opi.sg.hse.001.e&p_hse risk management and risk reporting - rev. 01

1

TIT

OLO

PR

OC

ED

UR

A T

ITO

LO

P

RP

OC

ED

UR

A T

ITO

LO

PR

OC

ED

UR

A

opi sg hse 001 e&p r01

This document is the property of eni spa. All rights reserved

REFERENCE MSG:

HSE

Professional Operating Instruction

HSE Risk Management and Reporting


2

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



TITLE:

HSE Risk Management and Reporting

NOTE:

This document replaces the standard Doc. N° 1.3.0.10 “HSE RISK Management and Risk

Reporting”.

Once downloaded from the intranet this document is to be considered as an uncontrolled copy.

DATE OF ISSUE: EFFECTIVE DATE:

October 2013 October 2013

PREPARED BY: CHECKED BY: APPROVED BY:

SICI SICI

SICUR

SGIAQ

SAL/E&P

HSE IMS Management Representative

3

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



1. Objective ....................................................................................................... 4

2. Scope of application ........................................................................................ 5

3. Internal references ......................................................................................... 6

4. External references ......................................................................................... 7

5. Definitions ..................................................................................................... 8

6. Risk Management Process .............................................................................. 13

7. List of Appendices and Attachments ................................................................ 40

Indice

4

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



1. Objective

The primary objective of this document is to provide guidance for definition of risk

management process and risk tolerability criteria, in particular how HSE risks shall

be managed and how they shall be reported at periodical interval to eni e&p

division.

Risk management criteria shall be used only once all legislative prescriptions have

been properly applied. Where specific regulatory requirements exist in a particular

location, the most stringent requirements shall be applied.

In addition to the requirements set in the HSE IMS Directives and Application

Requirements, reference is also made to ISO 17776 “Petroleum and natural gas

industries – Offshore production installations – Guidelines on tools and techniques

for hazard identification and risk assessment”.

1.Objective

5

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



2. Scope of application

This Professional Operating Instruction applies to HSE professional family

pertaining to the eni e&p business area and it has been developed pursuant to the

HSE Management System Guideline.

In addition, each subsidiary shall record and report the risks from its affiliates and

from the joint-ventures where e&p division or subsidiary is the Operator.

2. Scope of application

6

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



3. Internal references

eni spa Code of Ethics available on website Myeni

eni spa Model 231, available on website Myeni.

msg sn eni spa - MSG “Sistema Normativo”

msg hse eni spa -MSG “HSE” and relatives annexes

pro sg hse 001 e&p r01 “Management method for regulatory instruments of

the HSE Integrated Management System of the e&p division.”

3. Internal References

7

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



4. External references

ISO 14001:2004 “Environmental Management System – Requirements with

guidance for use”

OHSAS 18001:2007 “Occupational Health and Safety Management System.

Requirements”

EN ISO 17776: 2000 – "Petroleum and natural gas industries - Offshore

production installations - Guidelines on tools and techniques for hazard

identification and risk assessment "

ISO 31000:2009 – “Risk Management – Principles and Guidelines”

IEC 61508 "Functional safety of electrical / electronic / programmable

electronic safety related system (all parts)

IEC 61511 "Functional safety instrumented systems for the process industry

sector (all parts)

"Task Risk Assessment Guide– A Step Change in Safety" UKOOA, IMCA, IADC,

IAGC OPITO, (August 2000)

E&P Forum QRA Data Sheet Directory 15/10/96

UKOOA – 95

OLF (1999) "OLF recommended method for environmental risk analysis "

OGP Report N° 415 December 2008 “Asset Integrity – thed key to managing

major incident risks”

UK HSE - (1989) "Quantified Risk Assessment an Input to Decision Making" –

ISBN 0 11 885499 2

UK Health and Safety Executive R2P2

NORSOK Standard Z-013 Rev.2 - (2002) "Risk and emergency preparedness

analysis"

4. External References

8

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



5. Definitions

For the purposes of this document, the following definitions apply:

e&p: exploration & production

ALARP: As Low As Reasonably Practicable

BPEO: Best Practicable Environmental Option

FMEA: Failure Mode and Effect Analysis

FTA: Fault Tree Analysis

HAZOP: HAZard and OPerability Analysis

HAZID: HAZard IDentification

IDLH: Immediately Dangerous for Life and Health

IEC: International Engineering Consortium (see http://www.iec.org/)

ISO: International Organization for Standardization (see http://www.iso.org/).

NORSOK: Norwegian Technology Centre standards

OGP: International Association of Oil & Gas Producers (see http://www.ogp.org.uk/)

OLF: Oljeindustriens Landsforening (see http://www.olf.no/)

OHSAS: Occupational Health & Safety Agency (see http://ohsas.org/)

OREDA: Offshore Reliability DAta (see http://www.sintef.org/)

QRA: Quantitative Risk Assessment

UKOOA: UK Offshore Operators Association (see http://www.ukooa.co.uk/)

AEA Safety Report Series 34 - Radiation Protection and the Management of Radioactive

Waste in the Oil and Gas Industry

Shall: Identifies a requirement which is mandatory

Should: Identifies a requirement which is recommended; deviation from this requirement

or different solution shall be justified.

Acceptable Risk / Acceptability: See “Tolerable Risk” (ISO 17776:2000).

5. Definitions

9

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Accident: Undesired event giving rise to death, ill health, injury, damage or other loss

(OHSAS 18002:2000). An alternative simpler definition: unplanned event giving rise to

undesired outcome (death, ill health).

ALARP: (As low As Reasonable Practical) The point at which the effort to introduce further

reduction measures become unreasonably disproportionate to the additional risk reduction

that will be obtained. The concept of ALARP may be qualitative or quantitative and, where

necessary, guidance notes issued by the Authorities for application should be adopted.

Barrier: measure which reduces the probability of realizing a hazards potential for harm

and which reduces its consequence. Barriers may be physical (materials, protective

devices, shields, segregation, etc.) or non-physical (procedures, inspection, training, drills,

etc.) - ISO 17776:2000

BPEO: (Best Practicable Environmental Option)suggested pragmatic approach for the

control of polluting effluents and emissions without penalizing the offending industry.

Based on the concept that the cost of pollution are at least partially offset by the economic

and social benefits of viable ( sustainable ) industry.

Company: An organization part of or connected to eni e&p division such as: Geographic

Unit, Affiliate, Subsidiary or Joint Venture under operational control.

Flash Fire: Combustion of a flammable vapour and air mixture in which flame passes

through that mixture at less than sonic velocity and for relatively short periods of time

(typically less than 3 seconds), such that negligible damaging overpressure is generated.

Hazard: Anything with the potential to cause harm, including ill health or injury, damage

to property, plant, products or the environment; production losses or increased liabilities.

(OGP report 6.36/210, 1994 ‘Guidelines for the development and application of health,

safety and environmental management systems’).

Hazardous event: A hazardous event is synonymous with a hazard.

IDLH: It is airborne contaminant concentration of a given contamination below which an

individual (unprotected by breathing apparatus or respirator) is able to escape without loss

of life or immediate or delayed irreversible health effects or severe eye or respiratory

irritation or other reactions that would hinder escape

Incident: work-related event(s) in which an injury or ill health (regardless of severity) or

fatality occurred or could have occurred (OHSAS 18001:2007). An accident is an incident

which has given rise to injury, ill health or fatality. An incident where no injury, ill health or

5. Definitions

10

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



fatality occurs may also be referred to as a “near miss”. An emergency situation is a

particular type of incident.

LC% hmn - LethalConcentration for Humans: A concentration by which a given percentage of

the exposed population will be fatally injured, following a certain period of exposure.

LFL - Lower Flammability Limit. The lowest concentration of the substance (vapour or gas)

in air that is known to produce a flash of fire when an ignition source is present.

Occupational illness: An occupational illness is any abnormal condition or disorder of an

employee, other than one resulting from an occupational injury, caused by exposure to

environmental factors associated with employment. (Record-keeping Guidelines for

Occupational Injuries and Illnesses, Occupational Safety and Health Act, OSHA, USA,

1986). This includes both acute and chronic illnesses or diseases. They may be caused by

inhalation, absorption, ingestion of or direct contact with the hazard, as well as exposure

to physical, psychological and biological hazards.

Occupational injury: An occupational injury (i.e. not an occupational illness) is caused by

a single incident and has immediate consequences.

Occupational medicine: The speciality concerned with the diagnosis, management and

prevention of diseases due to, or exacerbated by, workplace factors.

Qualitative Risk Assessment: Generic term used for techniques which allow the risk

associated with a particular activity to be estimated in relative terms such as “high” or

“low” (ISO 17776:2000).

Quantitative Risk Assessment: Generic term used for techniques which allow the risk

associated with a particular activity to be estimated in absolute quantitative terms rather

than in relative terms such as “high” or “low” (ISO 17776:2000).

Reliability: the probability that an item will perform a required function under stated

conditions for a stated period of time – IEEE 90. A barrier is highly reliable if:

the probability to fail in operation or on demand (either for equipment or

through human error) is low as per failure records;

it is covered by functional requirements/job specification (performs a

required function);

it is fit-for-purpose/a function of competence as demonstrated by review /

appraisal (performs the function under stated conditions);

5. Definitions

11

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



it is properly maintained / tested (physical test or via drill/exercise) in view

of its expected working life / working cycle (performs the function for a

stated period of time);

Where 1 or 2 of the above applicable features are missing, the level of control is

considered to be Medium. Where 3 or 4 controls are missing or where they are unknown,

the level of control is considered to be Low.

Risk: Combination of the likelihood of an occurrence of a hazardous event or exposure(s)

and the severity of injury or ill health that can be caused by the event or exposure(s)

(OHSAS 18001:2007).

Risk Analysis: Use of available information to identify hazards and to estimate risks (ISO

17776:2000). ( there is not a universally accepted distinction between risk analysis and

risk assessment).

Risk Assessment:

1. Overall process of risk analysis and risk evaluation (ISO 17776:2000);

2. The whole process of risk analysis and the evaluation of the results of the risk

analysis against technological and/or economic, social and political criteria (OGP report

11.1/98, 1984 ‘Applications and limitations of risk assessment in offshore exploration

and production’).

Risk Evaluation: Judgment, on the basis of risk analysis, of whether a risk is tolerable

(ISO 17776:2000).

Risk Register: Document proving a brief, but complete, overview of the identified

hazards, the relevant screening criteria and the measures necessary to manage them. Screening Criteria: Targets or standards used to judge the tolerability of an identified

hazard or effect (ISO 17776:2000). For the purpose of this document, they have been

developed by eni e&p division and are intended for use where not provided by regulators.

Societal Risk: The risks to society arising from operations; the term “society” in this

context include communities, residential areas and, in general, the “public

domain” which is not connected with those operations (the Canvey Study – HSE, 1978).

5. Definitions

12

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



TLV – Threshold Limit Value The time-weighted average concentration for a conventional

8-hour workday and a 40-hour workweek, to which it is believed that nearly all workers

may be repeatedly exposed, day after day, without adverse effect (TLV-TWA) (ACGIH).

Tolerable Risk / Tolerability: Risk which is accepted under definition of a tolerable

threshold, based upon the current state of science and technology and the general values

of society (ISO 17776:2000).

5. Definitions

13

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



6. Risk Management Process

Management of HSE risks is an integral part of the management of the business

and requires the total concerted effort of the organization, focused on the

objective of protecting people, the environment, assets, the business and earnings

from potential losses. The risk management criteria must be applied as part of a

broader risk management process within the organization.

In particular this document provides guidance for definition of risk management

process and risk tolerability criteria referred to:

People – the health protection and promotion and safety of people involved

in eni e&p division operations and activities or of other people who could be

affected by them

Critical Equipment Protecting Personnel - damage to or loss of

equipment and facilities playing a vital role in protecting personnel from

hazardous events

Environment – damage to the environment deriving from operational

activities or from incidents

Assets and Operations – damage to the Company’s assets and/or impacts

on projects and/or production losses

Reputation – damage to the business or to the ‘License to Operate’ or to

the overall value of the Company deriving from HSE risks; it includes, inter

alia, the image

Social context – damage to external stakeholders (international actors and

local communities mainly)

It is important to remember that most activities which carry some degree of risk

entail risk to more than one of the above areas. It is vital that all possible effects

of a hazard are considered together. For example an activity entailing risk to

company profits must not be considered in isolation to its effect on the HSE. It is

difficult to determine a hierarchy of importance in the risk effect areas mentioned

above, but by common consent the effect of a hazard on persons, including HSE

effects, carries most weight and the effect on assets and profits least weight.

The application of risk tolerability criteria as a management tool requires specifics

skills and expertise.


14

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Areas of Risks FULL QUALITATIVE APPROACH

Risk is a function of the likelihood of an event and the severity of its consequences.

The risk from a particular event is the HSE risk associated with a specific, discrete

scenario (such as helicopter crash, transport accident, oil spill, etc.) in terms of

effects on people, environment, assets and reputation and is usually assessed

qualitatively (see Appendix B1).

All the risks coming from external factors (e.g. geo political conditions, political

instability, earthquake, presence of closely plant/installation) shall be taken into

account in the this process. A specific application of the Full Qualitative Approach is

the assessment of personnel Risk. This is a non-specific term covering the risk of

injury, diseases or fatality to personnel from named tasks, or from routine or special

operations (occupational risk : see Appendix B2).

SEMI- QUANTITATIVE APPROACH

Risks to People (Health and Safety)

Hazardous activities may result in injury, fatality or diseases both to those personnel

engaged in work associated with the activity or to community. Risks to people may

be divided into:

a) Individual Risk - the total risk of death in a fixed time period (most often one

year) to which a worker or a member of the community may be exposed from all

credible hazards and sources of accidents (see Appendix B3).

b) Societal Risk- the risks to society arising from operations; the term “society”

in this context include communities, residential areas and, in general, the “public

domain” which is not associated to those operations ( see Appendix B4).

Environmental Risk

The Environmental Risk is the risk to the environment from different activities that

fall under the responsibility of the Company. As a consequence, environmental risk

management should take account of the exposure of the environmental resources

to a variety of activities which constitute, as a whole, the sustainable development of

the Company itself ( see Appendix B5).


15

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Asset Risk

The Asset Risk considers the probability of damage to Company’s physical assets,

impacts on projects (failure to meet project objectives) and operations in terms of

production loss, deferred production and costs of replacement of damaged

structures and equipment due to any incidents (see Appendix B6).

Reputation Risk

Reputation risk is the risk to the reputation of a Company as perceived by society

at large, or sometimes more specifically its “peers” (other oil companies), its

employees, its shareholders, the government or financial institutions.

The reputation of the Company is linked and can be affected by HSE incidents or

accidents of all types. Reputation consists of a combination of the characteristics,

performance and behaviour of a Company and importantly for risk management,

the perception of the Company. Although reputation can be considered as an

‘intangible’ asset, it is important because it can affect the ability of the Company

to establish or maintain business at all stages of the development cycle. Therefore,

actual or perceived HSE impacts can damage the reputation/the business of the

Company and in turn tangible Company assets ( see Appendix B7).

Risk Management Process

The Risk Management Process (see Figure 1) is a continuous, iterative process,

which typically consists of five major steps:

1. Establishing the context:

identification of internal and external factors that it is necessary to consider

in the risk management process. These shall include:

factors inside the organization such as corporate risk management

standard, internal organization and delegation of responsibilities and

internal capabilities of the persons who operate, maintain and

manage activities at the facilities.

factors outside the organization such as applicable legislations, codes

and standards and key stakeholders such as partners, regulators,

local communities, NGO, major contractors and suppliers;


16

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



2. Communication and consultation:

identification and management of any affected interested parties, key figures

within and outside the Company shall be identified to ensure their

consultation and involvement in the risk assessment process.

3. Risk assessment:

it includes the following sub-steps:

a) Risk Identification: Identification and definition of potential hazards

and their potential effects:

b) Risk Analysis: Evaluation of the risk arising from identified hazards

in terms of evaluation of the likelihood / probability / frequency of

occurrence of accident sequences, evaluation of severity of the

consequences and analysis of the preventive and recovery barriers

in place.

Such information can be retrieved from various sources, including:

internal knowledge and experience of line / project / department

managers and HSE experts;

industry frequency and failure rate databases and co-operative

research programmes;

relevant international, national and eni e&p Division standards

and codes of practice;

industry and trade association codes of practice and other

guidance.

The risk analysis is aimed at determining the number of barriers in place and

evaluating their reliability considering all factors that can affect its performance in

terms of functionality, availability, reliability and survivability (e.g. design

specifications, inspections, functional testing and maintenance requirements as well

as operational procedures, operator training and competence, management of

change).


17

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



c) Risk Evaluation: Assessment of tolerability of risk to people,

environment, assets and reputation by comparing risk level with

the relevant tolerability criteria

4. Risk treatment:

Identification of effective risk reduction measures needed to reduce the likelihood /

probability / frequency (prevention) and/or to control incidents (limiting the extent

and duration of a hazardous event) or to mitigate the consequence of an accident

(control and mitigation).

5. Monitoring and review:

Monitoring and review of the entire process to ensure it continues to be effective

and to verify whether the barriers continue to be effective. In particular, this

review is necessary every time a significant change occurs in the installation

which has the potential to affect its integrity.

18

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Figure 1 – Risk Management Process

Risk Identification and Analysis

A systematic approach to the identification of hazards and the evaluation of risk is

a key element of effective HSE management, providing information to support

decision-making on risk-reduction measures.

For new installations or activities hazards shall be identified as early as possible, in

order that sufficient time can be given to the most appropriate way to manage

them. It is always easier to make modifications early in the design stage of a

project, when changes can be made with minimal effect on cost and schedule.


19

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Risk analysis and risk assessment shall also be applied to existing facilities, but in

some cases changes that would be justified during design may not be practicable

for an existing facility. As an example, improvements in layout may not be

practicable for existing facilities. Also the work necessary in undertaking

modifications to an existing facility itself introduces an additional risk of accident.

Should such a situation occur, managerial and operational criteria (such as de-

manning) may be adopted instead of technical provisions.

Risk Identification

Risk identification includes:

A broad review of possible hazards and sources of accidents, with particular

emphasis on ensuring that relevant hazards are not overlooked.

A rough classification into critical hazards (as opposed to non- critical) for

subsequent analysis

Explicit statement of the criteria used in the screening of the hazards

Explicit documentation of the evaluation made for the classification of the

non-critical hazards.

Hazards can be identified and assessed in different ways using one of the

following tools and techniques:

- Experience from previous analyses, safety inspections and audits,

useful when the activity under consideration is similar to activities

undertaken previously in other locations. The approach is not suitable

when dealing with innovative systems or where local conditions

invalidate previous experiences

- Use of checklists and accident statistics. Checklists are normally

drawn up from standards and operational experience and ensure

that known hazards have all been identified and assessed. They are

easy to apply and can be used at any phase in the project life cycle.

Examples of Hazard checklists are provided in ISO 17776 (Ref.1)

- Codes and standards that reflect collective knowledge and experience,

accumulated on the basis of Company, national or international


20

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



operations. These documents incorporate the lessons learned from

previous design, from hazard and risk assessment and from accident

and incident investigation. The compliance with prescriptive

standards ensures the reduction of risks to a tolerable level.

The use of checklists based on requirements laid out in codes and

standards is an effective technique in identifying compliance with

standard practice and highlighting aspects which require further

investigations.

- Structured review techniques (HAZID, HAZOP), used to identify and

evaluate known and unforeseen hazards and unintended events that

are not adequately addressed by the previous methods.

More details about these techniques can be found in ISO 17776.

The selection of the appropriate hazard identification and risk evaluation tools and

techniques depends upon the nature and scale of the installation, the information

available, the phase of the project and experience of similar installations.

Risk Analysis

Frequency Evaluation

Frequency information may be obtained from

Experience

Company data and source including accident and incident data

Published data sources such as WOAD and OREDA.

Where data does not exist, it may be possible to derive it from more fundamental

data using the following methods:

- Fault Tree Analysis (FTA)

- Failure Mode and Effect Analysis (FMEA)


21

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



These are expected to provide estimates that may not be homogeneous with those

coming from experience, therefore, where possible, estimated frequency data for

initiating events should include an allowance for human and/or operational factors.

Frequency is usually expressed in occurrences per year.

Consequence Evaluation

Consequence analysis includes consequence modelling, for example estimation of

accidental loads, such as intensity of fires, modelling of escalation and estimation

of response to accidental loads.

Consequence analysis can be applied to assess HSE aspects for a range of

consequence scenarios and involves the use of predictive models. Consequence

scenarios may be developed in simple narrative form, using multiple branch event

trees and utilising more or less complex computerised modelling techniques.

Since the majority of models provides only an approximation of what might

happen, models should only be used when they are validated in a particular

application and their predictive capability is generally accepted.

Successful application requires use by personnel with adequate training and

experience.

As far as possible, consequence analysis should also assess the contribution to

failure from human and organisational factors, together with the contribution from

such failures to dependent failures (escalation).

The following analysis methods may be used for the escalation analysis:

Event Tree Analysis (ETA)

Simulation/ probabilistic analysis

More details about these techniques can be found in ISO 17776.


22

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Risk Evaluation

Measurement of risk is the preliminary phase of assessing its acceptability

(“tolerability”). It is necessary to compare risk figures with

acceptability/tolerability thresholds in order to determine whether the risk is fully

acceptable, completely intolerable or somewhere in between.

Measurement of Risk

In order to interpret risk to people, reputation etc. some means of measurement

of risk is required. Since risk is in its simplest terms consequences times frequency,

obvious types of measure may be:

Fatalities / occupational illness per year ( risk to people)

Spills per transfer operation (risk to the environment)

Financial losses per year (asset losses)

Apart from financial loss which is relatively easy to measure in risk terms, all other

areas present problems. Environmental risk is particularly difficult to define except

in terms of specific items such as spills as detailed above. Some of the problems

with the measurement of environmental risk are described below:

- Some environmental discharges are continuous but have indeterminate

effects

- Some environmental hazards are short term in duration but have long term

effects changing over time

- Some environmental hazards may have quite different effects on, for

example, air quality, water quality and ecology, making a global measure of

environmental risk difficult to define.

These problems make the use of matrices discussed later, particularly helpful for

environmental risk measurement. In assessing environmental risk one should pay

attention to separate risks from impacts. Risks refers to acute phenomena,

impacts normally refers to chronic effects ( that may be negative but also

positive).


23

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



In this view, a continuous environmental discharge constitutes a risk only if it is

limited in time ( contingency) or due to an upset condition.

Risk to reputation is also very difficult to measure, as reputation is an intangible

concept. The normal approach is to define the effect of a reputation hazard in

terms of significance to the news media and to assess its impact geographically

(e.g. very local, national or international). Given the difficulty of expressing this in

quantitative terms, a qualitative approach is always used in this area.

Risk to people can be measured in various ways according to the types of

individuals at risk and their exposure. A discussion of the ways of measuring risk

to people is given in Annex A.

All estimates of risk for people are based on either qualitative or quantitative

approaches.

Risk Matrix and criteria

Risk matrix is a tool, inspired to the ISO standard 17776, which shall be used as a

background for setting risk tolerability criteria. When used as a qualitative matrix,

it considers events that have been experienced by the Company or the Company

may expect in case of deterioration of such events.

In case Company history/experience is considered not consolidated (in terms of

No. of plants / operations), reference shall be made to e&p industry in the same

geographical area.

The risk matrices are reported in Appendix B.

The matrix axes, consistent with the definition of risk, are Consequences and

Likelihood / Probability or Frequency.

The vertical axis represents the measure of the potential consequences of credible

scenarios. A scale of consequences from ‘1’ to ‘5’ is used to indicate increasing

severity. The potential consequences of credible scenarios are considered as


24

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



consequences that could have resulted from the released hazard if circumstances

had been less favorable.

The horizontal axis represents the measure of likelihood / probability / frequency

of the occurrence of a hazardous event. Such a scale is defined in general terms

from ‘0’ to ‘E’ on the basis of historical evidence or experience that such

consequences have materialised within e&p industry or the Company.

The risk matrices are separated in four regions that identify the limit of risk

tolerability; such regions are:

1. Continuous improvement( Low tolerable risk area): The level of risk is

that requires continuous monitoring to prevent deterioration.

2. Risk reduction measure (Medium tolerable area ): The level of risks

that requires generic control measures.

3. Risk reduction measure (Medium–High; criticality area): The level of

risk shall be mandatorily reduced applying suitable corrective measures,

provided that is demonstrated that the implementation of such measures is

not disproportionate to the benefits (ALARP). A discussion of ALARP and

cost-benefits analysis is given in Annex C. For operating fields the risks could

be recovered in a maximum 4Y period.

4. High risk( criticality risk area): The level of risk is not acceptable and risk

control measures are required to move the risk figure to the previous

regions. For operating fields the risks could be recovered in a maximum 1Y

provided that interim Operational Measures are adopted.

Depending on the position of the intersection of a column with a row in the risk

matrix, it is possible to classify the risk.

For the same scenario (grouping all hazardous events which have the same

severity of consequences), a resulting likelihood / probability / frequency is

assigned or calculated, such that the risk can be classified. The classification is


25

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



repeated for all the risk areas (People, Environment, Assets and Reputation). The

overall risk of a hazard is classified according to which among consequences has

the highest rating.

Risk Screening Matrix

The Risk Screening Matrix is reported in Aooendix B1 and provides definition of

consequences and a range of qualitative criteria to estimate likelihood / probability

or frequency. This shall be used in the identification of high level HSE Risk during

risk screening (Major Hazard Analysis, Environmental Impact Assessment, etc.).

This matrix provides the basis to identify significant risks or areas of risk (for

example, transportation risk) and prioritise further assessment and management

efforts.

Risk screening matrices are suitable to be linked with other means of assessing

tolerability, especially when assessing human risk in high hazard scenarios, usually

connected with safety accidents. Risk Acceptability for these scenarios is discussed

in Appendix A.

Should the qualitative risk figure be intolerable, either a quantitative risk analysis

(QRA) or the adoption of fit-for-purpose and more effective risk-reduction

measures shall be required.

Personnel Risk (Task)

When considering Occupational Health and Safety Risk Assessment related to

specific tasks, a qualitative approach is preferred, since it is usually based on past

experience.

The Personnel (Task) Risk Assessment Matrix is based on the document “Task Risk

Assessment Guide - A step change in safety” and is reported in Appendix B2.


26

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



The occupational health risk (occupational illness or injury) is usually based on

“exposure” to hazardous agents (physical, chemical, etc.); this is covered by

specific Minimum Health Standards.

Risk to People (e&p operation)

Risk to People induced by e&p operations can be assessed both qualitatively and

quantitatively.

When performing Quantitative Risk Assessment (QRA) as a forecast of possible,

future events, fatalities have to be considered with care, avoiding a deterministic

approach; in this context, for example, to evaluate the risk of fatality, it is

necessary to consider not only the frequency (or probability) of the accidental load

(in terms of radiation from a fire, overpressure from an explosion, toxicity from a

toxic release etc.) but also the vulnerability of humans to this load.

The Risk to People (e&p operations) Assessment Matrix is reported in Appendix B3.

Societal Risk

The Societal Risk matrix to asses risk to society arising from e&p operations is

reported in Appendix B4.

Environmental Risk

The environmental risk matrix has been derived from a document prepared by the

OLF’s environmental committee for oil spill to sea and has been extended to

onshore activities too; it is reported in Appendix B5. This matrix essentially

provides an expansion of the definitions of environmental consequences included

in the Event Screening matrix.

As far as consequences are concerned, a list of options is shown; they are

intended not to be used contemporarily; for example, in sensitive areas, the

option based on amount of spilled oil is not suitable, and is preferable to adopt

options related to protection of fauna and flora.


27

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Asset Risk

The asset risk matrix is reported in Appendix B6. Even in this case, different

options are shown to describe consequences, based on times and costs for repair.

As far as probability / frequency is concerned, both quantitative and qualitative

criteria are shown, where the latter is based on reliability of technical / operational

protection systems, such as temporary refuges, control systems etc. The reliability

is expressed in terms of minimum number of failures needed for the hazard to be

realized (higher the number of failures, higher the number of barriers against the

hazardous event).

Reputation Risk

Reputation is essentially an intangible asset. However, HSE risks can have a

significant impact on reputation with serious consequences to the Company. It is

therefore advisable that the reputation aspect of any risk is properly evaluated

against the criteria in Appendix B7.

Risk Treatment

For any given risk there are four basic management approaches:

1. Take/Accept: the risk is tolerated in its basic state with no active controls

being applied;

2. Terminate: the factors which create the risk are eliminated (e.g.

replacement of dangerous chemicals)

3. Treat/Manage: apply controls in the form of hardware, software,

procedures with the effect of reducing the frequency or consequences of the

event

4. Transfer: Insure (only in case of risk for assets).

Risks are generally classified according to the controls that either are put in place

or must be implemented to reduce/control the risk.


28

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



The risk reduction measures should be identified through a Quantitative Risk

Assessment (QRA) based on the following steps:

1) Identify hazardous events, considering techniques such as Event Trees;

2) Consider the accidental loads (e.g. radiation from fires) and, hence, the

damage/harm deriving from the hazardous event to: an employee, a man of

the public (risk to people), a plant section (asset risk) etc;

3) Sum up frequencies of all hazardous events of the same nature (all gas

releases, all fires, all explosions etc.) with same consequences (harm to an

employee, a man of the public, a group of people, an area with a given

occupancy);

4) Enter the suitable risk matrix and verify tolerability;

5) If unacceptable, assess what controls are viable;

6) Determine if the risk, which is residual after controls, will be manageable;

7) If still unacceptable, consider further mitigating factors (reduction of % of

manning, chance of sheltered escape, favorable wind directions, extra

controls etc.) to re-conduct the event in the acceptable area;

8) If still unacceptable, consider the “zero option” (“terminate” the risk).

Identification, Development and Implementation of Controls

Risk reduction measures include preventative measures (reduction of likelihood /

probability / frequency) and mitigating measures (reduction of severity of

consequences). Mitigation measures include steps to prevent escalation of

developing abnormal situations and to lessen adverse effects on Health, Safety

and the Environment.

Risk reduction measures also include recovery preparedness measures, which

address emergency procedures as well as restoration and Company procedures to

recover.

In identifying control measures, consideration should be given to:

The activity


29

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



The people involved

What tools, equipment and materials are to be used

The working environment

The remedial measures needed to control each of the high risks should be based

on good safe working practice in order to reduce the residual risks to a level which

is practicable. If the identified remedial measures are not suitable to move into

the HIGH- MEDIUM Region, a detailed QRA , when applicable, shall be performed

in order to substantiate the final risk level.

The “hierarchy” principle shall be adopted, with the following priority list:

1) Avoid the risk

2) Replace hazardous devices/operations with less hazardous ones

3) Prefer collective safety measures to individual ones

4) Adopt alternative design/operations

5) Increase No./effectiveness of controls, supported by the best available

practices (HSE MSG) and technologies.

The process stops when efforts to introduce further reduction measures become

unreasonably disproportionate to the additional risk reduction that will be obtained.

An approach widely used is to evaluate the effort and cost involved in a number of

different risk-reducing measures and to estimate the risk-reducing effect of each.

By evaluating the cost or effort necessary to arrive at a common level of risk

reduction it is often possible to identify those measures which are clearly more

effective in risk reduction.

In case of asset risk, the following formula can be adopted for comparison:

(probability of the hazard) x (costs if it realizes) = expected cost from the risk

Evaluation of risk-reducing measures should always be based on sound

engineering principles and common sense. The following aspects should also be


30

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



observed: local conditions and circumstances, the state of scientific and technical

knowledge relating to the particular situation, and the estimated costs and

benefits. See Appendix C for further information on Costs-Benefits analyses.

It must be clear in any case that no level of risk of fatality for anyone person is

acceptable.

Risk Register

From the risk assessment process, each Company shall develop a Risk Register

which detail the main areas HSE risk associated with activities in all operating

unit/project (exploration/development/operation), including normal and temporary

activities (e.g. operation plant, warehouse, marine base, headquarter, guesthouse,

drilling activity, seismic).

The Risk Register shall record the most significant hazards (together with their

consequences and probability of occurrence) which, if realized, have the potential

to adversely affect the Company with consequential negative impacts on its HSE

performance and reputation.

The Risk Register should demonstrate that:

all hazards, effects and threats have been identified

the likelihood / probability / frequency and consequences of a hazardous

event have been assessed

controls to manage potential causes (threatened barriers) are in place

recovery preparedness measures to mitigate potential consequences have

been taken.

The Risk Register is a live document and it shall be updated at minimum

one per year and whenever change on process/project is highlighted.

The Risk Register format is free and can be replaced by the tool requested by local

legislation ( i.e DUVRI) but, as minimum, it shall contain the information that


31

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



need to be reported to the HQ. It is up to the reporting Company ( Geographic

Unit or GU) to use the Risk Report as a Risk Register template for internal usage.

Risk Reporting

The Risk Report is a tool that allows Company and eni e&p Division to be aware of

the main HSE risks associated with their operations and be informed about

progress in reduction of those risks classified as medium, high-medium, and high.

A copy of the Risk Report shall be sent to the eni e&p division SEQ/SICI

Department , by end of June each year.

An Action Plan related to the high risks, identified through the Risk Management

Process, shall be send to eni e&p division SEQ/SICI Dept within one month from

their identification.

A template for Risk Report is reported in Appendix D.

Four Areas of Risk have been identified. Risks associated to each area shall be

addressed, where applicable (see Table 1, 2, 3).

Other risk areas and categories may be added to the list depending on specific

local conditions.


32

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Table 1 – Risk Areas and Categories- social aspects and environment

RISK AREAS RISK CATEGORY

Soci

al A

spec

ts

1.1 Communities & Security

1.1.1 Hostile communities/media

1.1.2 Damage to cultural heritages

1.1.3 Terrorist Activity/Sabotage/Bunkering

1.1.4 Internal & external security threats

1.2 Workforce / Ethics

1.2.1 Stress/shift induced risk

1.2.2. Turnover risk

1.2.3. Inadequate level of indigenous training (local workforce/contractors)

1.2.4. Communication barriers

Envi

ronm

ent

2.1. Emissions

2.1.1 Continuous discharges to air (air quality requirements)

2.1.2 Emergency/Upset discharges (GHG emissions requirements)

2.2. Spills

2.2.1 Underground contamination

2.2.2 Surface contamination

2.2.3 Transportation by sea/land/internal water (including loading and unloading activities)

2.3. Wastes

2.3.1 Pollution from operational wastes

2.3.2 Pollution from domestic wastes

2.3.3 Pollution from sanitary wastes

2.3.4 Pollution from radioactive waste (TENORM or radioactive sources)

2.4. Production Water

2.4.1 Continuous discharge to water (legislative requirements, drainage systems, oil/water separation)

2.4.2 Continuous discharge to soil

2.5. Facility impact

2.5.1 Impacted area (footprint)

2.5.2 Pipeline routing impact

2.5.3 Previous land use

2.5.4 Vulnerable fauna and flora

2.5.5 Visual impact

2.6. Biodiversity 2.6.1 Reduction of indigenous biodiversity

2.7. Subsidence

2.7.1 Ground structure

2.7.2 Foundations

2.7.3 Reservoir depletion


33

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Table 2 – Risk Areas and Categories- safety


Saf

ety

3.1. Process Safety

3.1.1 Loss of Primary Containment (lack of process control, erosion/corrosion, process stress)

3.1.2 Manning inconsistent with design and operations philosophy

3.1.3 Risk of stored flammables

3.1.4 Risk of ignition (fire, explosion, flash-fire)

3.1.5 Risk from layout (lack of containment, module proximity, unfavourable wind directions, wrong escape routes and mustering)

3.1.6 Blowout risk

3.1.7 Risk of inhibits/overrides of safety critical elements

3.2 Operations Safety

3.2.1 Air transportation and communication risk

3.2.2 Land transportation and communication risk

3.2.3 Marine/Internal waters transportation and communication risk (e.g. anchor handling activities + towing)

3.2.4 Heavy lifting

3.2.5 Maintenance hazards (access, override, bypasses, etc.)

3.2.6 Risk of substandard Contractors/ Subcontractors (contractual clauses and conditions, training and competency)

3.2.7 Concurrent/Simultaneous Operations

3.2.8 Construction, Commissioning, Start-up and Shutdown risks

3.2.9 Drilling operations risks

3.3 Emergency Response

3.3.1 Lack of emergency preparedness (firefighting, spill clean-up, security support, evacuation)

3.3.2 Lack of communication for emergency planning

3.4. Office Safety 3.4.1 Office-related risks


34

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING




Hea

lth

4.1. Work Environment

4.1.1 Chemical agent (including carcinogenics, toxics, hazardous sustances, asphyxiation agents)

4.1.2 Physical agent (noise, Vibration, barometric, Thermal, electricity, Electromagnetic Field, Optical Radiation, Ionizing Radiation, TENORM)

4.1.3 Ergonomic risk (Physical static load, Physical dinamic load, job place) Office comfort (Ventilation, illumination, temperature, etc)

4.1.4 Psychosocial risk (content of task, time organization, job charge, etc)

4.2. Medical Emergency

4.2.1 Site medical facilities

4.2.2 Medical emergency response capabilities (EG: major incidents)

4.2.3 Country & Regional medical support

4.2.4 Competence medical staff

4.2.5 Communication & response (EG; Planning, preparation, response, delay, etc)

4.3. Disease Risk

4.3.1 Endemic diseases and vector transmission diseases

4.3.2 Animal Contact

4.3.3 Social risk (HIV, STD, etc.)

4.3.4 Workplace transmission diseases - biosafety.

4.3.5 Catering risk (Food storage, handle, disposal; contamination, heat contact, food chain management)

4.3.6 Water risk (human consumption water and water disposal management)

4.3.7 Pandemic Disease

4.4 Remote Locations

4.4.1 Climate and Geography

4.4.2 Fitness to work

4.4.3 Exacerbation pre existing conditions.

4.4.4 Road accidents, drivers.

4.4.5 Remote site considerations (hig risk work, limited facilities, security, rotational work, cultural changes)

4.4.6 Location and logistics

Table 3 – Risk Areas and Categories- health


35

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Risk Categories have been identified for each Area, as well as potential areas of

impact. Potential impacts may be on People ‹P›, Environment ‹E›, Assets ‹A›,

Reputation ‹R› or more than one of these.

Risk Areas are numbered to allow a management summary to be developed in a

structured manner, which shows where the key risks are located.

Risk Ranking Matrices are used to rank the risks, according to the following

process. Upon selection of the Risk Areas (step 1), the Risk Category (step 2)

and the identification of potential areas of impact - P, E, A, R - (step 3), it is

necessary to associate a frequency (or probability) of occurrence to the events

being analysed (step 4).

This can be done by using the reference matrix in Appendix B.

Two different methods can be adopted to enter the proper frequency, depending

on whether or not such an event has already happened within the Company:

Reactive method: the frequency category of the event is identified by using

Table 4. Frequencies corresponding to 0 and A are not covered, as these

categories imply that the event has not happened within the Company, and

therefore the second method should be used.

Table 4 – Frequency Evaluation (reactive method)


36

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Predictive method: where there is no experience of any previous occurrence of

the event being analysed within the Company, the realisation of the hazard under

consideration is the result of potential failures or absence of relevant controls,

which may be hardware (HC) or operational (OC) in nature.

Table 5 shows how the level of risk is determined, based on the number of, and

reliability of the controls.

Table 5 – Frequency Evaluation (predictive method)

In either case a frequency category 0 to E (for reactive), or 0 to C (for predictive),

will be allocated to the event.

This parameter, together with the severity category of the event’s consequences,

will allow the risk figure to be entered in the matrix of Appendix B (step 5).

The risk may fall in the “red” region (High Risk); in the “orange” region (Medium-

High Risk), in the “yellow region” (Medium Risk) or in the “light blue” region (Low

Risk).


37

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



The next step (step 6) requires that measures are identified that allow the High

Risk events to be moved at least to the Medium Risk area and the Medium Risk

events to be moved, if practicable, as close as possible to the Low Risk area.

This can be done by taking measures which reduce the severity of the event or its

probability of occurrence.

An Action Plan shall be drafted to ensure that these measures are then

implemented in a controlled manner.

Examples of Hardware and Operational Controls are provided in Table 6 and Table

7 respectively.


38

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



HC4.3. Escape, Evacuation & Rescue Equipment

HC4.4. Medical Emergency Equipment

HC4. Emergency Equipment

HC3.7. Communication System (PA/GA)

HC3.8. Emergency Power Supply System

HC3.9. Medical Emergency Response Plan

HC3. Emergency System

HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency devices)

HC4.2. Collective / Personal Protective Equipment

HC3.1. Emergency isolation system (ESD) different from process / equipment control system

HC3.2. Emergency well isolation system (BOP, SSSV) different from process / equipment control

HC3.3. Emergency relief system (e.g: Emergency Blowdown System)

HC3.4. Emergency disposal system (e.g.: Flaring & Venting)

HC3.5. Gas Detection System

HC3.6. Fire Detection System

HC2.5. Temporary Refuges

HC2.6. Leak Containment System (blanketing, double seals)

HC2.7. Critical structures / foundations

HC2.8. Injury mitigation system (e.g. roll-bars, dual engines)

HC2.9. Store for medications and lab - X-ray reagents. X-Ray Isolation

HC2. Passive Protection

HC1.7. Health / Environment Technical provisions (e.g. treatment units, clinic, medical attentionequipment, specific equitment, etc.)

HC1. Equipment

HC2.1. Explosion containement system

HC2.2. HVAC (Ventilation, positive pressure systems)

HC2.3. Liquids containment and drainage system

HC2.4. Fire walls / passive fire protection

HARDWARE CONTROL (HC)

HC1.1. Item or assembly layout / route

HC1.2. Process Control Equipment/System

HC1.3. Pressure Protection System

HC1.4. Kick Control System

HC1.5. Risk monitoring (EG: black box, IVMS, flight follow, navaids)

HC1.6. Ignition Control

Table 6 – List of Hardware Controls


39

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



OC6. Training and CompetencyOC6.2. Assessment / Gaps Removal of supervisors' competency, conduct and motivation

OC6.3. Specific training for radiation protection specialist

OC6.1. Minimum level of staff (Company and Contractor) experience at all staff changes (turn over,shift, etc.)

OC4. Emergency PlanningOC4.1. Emergency Response Plan (e.g. Safety, spill, health)

OC4.2. Scenario-based Contingency Plans

OC4.3. Emergency Response team (e.g. Firefighting, first aid brigade)

OC5. Responsibility/CommittmentOC5.1. Line manager Leadership, Commitment and Accountability to recognise / remove the hazard

OC5.2. Contractor Leadership, Commitment and Accountability to recognise / remove the hazard

OC5.3. HSE Professionals availability on site

OC2.7. Incentive Scheme

OC2.8. EHS Impact Assessment

OC2.9. Audit / Review program

OC3. Process Safety Management

OC3.1. Process Safety culture

OC3.2. Process Safety audits

OC3.3. Safety Critical Elements management

OC3.4. Inspection & Testing program

OC3.5. Preventive Maintenance Management System

OC1.9. Training & Awareness

OC1.10. Staff/Contractor Competency

OPERATIONAL CONTROL (OC)

OC2. Hazard-specific formal protocols

OC2.1. Hazard & Risk Management

OC2.2. Safety Engineering Design

OC3.3. Safety Critical Elements management

OC2.4. Due Diligence Approach

OC2.5. Community program (education, dialogue, welfare, health)

OC2.6. Occupational Health & Medical Support program

OC1.3. HSE / Process Safety rules for Construction & Commissioning

OC1.4. Start-up, shut-down, operating procedures (e.g. Permit-to-Work System)

OC1.5. Procedures for non-routine / repetitive tasks (critical or driven by experienced errors or incidents

OC1.6. Procedures for management of TENORM and other radioactive sources

OC1.7. Management of Change procedures

OC1.8. Contract HSE Requirements

OC1. Safe Systems of Work

OC1.2. HSE / Process Safety rules for Well/Production/Logistics Operations/TENORM/Electromagnetic-optical radiation Monitoring

OC1.1. Activity / Product / Service information (process, design, changes, risk data, well monitoring)

Table 7 – List of Operational Controls


40

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



7. List of Appendices and Attachments

Appendices:

A – Measurement of Risk to People

B – Risk Matrix

C – ALARP and Cost Benefit Analysis

D – Risk Report Template and User’s Guide

Attachment:

A – Risk Report Checklist (opi sg hse 001 e&p r01 AttA)

7. List of Appendices and Attachments

41

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



A – Measurement of Risk to People

Risk to people (usually, personnel or, generally speaking, workers) can be measured in

terms of risk of exposure, risk of injury or risk of fatality. Normally in quantitative risk

assessments the fatality risk is considered, while for the other risks a qualitative

approach is adopted.

Risk can be measured in a generalised way such as “high”, “high- medium”, “medium”

and “low” where these terms refer to comparative indications of risk for the industry or

activity under review. Alternatively it can be measured in specific terms where an

attempt is made to calculate the average probability of injury or death in a specific time

period either to an individual or to a group of people.

To measure risk in general terms, risk matrices have becoming increasingly used. These

give a framework for both measuring risk and assessing its acceptability. Risk matrices

are discussed in detail elsewhere in the main text of this document and examples are

given in Appendix B.

Risk matrices are useful to determine risk to personnel or workers in (but not limited to)

the following situations:

1. Screening

2. Where options need to be compared and all information are not available for a

detailed Quantitative Risk Analysis

3. Where quantification is difficult or impossible, such as in short term tasks where the

main risk is personnel injury.

Specific Measurement of Risk

Risk to Individuals

The method of measurement, which has become increasingly used in recent years, is

individual risk (IR). This is the risk of fatality to any person exposed to a hazard normally

averaged over a year. Individual risk can be specific to a particular

individual, averaged over those individuals in a high risk group, or averaged across all

persons in a potentially high risk location (e.g. where high H2S levels are expected in

Appendix A

42

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



the reservoir). In measuring individual risk the changes in exposure of persons, for

example by moving away from or closer to the hazard over a period of time is taken

into account. Individual risk may also be assigned to specific locations.

Calculation of Individual Risk

Consider a particular location at risk from a hazardous event nearby. The individual

risk from the event following realisation of the hazard is calculated as follows.

To a specific individual whether a worker or external member of the public

IR = zp1p

2

where p1 = fatality probability

z = event frequency

and p2 = proportion of time for which the person is present in the location

If there are several locations where the individual could be present and still be at risk

from the hazardous event then the total risk from the event can be summed from the

risk at each location.

Should other information (such as % of success of escape or evacuation; % of

favourable winds etc.) become available, the overall IR figure can be progressively

refined to keep account of these parameters.

In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due

regards to availability and reliability of data.

To the average individual (normally this would be used for a typical worker on a

specified site such as an offshore platform)

IR = z(n/N)p1p

3

Appendix A

43

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



where p1 = fatality probability

z = event frequency

n = the average number of persons present at the affected location

N = the total workforce on site (all assumed to work for similar number of hours

per week)

and p3 = proportion of time for which the person is present on site

Should other information (such as % of success of escape or evacuation; % of

favourable winds etc.) become available, the overall IR figure can be progressively

refined to keep account of these parameters.

In summary, it is possible to calculate a “coarse” IR and a “refined” IR, with due

regards to reliability of available data.

Tolerability of Individual Risk

The tolerability of the Individual Risk deriving from above mentioned calculations

(both “coarse” and “refined”) is evaluated against the risk matrices in Appendix B.

In particular, it is compared with risk figures shown in the “row” 4 (single fatality)

of Matrix B3; such figures are different when considering a “worker” or a “third

party” (member of the public).

Should the IR figure fall within either the “red” or the “yellow” region of the matrix,

it is necessary to move it away or to reduce it respectively, by adopting risk

reduction measures (e.g. introducing new “barriers”, improving the integrity of

existing barriers, etc.).

Risk to Groups

Individual risk to specific persons may be low in particular situations but due to

the large number of persons exposed, the possibility of fatality may be significant.

In these situations it may be appropriate to determine the Potential Loss of

Life(PLL). This is a measure of how many persons would become fatalities from a

particular site or event, normally expressed over a period of time.

Appendix A

44

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Calculation of PLL

Consider a particular location at risk from a hazardous event nearby. The potential

loss of life (PLL) from the event following realisation of the hazard is calculated as

follows. The event frequency is z.

PLL = zp1n

where p1 = fatality probability ;z = event frequency and n = the average

number of persons present at the affected location

Tolerability of Risk to Groups

When using a “consequence” figure which implies more than a single fatality, the

“row” 5 (multiple fatalities) of Matrix B3 can be used as a reference for tolerability

of the group risk.

Societal Risk

Societal risk expresses the risk to persons not employed or present at a workplace.

The Societal Risk is usually taken into account once the Individual Risk

and the Group Risk have been evaluated and suitably re-conducted into

the “tolerability” area.

Once the Individual Risk figure is found to be “tolerable” in Matrix B3, the Societal

Risk can be assessed against “occupancy” levels of the area surrounding

plants/assets.

This is achievable by utilising the Matrix B4.

Appendix A

45

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B – Risk Matrix - B1. Basic Risk Screening Matrix (Full Qualitative Approach)

Consequence Increasing Annual Frequency

Severity

Peop

le

Environ.

Assets

Repu

tation

0 A B C D E

Practically non‐

credible occurrence

Rare occurrence

Unlikely occurrence

Credible occurrence

Probable occurrence

Likely/Frequent occurrence

Could happen in E&P industry

Reported for E&P industry

Has occurred at least once in Company

Has occurred several times in Company

Happens several times/y

in Company

Happens several

times/y in one location

1 Slight health effect /

Slight effect

Slight damage

Slight impact

Continuous Improvement

2 Minor health effect / injury

Minor effect

Minor damage

Minor

impact

Risk Reduction Measures

3 Major health effect / i j

Local

effect

Local damage

Local

impact

4 PTD or 1 fatality

Major effect

Major damage

National impact

High Risk

5 Multiple fatalities

Extensive effect

Extensive damage

International impact

Appendix B

46

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B2. Personnel (Task) Risk Assessment Matrix

Severity

Personnel (Task) Risk

0 A B C D E

Not Applicable

Not Applicable

Could occur, when

additional factors are present; otherwise unlikely.

Not certain to happen but an

additional factor may result in an accident/ exposure.

Almost inevitable than an accident/ exposure would result

Almost inevitable that more than one accident/ exposure would result

N/A N/A



Happens several times a year in

Company

Happens several

times/y in one

location

1 (NOT APPLICABLE) Continuous Improvement

2

Minor health effect / injury: offsite medical treatment or LTA;

up to 10 days off. Agents have reversible effects to health.

Risk Reduction Measure

3

Major health effect / injury: more than 1 LTA; up to 30 days off. Agents have irreversible effects to

health: noise, manual handling, toxics, etc.

4

PTD or 1 fatality: agents are capable

of serious disability or death

5

Multiple fatalities

from an accident or occupational illness (e.g. chemical asphyxiation or cancer or

epidemic diseases)

High Risk

Appendix B

47

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B3. Risk to People (Operations) Assessment Matrix

Severity

People (Operations Risk) (usually in the open)

0 A B C D E

<10‐6 occ /y (1)

10‐6 to 10‐4 occ/y (1)

10‐4 to 10‐3 occ/y (1)

10‐3 to 10‐1 occ/y (1)

10‐1 to 1 occ/y (1)

>1 occ/y (1)

Could happen in

E&P industry




Happens several

times/y in Company

Happens several


1 Slight health effect / injury Continuous Improvement

2 Minor health effect / injury Risk Reduction Measures

3 Major health effect / injury Compulsory reduction measures

4 Permanent Total Disability or 1 fatality

(small exposed population)

High for 3rd parties onshore


(exposed groups)

High Risk

(1) frequency expressed in occurrencies per year

Appendix B

48

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B4. Societal Risk Matrix

Severity

Societal Risk 0 A B C D E

Radiation

(kW/m2)

(assuming unobstructed escape to repair)

Flash Fire Overpres‐ sure

(mbar)

Toxicity

(ppm)

(based on 30 min event

duration)

<10‐6 occ/y

10‐6 to 10‐4 occ/y 10‐4 to 10‐3

occ/y N. A. N. A. N. A.

1 < 3 ‐ < 30 Up to TLV Continuous improvement

2 3 ‐ 30 TLV

No more than 500 people in the open or 100 if mobility is reduced. (*)

Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*)

Compulsory


3 5 ‐ 70 IDLH

No more than 500 people in the open or 100 if mobility is reduced. (*)

Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*)

Up to 1m3/m2 in residential area. None in the open unless on monthly basis. (*)

4 7 ½ LFL 140 LC 1% hmn

Up to 500 people inenclosures, 100 at open, 1000 people/day max. at railway stations (*)


5 12.5 LFL 300 LC 50% hmn


Up to 0.5m3/m2 in residential area. (*)

High risk

(*) Industrial, agricultural, artesian areas admitted

Appendix B

49

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B5. Environmental Risk Matrix

Severity

Environment

0 A B C D E

<10‐6 occ/y

10‐6 to 10‐4 occ/y

10‐4 to 10‐3 occ/y

10‐3 to 10‐1 occ/y

10‐1 to 1 occ/y

> 1 occ/y

1

Slight effectNo stakeholder impact or temporary impact on

the area.

Involved area < 0.1 sq mile Spill (1)< 1 m3 – no sensitive impact on ground.

Continuous improvement

2

Minor effect

Some local stakeholder concern or 1 year for natural recovery or impact on small no. of not

compromised species.

Involved area < 1 sq mile Spill (1)< 10 m3 –impact on localised ground.

Risk reduction measures

3

Local effect

Regional stakeholder concern or 1‐2 years for natural recovery or 1 week for clean‐up or threatening to some species or impact on

protected natural areas.

Involved area < 10 sq miles – Spill (1)< 100 m3.

4

Major effect

National stakeholder concern or impact on licences or 2‐5 years for natural recovery or up to 5 months for clean‐up or threatening to

biodiversity or impact on interesting areas for

science.

Involved area < 100 sq miles – Spill (1)< 1000 m3.

5

Extensive effect

International stakeholder concern or impact on licences / acquisitions or > 5 years for natural

recovery or > 5 months for clean‐up or reduction of biodiversity or impact on special conservation areas.Involved area > 100 sq miles – Spill (1)>

1000 m3.

High risk

Appendix B

50

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B6. Asset Risk Matrix

Severity Risks to Assets/Project Objectives

• costs in USD • figures below shall not be

combined for deriving the value of a human life!

0 A B C D E

<10‐6 occ/y

10‐6 to 10‐4 occ/y

10‐4 to 10‐3 occ/y

10‐3 to 10‐1 occ/y

10‐1 to 1 occ/y

>1 occ/y

1 Slight damage

No disruption to operations/business. Continuous improvement

2

Minor damage

Possible short disruption of operations/business:

repair cost < 200000; production downtime < 1 day.


3

Local damage

The unit has been repaired/replaced to resume operations:

repair cost < 2500000; production downtime < 1 week.

4

Major damage

Long time/Major change to resume operations/business:

repair cost < 25000000; production downtime < 3 months.

Major inquiry for the damage cost.

5

Extensive damage

Total loss of operations/business. Revamping necessary to resume the

process: repair cost > 25000000; production

downtime > 3 months. Extensive inquiry for the damage cost.

High risk

Appendix B

51

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



B7. Reputation Risk Matrix

Severity

Reputation

0 A B C D E

Could

happen

in E&P

industry

Reported

for E&P

industry

Has

occurred

at least

once in

Company

Has

occurred

several

times in

Company

Happens

several

times/y

in

Company

Happens

several

times/y in

one

location

Non‐credible

occurrence Rare occurrence

Unlikely occurrence

Credible Occurrence

Probable occurrence

Likely/ Frequent Occurrence

1

Slight impact Minor and short lived impact in the locality

Continuous improvement

2

Minor impact

Some loss of reputation in the area, which should be recovered


3

Local impact

Significant potential damage to the regional reputation

4

Major national impact

Serious/permanent damage to the ability of the Company to sustain business position in the location, some broader implications for

the Company

5

Major international impact

Potential loss of future business position in the location/region and or lasting

significant damage to broader Eni image

High risk

Appendix B

52

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Note:

The reputation of the Company is linked and can be affected by HSE incidents or

accidents of all types. Reputation consists of a combination of the characteristics,

performance and behaviour of a Company and importantly for risk management,

the perception of the Company. Although reputation can be considered as an

‘intangible’ asset, it is important because it can affect the ability of the Company

to establish or maintain business at all stages of the development cycle. Therefore,

actual or perceived HSE impacts can damage the reputation/the business of the

Company and in turn tangible Company assets.

Appendix B

53

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



C – ALARP and Cost-Benefit Analysis

ALARP

Where risks are very low whether to personnel, the environment, assets or reputation

then the situation may be considered acceptable. On the other hand where risks are

high, good operating practices and often the law, requires that they be reduced.

Where risk exists in the region in between, normally called the ALARP region especially

where the risks are safety risks, a more structured approach is required. In the ALARP

region a reduction in risk is justified unless it is grossly disproportionate to the

benefits gained. In practice many risks fall in this region and so what is often known

as an ALARP case should be made for each of these. Sometimes this is possible by

discussion alone. For example, where hazardous activity is not known to have any

safer alternative and where personnel exposure cannot be further reduced, an ALARP

case may be presented in such terms without recourse to more detailed analysis.

However where a range of protective measures exists each entailing some cost, unless

the cost can be accepted, further analysis is required.

This analysis is usually based on a cost-benefits analysis described below.

Costs-Benefits Analyses

A costs-benefits analysis requires a comparison between the total costs of carrying out

an improvement to reduce or eliminate the risk, and the benefits gained. The costs

and benefits are normally considered over the lifetime of the development/operating

unit, or sometimes over the period for which the costs of the improvement can be

written off.

The costs of an improvement can normally be estimated with some accuracy. The

simplest way of doing this is to take the total cost as it is. This works well if the

development has a limited operating life. If the operating life is longer the true

Appendix C

54

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



cost of the improvement may include the effective cost of “borrowing” the money over

the relevant time period.

Benefits are effectively the losses that are, on average, avoided by implementing the

improvement. Benefits are harder to estimate than costs.

For risks to assets, the benefits may be easiest to judge. The losses that are avoided

include the capital losses of the damaged/destroyed facilities, reconstruction costs and

the loss of operating profits. For risks to personnel the easiest approach is to place a

monetary value on technical and operational efforts made to save human life.

It is implicit to this approach that low-cost measures are implemented in any case.

Costs-benefits analyses are very difficult to perform where the principal risks are to

the environment or to reputation due to the difficulties in estimating the benefits

obtained from improvements in these areas.

Limitations of Costs-Benefits Analyses

ALARP type arguments cannot and must not be made as a means of avoiding basic

levels of protection to personnel. It is a requirement of many laws and codes and

standards that some means are available to allow personnel who may be exposed to a

reasonably foreseeable hazard, of saving their life. Examples are lifejackets, lifeboats

and liferafts on boats and offshore installations, lifejackets and breathing masks on

airplanes, and fire alarm systems, and escape stairs in buildings.

In particular, ALARP type arguments cannot be used to avoid providing systems such

as these or to reduce the number of such systems/equipment items.

Appendix C

55

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



D- Risk Report User’s Guide

Here following a user’s guide on the Risk Report; the Risk Report Checklist is in the

Attachment A to the present Professional Operating Instruction (opi sg hse 001 e&p

r01 AttA).

Scope of this guide is to provide, by using a simplified approach, the main steps for

filling in the Risk Report form.

STEP 1: Selection of the Risk Areas

Four Areas of Risk have been identified:

1. Social Aspects

2. Environment

3. Safety

4. Health

For each Area of Risks, some sub-areas (e.g.: 1.1, 1.2, 1.3 …) have been identified.

The Areas of Risks are reported in the column A.

STEP 2: Selection of Hazard Category associated to the Areas of Risk

For each Risk Area, some Hazard Categories shall be addressed (in doing this use

the associated drop down menu in the column B).

Other risk areas and categories shall be added to the list, depending on specific local

conditions, selecting the line “Others” and writing directly in the relevant boxes.

It is important to fill in each Area of Risk (none shall be omitted) and their

associated Hazard Risk category; if some of them are not applicable, specify

the reasons.

Appendix D

56

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



STEP 3: Identification of Potential Impact

For each Risk Area, the Potential Impacts shall be defined.

Impacts could be on People ‹P›, Environment ‹E›, Assets ‹A›, Reputation

‹R› or more than one of these. Select in the drop down menu in the column C

the highest among these impacted objects.

STEP 4: Evaluation of Controls/Barriers in place

An exhaustive list of controls/barriers have been already identified.

They have been divided into hardware controls (HC) and operational controls (OC),

and in turn, into preventive and recovery controls. (see reference keywords sheet

in the form of Risk Report).

Once the controls/barriers have been identified and selected, note P (Preventive)

or R (Recovery) in the column D, and thick them in the drop down menu in

column E (describing them as a free text in the available box).

Appendix D

57

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



diked areas around tanks, hazardous drain systems different from non-hazardous ones-

fire detectors and gas detectors are linked to the ESD system (not in automatic mode)

firefighting system: ring main, fire hydrants, fire trucks



HC4.1. Active emergency equipment (firefighting, anti-pollution, standing-by emergency de

STEP 5: Risk Analysis

For each identified hazard, the evaluation of the associated risk shall be addressed

in terms of frequency of occurrence and severity. The risk evaluation will be

carried out through analysis of the preventive and recovery barriers in place as

already selected in the previous step.

The Current Risk figure is expressed as “Frequency” x “Severity of

consequences”.

For the evaluation of Frequency, it is possible to apply one of the following:

1. Predictive Method: if no incident referred to the selected

hazard has been experienced in the last 3 yrs

2. Reactive Method: if an incident (real or potential) referred to

the selected hazard has been experienced in the last 3 yrs

Appendix D

58

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



THE PREDICTIVE METHOD IS BASED ON:

(Use the Table 1)

No. of risk frequency barriers (preventive barriers only)

Reliability of these barriers. The reliability is proven by three basic

elements: 1. its absence was a cause of accident in the past – if yes,

thick in the dedicated box G 2. it is standardized - if yes, thick in the dedicated box H 3. it is kept in good condition – if yes, thick in the

dedicated box I

From the combination of these three elements, it is possible to derive the probability

of occurrence of the selected hazard, as follow:

o No. 1 “yes” only: Low reliability

o No. 2 “yes”: Medium reliability

o No. 3 “yes” : High reliability

Table 1

When two barriers are not independent, the lowest reliability prevails.

Appendix D

59

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



The final evaluation of the frequency, as deriving from the Table 1, shall

be reported in column N of the form.

THE REACTIVE METHOD IS BASED ON:

(Use the Table 2)

Statistics of the last decade incidents related to your Company

Table 2

The frequencies, defined in table 2, are reported in J, K, L, M column of the form

respectively.

The final evaluation of frequency shall be reported in column N of the form.

The Predictive and Reactive Methods can be applied together (if justified) and the

worst figure be adopted.

Appendix D

60

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



For the evaluation of Severity of Consequences it is possible to proceed as

follows:

1. Define, with the help of Table 3, What could have happened in more

adverse conditions ( worst potential consequences rather than real

ones);

Has the event already occurred at least once in the last 10 years in the Company?

Probability = B

Has the event already occurred several times in the last 10 years in the Company?

Probability = C

Has the event already occurred several times a year in the Company?

Probability = D

Has the event already occurred several times a year in one facility?

Probability = E

In case there is no evidence of control in place - Reactive Method (see attached Risk Screening Matrix - Table 2)

Appendix D

61

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Table 3

2. Consider the risk severity mitigation barriers in place (recovery barriers

only) and evaluate their reliability.

The reliability of a recovery barrier is based on three basic elements:

1. its absence was a cause of escalation of an accident in the past - if

yes, thick in the dedicated box G

2. it is standardized for the specific risk( fit –for-purpose) – if yes, thick

in the dedicated box H

Appendix D

62

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Description Does 3 years accident records show failure of this control has been a contributor to an event?

Is this control covered by technical specifications/dedicated work instruction?

Is this control subject to periodical maintenance or periodical review/audit?

diked areas around tanks, hazardous drain systems different from non-hazardous ones


firefighting system: ring main, fire hydrants, fire trucks




3. it is kept in good condition(ready to intervene)- if yes, thick in the dedicated

box I.

From the combination of these three elements, it is possible to derive the ability of

the barrier to reduce the severity of an accident, according to the following criteria:

• No. 1 “yes” only: Low reliability;

• No. 2 “yes”: Medium reliability;

• No. 3 “yes” : High reliability

No. 2 Medium reliability barriers are equivalent to 1 High reliability barrier.

When two barriers are not independent, the lowest reliability prevails.

An High reliability barrier only is able to reduce the severity by one order of

magnitude.

All other combinations have no effect.

The severity shall be reported in the column O of the form.

The Frequency and the Severity of the event’s consequences will allow, entering in

the Risk Matrix (Figure 1) to define the Risk Area.

Appendix D

63

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Consequence Increasing Annual Frequency

Severi

ty

Peo

ple

En

vir

on

.

Ass

ets

Rep

uta

tio

n

0 A B C D E

Practically non-

credible occurrence

Rare occurrence

Unlikely occurrence

Credible occurrence

Probable occurrence

Likely/Frequent occurrence

Could happen in E&P

industry


Has occurred at least once in

Company

Has occurred several times in

Company

Happens several times/y

in Company

Happens several


1 Slight health effect / injury

Slight effect

Slight damage

Slight impact

Continuous Improvement

2 Minor health effect / injury

Minor effect

Minor damage

Minor

impact


3 Major health effect / injury

Local

effect

Local damage

Local

impact

4 PTD or

1 fatality

Major effect

Major damage

National impact

High Risk


Extensive effect

Extensive damage

International impact

Figure 1- Risk Matrix

The risk may fall in the “red region” (High Risk); in the “orange region” (Medium-

High); in the “yellow region” (Medium Risk) or in the “light blue” region (Low Risk).

In detail, the following definition/criteria shall be adopted:

Appendix D

64

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



1. High risk( criticality risk area): The level of risk is not acceptable and risk

control measures are required to move the risk figure to the previous

regions. For operating fields the risks could be recovered in a maximum 1Y

provided that interim Operational Measures are adopted.

2. Risk reduction measure (Medium–High; criticality area): The level of

risk shall be mandatorily reduced applying suitable corrective measures,

provided that is demonstrated that the implementation of such measures is

not disproportionate to the benefits (ALARP). A discussion of ALARP and

cost-benefits analysis is given in Annex C. For operating fields the risks could

be recovered in a maximum 4Y period.

3. Risk reduction measure (Medium tolerable area ): The level of risks

that requires generic control measures.

4. Continuous improvement( Low tolerable risk area): The level of risk is

that requires continuous monitoring to prevent deterioration.

Insert the color (RED, ORANGE, MEDIUM, and LIGHT BLUE) of the Risk, in the

column P of the form.

Frequency Severity Risk

Current Risk Figures

4C

Appendix D

65

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



STEP 6: Risk Treatment

Taking into consideration the Risk Area, mitigation measures shall be put in place

(in addition to controls/barriers in place).

It is mandatory to define the mitigation measures for High and High-Medium Risks;

the implementation of mitigation measures are recommended for Medium Risk if

they are effective to move the risk in “light blue” region ( Low risk).

Identification of effective risk mitigation measures (controls) are needed to reduce

the frequency (in case of preventive controls/barriers) or to mitigate the

consequence of an accident (in case of recovery controls/barriers).

Once the mitigation measures have been identified and selected, note P

(Preventive) or R (Recovery) in the column Q of the form. The description of

the mitigation measures selected in the drop down menu will be reported in

column R, specifying in column S if the mitigation measures are independent

from the previous (existing) controls.

Independence is granted if the new control has no element in common with the

previous ones, including the controls already in place.

Examples are:

• A fire emergency team is not independent from a firefighting system.

• An ESD system is not independent from a depressurization system in case of gas

release.

Preventive/Recovery

Description

Is the measure independent from the previous control/measures

Measures to be Implemented

Appendix D

66

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



Rupdate the contingency plans and reinforce the emergency drills; ensure follow-up from drills.

P review/upgrade of firefighting design and construction (in particular, relocation of Brass fire pump), assignment of relevant contracts and installation/commissioning.

OC4.2. Scenario-based Contingency Plans

OC2.2. Safety Engineering Design

NOTE: if a Preventive Measure is NOT independent from a Recovery Measure, the

prevailing purpose of the measure as a whole (either Preventive or Recovery) is

adopted.

STEP 7: Monitoring and follow up

For the implementation of the identified mitigation measures, it is mandatory to

assign:

1. Responsibility for the implementation of action – column T

2. Budget allocation- column U

3. D-line for the close out of the actions – Column V

4. KPI for the monitoring- Column W Budget AllocationResponsibility Assigned for

Measure Implementation (indicate Dept.)

KPI adopted to monitor progress?

Deadline for Close-out (dd/mm/yyyy)

CRV, EMENone

end 2012SHERPA Database

Project, ENG end 2013

Investment Database

Appendix D

67

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



For the evaluation of the residual Frequency and Severity of the risk, it is

essential to consider the effective date of actions close-out. Prior to that date,

the current risk does not change at all. Report the results in columns X and Y

of the form.


Residual Risk @

30 / 06 / 2013

C 4

Once the mitigation measures have been fully implemented, it is necessary to re-

evaluate the risk. To do this, follow the same methodology described in steps 4

and 5:

Description Does 3 years accident records show failure of this control has been a contributor to an event?

Is this control covered by technical specifications/dedicated work instruction?

Is this control subject to periodical maintenance or periodical review/audit?

diked areas around tanks, hazardous drain systems different from non-hazardous ones


firefighting system: emergency preparedness has proven to be improved, fire pump in Brass has been relocated and firefighting network has been refurbished.




Appendix D

68

HS

E

RIS

K M

AN

AG

EM

EN

T

AN

D

RE

PO

RT

ING



and report the results in columns X and Y of the form. Include the evaluation of the

residual risk in the dedicated column Z, considering as D-line the date of the delivery of

next update of the Risk Report to SEQ/e&p.


Residual Risk @

30 / 06 / 2014

C 3

Appendix D

opi.sg.hse.001.e&p_hse risk management and risk reporting - rev. 01

Documents

hse risks

reportingopi sg hse

risk management criteria

risk reporting

ep r01this document

reporting opi sg hse

hse ims directives

risk assessment