prevent a Top Event, to prevent Escalation Factors and to reduce the Consequences should the Top Event occur. 6.2 Identify at least one HSSE Critical Activity to maintain each Barrier. 6.3 Assign HSSE Critical Activities to the designated HSSE Critical Positions or within HSSE Critical Processes. 6.4 Identify HSSE Critical Equipment and performance criteria for assigned HSSE Critical Activities. 6.5 Assign maintenance through HSSE Critical Activities or within HSSE Critical Processes. 6.6 Identify criteria for ALARP determination and consistently apply these criteria. 6.7 Provide a Documented Demonstration Of ALARP for the Bow-Tie or equivalent methodology with details of: Hazards, Threats, Events, Consequences, Controls and Recovery Measures, performance criteria and Monitoring method. HSSE Critical Activities, HSSE Critical Positions or HSSE Critical Processes, and a list of identified corrective/improvement actions. The results of ALARP determinations, criteria by which Risk reduction to ALARP is achieved, and any required corrective actions to reduce Risk to ALARP. A Remedial Action Plan to close identified gaps. WHO: The Manager is Accountable. Requirements Identifying Barriers Information on Barriers (see section 2.5) Process Safety Narrative Identifying/Assigning Critical Activities Set the methodology for identifying HSSE Critical Positions if not derived through a Bow-Tie or equivalent methodology. HSSE Critical Positions are those positions which have the responsibility to design, implement or maintain Controls or Recovery Measures identified in requirement 6.1. Requirements For Environment (e.g. biodiversity, water, SGW and Air) Bow-Tie equivalent methodologies may include specific Environmental Risk assessment methodologies and environmental monitoring methods combined with assessment and recommendations of cost effective risk management options (including but not restricted to barriers and HSSE & SP Critical activities) reducing the Risk to As Low As Reasonably Practicable (ALARP). These methodologies may also document the ALARP determinations, required corrective actions and remedial action plans to close identified gaps. Refer to: ALARP Guide for Documented Demonstration of ALARP Explanation of HSE Case, Demonstration of ALARP, HAZID, HAZOP and PHA, HEMP, LOPA Managing Risk Guide 9/34

10 7. Review Hazards and Risks and maintain documentation. 7.1 Review the content of the Hazards And Effects Register and the Documented Demonstration Of ALARP when existing operations/activities are changed in a way that would change the Hazards or reduce the effectiveness of Controls and Recovery Measures. WHO: The Manager is Accountable for requirements 2 7. Identifying changes in the operations/activities Set the methodology for identifying changes/activities, which require review of Hazards And Effects Register and ALARP, if not derived through the Management of Change, Learning From Incident or equivalent process. Recognise the need for review of Hazards And Effects Register or ALARP to maintain the liveliness. As a good practice, set-up a periodical review mechanism for Hazards And Effects Register and ALARP to update the risks and controls time to time. Managers may use this HEMP on a page in the review as a framework/agenda. Discuss the review of the Hazards And Effects Register and ALARP process: 1. as part of the agenda in annual Management Review to make it more robust and in the line of sight; 2. as part of the investigation of Incidents at the location, Learning From Incidents (LFI), where there is possibility of impact on RAM risk ranking; and 3. as part of any changes proposed by the business in the RAM risk ranking criteria for specific activities. Managing Risk Guide 10/34

11 Appendices APPENDIX 1: Consequence Categories and Severities The following tables, one for each of the Consequence categories (People, Assets, Community and Environment), show the Severity levels and definitions. People Level Definition 0 No injury or health effect 1 Slight injury or health effect No Treatment Case or First Aid Case Illnesses that result in noticeable discomfort, minor irritation or transient effects that are reversible after exposure stops 2 Minor injury or health effect Medical Treatment Case Lost Workday Case or Work Case, where either has a duration of up to and including 5 days Illnesses with reversible health effects such as food poisoning and dermatitis 3 Major injury or health effect Lost Workday Case or Work Case, where either has a duration exceeding 5 days Illnesses with irreversible health effects such as sensitisation, noise induced hearing loss, chronic back disorders or repetitive strain injury Mental illness due to stress with reversible health effects 4 Permanent total disability or up to three fatalities Illnesses with irreversible health effects such as corrosive burns, asbestosis and silicosis Cancer Mental illness due to stress with irreversible health effects 5 More than three fatalities Illnesses with irreversible health effects such as multiple asbestosis cases traced to a single exposure situation Cancer in a large exposed population NOTES: This Guide is aligned with the Incident Classification and Reporting Rules and Group Parameters for HSSE & SP Performance Monitoring and Reporting Specification (PMR) section of the. The PMR is in turn aligned with the Occupational Safety & Health Administration (OSHA) Standard 29 CFR 1904, issued by the United States Department of Labor Managing Risk Guide 11/34

12 Assets Level Definition 0 No damage 1 Slight damage Costs less than US $100,000 2 Minor damage Costs between US $100,000 and US $1 million 3 Moderate damage Costs between US $1 million and US $10 million 4 Major damage Costs between US $10 million and US $100 million 5 Massive damage Costs in excess of US $100 million When assessing RAM asset consequence, include only direct damage to assets; do not include Consequential Business Loss (CBL). CBL is the indirect loss due to asset damage, environmental impact or impact on the community. It comprises losses such as lost production (expressed as profit margin), process unit downtime, product quality costs, cost of environmental clean-up, cost of recovery/disposal of waste and cost of reprocessing off-grade material. Example: Naphtha is being stored in a tank. There is a risk of fire leading to the loss of the tank (Impact to Assets). In this case the Asset is the tank. The loss of the stored product is not considered when using the HSSE RAM. Example: Propane is produced in a Hydrocracking operation. There is a Risk of fire and explosion associated with the Propane. Such an event would obviously impact the Hydrocracking unit resulting in a loss of production. This loss of production is not considered when assessing the Consequence to Assets and does not factor in to the damage estimate. Do not consider damage to 3 rd party assets. These consequences are covered under the Community Severity column. Managing Risk Guide 12/34

13 Community Level Definition 0 No effect 1 Slight effect, indicated by: Infrequent slight nuisance. (Nuisance to include interference with reasonable comforts and enjoyments of life, general inconvenience relating to day to day activities or enjoyment of land). No observable adverse or perceived effect on livelihood, social and cultural assets, community security, community health, vulnerable or Indigenous People. Local public awareness but no discernible concern. 2 Minor effect, indicated by: Limited short term nuisance Limited effects on livelihood and/or social or cultural assets, community health. No observable adverse effect on community security, vulnerable or Indigenous Peoples. Local public concern. 3 Moderate effect, indicated by: Persistent nuisance. Effects on livelihood and/or social and cultural assets, community health. Limited observable effects on community security, vulnerable or Indigenous Peoples. Local or Regional public concern. Local stakeholders, e.g. community, NGO, industry and government, are aware. 4 Major effect, indicated by: Persistent effects on livelihood and/or social and cultural assets, community health. Effects on community security, vulnerable or Indigenous Peoples and/or human rights infringements, that are serious and/or at a community level. Mitigation is complex or protracted. National public concern. Impact on local and national stakeholder relations. National government and/or NGO involvement with potential for international NGO action. 5 Massive effect, indicated by: Persistent, severe impact on livelihood, social and cultural assets, community security, community health, vulnerable or Indigenous Peoples and/or human rights infringements. Impact may affect a large geographic area or population. Mitigation is complex or protracted, and of limited effectiveness. International public concern. High level of concern and action(s) by governments and/or by international NGOs. The RAM consequence scale for Community is to a large extent qualitative and not quantitative. Use competent professionals in Social Performance (e.g. Authorised Person in Social Performance) and in Community Health (e.g. Health Project Officers). These practitioners will have a good overview of the impact of Shell activities on the surrounding communities. They will be able to combine this with a good understanding of relevant stakeholder perceptions of Community consequences and effects. The Community column contains generic descriptors, and in relation to Consequences, the Community context within which the risk is being evaluated will vary with each project and asset. To assist in the interpretation of these Consequence descriptions, a number of illustrative examples are provided for each of the Severity levels. For more examples and further support see the Social Performance SharePoint site. Managing Risk Guide 13/34

14 Environment Level Definition 0 No Effect No Impact to the Environment 1 Slight Effect Slight environmental damage contained within the premises. Examples include but are not limited to: A small spill in a process area or tank farm area that readily evaporates. 2 Minor Effect Minor environmental damage, but no lasting effect. Examples include but are not limited to: A small on-site spill with potential to harm the environment that has no off-site impact. On-site groundwater contamination with no potential for off-site contamination. A single exceedance of statutory or other prescribed limit. 3 Moderate Effect Limited environmental damage that will persist or require cleaning up. Examples include but are not limited to: A spill with potential to harm the environment that requires removal and disposal of over 100 m 3 of impacted soil/sand. A spill with potential to harm the environment which reaches surface water off-site. Off-site groundwater contamination. Off-site habitat and/or ecology effects or damage, e.g. fish kill or damaged vegetation. Repeated exceedance of statutory or other prescribed emission limit for longer than 3 months and/or, with potential long-term effect. 4 Major Effect Severe environmental damage that will require extensive measures to restore beneficial uses of the environment. Examples include but are not limited to: A spill to water with potential to reach a shore and cause harm to the environment. Off-site contamination of surface or groundwater over an extensive area. Requirement for Tier 2 oil spill emergency response. Off-site habitat and/or ecology effects or damage for greater than 1 year. Extended exceedances of statutory or other prescribed emission limits for greater than 1 year and/or with potential long-term effect. 5 Massive Effect Persistent severe environmental damage that will lead to loss of natural resources over a wide area. Examples include but are not limited to: A spill resulting in pollution of a large tract of wetlands, ocean, part of a river estuary or beach/coastal habitat Requirement for Tier 3 oil spill emergency response. Persistent off-site habitat and/or ecology effects or damage with proven long-term effect. The RAM consequence scale for Environment is to a large extent qualitative and not quantitative. Use environmental professionals competent in their respective discipline areas for assessing severities who have a good overview of local, national and regional environmental issues, regulations and focus areas including a good overview of sensitive areas, habitats and species combined with a good understanding of relevant stakeholder and NGO perceptions of environmental consequences and impacts. The consequence severities should not be interpreted as being limited to spills and should also be used to assess other examples of consequences in an area including but not limited to Managing Risk Guide 14/34

15 overuse/overexploitation of water, operational discharges/emissions to sea and air, chronical leakages from waste sites and damage to flora and fauna from construction activities. Some lines of businesses and regions have developed very useful and more detailed documentation which provides additional real business examples to help people to assess actual and worst credible consequences and their associated severities (see Appendix 5). When assessing Environment RAM consequence for repeated exceedances of statutory or other prescribed limits between the quantitative criteria windows defined for minor, moderate and major effects also take into account other factors like regulatory policy, focus and feedback, mediation/frequency of the emission/discharge limit and to what extent the exceedance(s) represent and actual impact on the environment. For Environmental Consequences not covered by this RAM, such as business-time loss costs associated with onsite and/or off-site clean up, here it is necessary to communicate these consequences and associated Risks to the Business. In these cases an SME should be consulted. Managing Risk Guide 15/34

16 APPENDIX 2: Likelihood Scale The scale of increasing Likelihood is intended to represent a range from highly unlikely to frequent. It is expressed in terms of frequency of historical events per period per Industry, Organisation or Location. These descriptions are used in every application of the RAM so as to promote consistent assessment of Risk. Increasing Likelihood A B C D E Never heard of in the Industry Heard of in the Industry Has happened in the Organisation or more than once per year in the Industry Has happened at the Location or more than once per year in the Organisation Has happened more than once per year in the Location The terms Industry, Organisation and Location are defined in the Glossary. Shell Businesses provide detailed guidance on the application of these terms to their Organisations. This guidance can be updated if the Organisation changes. The RAM Likelihood scale is qualitative not quantitative. Use a competent HSSE & SP professional for the few applications where historical incident or failure data is available to numerically calculate Likelihood, e.g. quantified Risk assessment (QRA) and layer of protection analysis (LOPA). Reference Industry Organisation Location Downstream Oil and Gas Industry Upstream Oil and Gas industry LNG Industry Global Manufacturing Global Retail Global Commercial Global T&S Global T&S US Pipeline Global Chemicals Upstream Organisation is defined as a specific global Line of Business Integrated Gas Organisation is defined as a specific global Line of Business Refinery or Chemical Plant Retail region GC Sub Business (i.e. Lubes Supply Chain; LNG; Specialties; Aviation Marketing; T&S Maritime TSO Distribution Region Specific Pipeline or Region Region A large self-contained worksite or a cluster of small self-contained worksites which carry out the same activity. Examples are: an offshore production platform, or a flow station, drilling rig, seismic unit, gas processing plant or a LNG terminal. Managing Risk Guide 16/34

17 APPENDIX 3: Frequently Asked Questions FAQ 1 Q. When we are assessing the potential Consequences of an incident and trying to decide what could have happened, how much imagination do we use? A. Determine the worst case credible potential Consequences. To do this, the following guidance is provided: 1. Ask the question What if? For example: What if the gas had ignited? What if the person working at height had not been clipped on when they slipped? What if it was raining or the wind was in a different direction? What if the oil spill had contaminated the drinking water aquifer? What if the oil spill had contaminated a nearby sensitive area or habitat? What if the oil spill had contaminated a community recreational area, beach or site of cultural importance? What if the Environment Regulatory non-compliances had resulted in regulatory body filing charges against the company? What if person inhaled H 2 S? What if the oil spill had contaminated agricultural land or a fishing area? 2. Wherever possible refer to incident reports, incident databases (both internal and external to Shell) or business hazard registers (if they exist) to find out what has happened previously in similar circumstance. Recognise that the circumstances of two incidents are never exactly the same; therefore experience and critical thinking also play a part. 3. Be credible but not too imaginative with potential Consequences scenarios: Avoid what ifs that could not occur under the circumstances of the particular incident. o For example: if a person tripped and fell to the ground at the same level is this considered to be a potential fatality? It all depends. If it was possible to strike the head against a valve stem or concrete curb when falling, the answer is possibly yes. (Although not common, fatalities have resulted from falls at the same level) If there was no realistic possibility of a severe blow to the head when falling (i.e. walking over soft, open grass area) the answer is probably no. Avoid highly unlikely what ifs such as amputation resulting from infection of a cut. Avoid stringing too many what ifs together to produce an incredible Consequence. o If two or more what ifs are needed for a Consequence to be realised, challenge each to establish that when they are combined, the overall Consequence is credible. Managing Risk Guide 17/34

18 FAQ 2 Q. People across the world ride bicycles every day in workplaces or during their leisure time. Falling off a bicycle could result in a broken arm (Severity 3). Does this mean that bicycle riding is assessed as People 3E (red area of the RAM)? A. No. You need to first identify the potential Consequences of riding a bicycle and then the Severity and likelihood of these potential Consequences. If a broken arm is one of the worst case credible Consequences, you need to estimate how often in the past falls from a bicycle have resulted in broken arms. To analyse this we begin at the far right column of the RAM: Start by determining if there have been bicycling incidents resulting in broken arms at our Location several times a year. If the answer is yes then the Likelihood is E. People 3E (Red area of the RAM). If this is not the case look to the next column to the left. Continue with the same question but now consider has a broken arm happened once at our Location or multiple times per year in the Organisation. If the answer to this question is yes then the Likelihood is D. People 3D (Yellow Area of the RAM) If this is not the case look to the next column to the left. Continue with the same question but now consider has a broken arm happened once in our Organisation or multiple times per year in the Industry. If the answer to this question is yes then the Likelihood is C. People 3C (Yellow area of the RAM) If this is not the case look to the next column to the left. However a broken arm may have happened somewhere in Industry, then the Likelihood is B. Then the assessed Risk of riding a bicycle is People 3B (dark blue area of the RAM). Note that two of the Risk assessments People 3D and People 3C have the same RAM Ranking, Yellow. The Risk mitigation requirements for both of these Risks are the same. It is not productive in this case to spend significant resource debating if the Risk is 3D or 3C and the effort required to mitigate the risk is the same. FAQ 3 Q. How do we know if something has happened before in the Industry? Our incident databases are not very comprehensive when it comes to incidents outside our Organisation. A. You can assume that virtually all the possible task (workplace) related Consequences have happened somewhere at some time. We can often apply our experience and judgment to conclude that it may have happened and is therefore in column B. With respect to common industry-wide situations such as working at height, an incident in a biscuit factory is just as relevant as an incident on an oil refinery. These incidents may not have happened in our Organisation or even in the oil/petrochemical industry. It is important to look broadly for these common situations to have a good understanding of the true Likelihood. We may even find when we do this that the broader industry data indicates that similar incidents have happened more than once per year, in which case the Likelihood is placed in column C. Community impacts which are common industry wide include land acquisition and resettlement in the agricultural sector, impacts on fishery livelihood due to infrastructure development etc. Process related hazards, which are more specific to a type industry or business (e.g. Chemicals Manufacture) and generally have high Consequences and lower Likelihoods. It is essential to search incident databases or talk to HSSE and technical specialists for data on previous incidents. You also have to determine if these are similar incidents in similar situations with similar hazard release scenarios and therefore valid precedents. Only if there is no evidence of previous incidents may the scenario be assessed as theoretical and put in column A. It is important to note that the possibility of something occurring does not make it credible. When identifying the Likelihood an A validate through conversations with HSSE and technical specialists that what is possible has not been confused with what is credible. Managing Risk Guide 18/34

19 FAQ 4 Q. We have suffered several serious spill incidents in the past but in recent years there have been none. Do we now estimate Likelihood on the basis of numbers of incidents in the recent years? A. No. The fact that there have been no spill incidents in the last few years does not mean that the Likelihood is now lower than it was previously. You always need to consider the past spill incidents when determining Likelihood. There are many factors that explain that there have been no recent spills. One reason could be that the controls have been applied and maintained more rigorously. Another reason could be that activities associated with higher risk of spills have not been carried out in the last few years. If that is the case, the situation could easily reverse in the next few years. The hazard release potential is still there and by extension the Risk still exists. By retaining a Likelihood estimate based on the longer-term history, the Risk Ranking is a more accurate representation of the Risk the Location, Business or Organisation faces. Example: 10 years ago our Organisation set a requirement for window cleaners to work from scaffolds or with fall arrestors and have applied it rigorously ever since. As a result there have been no further falls. In the preceding 10 years there were two falls in our Organisation. We do not conclude that the Risk of falling during window cleaning is now People 4B. The Risk is still People 4C. FAQ 5 Q. There are only two modes of transport to transfer people to an offshore platform - helicopter or ship. Following a number of helicopter incidents over the past 15 years, we have decided to make the transfers by ship in future. When we reassess the Risk of transferring people do we take account of the earlier Helicopter incidents? A. Probably not. If the previous incidents all related to the operation of helicopters they are not valid precedents for the new situation. The hazard release scenario has changed. The basis for the Likelihood estimate should involve transfer of people by ship. Example: Consider the window-cleaning example in FAQ 4. Suppose that 10 years ago our Organisation took the additional step of redesigning the windows so that they could be rotated though 180 deg. and washed from inside. However it is still necessary to lean out from the windowsill to reach some parts of the outside of the windowpane. Now it is less clear whether the inherent Risk of falling is still 4C, or has reduced to 4B as the Hazard Release Scenario may have changed (falling out a window versus falling from a suspended platform) A judgment has to be made whether the hazard release scenario is still essentially the same or has fundamentally changed. FAQ 6 Q. When we look at several potential Consequences from an incident or a hazard release scenario, will the Consequence with the highest Severity also have the highest RAM rating? A. Not necessarily. A Hazard with a Consequence of 3 and a Likelihood of E is assessed 3E and will be in the Red area of the RAM. Whereas a Hazard with a Consequence of 4 and a Likelihood of B Yellow area of the RAM. In general the high Severity Consequences tend to be infrequent and the lower Severity Consequences tend to happen more often. This means that if there are several possible Consequences from a hazard release scenario, the respective Risk ratings will tend to be distributed across an equi-risk diagonal of the RAM, i.e. bottom left to top right. It is good practice to evaluate at least one high Severity Consequence and one high frequency Consequence, to be sure that the Risk is properly characterised. Managing Risk Guide 19/34

20 FAQ 7 Q. A Risk assessment of all activities in our business unit (part of HEMP) has concluded that there are two hazards with a RAM red Risk: Transfer of people by road between the various plants Operation of one particular plant, which under certain operating conditions releases hydrogen sulphide to atmosphere Over the past 5 years we have implemented a programme of improvements to the hydrogen sulphide containing plant. This included both additional instrument safeguarding systems and improvements to the shutdown procedures and emergency response. The possibility of hydrogen sulphide being released has not been eliminated but the Risk of plant operators and contractors being affected have been significantly reduced. During the same period we have undertaken a couple of defensive driving campaigns, but the driving standards are still not acceptable and there have been two more fatalities. In the RAM screening of potential activities for next year s HSSE Plan we show the hydrogen sulphide containing plant in the yellow. This emphasises that road transport is the top priority. Is this a correct use of the RAM? A. No. While the improvement efforts at the location have reduced the Residual Risk (risk that remains after controls and recovery measures have been introduced), the RAM Risk (Risk with no controls in place) has not changed. The potential for the plant to release hydrogen sulphide is still there and the correct application of the RAM requires that the RAM Risk rating remain in the red area, not the yellow area. The example above is referred to a box hopping. This is not permitted. The RAM Risk is associated with the Hazard and not the system in place. FAQ 8 Q. There are many fatal road transport incidents each year in our Organisation. The Risk of transporting products by road is assessed People 4D (red area of the RAM). Does this mean that road transport of products is an intolerable Risk and to be stopped? A. No. The RAM is not be used to decide if the Risk does not meet tolerability. The RAM Risk is used to determine the level of Risk Mitigation required. Once Risk Mitigations have been implemented, then it is possible to determine if the Residual Risk meets Tolerability Criteria and is being managed to ALARP. Refer to the ALARP Guide for information on determining ALARP. FAQ 9 Q. One of the scenarios assessed in a HEMP study was the seal failure on a crude oil transfer pump and the Risk of the crude oil leak igniting and escalating to a major fire (assume RAM Severity rating Assets 4). Our incident database revealed that there have been 2 incidents in our Organisation in the past 5 years in which crude oil pumps failed and the incidents escalated to major fires (Likelihood C). Neither of these incidents was caused by pump seal failure. Is it correct to conclude that the Likelihood of this failure scenario is thus B and not C? A. No. If you assess the Risk of failure of an individual component to reduce the Risk assessed on the RAM, you are guilty of salami-slicing, which means cutting up the Risk into small components so that the assessed Risk of each component is lower. This practice commonly leads to an underestimate of the overall Risk and too low a priority for the resulting actions. The intended use of the RAM is to assess the Risk of failure of a whole system. In this example the scenario to be assessed is failure of the crude oil pump escalating to a major fire, which is Likelihood C. Managing Risk Guide 20/34