Shell International Exploration and Production B.V.

Health, Safety and

Environmental
Management
Systems

EP 95-0100
Acknowledgement

Acknowledgement is given to E & P Forum for

permission to reproduce E & P Forum 'Guidelines
for the Development and Application of Health,
Safety and Environmental Management Systems".
Shell EP participated in the development of these
guidelines and has adopted the guidance provided
in the document

The text has been presented in the format of the EP

HSE Manual to facilitate electronic document
retrieval.

HSE
MANUAL

Revision 0: 19 October 1995

EP HSE Manual Amendment Record Sheet

Section Number: EP 95-0100

Section Title: Health, Safety and Environmental Management Systems

Rev. Chapter Description of amendment Date Amended

Nos. by
No. dd/mm/yy

0 All Original hard copy and CD-ROM issue 19/10/95 EPO/61

 Contents

CONTENTS 8 Review 85

Introduction iii
Appendices
1 Leadership and Commitment 1 I Group Policy Guidelines on Health, Safety
and the Environment 87
2 Policy and Strategic Objectives 5
3 Organisation, Responsibilities, Glossary 89
Resources, Standards and
Documents 11 References 97
3.1 Organisational Structure and
Responsibilities 12 Index 99
3.2 Management Representative(s) 15
3.3 Resources 16
3.4 Competence 17
3.5 Contractors 19
3.6 Communication 21
3.7 Documentation and its Control 25

4 Hazards and Effects Management

Process 35
4.1 Identification of Hazards and Effects 37
4.2 Evaluation 40
4.3 Recording of Hazards and Effects 47
4.4 Objectives and Performance Criteria 48
4.5 Risk Reduction Measures 50

5 Planning and Procedures 53

5.1 General 54
5.2 Asset Integrity 57
5.3 Procedures and Work Instructions 59
5.4 Management of Change 61
5.5 Contingency and Emergency Planning 63

6 Implementation and Monitoring 67

6.1 Activities and Tasks 68
6.2 Monitoring 69
6.3 Records 74
6.4 Non-compliance and Corrective Action 75
6.5 Incident Reporting 76
6.6 Incident Follow-up 78

7 Audit 81

EP 95-0100 Revision 0 19 October 1995 i

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

This page intentionally left blank

ii EP 95-0100 Revision 0 19 October 1995

 Introduction

INTRODUCTION

Objective
The objectives of this document are to:
 provide EP operating companies (Opcos) with complete and comprehensive guidance on all
aspects of an HSE Management System
 promote a common framework recognisable by EP contractors worldwide thereby easing
prequalification, assessment and interfacing of management systems and joint preparation of
Safety (HSE) Cases.

Scope and structure

The E&P Forum 'Guidelines for the development and application of health, safety and environmental
management systems' and the Group HSE Management System Guidelines describe ‘what’ should be
in an HSE Management System. This Manual on EP HSE Management Systems effectively describes
’both the 'what' and the 'how' and draws extensively from those systems which already exist within
the Group and EP, eg incident reporting, emergency response and permit-to-work. The contents of
these references, which include Group guidance, eg Shell Health Safety and Environmental
Committee (SHSEC*) ‘yellowbooks’, EP technical publications and DEPs are not repeated here,
although, the key HSE principles they contain are summarised.
* The Shell Health, Safety and Environmental Committee replaces the previous PSEC, Product,
Safety and Environmental Committee and the SSHC, the Shell Safety and Health Committee.
SMS has been introduced in most EP Opcos and is thus the first step in the introduction of an
objective-setting HSE Management System in these Opcos. Others have also progressed
Environmental Management Systems and can thus build on the foundations of these formal systems
of HSE management. Nothing provided in this Manual in any way contradicts the principles nor the
implementation of SMS or EMS. Rather it brings together the aspects common to the management of
them both in an agreed structure aimed at avoiding duplication and improving the recognised synergy
of managing H, S and E.
This document has been prepared in a format which allows the reader to clearly see which parts are
the industry guidance and which are functional Shell EP guidance. The eight chapters that follow
include the original text as it appears in the E&P Forum Guidelines; text appearing in italics is from
the supplementary section of the same Guidelines. The Shell annotations appear with a box bar in the
left hand margin and are highlighted by the appearance of the Shell pecten. These annotations
describe how HSE MS is implemented in Shell Companies. The E&P Forum text has been
incorporated within this guideline and carries the same status as the Shell text.
There are some minor differences in the wording of titles. Where the E&P Forum section is entitled
Evaluation and Risk Management, it has been renamed Hazards and Effects Management Process in
the Shell text. This change has been made to emphasise the fact that risk management includes both
hazards and effects, eg on the environment and that this does not always entail quantitative risk
assessment and to emphasise the focus on the hazards and effects. Other minor differences in text are
highlighted in the document.
Three key areas identified in this document are addressed in greater detail in accompanying
documents to this section of Volume 1:
EP 95-0110 Management of Contractor HSE
EP 95-0120 Competence Assurance for HSE-Critical Activities
EP 95-0130 Audit

EP 95-0100 Revision 0 19 October 1995 iii

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Safety and HSE Management Systems in Shell

A management system describes the way an organisation is managed with respect to its stated
objectives. It does this by concentrating on critical activities, ensuring that they are properly
controlled and that measurements are made and reported so as to enable monitoring of overall
performance and identification of areas for improvement. Management systems provide continuity, a
consistent and structured approach, identify improvement opportunities and can be used to
demonstrate that controls supported by procedures and documentation are in place. The introduction
of such systems is required in some areas by legislators. In EP, the changing face of the business,
including the increasing use of contractors for non-core business requires more rather than less
formalisation of the business processes.
The benefits and stability afforded by management systems are self-evident, particularly in helping to
identify gaps in the existing management structure. However, for management systems to be
successful, it is essential to avoid rigidity, bureaucracy, over-complexity and the suppression of
innovative thinking. The focus must be maintained on the critical issues. Most management systems
have in common a basic ‘plan’, ‘do’, ‘check’ and ‘feedback’ loop. Figure I shows this as an inner loop
and expands it further to include standards and procedures and performance monitoring.
An Opco corporate management system may address a number of management aspects, eg finance,
data integrity, quality, or perhaps only those relating to safety, in which case it will be a Safety
Management System (SMS). Any such aspect management system like the SMS is therefore a sub-
system of the overall system.
Figure I Structure of the HSE Management System (E&P Forum)

iv EP 95-0100 Revision 0 19 October 1995

 Introduction

policy &
strategic
objectives
organisation
resources &
review Leadership documentation
&
Commitment
implementation evaluation
& & risk
monitoring management

planning

audit

The E&P Forum representation of the HSE Management System is shown above. The Shell
equivalent representation appears at the beginning of each chapter of this document.
Within an Opco, a number of processes will be ongoing and typically these might include Survey
Operations, Concept Development, Design, Construction, Production and Maintenance and
Decommissioning/Abandonment. Each of these processes contributes to the 'do' or 'implement' part of
the Corporate Business Process Loop and each have a 'plan', 'do', 'check' and 'feedback' loop of their
own. Figure II gives a graphical presentation of this layered management system concept. Within each
process there are a number of activities and tasks which have their own Business Process Loop.
The processes, activities and related data entities of a typical Shell EP Opco have been identified in
the EP Business Model (EPBM). A part of the EPBM lists and describes the activities that achieve the
defined objectives and is common across Opcos. The Business Processes in which activities are linked
run across organisational boundaries and give a complete coverage of the activities of the business.
These activities listings are an excellent starting point for an Opco when describing its business,
allowing business process linkage and integration.

EP 95-0100 Revision 0 19 October 1995 v

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Figure II HSE Management System at corporate, process and activity levels

CORPORATE (SMS)

Plan
PROCESSES eg Survey

Plan Drilling

ACTIVITIES
Development
plan
Feedback Feed-
Back f-bk Do do
DO
chk
DO

Check

Check

Check Check

Any management system which was to describe the Business Process Loop for every activity and task
would be completely unworkable. The key therefore is the identification of those critical activities
which require formalised controls. In the case of business processes involving Health, Safety and
Environment, identification of HSE-critical activities is done using a technique called the Hazards and
Effects Management Process (HEMP).

vi EP 95-0100 Revision 0 19 October 1995

 Introduction

Note: In previous guidelines for the Safety Management System (SMS), the process was identified in
terms of hazard only. The basic structure, approach and application of the Hazard Management
Process in the SMS is, however, identical.
This process allows HSE-critical activities to be adequately addressed before things go wrong rather
than in reaction to things going wrong.

EP 95-0100 Revision 0 19 October 1995 vii

 1 Leadership and Commitment

1 LEADERSHIP AND COMMITMENT

This chapter addresses the top-down commitment and company culture necessary for the success of
the system.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

Senior management of the company should provide strong, visible leadership and commitment, and
ensure that this commitment is translated into the necessary resources, to develop, operate and
maintain the HSE MS and to attain the policy and strategic objectives. Management should ensure
that full account is taken of HSE policy requirements and should provide support for local actions
taken to protect health, safety and the environment.
The company should create and sustain a company culture that supports the HSE MS, based on:
 belief in the company’s desire to improve HSE performance
 motivation to improve personal HSE performance
 acceptance of individual responsibility and accountability for HSE performance
 participation and involvement at all levels in HSE MS development
 commitment to an effective HSE MS.
Employees of both the company and its contractors should be involved in the creation and
maintenance of such a supportive culture.
The foundation of an HSE MS is leadership and commitment from the top management of the
company, and its readiness to provide adequate resources for HSE matters.
Particular attention is drawn to the importance of senior management providing a visible expression
of commitment. Failure to do so will undermine the credibility of HSE policy and objectives.

EP 95-0100 Revision 0 19 October 1995 1

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Demonstrations of commitment to the HSE MS at different management levels include, amongst

others:
 Allocating the necessary resources, such as time and money, to HSE matters
 Setting a personal example in day-to-day work
 Putting HSE matters high on the agenda of meetings, from the Board downwards
 Being actively involved in HSE activities and reviews, at both local and remote sites
 Communicating the importance of HSE considerations in business decisions
 Recognition of performance when objectives are achieved
 Encouragement of employees' suggestions for measures to improve HSE performance
 Participation in internal and external initiatives.
Management leadership is also necessary to promote a company culture conducive to good HSE
performance, in which the HSE MS can function effectively. Senior management can foster active
involvement of employees and contractors in improving HSE performance by encouraging a culture
of belief, motivation, individual responsibility, participation and commitment:
 Belief in the company's will to improve its HSE performanceessential to open and supportive
incident reporting, and to effective HSE MS implementation
 Motivation to improve personal HSE performancebased on awareness, understanding,
acceptance of individual responsibility and positive recognition to reinforce desirable attitudes
and behaviours
 Participation of staff at all levelsthrough seeking their views and involvement in HSE MS
development, and energetically pursuing suggestions for improvement
 Commitment of staff at all levels is essential if the HSE MS is to be fully effective, and should
follow from secure belief, personal motivation and active participation.

Demonstration of leadership and commitment

In addition to the above, leadership and commitment is further demonstrated by:
 attendance at and chairing HSE meetings
 receiving and acting on HSE reports
 promoting HSE topics in company meetings and in company publications
 nominating high-potential staff for HSE positions
 developing an open approach to external liaison with authorities and the general public
 conducting HSE audits or inspections personally

2 EP 95-0100 Revision 0 19 October 1995

 1 Leadership and Commitment

 emphasising plans for achieving HSE objectives

 participating in the execution of HSE plans
 holding HSE review and analysis sessions
 including HSE performance data, etc on agendas for board meetings
 spending time in the field
 participating in incident investigation
 communicating with contractors on HSE matters
 attending HSE meetings/conferences outside the company
 allocating experienced and competent personnel to develop and maintain the HSE MS
system
 setting specific HSE tasks and targets for individuals and departments.

EP 95-0100 Revision 0 19 October 1995 3

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

This page intentionally left blank

4 EP 95-0100 Revision 0 19 October 1995

 2 Policy and Strategic Objectives

2 POLICY AND STRATEGIC OBJECTIVES

This chapter addresses corporate intentions, principles of action and aspirations with respect to health,
safety and environment and the aim of improved HSE performance.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

The company’s management should define and document its HSE policies and strategic objectives
and ensure that they:
 are consistent with those of any parent company
 are relevant to its activities, products and services, and their effects on HSE
 are consistent with the company’s other policies
 have equal importance with the company’s other policies and objectives
 are implemented and maintained at all organisational levels
 are publicly available
 commit the company to meet or exceed all relevant regulatory and legislative requirements
 apply responsible standards of its own where laws and regulations do not exist
 commit the company to reduce the risks and hazards to health, safety and the environment of its
activities, products and services to levels which are as low as reasonably practicable
 provide for the setting of HSE objectives that commit the company to continuous efforts to
improve HSE performance.
The company should establish and periodically review strategic HSE objectives. Such objectives
should be consistent with the company’s policy and reflect the activities, relevant HSE hazards and

EP 95-0100 Revision 0 19 October 1995 5

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

effects, operational and business requirements, and the views of employees, contractors, customers
and companies engaged in similar activities.
A company may choose to publish an integrated HSE policy or it may prefer to treat health, safety
and environmental policies separately. Whichever course is adopted, the policies will need to address
the topics identified in these Guidelines.
It is important that policy be initiated, developed, actively supported and endorsed by management at
the highest level, and be made available in readily understood form to interested parties-eg through
the company’s annual report and in booklets and displays. The company will need to identify any
regulatory requirements for HSE policies and to satisfy such requirements.
Health and safety policy may, for example, include commitments to:
 Establish safe and healthy procedures and practices in all operations, and strive towards an
incident-free workplace
 Provide properly engineered facilities, plant and equipment and maintain them in a safe and
secure condition
 Promote openness and participation in health and safety matters
 Provide training to enable staff to work in a healthy and safe way
 Undertake health and safety awareness and education campaigns.
The environmental policy may, for example, state commitments to:
 Undertake all operations with proper regard for the environment, and strive to reduce
environmental risk to a level that is as low as reasonably practicable
 Reduce waste and the consumption of materials, fuel and energy
 Reduce, and avoid where practicable, emissions and discharges
 Provide staff training and awareness programmes
 Participate in environmental initiatives and regulatory developments
 Reduce the hazards and adverse environmental effects of new developments to a level that is as
low as reasonably practicable
 Work towards the goal of environmentally sustainable economic development.
The policies of companies with good HSE records typically also refer to, for example, the:
 Importance of effective organisation to successful HSE management
 Importance of communication with interested parties
 Need, as in other areas of the business, for a systematic, planned approach to HSE
 Frequent role of management control failure in causing incidents.

Terminology
Different companies use the same terms in different ways. The Shell publication (Ref. 1)
provides definitions for most terms in business planning including mission, vision,
objective and targets. The key Shell definitions relevant to this section are:

6 EP 95-0100 Revision 0 19 October 1995

 2 Policy and Strategic Objectives

Objectives: 'goals which the organisation wishes to achieve over the long term. Provides a
basis for judging progress and achievements' ('What do we want?').
Strategies: 'the framework for plans to achieve the objectives. Used as a screen for
possible plans' ('How will we do it?')
Targets: 'goals identified and agreed for in the following year, subsequently used as a
basis for performance assessment'. ('How do we measure our success?')
In this document the term 'strategic objective' has been used and is the same as to the Shell
term 'objective'.

Setting of strategic objectives

The HSE Policy of the company provides the starting point for establishing the HSE
Objectives (Strategic Objectives). Management of the company establishes the objectives
which must be achieved and sets the limits within which the company must operate.
Objectives should be provided in risk tolerability terms wherever practicable. These are
used to establish a hierarchy of objectives through to the workplace as described in
Chapter 4.
One method of describing risk tolerability is the risk matrix with probability on one axis
and consequence on the other as described in 4.2.
Health risk and environmental risk can be considered in the same way as safety. In the case
of health and environment the probability refers to probability of exceeding the set limits.
Accidental discharge to the environment or accidental exposure to a health hazard
remains as the probability of occurrence.

The policy statement

A policy statement provides a means by which management can communicate its
intentions and expectations on topics that have a broad application throughout the
company.

'What is our course of action to manage the risk?'

Major policies, such as HSE policy, should be formulated by senior management with
input from functional management. An HSE policy should be part of a hierarchy of policy
statements; each of which is specific to an individual part of the business. Policies should
be developed in a structured way, rather than on an ad-hoc basis.
A policy statement should demonstrate: Commitment to a pursuit; Cognisance of the
nature of an endeavour; and the intention to Control business activities ('the 3 Cs').

Commitment
 to the pursuit of objectives
 HSE is as important as other business objectives
 demonstrates openness to employees, customers, shareholders and society
 demonstrates determination to achieve continuous improvement

EP 95-0100 Revision 0 19 October 1995 7

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 recognises that HSE is the responsibility of line management.

Cognisance
 demonstrates to employees, customers, shareholders and society that the company
recognises and accepts its responsibilities
 recognises that most accidents if not all accidents/injuries/incidents are avoidable
 understands the need for competent, motivated staff.

Control
 demonstrates that policies form part of a structure of controls
 demonstrates a consistent approach to the business
 recognises that most accidents/injuries/incidents are failures in control.

The content of an HSE policy

An Opco HSE policy shall be consistent with the Group HSE Policy Guidelines. Because
the activities of an Opco are more limited than those of the Group, its policy statement
should be more focused on specific HSE issues.
The HSE policy should be clear, concise and motivating. The Group Policy Guidelines on
Health, Safety and the Environment are contained in Appendix I. The content should clearly
express:
 what the company intends to PREVENT (using words such as: prevent, limit, protect,
eliminate)
 what the company intends to IMPROVE (using words such as: create, develop, carry
out, replace)
 what the company intends to COMPLY with (using words such as: comply, demand,
require).
The content should distinguish between policies which are specific to the areas of Health,
Safety and Environment, and those which are common to all areas. Policies which are
specific to each of the areas may include:
Health: to CREATE a healthy work environment and actively promote the health and well-
being of staff.
Safety: to PREVENT all incidents that might arise through company activities.
Environment: to pursue progressive REDUCTION of emissions, effluents and discharges
of waste materials that are known to have a negative impact on the environment with the
ultimate aim of ELIMINATING the negative impacts.
Aspects which are common to all areas include the recognition of:
 position of HSE in relation to other business aspects: it is the policy of Shell
companies to conduct their activities in such a way as to take foremost account of the
health and safety of their employees and of other persons, and to give proper regard to
the conservation of the environment.

8 EP 95-0100 Revision 0 19 October 1995

 2 Policy and Strategic Objectives

 position within the industry: Shell companies aim to be among the leaders in their
respective industries in matters of HSE.
 compliance with legislation: Shell companies accept full compliance with legislative
requirements as a starting point for their policies.
 line management responsibility: The execution of HSE policies is a line
management responsibility.
 assessments in planning stages: HSE matters should be assessed before entering into
new activities.
 contractors’ HSE standards: Contractors’ HSE policies should be fully compatible
with those of Shell.
 interests of stakeholders: Shareholders, employees, customers and society have
legitimate concerns which should be answered.
 regulations and industry standards: continual improvements in the developments of
regulations and industry standards in HSE will come about by working with legislators
and others.
In addition to the Opco HSE policy, a company will need to establish specific policies.
These might include policies on drugs and alcohol abuse (Ref. 2), AIDS (Ref. 3), smoking
(Ref. 4), road safety, gas flaring and others. Because these policies focus on a particular
HSE topic, they can be very specific in content. The referenced documents provide
assistance to Opcos in updating their policies.
In view of the Shell policy guidelines on health promotion and the increasing public
pressure for measures against active and passive smoking, a position paper on smoking and
passive smoking in the workplace was sent to Opcos in 1994 with a recommendation that
Opcos continue to review their position with regard to smoking at work. Copies of this paper
can be obtained from SIEP.

The format of an HSE policy

An HSE policy should follow the same format as any other company policy. This means that
the policy:
 should be produced in a bold, easy to read format
 should be in the working languages of staff and the workforce
 should be consistent in appearance with other company policies
 should clearly identify the company and the business areas to which it refers
 is usually restricted to one A4 page or A3 display of concise, action-oriented
statements
 is endorsed and dated by the senior executive of the company.

The dissemination of an HSE policy

The company HSE policy should be used as a basis for the formulation of departmental or
functional plans and objectives.

EP 95-0100 Revision 0 19 October 1995 9

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

The HSE policy should be made easily available for company employees and external
parties, as appropriate, for example:
 all new and existing employees should receive a personal copy of the company HSE
policy after an open discussion of how the contents relate to his/her function with
his/her supervisor
 the policy should be on display in/within the company premises in a prominent
location.

The life cycle of an HSE policy

All control systems tend to deteriorate over time or become obsolete as a result of change.
This calls for the HSE policy to be regularly reviewed with emphasis on its intent, scope
and adequacy. The HSE policy should have a custodian who is responsible for this review.

10 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

3 ORGANISATION, RESPONSIBILITIES, RESOURCES,

STANDARDS AND DOCUMENTS
('Organisation, resources and documentation' in the E&P Forum HSE MS Guidelines)

This chapter addresses the organisation of people, resources and documentation for sound HSE
performance.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

EP 95-0100 Revision 0 19 October 1995 11

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

3.1 Organisational Structure and Responsibilities

Successful handling of HSE matters is a line responsibility, requiring the active participation of all
levels of management and supervision; this should be reflected in the organisational structure and
allocation of resources.
The company should define, document and communicate—with the aid of organisational diagrams
where appropriate—the roles, responsibilities, authorities, accountabilities and interrelations
necessary to implement the HSE MS, including but not limited to:
 provision of resources and personnel for HSE MS development and implementation
 initiation of action to ensure compliance with HSE policy
 acquisition, interpretation and provision of information on HSE matters
 identification and recording of corrective actions and opportunities to improve HSE
performance
 recommendation, initiation or provision of mechanisms for improvement, and verification of
their implementation
 control of activities whilst corrective actions are being implemented
 control of emergency situations.
The company should stress to all employees their individual and collective responsibility for HSE
performance. It should also ensure that personnel are competent (see 'Competence' in 3.4) and have
the necessary authority and resources to perform their duties effectively.
The organisational structure and allocation of responsibilities should reflect the responsibility of line
managers at all levels for developing, implementing and maintaining the HSE MS in their particular
areas. The structure should describe the relationships between:
 different operating divisions
 operating divisions and supporting services (whether the services are provided on the same
facility or from a larger corporate organisation)
 onshore and offshore organisations
 employees and contractors
 partners in joint activities.
Support services may include procurement (of materials, contracted services and equipment),
personnel, research and development, public relations, safety, environmental, security and
occupational health, whether provided by the facility or by the parent organisation.
The allocation of HSE responsibilities will depend upon the nature and structure of the individual
company; some examples might be:
 Senior management—assume responsibility for developing, resourcing, reviewing and
complying with the HSE policy
 Finance—develop and maintain accounting procedures which enable identification and
allocation of HSE costs and benefits

12 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

 All individual function, activity and operations/business unit managers (eg Operations,
Drilling, Production, Exploration, Engineering, Services, Marketing, Contracts, Research and
Development, Procurement, Petroleum Engineering, Legal, Finance and Site Personnel)—
implement the HSE MS in their areas of responsibility (in consultation with employees) and
effective two-way communication and training programmes on HSE matters.

Roles, responsibilities and accountabilities

The following are general but fundamental points about roles, responsibilities and
accountabilities:

 each employee should be made aware of his or her individual HSE role,
accountabilities and responsibilities
 each employee should be given the necessary authority commensurate with individual
levels of responsibility
 the HSE elements of each position in an organisation (role/duty, responsibility and
accountability and reporting relationships) should be clearly defined in writing and
issued individually
 responsibility will not be taken seriously if appropriate authority is not given and if
accountability is not assigned through recognised management procedures.
Activities
If an Opco has adopted the EP Business Model (EPBM) to describe the business activities
and information flow, then the organisational roles, responsibilities and accountabilities
should be aligned with the EPBM.
Assets
Care should be taken to assign ownership of HSE Cases with asset ownership.
Function of HSE Department and Advisers
HSE departments should act in an advisory capacity; they are neither responsible nor
accountable for HSE performance in the line but for providing impartial professional HSE
advice to enable management at all levels to fulfil their HSE responsibilities. This advice
includes provision of the following to Opco management:
 guidance on incident reporting, investigation and follow-up
 communication on HSE developments generated in SIPM, other Opcos, industry and
within government departments
 guidance on external HSE developments (national and international) including
(inter)national legal issues, societal expectations, and non-governmental organisations

EP 95-0100 Revision 0 19 October 1995 13

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 co-ordination of the provision of services common to all functions such as induction

training
 guidance on HSE performance reporting
 collation of HSE performance reports
 co-ordination of preparation of annual HSE report.
The HSE department may also be:
 custodian of the HSE MS
 custodian of HSE structured review techniques such as Quantitative Risk Assessment
(QRA), Environmental Assessment (EA), Hazard and Operability Study (HAZOP),
Health Risk Assessment (HRA), etc.
and to provide the following to all supervisory levels:
 technical HSE information and experience (data, techniques, equipment,
specifications, know-how, research information)
 guidance and support for HSE audits, reviews and inspections
 advice on HSE training, instruction and exercises
 guidance on the setting up by the line of HSE Cases.

14 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

3.2 Management Representative(s)

A management representative or representatives should be assigned responsibility, authority and
accountability for co-ordinating implementation and maintenance of the HSE MS. The
representative(s) should be accountable to senior management, but the appointment(s) shall not reduce
the responsibility of individual line managers for implementing the HSE MS in their areas.
The management representative or representatives need to have sufficient knowledge of the company
and its activities, and of HSE issues, to undertake the role effectively. Whilst maintaining overall
responsibility for co-ordinating HSE management activities across all functions and groups,
representative(s) will act in conjunction with line management in all functions, activities and
processes. Line management remains fully accountable for developing and implementing the HSE MS
in its area of responsibility.
Some companies may divide the management role among several positions, such as health and safety
manager and environment manager, or it may be a significant part of a line manager’s duties. If the
management representative has other functions to perform, care will need to be taken to ensure that
there are no conflicts of interest with HSE responsibilities.

In most Shell Opcos, the Management Representative responsible for the co-ordination,
implementation and maintenance of the HSE Management System is the most senior
manager responsible for the process or asset to which the HSE Management System applies.
A general manager or Chief Executive who nominates a manager to have specific
responsibilities for HSE matters or become a 'Management Representative' should specify
clearly what has been delegated, eg:
 attendance at meetings
 participation in investigations
 selection and specification of key HSE staff
 duties with respect to assessment of company HSE performance
 means of measuring performance of positions.
The HSE manager normally acts in an advisory capacity as described under 3.1. He or she is
often delegated the responsibility for maintenance of the HSE MS on behalf of the Chief
Executive or Senior Manager and should be directly in contact with him for its update. The
application of the HSE MS to a local operation or plant will always be the
responsibility of local line management in accordance with the asset management
hierarchy.

EP 95-0100 Revision 0 19 October 1995 15

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

3.3 Resources
Senior management should allocate sufficient resources to ensure the effective operation of the HSE
MS, taking account of advice from the management representative(s), line management and HSE
specialists. Resource allocation should be reviewed regularly as parts of the review of the HSE MS
(see chapter 8), of management of change (see 5.4 ) and of risk management (see chapter 4).
Resource allocation should be considered as it applies to all parts of the HSE MS; issues to consider
include, among others:
 Facilities, plant and equipment to meet legislative and regulatory requirements
 Personnel, equipment and infrastructure to respond to and mitigate emergency situations
 Availability of management for HSE audits and reviews
 Resource allocation for new developments.
Depending on the particular circumstances of the company, the management representative and other
managers may need support from specialist advisers to accomplish their tasks effectively.
The allocation of necessary and justified resources for HSE matters is widely regarded by staff and
other interested parties as indicative of corporate commitment to HSE policy and objectives.

Allocation of resources should include for:

 prompt rectification of HSE-related deficiencies identified by the company or
authorities
 ongoing verification that the HSE-critical systems function in accordance with the
design intent and objectives
 undertaking specific structural review techniques such as HRA (Health Risk
Assessment), EA (Environmental Assessment), QRA (Quantitative Risk Assessment)
 ongoing training requirements to maintain and enhance competencies
 high-calibre line staff for HSE function.
Where personnel resources are contracted, the minimum level of competencies required to
carry out HSE contract activities must be defined and allowances made for any training
necessary.

16 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

3.4 Competence
Basic procedures for competence assurance are as follows:
 identify manner in which tasks are to be performed
 identify competencies (abilities, skills, knowledge) required
 select appropriate staff
 provide training if necessary
 review performance.
General
The company should maintain procedures for ensuring that personnel performing specific assigned
HSE-critical activities and tasks are competent on the basis of appropriate:
 personal abilities
 skills developed through experience, and
 acquired knowledge.
Systems for competence assurance should apply both to initial recruitment and to selection for new
activities, and to both staff and contractors. The continuing competence of personnel to perform their
duties should be regularly reviewed and assessed, including appropriate consideration of personal
development and training required to achieve competence for changing activities and technologies
(see 'Training' on following page). Procedures for competence assurance include, amongst others:
 systematic analysis of requirements for tasks
 assessment of individuals’ performance against defined criteria
 documented evidence of individual competence
 programmes for periodic re-assessment.
In addition to allocating responsibilities, management will need to determine the level of competence
—based on personal abilities, skills, experience, formal qualification and training—necessary to
ensure the capability of personnel to carry out HSE-critical functions. Activities and roles which
affect the HSE performance should be included in job descriptions and performance appraisals.
Structured and documented competence assurance systems and procedures help to facilitate the
processes of:
 Determining the competence requirements of particular activities
 Defining and recording criteria for competence
 Assessing individuals against the defined criteria
 Documenting and certifying competence when necessary
 Identifying aspects where personnel are not yet judged competent
 Training individuals to increase competence in those areas
 Periodic re-assessing of competent personnel
 Assessing competence for job transfers and new activities and technologies.
Training—including refresher courses—helps ensure that:
 All personnel can make an appropriate contribution to good HSE performance.
 New recruits, and staff assigned to new tasks, equipment and procedures, understand their roles
and responsibilities for HSE matters.

EP 95-0100 Revision 0 19 October 1995 17

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 Managers understand the HSE MS, have the necessary knowledge to play their part in it, and
appreciate the criteria by which its effectiveness will be judged.

Training
The company should maintain procedures to ensure and increase competence through identification of
training needs and provision of appropriate training for all personnel. Training may be provided
through formal courses and/or through structured development in the workplace. The extent and
nature of training should be sufficient to ensure achievement of the company’s policy and objectives,
and should meet or exceed that required by legislation and regulations. Appropriate records of training
should be maintained (see ‘Records’ 6.3) and refresher training scheduled as required.
The basic procedures for effective company training procedures are as follows:
 consider tasks and individuals
 identify type/extent/frequency of training needed
 prepare training course/material
 record training conducted
 obtain participant feedback
 evaluate effectiveness.
Systems should be developed to monitor the effectiveness of training programmes and to introduce
improvements where necessary.

EP 95-0120 provides more detailed guidance on competency and training in Shell EP.

18 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

3.5 Contractors
The company should maintain procedures to ensure that its contractors operate a management system
that is consistent with the requirements and provisions of these HSE MS Guidelines and that it is
compatible with the HSE MS of the company. Procedures should facilitate interfacing of contractors’
activities with those of the company and with those of other contractors, as appropriate. This may be
achieved by means of a specific interface document between company and contractor so that any
differences may be resolved, and procedures agreed, before work commences. Although all the
recommendations in these Guidelines may be applicable to the contracted organisation, the procedures
should pay particular attention to the following:
 selection of contractors, including (amongst other considerations) specific assessment of their
HSE policy, practices and performance and the adequacy of their HSE MS, commensurate with
the risks associated with the services to be provided
 effective communication (see 3.6) of the key elements of the company’s HSE MS, and of the
standards of worker and environmental protection expected from the contractor, including
agreed HSE objectives and performance criteria
 sharing by company and contractor of relevant information which may impact on the HSE
performance of either
 the requirement that each contractor have an effective and relevant training programme which
includes records and procedures for assessing the need for further training
 definition of methods for monitoring and assessing contractor performance against agreed HSE
objectives and performance criteria.
Contractors and sub-contractors play a substantial role in the EP industry, often working within a
facility and alongside a company’s own workforce; the activities in which they are engaged (eg
construction and major maintenance) are typically non-routine and are in exposed situations.
For those reasons, these Guidelines have been designed to apply equally to the operations of a
principal or contracting company.
Records and safety statistics have generally indicated that contractors’ employees are involved in
incidents more frequently than are employees of the principal company. They may be less familiar
with site-specific hazards than are the company’s own employees. For these reasons it is particularly
important to consider how the HSE MS of a company (whether itself a principal or contracting
organisation) is interfaced with that of its contractors and sub-contractors. In this context, particular
attention is drawn to:
 Establishing clear communication between company and contractor staff, at all levels
 Procedures for the management of change
 Permit-to-Work systems
 Incident reporting and follow-up
 Emergency plans and their communication
 Audit and review
 Communication of hazards and individual risks, and roles in risk management.
However contracted activities will also need to be considered in other parts of the HSE MS.

EP 95-0110 provides more detailed guidance on Shell EP Management of Contractor HSE.

EP 95-0100 Revision 0 19 October 1995 19

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

3.6 Communication
The company should maintain procedures to ensure that its employees, and those of its contractors
and partners, at all levels, are aware of the:
 importance of compliance with the HSE policy and objectives, and their individual roles and
responsibilities in achieving it
 HSE risks and hazards of their work activities and the preventive and mitigation measures (see
chapter 4) and emergency response procedures that have been established (see 5.5)
 potential consequences of departure from agreed operating procedures
 mechanisms for suggesting, to management, improvements in the procedures which they and
others operate.
Maintaining means of external communication in times of emergency is especially important and
special contingency arrangements should be in place (see 'Contingency and emergency planning' see
5.5).
The company should maintain procedures for communication of HSE information, consistent with its
policy and with applicable legislation and regulations. The company should, whilst protecting
confidential information, make available its HSE experience to employees, contractors, customers and
companies engaged in similar activities to facilitate improvements in industry HSE performance.
The company should maintain procedures for receiving and responding to communications from
employees, contractors, customers, government agencies and the public concerning its HSE
performance and management. Community awareness and consultation programmes should be
maintained where appropriate.
Effective communication requires careful consideration of the message to be transmitted—or the
information to be sought—and to the most appropriate medium for doing so.
Effective two-way communication on HSE issues, including awareness programmes and campaigns
directed towards specific HSE concerns, are important means of motivating staff towards a proper
regard for HSE issues.
The need to communicate in an appropriate language and style needs to be borne constantly in mind,
particularly when transmitting technical information to non-specialists. HSE-critical procedures and
instructions (such as emergency evacuation instructions, and recovery measures in the event of oil
spillage) need to be in a language and style that is understood by site staff. Cultural and language
barriers to communication (such as those for personnel whose mother tongue is not the main site
language) need to be identified. Communications must be tested regularly.
Community awareness and consultation programmes may be effective for responding to legitimate
community concerns about the HSE effects of facilities.

20 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

Hierarchy of meetings
A transparent structure of meetings and information flow both upwards and downwards
must be available and understood at all levels. The most senior executive of the Opco shall
chair an HSE Steering Group Meeting or equivalent. A description of the hierarchy of the
HSE meetings should indicate the frequencies, the information flow and the terms of
reference for the meetings. The broad objectives of a typical HSE Committee meeting are
described in 'Function of HSE committees', below.
All employees and contractors should be involved in HSE meetings which should include
tool box meetings held at the workplace.

Function of HSE committees

The broad objectives and activities of HSE committees are to:
 stimulate effective two-way communication on HSE issues between management and
personnel
 contribute to full staff participation in the implementation of HSE management
 serve as HSE advisory bodies to management
 monitor measures taken for the prevention of accidents, their implementation and
adherence
 organise inspections and audits focused on unsafe or environmentally unacceptable
practices
 review reports of inspection and audits
 review investigation reports of recent accidents/incidents
 monitor follow-up of accidents and incidents that have occurred
 advise management on suggestions for further improvement of HSE
 endeavour to secure the co-operation of all persons in the promotion of HSE
 advise on HSE training, instructions and guidance of workers.

Information flow
Communication methods are many and varied but those commonly used for HSE matters
are:
 minutes of meetings
 departmental HSE Plans and performance targets
 bulletins
 quarterly video

EP 95-0100 Revision 0 19 October 1995 21

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 newsflashes
 posted performance indicators
 E-Mail HSE news
 HSE information phone line
 external reporting of environmental data is described in chapter 6.

Introduction of new procedures

The most satisfactory approach for preparing procedures which will be adhered to is to have
those involved in the activity prepare their own procedures. Ownership is thus enhanced.
The process of procedure preparation and improvement must be controlled and ways found
to keep involvement high whilst maintaining the required level of standardisation. As a
minimum, it is important both in terms of communication and motivation that new draft
procedures are introduced to those who are to implement them and that their input is sought.

Feedback
The following are the key points about feedback as an important feature for HSE
management:
 assessment: feedback is essential; it is the only way of assessing effectiveness of
communication.
 continuity: there should be a two-way flow of HSE communication at all levels; if
there is not an open exchange at higher levels then information ceases to flow at lower
ones.
 responsiveness: when there is a serious problem the workforce need timely assurance
that it is being tackled promptly.
 improvement: ideas and responses should be encouraged, whether or not they are
immediately constructive.
 criticism: regard upward flow of criticism as healthy and normal; lack of criticism
should be treated with unease (perhaps the workforce has given up trying to get
through to management).
 interpretation: be prepared to have to investigate the true meaning behind feedback.
 filters: beware of filters against upward flow of 'bad news' for management, ie 'no
news is bad news for HSE'.
 reward: consider schemes for rewarding the flow of feedback as an indication of
encouragement. Recognition is often valued more than material rewards.

Motivation
Motivation is the process of creating the right circumstances for people to want to work and
behave in the right way. This is equally true for HSE.

22 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

Management needs to create the necessary peripheral conditions (eg sound HSE
management systems, through working conditions). Absence of these may result in
employee dissatisfaction but the motivation factors are different from these peripheral issues
and are associated with the experiences of the job itself.
In order to motivate and modify behaviour in HSE matters, HSE must be built into
individual jobs. The consequences of inappropriate behaviour must be made clear. Methods
for promoting motivation include:
 Making individuals and groups more aware about why there is a need for HSE
controls (eg procedures, training)
 Encouraging group and individual HSE problem-solving and target-setting
 Providing ideas for HSE self-inspection and monitoring
 Making HSE rules and procedures part of everyone's job
 Recognising and making an example of evidence of safe and environmentally sound
working practices
 Encouraging group self-enforcement and shared responsibility
 Designing jobs with complete elements of work for individuals
 Involving individuals at the work face in incident investigation by more than post-
accident interviews.
The direct and personal interest shown by a supervisor in his subordinate’s work through
congratulation or criticism remains the most powerful motivational and behaviour
modification technique in HSE matters.
Incentive schemes can provide motivation and focus but should not be complex and time
consuming to manage and above all must be seen to be fair. They should preferably not be
based on indicators, eg lost time incident (LTI) or total recordable case frequency (TRCF).
Suggestion schemes can be motivational but reasons for non-implementation or rejection
must be managed positively.
HSE performance boards sited in prominent and public locations with regular update
provides focus to the HSE effort.
Information on serious incidents should be disseminated as soon as possible even if
incomplete. Delay can convey lack of concern.
'Theme of the Month' is an effective approach where effort is focused on a particular
problem. Posters, videos and training packs can assist in reaching a large workforce or a
workforce with different languages.
It is often the most highly motivated individuals who 'bend the rules' or violate the
regulations since they perceive this to be necessary to get the job done. It is line
management’s job to counter these perceptions and to create a culture whereby following
sensible rules also improves efficiency and motivation.

EP 95-0100 Revision 0 19 October 1995 23

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

3.7 Documentation and its Control

HSE MS documentation
The company should maintain controlled documentation to:
 record the HSE policy, objectives and plans
 record and communicate key roles and responsibilities
 describe HSE management system elements and their interactions
 cross-reference related documentation and describe links with other aspects of the overall
management system
 record the results of HSE hazards and effects management process
 record relevant legislative and regulatory requirements
 record, where necessary, procedures and work instructions for key activities and tasks
 describe emergency plans and responsibilities, and the means of responding to incidents and
potential emergency situations.
Such documentation should cover:
 the company
 organisational divisions and business units
 individual functions and operations (eg facility design, exploration, land acquisition, drilling)
 contractors and partners.

Document control
The company should maintain procedures for controlling HSE MS documents to ensure that:
 they can be identified with the appropriate company, division, function or activity
 they are periodically reviewed, revised as necessary and approved for adequacy by authorised
personnel prior to issue
 current versions are available at those locations where they are needed
 when obsolete, they are promptly removed from all points of issue and points of use.
Documentation should be legible, dated (with dates of revision), readily identifiable, numbered (with
a version number), maintained in an orderly manner and retained for a specified period. Policies and
responsibilities should be established for the modification of documents, and their availability to
employees, contractors, government agencies and the public.
The primary purpose of the documentation is to provide an adequate description of the HSE MS, and
to serve as a permanent reference to the implementation and maintenance of that system.
Documentation may be in paper, electronic, or other format, but it is important to ensure consistency
in approach and content, and in control, review and amendment of procedures.
Proper documentation enhances HSE management efficiency through:
 Channelling information efficiently to where it is used and needed by staff
 Aiding awareness of responsibilities and correct task performance
 Avoiding information-dependency on individuals

24 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

 Reducing learning time on new tasks

 Demonstrating the existence of systems and practices.
In determining the degree of detail of HSE MS documentation, consideration will also need to be
given to its use by system auditors to verify that the system exists, and that it is fit for its purpose,
given the nature of the hazards and risks and environmental effects involved.

Guidelines on the preparation of the principal HSE documents, describing the HSE
Management System and an HSE Case are included EP 95-0310, in Volume 3 of this
Manual. These are summarised below:

HSE MS - Structure and description of components

All the relevant elements of the HSE MS are documented in the HSE MS Manual. This is an
Opco-wide and corporate level document tailored to the individual Opco’s requirements and
owned by the Opco’s management.
The HSE MS is documented in four parts as shown in Figure 3.1. Whether this document is
held electronically or on paper is a matter for local Opco decision. What is important is that
it:
 is used and kept current
 reflects the way things are done in the Opco and is seen to add value to the operation.

EP 95-0100 Revision 0 19 October 1995 25

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Figure 3.1 The HSE Management System Manual

The HSE MS Manual

Part 1 Part 2 Part 3 Part 4

Management HSE MS Ref. Remedial
System Activities Documents Action
Elements Catalogue and Standards Plan

The HSE MS Manual

Part 1: Management System Elements
The first part describes the Opco’s management system under the same headings as
contained in this Manual (except for chapter 1), ie:
1. Introduction
2. Policy and Strategic Objectives
3. Organisation, Responsibilities, Resources Standards and Documentation
4. Hazards and Effects Management
5. Planning and Procedures
6. Implementation and Performance Monitoring
7. Audit and Review.
In the HSE MS Manual itself there is no section on Leadership and Commitment. This is
demonstrated within the company in different ways, including the preparation and issue of
the Manual itself under the signature of the Chief Executive. Part 1 - Section 1 of the HSE
MS Manual is used as an 'Introduction'.
Part 2: HSE Management System Activities Catalogue
The second part describes activities within the Opco where hazards and effects are managed.
These activities are termed HSE-critical and involve any activity from an analysis of the
EPBM that has an element of identification, assessment, control of and/or recovery from a
hazard or effect. The information is compiled in the form of a catalogue of specification
sheets that describe, for each HSE critical activity, such key aspects as hazard management
objectives, essential competencies, accountabilities and procedures to be used.

26 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

Part 3: References, Documents, Codes and Standards

The third part provides a comprehensive list of all the documents and standards referred to
in Parts 1 and 2, together with a description of their purpose, revision date, custodian,
review cycle, cross-referenced to the appropriate activities and hazards. In the context of
hazards and effects managed at a corporate level it may be appropriate to record the
information relating to such hazards and effects in the HSE MS Manual, eg the corporate
policy on flaring, energy consumption, land use.
Legislation
The most fundamental obligation for Opcos is to assemble and maintain a register/copies of
HSE legislation (local, national and international) applicable to their operations. Such a
register consists typically of:
 laws
 permits
 licences
 regulations
 international treaties and conventions where not ratified into national law but adopted
by the Company nevertheless.
The mechanism for incorporating changes in legislation into the company system must be
clearly described.
HSE standards
Shell Group policy on standards is to rely, to the maximum possible extent on external
international standards, such as ISO. The active participation in the development of such
standards is aimed at minimising the additional requirements necessary when these
standards are adopted in the Group DEPs, SSHEC Guidelines and in Opcos and projects.
The extent of HSE standards may depend on the degree of coverage of HSE legislation. For
example, a set of regulations about the use of electricity may be sufficiently detailed and
explicit that they adequately meet the minimum Group standards and can therefore be
formally adopted as a basis for the Opco use.
Part 4: Shortfall and Remedial Action Plan
The fourth part describes how the shortfall (identified by preparing the HSE MS through to
audit, reviews and other forms of shortfall identification) are corrected as part of the
corporate (HSE) plan.
An HSE Case Structure and description of components
An HSE Case is an operation- or facility-specific demonstration of the HSE MS in action. It
is both a programme of formal HSE assessment to assure itself that an operation or facility is
safe and an analysis that demonstrates the provision of:
 a simple, methodical and auditable reference document of all information relevant to
the HSE of the particular operation
 a living document that is added to and amended throughout the life of the
operation/asset

EP 95-0100 Revision 0 19 October 1995 27

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 a vehicle for Opcos to satisfy themselves, by way of joint HSE Case preparation that
contractors will set and achieve the same standards as those of the Opco.
In particular it must show:
 the Opco has an effective HSE MS in place for the operation or facility concerned
 all the significant hazards and effects have been identified, assessed, eliminated
wherever possible, and controls in place to manage the remaining hazards, with
appropriate recovery plans in the event of loss of control
 the risks have been evaluated and measures taken to reduce the risks to a level that is
As Low As Reasonably Practicable (ALARP).
The HSE Case should be presented in the form of operation-specific objectives,
performance standards and acceptance criteria. It should describe the actual level of risk
management being achieved and how the gap between intended and actual achievement is
determined, measured, monitored and reduced. It should be a clear and concise document,
with connections between the parts clearly apparent so that it can be used for reference and
be auditable as shown in Figure 3.2.
Figure 3.2 The HSE Case

The HSE CASE

Part 1 Part 2 Part 3 Part 4 Part 5 Part 6 Part 7

Hazard
Mgt. Operation’s Activities Description Identified
Analysis Conclusions
Summary HSE MS Catalogue of Deficiencies
& Operation Hazards &
Introduction
Effects Remedial Statement
Register Work Plan of Fitness
MOPO
Depending on local circumstances and legislation, the HSE Case may have to be subdivided
into H, S or E, or HS and E for example.
Whether an electronic or paper format is used depends on local circumstances but an HSE
Case will need to be kept up to date and relevant to the changing demands of the operation.
It should also be in a format which can be used by the workforce who should also have been
involved in its preparation.
An HSE Case has the following linked parts:
Part 1: Introduction and Management Summary
Part 1 provides management’s endorsement of the HSE Case, the management summary and
the introduction to the document.

28 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

Part 2: Operation’s HSE Management System

Part 2 describes those elements of the corporate HSE that are directly applicable to the
management of the particular operation. When there is no difference between the corporate-
level and the operation-level material this section demonstrates the implementation of what
was described in the HSE Manual.
Any limits specified by local authorities as relevant to the operation or area must be listed in
this document.
Part 3: Activities Catalogue
Part 3 contains the operation-specific activities analysed to a level, appropriate to the
management locally, of HSE risk.
Critical Activities
The business processes involved in the operation are broken down into sub-processes and
then into activities. If one of the steps in the hazards and effects process described in chapter
4 is involved then that activity is recognised in the HSE MS as being HSE-critical. All such
activities are then subjected to a quality management type procedure to ensure that they are
carried out satisfactorily. The identification of HSE-critical.
activities, in relation to work done, can be facilitated using the EP Business Model, which
identifies business processes and activities and provides a structure for examining them.
Business processes link activities, and run across organisational boundaries. Such a focus on
processes gives comprehensive coverage of activities and ensures a complete coverage of
the business. Activities should be broken down to such a level that individual accountability
can be identified.
Activities Catalogue HSE Specification Sheets and HSE MS Activities Catalogue
These provide a summary of how HSE-critical activities are to be managed and comprise a
description of each component part of the HSE management system including:
 a description of the activity
 the hazard management objectives
 methods to be used to achieve the objectives
 HSE-critical inputs needed for the activity
 HSE-critical products of the activity
 form of recording the activity
 method of verifying how activities are to be completed to standard
 accountable personnel
 competence requirements for personnel carrying out work
 hazard register cross-reference.
A compilation of these sheets for a recognisable process, etc provides an HSE MS Activities
Catalogue.
Guidance for the preparation of the Activities Catalogue is included in EP 95-0310.

EP 95-0100 Revision 0 19 October 1995 29

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Part 4: Description of Operations

Part 4 provides sufficient background knowledge of the operation to present a clear
understanding of the HSE aspects necessary and sufficient to support the hazards and effects
management process.
Part 5: Hazards and Effects Analysis/Hazards and Effects Register
Part 5 provides evidence that all potentially significant hazards and effects have been
identified, the risks from hazards and effects evaluated and understood and the controls to
manage the causes (threats) and consequences of the hazards are in place. It is in turn
divided into four parts:
 hazards and effects analysis
 hazards and effects register
 Manual Of Permitted Operations (MOPO)
 HSE-critical operations procedures.
i) Hazards and Effects Analysis
This describes those investigations carried out as part of the Hazards and Effects Analysis.
This shows that a full and systematic check has been made of hazards and effects.
The environmental-critical input will be based on an Environmental Assessment (EA) of the
planned activity in its local context. The EA will define the local environment and its
sensitivity. This will have to be matched with the activities that generate a potential
environmental effect. The environmental sensitivities will help define the applicable
screening criteria which should not be exceeded if adverse environmental effects are to be
avoided.
ii) Hazards and Effects Register
This should present the results of the analysis made of each hazard in a clear and concise
form and should include the following elements:
 hazards and effects identification and description
 assessment of the hazards and/or effects
 consequences foreseen
 potential severity
 risk exposure
 escalation factors involved
 form of hazard defences, controls and recovery measures.
iii) Manual of Permitted Operations
One of the key documents is the Manual of Permitted Operations (MOPO), defining the
envelope within which the operation is to be managed. This includes such aspects as:

30 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

 instructions if defence systems are reduced, eg alarm systems disabled for maintenance
 restrictions in adverse weather conditions
 restrictions when concurrent operations are underway
 limits of operating parameters under atypical conditions.
The most convenient way of representing such information is often in the form of a matrix
with failure modes or restrictions on the x-axis and the associated permitted operations on
the y-axis.
iv) HSE-critical Operations Procedures
Some of the control and recovery measures may refer to specific procedures (HSE-critical
Operations Procedures). Each of these procedures includes a statement of the hazard
management objectives and any assumptions in its preparation.
Part 6: Remedial Work Plan
Part 6 is a demonstration of the commitment to improvement by resolving any corrective
actions arising from the hazards and effects assessments, with action parties and completion
dates.
Part 7: Conclusion and Statement of Fitness
Part 7 presents the conclusions concerning the objectives of the HSE Case and a Statement
of Fitness for the operation or facility.
HSE Documentation Control principles
In order for HSE documentation to function effectively they need certain controls:
 management controls for formal administration
 custodianship for technical correctness
 communication for correct use.
The principles for management control of documents are:
 identification by division, function or activity
 approval by authorised personnel (custodian) prior to issue
 clear differentiation between that which is mandatory and that which is guidance only
 review and revision, as appropriate, regularly and systematically or in cases where a
response is required to a specific need
 availability of current version at all locations where required
 definition and understanding of change and modification procedures
 removal promptly from all points of issue and use when obsolete.

EP 95-0100 Revision 0 19 October 1995 31

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Standards, Guidelines and Procedures

A custodian is assigned to those standards, guidelines and procedures which are applied
across a company. This custodian is responsible for the approval and for technical content.
HSE Case Documentation
For HSE Case documentation in place, the line management custodian for the operation or
facility to which the Case refers is responsible for the control of the documentation.
Line management is responsible for the implementation procedures contained in the
documentation, monitoring compliance and advising document custodians (and the HSE
Focal Point) of any inaccuracies or impracticalities and obtaining custodian approval for and
documenting of any deviations.

32 EP 95-0100 Revision 0 19 October 1995

 3 Organisation, Responsibilities, Resources, Standards and Documents

This page intentionally left blank

EP 95-0100 Revision 0 19 October 1995 33

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

4 HAZARDS AND EFFECTS MANAGEMENT PROCESS

('Evaluation and Risk Management' in the E&P Forum HSE MS Guidelines).
Risk is present in all human endeavours. This chapter addresses the identification of HSE hazards and
evaluation of HSE risks, for all activities, products and services, and development of measures to
reduce these risks.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

The essential steps of Hazard Management are as follows:

1. Identify hazards and effects
2. Establish screening criteria
3. Evaluate hazards and effects
4. Document significant hazards and effects and applicable statutory requirements
5. Set detailed objectives and performance criteria
6. Identify and evaluate risk reduction measures
7. Implement selected risk reduction measures.

In the E&P Forum HSE MS Guidelines this process is called Evaluation and Risk
Management. The level of risk tolerated by the company should be defined to the extent
possible in the HSE Policy and Strategic Objectives. These must clearly link with the more
detailed objectives and criteria in the HSE or Safety Case and be applicable to the actual
operation taking place. Thus the cascade of objectives and criteria may be considered in the

34 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

following way:

EP 95-0100 Revision 0 19 October 1995 35

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Table 4.1 Objectives and criteria in an HSE Case

Corporate Provide HSE policy and strategic objectives for HSE
HSE Policy
and HSE
Management
System
Manual

HSE Establish screening criteria (consider here legal requirements and levels)
Management
System Establish risk tolerability levels
Manual and
HSE Case
Assess the risk via the Hazards and Effects Management Process

HSE Case Set specific tolerability limits reflected in practical measures and linked to levels of risk
tolerability.

Set detailed performance criteria

Establish performance indicators (PIs)

Implement and monitor performance via PIs

Thus the HSE Management System provides the corporate direction and strategic view on
how the company intends to carry out a programme of continuous improvement in its HSE
performance. The HSE Case describes how these intentions are translated into practice at the
workplace.

36 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

4.1 Identification of Hazards and Effects

The company should maintain procedures to identify systematically the hazards and effects which
may affect or arise from its activities, and from the materials which are used or encountered in them.
The scope of the identification should cover activities from inception (eg prior to acreage acquisition)
through to abandonment and disposal.
The identification should include consideration of:
 planning, construction and commissioning (ie asset acquisition, development and improvement
activities)
 routine and non-routine operating conditions, including shut-down, maintenance and start-up
 incidents and potential emergency situations, including those arising from:
– product/material containment failures
– structural failure
– climatic, geophysical and other external natural events
– sabotage and breaches of security
– human factors including breakdowns in the HSE MS.
 decommissioning, abandonment, dismantling and disposal
 potential hazards and effects associated with past activities.
Personnel at all organisational levels should be appropriately involved in the identification of hazards
and effects.
Identification of HSE hazards and effects typically requires the application of specialised techniques
and systems, such as hazard and operability studies (HAZOPs), event or fault tree analysis, failure
mode and effect analysis (FMEA) or environmental impact assessment (EIA), and the involvement of
staff with specific expertise in risk management, HSE issues, design and operations. HSE hazards and
effects may also be identified using operational checklists and informal 'hazard hunts' at operating
sites. The participation of operational employees in such activities is to be encouraged as a means of
increasing their understanding of hazards, risks and effects.
Hazard identification is conducted at an early stage in the design and development of new facilities,
equipment and processes. This permits sound HSE practices, systems and equipment to be 'designed-
in', and allows a wider choice of risk prevention, mitigation and recovery measures to be employed
than with existing facilities. Continuous hazard identification is required at existing facilities to
maintain and improve HSE performance.
It is probably in the area of hazard identification and risk assessment that most differences between
traditional occupational health and safety strategies and environmental protection programmes will
occur. However, there are parallels between the causative events or hazards in the two areas:

EP 95-0100 Revision 0 19 October 1995 37

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Environment Safety and Health

Chronic Continuous discharge Occupational exposure
Acute (incident) Oil spill Fire/explosion

Identification
Identifying and managing hazards and adverse effects of activities is a vital part of HSE
management. The Hazards and Effects Management Process is designed to do this and in
Shell EP, this process has been divided into the four basic steps of Identify, Assess, Control
and Recover. These four steps are inherent in many existing techniques used in HSE. The
hazards and effects management process is not a new concept.
For illustrative reasons the four steps are described sequentially. In practice, the stages are
not always distinct, and many decisions about the overall process are taken as a whole. In
more complex situations the process tends to be iterative but in all cases must lead to the
reduction of risk to a level that is as low as reasonably practicable (ALARP).
This process should be applied to past, current and new activities and assets. It involves the
assessment of HSE impacts or potential impacts on people, on the environment and on
assets and should include the full life cycle of the activity or asset from inception to
termination.
The requirement to involve all organisational levels in the identification of hazards and
effects means that briefing and awareness programmes must be available for all levels in the
appropriate languages. The impact of this change in approach should not be underestimated.
Training in hazards and effects management for all levels of line staff will be required.
Hazards and effects which could lead either directly, or indirectly to a hazardous event or to
harm to the environment or to health can be identified in many different ways. These are
described in Volume 3 of this Manual but are summarised below.
Broadly, the hazards and effects identification process is based on:
Experience/Judgement: Experienced staff at all levels provide a sound basis for hazard
identification.
Checklists: Checklists can be developed to facilitate hazards and effects identification.
However, the use of checklists must not be allowed to restrict the scope of the process.
Standards: Industry Codes and Standards reflect collective knowledge and experience,
accumulated on the broadest possible operational base. They generally focus on hazards
assessment and control, but are underpinned by the hazard and effects identification process.

38 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

Structured Review Techniques: A number of structured techniques initially developed for

use in safety management are now being extended to environmental and health
management, for example HAZID (Hazard identification), HAZOP (hazard and operability).
Environmental Assessment (also known as Environmental Impact Assessment EIA): fulfils
all the basic requirements of the Hazards and Effects Management Process.
Similarly the technique of Health Risk Assessment is used to systematically identify health
hazards in the workplace and to evaluate risk to health. It covers exposure to chemical,
physical and biological agents at the workplace and ergonomic factors. Psychological
aspects should also be taken into account. These principles are also considered in respect to
health hazards associated with the living environment and life-style.
Like Environmental Assessment, many of the review techniques described above and in
Volume 3 of this Manual, address not just the identification of hazards and effects but also
encompass all the steps of the process including assessment of the risk, provision of control
and planning for recovery.

EP 95-0100 Revision 0 19 October 1995 39

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

4.2 Evaluation
Procedures should be maintained to evaluate (assess) risks and effects from identified hazards against
screening criteria, taking account of probabilities of occurrence and severity of consequences for:
 people
 environment
 assets.
It should be noted that any evaluation technique provides results which themselves may be subject to
a range of uncertainties. Consequently formal risk evaluation techniques are used in conjunction with
the judgement of experienced personnel, regulators and the community.
Risk evaluation should:
 include effects of activities, products and services
 address effects and risks arising from both human and hardware factors
 solicit input from personnel directly involved with the risk area
 be conducted by qualified and competent personnel
 be conducted according to appropriate and documented methods
 be updated at specified intervals.
Evaluation of health and safety risks and effects should include, where appropriate, consideration of:
 fire and explosion
 impacts and collisions
 drowning, asphyxiation and electrocution
 chronic and acute exposure to chemical, physical and biological agents
 ergonomic factors.
Evaluation of acute and chronic environmental effects should include, where appropriate,
consideration of:
 controlled and uncontrolled emissions of matter and energy to land, water and the atmosphere
 generation and disposal of solid and other wastes
 use of land, water, fuels and energy, and other natural resources
 noise, odour, dust, vibration
 effects on specific parts of the environment including ecosystems
 effects on archaeological and cultural sites and artefacts, natural areas, parks and conservation
areas.
Evaluation of the risks posed by the identified hazards, however sophisticated the detailed techniques
employed (eg HAZOPs and HAZAN, QRA, health risk assessment, EIA), requires consideration of
both the severity of the consequences of a potential event and the probability of its occurrence.
RISK = PROBABILITY OF OCCURRENCE x SEVERITY OF CONSEQUENCES
Risks of different events can then be compared and considered against screening criteria. Such
criteria are most often a range of considerations or values and can take a variety of quantitative or
qualitative forms.

40 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

There may be considerable uncertainty attached to the estimate of the probability of an event; the
severity of the consequences if the hazard is realised may be more readily and precisely definable.
This 'two-factor model' can be used to evaluate the acute safety and/or environmental risks of a
specific incident (eg blow-out or oil spill).
The evaluation of chronic effects on the environment arising out of a company’s operations, however,
will need to take account of some 'events' which are regular or continuous, and intentional such as
the discharge of effluent or the operation of gas flares. For such effects:
RISK = SEVERITY OF CONSEQUENCES = EXPOSURE x DEGREE OF HARMFULNESS
(eg toxicity, disturbance to habitat)
Similarly, in health risk assessment the probability of some degree of exposure may be 100%; thus:
RISK = SEVERITY OF CONSEQUENCES = EXPOSURE x DEGREE OF HARMFULNESS
(eg toxicity)
Regulatory controls, health surveillance programmes or epidemiological studies (within the company
or externally) may indicate exposure to health hazards, chronic effects and the need for risk reduction
measures. Harmful agents (agents capable of causing chronic and/or acute adverse health effects)
include chemicals (eg hydrogen sulphide, hydrocarbon vapours, solvents, coating materials),
biological agents (eg pathogenic organisms causing malaria and legionella) and physical agents (eg
ionising radiation, cold and heat stress, dust, noise and vibration). Ergonomic factors (eg equipment
design and cumulative effects of repetitive movements) relating to the manner in which tasks are
performed will also need to be considered.
The results of formal risk evaluation facilitate:
 Assessment of the feasibility of the proposed activity, based on compliance with the defined
screening criteria
 Identification of the need for specific prevention, mitigation and/or recovery measures
 Identification of permitted operations (eg simultaneous operations)
 Identification of monitoring requirements (eg for emission and exposure monitoring)
 Prioritisation of opportunities for improvement.
Evaluation of HSE risks requires access to information on the probabilities of specific events and/or
on the nature and severity of likely consequences; sources of such information include, for example:
 Internal knowledge and experience of managers and HSE experts
 Industry frequency and failure rate databases and co-operative research programmes
 Relevant international, national and company standards and codes of practice
 Industry and trade association codes of practice and other guidance
Company and external R&D aimed at identifying hazards and effects, and assessing and reducing the
risks associated with them, is to be encouraged.

Assessment of Hazards and Effects

An objective approach to the assessment of hazards and effects is a critical element of the
hazards and effects management process, and is essential for setting priorities.
It is important that in assessing the hazards and setting the screening criteria the following
issues are also taken into account:

EP 95-0100 Revision 0 19 October 1995 41

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 risk to assets and production

 effects on reputation
 the cost effectiveness of risk reduction measures.
Other factors to consider in the process include:
 maintenance of a working balance between health, safety and environmental
considerations
 existing and planned legislation
 existing and planned Shell policies, standards and operating practices
 uncertainty in scientific knowledge and expert judgement.
Some of these issues cannot be fully quantified. For example, there is no established
framework for determining priorities between discharges to water and atmospheric
emissions. Decision making therefore contains a significant degree of judgement. Normal
business techniques for decision making are relevant, eg weighted decision trees, etc with of
course expert advice where appropriate. Application of hazard management must ensure that
the best knowledge available to the company is presented to decision makers in a useful,
complete, concise and transparent manner, highlighting what is fact and what is judgement,
and also the nature and magnitude of uncertainties.

42 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

Determination of risk
As described above, risk is the product of probability of occurrence times the severity of
consequences. In the preceding E&P Forum text, a second definition for risk has been
provided for environmental or health hazards namely exposure times degree of harmfulness.
The base definition of probability times severity of consequences is equally applicable in H
& E and the probability of occurrence can refer to the exceedance of pre set limits, eg
exposure levels or pollution levels for 'chronic' or routine hazards.

Risk may be determined in a qualitative or quantitative way, but to do either it is first

necessary to determine initiating events or threats that could release the hazard or cause the
effects in the first place. Medical records are an example of source documentation that could
aid in this process. Techniques for the estimation of the probability or frequency of exposure
to the hazard are described in Volume 3 of this Manual. The estimation of the potential
consequences of the hazard typically involves the use of predictive models addressing HSE
aspects for a number of scenarios. In Shell a number of predictive techniques are used and
these are also described in Volume 3 of this Manual.
Qualitative Risk Assessment
For less complex situations it is possible to conduct a simple assessment of incident
potential by making a banded assessment of probability and consequence. The Risk Matrix
is a useful graphical technique to utilise when doing this. Refer Figure 4.1).

Quantitative Risk Assessment (QRA)

QRA is a potentially powerful technique, but should only be used by personnel with
adequate training and experience. It is fully described in EP 95-0352. It can not be applied to
non-incident related environmental issues at the present time. QRA provides a structured
approach to assessing risk and expresses this numerically. The main function of QRA is to
identify high risk areas and assist in the comparison of design options and the selection of
operations philosophies with a view to establishing effective and efficient risk management.
Risk figures derived in an absolute rather than in a comparative sense should be used with
considerable caution. However, absolute risk figures may be required in some countries to
fulfil legislative requirements and also to determine whether or not risk levels are tolerable
and whether or not some regulatory or legal definition of ALARP has been reached.

EP 95-0100 Revision 0 19 October 1995 43

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Screening Criteria: Limits/Standards

It is essential that the hazards or effects once identified and assessed are considered against
screening criteria.

Screening criteria are values or standards against which the identified hazard or effect can be
judged. They can be established against legal and scientifically derived limits, or other
considerations like probability of occurrence and severity of consequence.

Some HSE screening criteria will be defined by local legislation but in the absence of
specific legislation, the company should adopt appropriate, internationally or Shell Group
accepted criteria. This should apply equally to health, safety and environmental criteria,
such as occupational exposure limits, engineering standards and environmental quality
standards.
The Screening Criteria are used during all phases of the hazards and effects management
process including the Control and Recovery phases to establish performance criteria against
which the effectiveness of agreed controls can be measured.

Screening Criteria: Qualitative Risk

Risk can be used as a screening criteria either in a quantitative or qualitative way. The
assessed risk can be regarded as either intolerable, negligible or in a region between the two.
In all cases consideration should be given to risk reduction to achieve a level deemed 'as low
as reasonably practicable' (ALARP), reflecting cost-benefit considerations. This is
accomplished by comparison to some form of acceptance criteria either established
internally or imposed by regulatory authorities.
Screening Criteria are most often a range of considerations or values and can take a variety
of formats. They may be qualitative or quantitative. The concept of the risk matrix (Figure
4.1) can be used for the qualitative portrayal of risk and screening criteria for incidents.

44 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

Figure 4.1 The risk matrix

CONSEQUENCE INCREASING PROBABILITY

Severity People Assets Environment Reputation A B C D E

Never Has Incident Happens Happens
heard of occurred has several several
in in occurred times per times per
EP EP in year in year in
industry industry Opco Opco location
0 No No No No
injury damage effect impact
1 Slight Slight Slight Slight Manage for continuous
injury damage effect impact improvement
2 Minor Minor Minor Limited
injury damage effect impact
3 Major Localised Localised Considerable
injury damage effect impact
4 Single Major Major National Incorporate risk
fatality damage effect impact reduction measures Intolerable
5 Multiple Extensive Massive International
fatalities damage effect impact

The risk matrix is a graphical portrayal of risk as the product of probability (exposure,
frequency or likelihood) and consequence and has broad applicability for qualitative risk
determination and graphical presentation of risk criteria.
The worst-case consequence is plotted against the highest probability and compared with the
resulting risk categorisation on the matrix.
The level of risk tolerability can be categorised on the matrix by shading in areas of
intolerable risk, areas that require risk reduction considerations and areas that are subject to
the normal, ongoing improvement processes.
The matrix shows risk on a scenario-by-scenario basis which may be combined with care to
provide a determination of the overall risk at a facility. It is however difficult to address a
highly complex system or a chain of events with competing variables influencing risk.
Additionally its application in the area of Hazards and Effects Management is clearly less
straightforward and interpretation and modification would be required.
A commonly used basis for qualitative criteria is comparison of the level of risk with that of
similar operations.

Screening Criteria: Quantitative Risk

Commonly used quantitative criteria for ALARP are often based on various indices with
distinction made between employees and the public. Target figures may be set by regulatory
authorities or the Opco. The uncertainties in the results from QRA can be large and where
target figures are established, they should account for the uncertainty of the results.
For more less obvious areas, a risk/benefit analysis may be required to determine when the
risk is as low as reasonably practicable. Examples of typical risk criteria are given in
Volume 3 of this Manual.
When seeking to lessen the estimated risk, consideration of prevention measures to reduce
probability should be the first choice see ‘Risk Reduction Measures’ 4.5. Risk can also be
reduced by mitigating the consequence of an incident.

EP 95-0100 Revision 0 19 October 1995 45

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

In general, a number of alternatives will be available for risk reduction or control. To

provide meaningful input to risk management, it is necessary to rank alternatives in terms of
risk reduction, cost or both.

Iteration
It must be recognised that the control, assessment and identification parts of the process are
inter-related and that it will be necessary for the hazard or hazardous effect to be reassessed
following the putting into place of preventive or mitigating control measures. It is possible
that controls in themselves may present additional hazards or a worsening of the hazardous
effect. An iterative approach must lead to the reduction of risk to a level that is as low as
reasonably practicable (ALARP).

46 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

4.3 Recording of Hazards and Effects

The company should maintain procedures to document those hazards and effects (chronic and acute)
identified as significant in relation to health, safety and the environment, outlining the measures in
place to reduce them (see 4.5 'Risk Reduction Measures') and identifying the relevant HSE-critical
systems and procedures.
The company should maintain procedures to record statutory requirements and codes applicable to the
HSE aspects of its operations, products and services and to ensure compliance with such
requirements.
Results of the evaluation need to be recorded, together with the data sources and assumptions used.
This record is used by operations personnel developing procedures and issuing work instructions and
other key personnel to communicate the hazards that have been identified and the measures that are
in place to prevent and mitigate the risks of occurrence. The hazards and environmental effects
documentation may be joint or separate documents. Inventories of routine emissions to air, water and
land may be maintained to monitor and manage effects. Note that there may be legislative and
regulatory requirements for such records as evidence of effective application of hazard management.

The documentation relating to the hazards and effects analysis and the management of the
hazards and effects is included in Parts 3 & 5 of the HSE Case (see 3.7 Documentation and
its Control).

EP 95-0100 Revision 0 19 October 1995 47

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

4.4 Objectives and Performance Criteria

The company should maintain procedures to establish detailed HSE objectives and performance
criteria at relevant levels.
Such objectives and performance criteria should be developed in the light of policy, strategic HSE
objectives, HSE risks, and operational and business needs. They should be quantified, wherever
practicable, and identified with defined time-scales; they should also be realistic and achievable.
As a follow-up to risk evaluation (see 4.2 'Evaluation'), the company should maintain procedures to
set performance criteria for HSE-critical activities and tasks, which stipulate in writing the acceptable
standard for their performance. It should also, at specified intervals, review the continuing relevance
and suitability of the criteria.
The setting and periodic revision of objectives and performance criteria and the continual
enhancement of the HSE MS underpins the company’s commitment to improvement of HSE
performance. Their quantification, and association with specific timetables, is important to establish
the credibility of corporate intentions.
HSE objectives and performance criteria will need to take into account previous performance and to
reflect any external changes of circumstances as well as any changes in the business itself.
The detailed objectives and performance criteria within the strategic objectives of the company
should be developed with the active participation of those who will be responsible for their
achievement.
Performance criteria describe the standards to which a particular activity or system element is to
perform, and can apply at various levels within the HSE MS. For example, in addition to specifying
acceptable levels of outputs or parameters (eg effluent quality, occupational exposure levels, lost-
time incidents frequency (LTIF), emission/discharge levels), such criteria may establish the nature
and frequency of such tasks as:
 Plant maintenance
 HSE MS reviews and audits
 Assessment of training needs
 Hazard and effects identification and risk assessment
 Testing of emergency plans
 Testing emergency shut-down and blow-out prevention systems
 Testing fire detection, protection and alarm systems
 Process and emission monitoring.
As the basis for control and monitoring, and performance measurement, criteria need to be both
readily measurable, and clearly and unambiguously documented. As a minimum, performance
criteria satisfy any relevant regulations, although they may frequently be set in the absence of such
regulations.
A hierarchy of HSE goals is thus formed, from company strategic objectives (eg to minimise adverse
HSE effects), through organisational and more detailed local objectives (eg to increase efficiency of
energy usage by a stated amount) to specific performance criteria (eg to ensure emissions of
hydrogen sulphide remain below stated levels).

48 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

The trending of performance against criteria over time provides a suitable technique for
developing simple performance indicators. These are 'vital signs' indicators showing the
extent of successful performance against set criteria over time. In particular where the
ALARP principle has been specifically addressed they should encompass the major risk
parameters and assumptions. This enables the risk profile of the facility or
operation to be monitored over time. From past experience almost all major excursions from
agreed and tolerable limits and almost every serious accident is preceded by indications that
all is not as it should be. The audit and review cycle will pick up any non-conformance but
should not be used as a routine monitoring and management tool. Performance criteria and
associated performance indicators must be established to serve this purpose on a day-to-day
basis.

EP 95-0100 Revision 0 19 October 1995 49

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

4.5 Risk Reduction Measures

The company should maintain procedures to select, evaluate and implement measures to reduce risks
and effects. Risk reduction measures should include both those to prevent incidents (ie reducing the
probability of occurrence) and to mitigate chronic and acute effects (ie reducing the consequences).
Preventive measures such as ensuring asset integrity (see 5.2) should be emphasised wherever
practicable. Mitigation measures should include steps to prevent escalation of developing abnormal
situations and to lessen adverse effects on health, safety and the environment and, ultimately,
emergency response measures to recover (see 5.5). Effective risk reduction measures and follow-up
require visible commitment of management and on-site supervision, as well as the understanding and
ownership of operations personnel.
In all cases consideration should be given to reducing risk to a level deemed 'as low as reasonably
practicable' reflecting amongst other factors local conditions and circumstances, the balance of cost
and benefits and the current state of scientific and technical knowledge.
Procedures should be in place to:
 identify prevention and mitigation measures for particular activities, products and services
which pose potential HSE risks
 re-appraise activities to ensure that the measures proposed do reduce risks, or enable relevant
objectives to be met
 implement, document and communicate to key personnel interim and permanent risk reduction
measures, and monitor their effectiveness
 develop relevant measures such as plans for emergency response (see 5.5 ) to recover from
incidents and mitigate their effects
 identify hazards arising from risk prevention and mitigation and recovery measures
 evaluate the tolerability of consequent risks and effects against the screening criteria.
Risk reduction measures can reduce HSE risks and effects in a number of ways, for example by:
 Preventing acute and chronic incidents
 Reducing the exposure (concentration/duration) of people to harmful agents that are routinely
present in the work area
 Reducing emissions/discharges to the environment.
A variety of risk reduction measures may be employed, appropriate to the nature, probability and
severity of the HSE risk or effect (eg chronic or acute effects, routine or non-routine operations).
Prevention measures are designed to prevent the realisation of hazards. Such measures include
specific hardware to control hazardous operations and to maintain asset integrity, such as:
 Blow-out preventers
 Pressure release systems
 Personal protective equipment
 Security systems.
It is important to realise that they also include organisational and system measures, such as:
 Intrinsically safer designs
 Quality assurance, maintenance and inspection procedures
 Safe working practices

50 EP 95-0100 Revision 0 19 October 1995

 4 Hazards and Effects Management Process

 Permit-to-Work systems
 Plans that take account of human factors
 Clear and well-communicated work instructions
 Use of Material Safety Data Sheets (MSDS)
 Prophylactic medical treatments such as vaccination/immunisation
 Alcohol and drug-use programmes.
Measures are also required to mitigate or lessen the adverse effects, in the event that a prevention
measure fails, and are therefore employed during abnormal or emergency situations. Such measures
include, amongst others:
 Ignition control systems
 Blast walls
 Secondary tank containments
 Passive fire protection
 Gas/fire/smoke detection.
Contingency and emergency planning is addressed more fully in 5.5.

Control of, and recovery from, hazards and effects

Risk reduction measures described above include preventive measures (likelihood reducing)
and mitigatory measures (consequence reducing).
The point at which measures can be classified as prevention, mitigation or recovery can
sometimes become unclear depending on what is considered to be the hazardous event, or
the 'top event'. For instance, if the pressure in a system rises and the relief valves operate,
then this can be viewed as a control measure if the hazardous event is thought to be vessel
rupture. Alternatively, the relief valve can be described as a recovery measure if the
hazardous event is considered to be overpressure. A similar situation would exist with gas
release and explosion. The selection of the hazardous event therefore dictates the
classification. Fortunately in practice, this makes little or no difference to the process of risk
reduction. For practical purposes it is recommended to always take the initial release of the
hazard as the hazardous event.

EP 95-0100 Revision 0 19 October 1995 51

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Many control aspects of design, prevention and mitigation, are inherent in the standards. EP
95-0230 provides an overview and guidance on the Design application of these standards
with respect to HSE. An example is the classification of areas which are hazardous with
respect to the siting of electrical equipment. This is essential input to a control activity
which the design engineer must prepare for the operator of the facility.
The controls that have to be implemented in the operations and abandonment phase are
listed in the hazards and effects register (eg procedures, work instructions, legislation,
design, personal competence, permit-to-work, standards, atmospheric emission
measurement, discharge monitoring, etc). All the threats and possible initiating events must
be controlled. If the users of the procedures consider the controls are not suitable or
acceptable then their assistance in developing more appropriate controls must be sought.
A comparison with what is in place will show any gaps or deficiencies that need to be
rectified.
A number of reference documents will be repeatedly used in describing controls to be
applied in the management of hazards. Some of these are listed below and are described and
are referred to in more detail in Volume 3.
Title Reference
Health Risk Assessment (Ref. 5)
Chemical Hazards: Health Risk (Ref. 6)
Assessment and Exposure Evaluation
Quantifying Atmospheric Emissions EP 95-0377
Permit-to-Work EP 95-0315 (E&P Forum)
Personal Protective Equipment Guide (Ref. 7)
Hazardous Area Classification (Ref. 8)
Safe Handling of Chemicals EP 95-0319
Waste Management Guidelines EP 95-0390 (E&P Forum)
Classifying Waste EP 95-0391
H2S in Operations EP 95-0317
Guidelines which describe contingency and consequence planning are given in 5.5 and EP
95-0316.

52 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

5 PLANNING AND PROCEDURES

('Planning' in the E&P Forum HSE MS Guidelines)

This chapter addresses the firm planning of work activities, including the risk reduction measures
(selected through the evaluation and risk management process). This includes planning for existing
operations, managing changes and developing emergency response measures.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

EP 95-0100 Revision 0 19 October 1995 53

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

5.1 General
The company should maintain, within its overall work programme, plans for achieving HSE
objectives and performance criteria. These plans should include:
 a clear description of the objectives
 designation of responsibility for setting and achieving objectives and performance criteria at
each relevant function and level of the organisation
 the means by which they are to be achieved
 resource requirements
 time scales for implementation
 programmes for motivating and encouraging personnel toward a suitable HSE culture
 mechanisms to provide feedback to personnel on HSE performance
 processes to recognise good personal and team HSE performance (eg safety award schemes)
 mechanism for evaluation and follow-up.
As the means of achieving the company’s HSE policy and objectives, soundly-based improvement
plans are key components of the HSE MS. Such plans require adequate resources and visible
commitment from all personnel. Ideally, such plans will form an integral part of the company’s
overall business plans.
HSE Plans may require development for such activities as:
 Acquisitions
 New developments
 Existing operations
 Modifications to existing facilities
 Abandonment programmes
 Geological surveys
 Seismic surveys
 Exploration or development programmes.
The resourcing requirements and time-scales also require definition to ensure that manpower is
available and that necessary budget commitments can be made.
Consultation with regulatory authorities and other external bodies drafting legislation, regulations
and standards is recommended to ensure that planning takes account (so far as is possible) of future
legislative and regulatory requirements.

54 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

There are three levels of planning, corresponding to the three organisational and quality
levels of Corporate, Process and Task. They are shown below, together with the typical time
scale that each covers and the level of detail involved:
Table 5.1 The three levels of planning (corporate, process, task) and the level of detail
involved in each case
Organisational Planning Typical time scale Level of detail
level

Corporate Strategic define direction Over several years Low

Process Management prepare One to 5 years Medium

business plan

Task Operational Up to a few weeks High

HSE management at corporate level is largely associated with forming policy and strategic
objectives as described in chapter 2. The two lower levels jointly correspond to most
operational and project-related planning requirements and are described below.
Planning in the context of HSE management involves developing strategies to meet the
objectives and targets for the organisation as a whole, each department and each section of
it. This requires the organisation to define its objectives and for each department or section
to set its own targets in order to meet these objectives. The use of planning at this level is
critical in improving environmental performance as reduction in wastes and emissions is
often a long term process requiring budgeting and allocation of resources well in advance.
HSE management planning at the process level consists largely of the framework aspects
described in chapter 3, namely:
 organisation, roles, responsibilities
 communications
 competence and training
 contractor management
 standards
 rehabilitation
 waste management
 emission/discharge control.
HSE task level planning consists of determining:
 adequate personnel resources to do the work
 adequate equipment, tools, services, etc to do the work

EP 95-0100 Revision 0 19 October 1995 55

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 a safe workplace
 a safe method of working
 procedures to do the work
 an adequate time scale for the work.
These elements will have been previously determined in the hazard assessments as being the
necessary controls needed to manage the risk. They must, as a minimum, satisfy legislative
requirements but are frequently set in the absence of such requirements.
It is preferable that key personnel charged with implementation should have been involved
in the planning stage. This is not always possible and in such circumstances these key
personnel need to be familiarised with the plans. Even for those instances where continuity
of key personnel between involvement in planning and implementation is achieved, it is
good practice to remind participants of the key HSE issues of the plan, prior to
implementation.

56 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

5.2 Asset Integrity

The company should maintain procedures to ensure that HSE-critical facilities and equipment which it
designs, constructs, procures, operates, maintains and/or inspects are suitable for the required purpose
and comply with defined criteria. Pre-procurement and pre-construction assessment of new facilities
and equipment should include explicit assessment of appropriateness to meet HSE requirements and
should emphasise design as the best preventive measure to reduce risk and adverse HSE effects.
Procedures and systems for ensuring asset integrity should address (amongst other factors) structural
integrity, process containment, ignition control and systems for protection, detection, shutdown,
emergency response and life-saving.
Deviation from approved design practices and standards should be permitted only after review and
approval by designated personnel and/or authorities, and the rationale for the deviation should be
documented.
It is important that accepted codes of practice and standards for key equipment and related activities
are followed.
To help assure the integrity of existing and planned facilities, careful attention needs to be paid to the
completeness of the engineering process—with specific reference to the design, manufacture,
installation, maintenance, testing and inspection of key equipment. In this context, key equipment
refers to that identified in the evaluation process as being critical to the continued effectiveness of
HSE controls. Particular emphasis needs to be placed on the design of new facilities, and hazard
identification at an early stage allows the best risk reduction measures (those that prevent incidents
through eliminating hazards at source) to be employed.
Quality assurance measures during the fabrication of key equipment help ensure that materials and
construction are in accordance with design specifications. Installation processes need to be managed
and inspected to check that design specifications and manufacturers’ instructions are followed, and
attention to effective maintenance, testing and inspection systems helps ensure the continuing
integrity of key equipment.
All personnel who perform the activities described above, related to asset integrity, are HSE-critical
staff and therefore require appropriate experience, qualifications and training to ensure their
competence to undertake these important risk reduction measures.

To ensure that Asset Integrity is safeguarded the following should be in place:

 clearly defined responsibility for asset custodianship
 a practical and widely understood plant change control system
 a transparent inspection philosophy and programme
 a programme of recorded management and cross-discipline/cross-facility inspections.

EP 95-0100 Revision 0 19 October 1995 57

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

The development of an Operations Reference Plan (ORP) is based on an analysis technique

which identifies those activities and assets which are categorised as:
 critical for safeguarding technical integrity
 cash flow critical
 neither safeguarding or cash flow critical.
Ref. 9 describes the Operations Reference Plan for Assets.

58 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

5.3 Procedures and Work Instructions

Developing procedures
Activities for which the absence of written procedures could result in infringement of the HSE policy
or breaches of legislative requirements or performance criteria, should be identified. Documented
procedures or standards should be prepared for such activities, defining how they should be conducted
—whether by the company’s own employees, or by others acting on its behalf—to ensure technical
integrity and to transfer knowledge effectively.
All written procedures should be stated simply, unambiguously and understandably, and should
indicate the persons responsible, the methods to be used and, where appropriate, performance
standards and criteria to be satisfied.
Procedures are required for procurement and contracted activities, to ensure that suppliers and those
acting on the company’s behalf comply with the company’s policy requirements that relate to them.
It is important to ensure that those who will be responsible for putting procedures and written
instructions into effect are closely involved in their production. Clarity and simplicity of style and
language are the characteristics to aim for in writing them, consistent with accurate coverage of the
activities which they address.
Providing instruction on the conduct of worksite tasks can take many forms, depending on the
complexity of the task, the competence of the people performing it, the inherent hazards and risks
associated with it, and the effects that it might have on other aspects of the operation or facility.
Thus, verbal instructions will need to be supported with, or replaced by, written work instructions
wherever the absence of written material could prejudice HSE performance. Written work
instructions will outline the work scope and reference any particular direction that is to be followed;
similar considerations to those for system procedures apply to their development. Monitoring
requirements and needs for personal protective equipment can be specified in the work instructions.
For example, in a production facility where hydrocarbons are stored or produced, stringent controls
are required and most work is conducted under a ‘Permit-to-Work’ system. Within this, the work is
defined, the precautions specified, other parties whose activities may be affected are notified, and the
permit signed off by all parties involved.

Issuing work instructions

Work instructions define the manner of conducting tasks at the work-site level, whether conducted by
the company’s own employees or by others acting on its behalf. In the case of HSE-critical tasks,
which have the potential for adverse HSE consequences if incorrectly performed, these work
instructions should be documented and communicated to relevant personnel.

The activities which can be described as 'HSE-critical' must have procedures. An HSE-
critical activity is one which includes any of the four elements of the Hazards and Effects
Management Process, ie identification, assessment, control and recovery.

EP 95-0100 Revision 0 19 October 1995 59

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

In an Opco where the EP Business Model (EPBM) has been adopted HSE-critical activities
will be identified as such areas where procedures are particularly necessary to cover
interfaces between different groups or disciplines and where co-ordination is vital to achieve
a successful HSE outcome.
In addition to the points made above, procedures should be:
 subject to a regular and formalised system of review, approval and update
 dated and easily updatable
 identified with a custodian
 accessible (not just physically evident but user-friendly and well indexed).

60 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

5.4 Management of Change

The company should maintain procedures for planning and controlling changes, both permanent and
temporary, in people, plant, processes and procedures, to avoid adverse HSE consequences.
The procedures should be suitable to address the HSE issues involved, according to the nature of the
changes and their potential consequences, and should address:
 identification and documentation of the proposed change and its implementation.
 responsibility for reviewing and recording the potential HSE hazards from the change or its
implementation
 documentation of the agreed change and implementation procedure, including:
– measures to identify HSE hazards and to assess and reduce risks and effects
– communication and training requirements
– time limits, if any
– verification and monitoring requirements
– acceptance criteria and action to be taken if breached.
 authority for approval to implement the proposed change.
Procedures should describe how the company will interpret and assess the implications of new or
amended legislation and how revised regulatory requirements are to be incorporated in the HSE MS.
Separate plans should be established in respect of the HSE management of new operations (relating,
for example, to acquisitions, developments, divestments, products, services or processes), or of
modified operations where the modification introduces significantly different HSE concerns, to
define:
 HSE objectives to be attained
 mechanisms for their achievement
 resource requirements to achieve HSE objectives
 procedures for dealing with changes and modifications as projects proceed
 corrective mechanisms which should be employed should the need arise, how they should be
activated and how their adequacy should be measured.
Any changes in the personnel, equipment, processes and procedures of the company have the
potential for adverse effects on health, safety and the environment.
All changes should be considered. These will include not only equipment changes but also
organisational restructurings—such as those that result from acquisitions, mergers, new joint
ventures and alliances. Plans relating to changes need to address the HSE aspects arising at all
stages of the development, to ensure that risks or adverse environmental effects are minimised by
effective planning and design.
For the same reasons, plans relating to new installations or modifications to processes and plant
need to cover all stages of the development, from feasibility studies, through planning and design, to
construction, commissioning, operation, maintenance and eventual decommissioning and
abandonment.
Changes which may be HSE-critical should be reviewed prior to implementation, and any necessary
amendments made to the HSE MS to ensure that their introduction does not prejudice sound HSE
performance.

EP 95-0100 Revision 0 19 October 1995 61

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

In a development or project, change control means the process by which proposals to change
from an originally agreed scope or terms of reference are reviewed and approval sought. The
EP Project Management Guide EP 90-400 (Ref. 10) describes the essential elements of such
a system.
In an operating plant, a change proposal may include a proposal to change hardware,
operating procedures or any aspect of the operation including, for example, level of
competence or change in throughput. A procedure to ensure that such changes are reviewed
must be clearly described and should involve the custodian of the appropriate HSE Case.
He/she should ensure that the HSE MS documentation is maintained up-to-date and that the
necessary hazards and effects assessment has been undertaken to confirm the continued
validity of the HSE Case.
It is important that standards and guidelines clearly differentiate between mandatory
requirements and guidance to facilitate the change process.
Of particular concern in this context are gradual changes such as discharge composition or
production creeping outside the design envelope. These need particular vigilance. Similarly,
a change in the type of chemicals used or the encroachment of local dwellings on land
adjacent to process plant might all constitute a change of circumstances requiring re-
assessment.

62 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

5.5 Contingency and Emergency Planning

The company should maintain procedures to identify foreseeable emergencies by systematic review
and analysis. A record of such identified potential emergencies should be made, and updated at
appropriate intervals in order to ensure effective response to them.
The company should develop, document and maintain plans for responding to such potential
emergencies, and communicate such plans to:
 command and control personnel
 emergency services
 employees and contractors who may be affected
 others likely to be impacted.
Emergency plans should cover:
 organisation, responsibilities, authorities and procedures for emergency response and disaster
control, including the maintenance of internal and external communications
 systems and procedures for providing personnel refuge, evacuation, rescue and medical
treatment
 systems and procedures for preventing, mitigating and monitoring environmental effects of
emergency actions
 procedures for communicating with authorities, relatives and other relevant parties
 systems and procedures for mobilising company equipment, facilities and personnel
 arrangements and procedures for mobilising third party resources for emergency support
 arrangements for training response teams and for testing the emergency systems and procedures.
To assess the effectiveness of response plans, the company should maintain procedures to test
emergency plans by scenario drills and other suitable means, at appropriate intervals, and to revise
them as necessary in the light of the experience gained.
Procedures should also be in place for the periodic assessment of emergency equipment needs and the
maintenance of such equipment in a ready state.
Foreseeable emergencies for which planning needs to be undertaken may include:
 Fire and explosion
 Failure of key controls (eg loss of well control), of power sources, or of services
 Structural failures
 Worksite injuries
 Diving, marine and aviation incidents
 Man overboard or missing person situations
 Spills and unplanned releases of product or other materials
 Loss of radioactive material
 Security breaches and sabotage
 Outbreaks of disease
 Civil disorder and military actions

EP 95-0100 Revision 0 19 October 1995 63

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 Geophysical and natural events.

and other emergency events highlighted by hazards and effects identification.
Emergency response measures include, amongst others:
 Emergency shut-down systems
 Fire-fighting devices
 Emergency evacuation procedures
 Rescue craft
 First-aid equipment and personnel
 Specialist medical treatment
 Oil-spill clean-up systems.
An important point to note about recovery measures is that since they are only required to act in
emergency situations—ie rarely—emphasis should be placed upon their reliability, which should be
assessed through regular and thorough inspection and testing. Account should be taken of the
increased risk involved in carrying out drills and testing of emergency procedures.
The emergency plans will need to:
 Be clearly communicated
 Be well-rehearsed
 Co-ordinate internal and external emergency response teams
 Pay particular attention to external communication
 Include provision for the reporting and investigation of incidents
 Take account of the environmental effects of measures taken to manage escalating emergency
situations (such as the effects of unconstrained fire-water run-off).

64 EP 95-0100 Revision 0 19 October 1995

 5 Planning and Procedures

Guidance on Shell Emergency Response Planning is provided in EP 95-0316 in Volume 3 of

this Manual. The guide describes the creation of awareness of emergency situations and the
development of an organisation, resources, procedures, training and review techniques for
managing emergency situations.
Emergency response plans must take into account the environmental sensitivities.
The following more specialised guidance is available:
Title Reference
Medical Emergency Guidelines for Management Ref. 11
Medical Emergency Guidelines for Health Care Ref. 12
Professionals and First Aiders
Guidance to First Aiders Ref. 13
Oil Spill Dispersants EP 95-0397

EP 95-0100 Revision 0 19 October 1995 65

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

This page intentionally left blank

66 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

6 IMPLEMENTATION AND MONITORING

This chapter addresses how activities are to be performed and monitored, and how corrective action is
to be taken when necessary.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

EP 95-0100 Revision 0 19 October 1995 67

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

6.1 Activities and Tasks

Activities and tasks should be conducted according to procedures and work instructions developed at
the planning stage—or earlier, in accordance with HSE policy:
 At senior management level, the development of strategic objectives and high-level planning
activities should be conducted with due regard for the HSE policy.
 At supervisory and management level, written directions regarding activities (which typically
involve many tasks) will normally take the form of plans and procedures.
 At the work-site level, written directions regarding tasks will normally be in the form of work
instructions, issued in accordance with defined safe systems of work (eg permits to work,
simultaneous operations procedures, lock-off procedures, manuals of permitted operations).
Management should ensure, and be responsible for, the conduct and verification of activities and tasks
according to relevant procedures. This responsibility and commitment of management to the
implementation of policies and plans includes, amongst other duties, ensuring that HSE objectives are
met and that performance criteria and control limits are not breached. Management should ensure the
continuing adequacy of the HSE performance of the company through monitoring activities (see
'Monitoring' 6.2).
Previous sections have described the planning process, from the development of procedures covering
broad areas of activity down to the level of issuing work-site instructions for the conduct of specific
tasks. The effective practical implementation of these planned arrangements requires that procedures
and instructions are followed, at all levels. Company and contractor staff need to be familiar with
relevant procedures and instructions before they start work.

Integration of HSE into the business

The HSE Management System follows the principles of quality management and is part of
the overall system for managing the business. Only once hazards and effects management
controls have been fully accepted as part of everyday business operations can business
integration truly be said to be achieved. Thus each member of the workforce must know his
role and contribution to the management of HSE risk and be able to recognise how this fits
with corporate HSE policy.

Contractors
Where activities involve contractors, the process of familiarisation with the Opco's plans is
especially important. Involvement of contractor’s key personnel jointly with the Opco in the
planning stage, whilst desirable, may not be feasible. The process of initiating
familiarisation of the contractor with the plan is then essential and is typically carried out as
part of a formal kick-off meeting. The initial period of a contract can be particularly
vulnerable to HSE incidents.
For further guidance see EP 95-0110.

68 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

6.2 Monitoring
The company should maintain procedures for monitoring relevant aspects of HSE performance and
for establishing and maintaining records of the results. For each relevant activity or area, the company
should:
 identify and document the monitoring information to be obtained, and specify the accuracy
required of results
 specify and document monitoring procedures, and locations and frequencies of measurement
 establish, document and maintain measurement quality control procedures
 establish and document procedures for data handling and interpretation
 establish and document actions to be taken when results breach performance criteria (see
'Objectives and performance criteria' (4.4); 'Risk reduction measures' (4.5); and 'Non-
compliance and corrective action' (see 6.4)
 assess and document the validity of affected data when monitoring systems are found to be
malfunctioning
 safeguard measurement systems from unauthorised adjustments or damage.
Procedures are required for both active and reactive monitoring. Active monitoring provides
information in the absence of any incident, ill-health or damage to the receiving environment. It
includes checking that HSE MS requirements (eg procedures) are being complied with, and that
objectives and performance criteria are met. Reactive monitoring provides information on incidents
(including near-miss incidents, ill-health or environmental damage) that have occurred and provides
insights into the means of preventing similar incidents in the future.
Monitoring provides the means of measuring performance against established requirements,
including objectives, targets and performance criteria. Thus, monitoring may include such activities
as:
 Regular monitoring of progress towards objectives and targets achieved by implementation of
HSE Plans
 Regular inspection of facilities, plant and equipment against specific performance criteria
 Systematic observation of the work and behaviour of first line supervisors to assess compliance
with procedures and work instructions
 Regular analysis of discharges, emissions and waste disposal
 Health surveillance of staff, including exposure monitoring and medical surveillance.
Monitoring facilitates control of HSE-critical activities and processes, and the detail and frequency
of measurement needs to reflect the nature and extent of the risks involved, and concentrate on the
areas where it produces the most benefit. Thus 'higher-risk' facilities, plant, activities and tasks
require monitoring in more detail and at a greater frequency.

EP 95-0100 Revision 0 19 October 1995 69

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Monitoring covers the entire range of monitoring activities from those carried out by
individuals at the workplace (which may comprise a simple visual check by a supervisor or
skilled worker of the work being carried out by a helper) through the more detailed checks
carried out by a co-pilot on take-off to the assessment of activity or task performance by the
use of performance indicators.
Often what is meant by monitoring in an Opco is incident follow-up and this will remain an
important aspect. However, in the HSE Management System it is only one part of the two-
pronged approach that includes active as well as reactive monitoring.

Personnel tasks and targets

Within the Shell Group, the staff appraisal system plays a key role in the setting and
monitoring of staff performance on all matters including HSE. Progress towards meeting
planned HSE targets should be reviewed at intervals not exceeding six months.

Active monitoring techniques in relation to incident causation

The goal of reducing the number and severity of incidents is achievable only by ensuring the
integrity of the defence system through active monitoring techniques. Fallible decisions,
latent failures, unsafe conditions or unsafe acts can all come about to result in an incident.
Monitoring techniques focusing on these causes can assess the effectiveness of the defence
system. The techniques should be used in a structured manner in combination with each
other in the different levels of corporate, process and task in the quality triangle.

70 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

Table 6.1 relates the common monitoring techniques most used at the three levels in the
quality triangle, ie task, process and corporate. Each technique targets the operational arena
in a different way and in quality management terms the approach of each technique can be
represented by coverage of a different part of the quality triangle.
Table 6.1 The common monitoring techniques
Task Process Corporate

Unsafe act auditing •

Management/HSE/inspections • • •

Systematic inspections • •

Failure state profiling • •

Auditing • • •

Further details of each technique, how the results should be interpreted, etc can be found in
the references in Table 6.2.

Monitoring environmental or health performance

The incidental release of a hazard such as a collision or oil spill is conspicuous. The release
of a 'chronic' or 'routine' health or environmental hazard normally involves the exceedance
of 'set' limits. It is unusual for such an exceedance to be conspicuous and therefore 'active'
measurement and comparison with 'set' limits is required if the exceedance is to be
recognised before the effects become serious or irreversible. Thus the differentiation
between 'active' and 'reactive' is less meaningful. A number of Shell guidelines are available
for health and environmental monitoring. These include:
Title Reference
Monitoring Air Quality EP 95-0376
Quantifying Atmospheric Emissions EP 95-0377
Monitoring Water Quality EP 95-0381
Monitoring Soil and Groundwater Quality EP 95-0386
Guide for Health Performance Reporting Ref. 14
Health Risk Assessment Ref. 5

Reactive monitoring
All HSE incidents should be investigated and analysed in accordance with the procedures
described in 'Incident reporting' see 6.5. Most Opcos use GUARD (Group Unified Accident
Reporting Data Base) or a variation of this computerised data handling system to manage
and analyse incident data generated within the Opco and the Group GUARD provides the
opportunity to retrieve data, prepare enhanced reports, detailed analysis and monitor the
status of follow-up actions.

EP 95-0100 Revision 0 19 October 1995 71

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Active monitoring HSE performance

Table 6.2 Active monitoring techniques: objective, approach and methodology
Techniq Objective Approach Methodology (short description)
ue
Unsafe Determination of Random observations Basic steps:
act reasons for, and auditing and open discussion  selection of area for audit
Ref. 15 conditions under of individuals' performance in  observation of people’s activities over short duration
which, unsafe the workplace  discussion with individual on approach to safe working
acts occur  listing of unsafe acts, conditions observed and
personnel categories involved
Inspectio Determination of Detailed examination of Basic steps:
ns the adherence to actual specific target area  select area(s) for inspection
HSE Plans and activities against planned  review plans and procedures for these area(s)
procedures by methods and procedures  check premises, plant and equipment
inspection of Tends to be focused at task  report and discuss discrepancies between planned
premises, plant level and actual
and equipment
Failure Determination of A diagnostic tool that Basic steps:
state the underlying appraises the categories of  customise generic database of indicators to Opco needs
profiling strength/ an organisation’s systems via  (at agreed intervals) select checklist of indicators from
(Tripo resistance of an the use of a random selection database
d/Delta) organisation to of predetermined HSE  issue checklist to onsite, offsite and contractor
EP 95- HSE incidents indicators from a generic supervisors as relevant
0320 database  plot individual scores by category and negotiate
differences
 compile profile of organisation from scores of each by
category
 compare profiles (from last test, other similar Opcos, etc)
 develop action points addressing any identified
weakness
Manage Determination of Examination by management Basic steps:
ment effectiveness of individuals or teams that  select areas of special focus
HSE systems focus on people’s activities  review briefing material (eg organogram, HSE minutes,
Inspectio Demonstration of and the system they use previous audit reports, etc)
ns line commitment Tends to be focused at  be briefed by Opco on work in area and HSE
Ref. 16 process level precautions, etc
 interview supervisor, operator, contractor, etc in area
 observe site activities, drills
 conduct round-up session, discussing good points and
deficiencies in system terms
Audit Verification of Systematic independent Basic steps:
EP 95- conformance with review by a team of an  select team members and plan audit
0130 established organisation’s systems,  review background material
guidelines/ personnel, facilities, etc using  on site, review management systems and gather audit
standards a predetermined targeted data
scope of coverage  review data and report audit findings
Tends to be focused at  recommend programme of action
process level  monitor progress by follow-up
 appraisal of performance

72 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

Most importantly this allows an Opco to compare it’s performance with other Opcos
internationally.
Targets for reactive performance are provided in the Group Annual HSE Report with
reactive indicators being used to appraise and compare such performance.
Definitions of the terms used are provided in the guides (see Refs. 14, 17 and 18).
The main principles involved in such reports are:
 Quantity of statistics: the amount of data required to be recorded by individual Opcos
for their own use will normally be more than needed for annual Group reporting.
 Coverage: statistics should cover the HSE-critical operations and all employees with
separate data compiled for contractors.
 Categorisation: reporting should be divided on a functional basis.
 Standardisation: reporting should be by use of standard forms.
 Performance indicators: Safety is reported by four indicators (Fatality Frequency,
Lost Time Injury Frequency, Total Reportable Case Frequency and Severity); Health
uses two types of indicators (exposure performance indicators and occupational illness
performance indicators).
Environmental indicators focus on:
– planned and unplanned emissions to atmosphere
– planned and unplanned aqueous effluent to surface water
– planned and unplanned disposal of waste
– contamination of soil and groundwater
– incidents (complaints, fires, spills, non-compliance)
– use of energy and natural resources.

EP 95-0100 Revision 0 19 October 1995 73

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

6.3 Records
The company should maintain a system of records in order to demonstrate the extent of compliance
with its HSE policy and its requirements, and to record the extent to which planned objectives and
performance criteria have been met.
Procedures should be maintained to ensure the integrity, accessibility and control of such records—
which should include relevant contractor and procurement records, the results of audits and reviews
(see chapters 7 and 8), training records (see 3.4 'Competence') and employee medical records.
The retention times of records should be established and recorded, and procedures should be
maintained regarding their availability and confidentiality.
Records are the evidence of the ongoing operation of the HSE MS. Care is to be taken to limit them to
the extent necessary for the specific application, but they need to be kept in order and designed to
enable assessment of compliance with policy and of the extent to which objectives are being achieved.
Relevant records compiled under other parts of the overall management system need not be
duplicated, but means of access to them is to be specified. In addition to legislative and regulatory
requirements, and of significant hazards and environmental effects, records should include:
 Reports of audits and reviews
 Situations of non-compliance with HSE policy, and of improvement actions
 Any incidents and follow-up actions
 Any complaints and follow-up actions
 Appropriate supplier and contractor information
 Inspection and maintenance reports
 Product identification and composition data
 Monitoring data
 Training records.
Records provide historic information on reported incidents and cases of non-compliance with the
HSE MS, and can thus provide useful information on long-term trends. For example, analysis of
records of medical treatments might show an increasing frequency of stomach complaints, suggesting
a possible problem in the food handling area or potable water system. Similarly, analysis of records
of oil in produced water might show a gradual increase over time, indicating a possible change in
reservoir fluids or a need for maintenance/modification of the treatment system.

74 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

6.4 Non-compliance and Corrective Action

The company should define the responsibility and authority for initiating investigation and corrective
action in the event of non-compliance with specified requirements relating to the HSE MS, its
operation or its results. Situations of non-compliance may be identified by the monitoring programme,
through communications from employees, contractors, customers, government agencies or the public,
or from investigations of incidents (see 'Incident reporting' (6.5); and 'Incident follow-up' (6.6)).
The company should maintain procedures for such investigation and corrective action, by which the
management of the individual function or activity concerned, in consultation with the management
representative, should:
 notify the relevant parties
 determine the causation sequence and likely root cause
 establish a plan of action or an improvement plan
 initiate preventive actions commensurate with the nature of the non-compliance
 apply controls to ensure that any preventive actions taken are effective
 revise procedures to incorporate actions to prevent recurrence, communicate changes to relevant
personnel and implement them.
Incidents of non-compliance with specified requirements may be sudden and temporary, or they may
persist for a long period. They may result from deficiencies or failures in the management system
itself, or in plant or equipment, or from human error.
In the investigation of non-compliance the causative mechanism(s) should be fully established and
reported, including factors within the management system. Such investigation will enable planning of
corrective action, including measures for:
 restoring compliance as quickly as practicable
 preventing recurrence
 evaluating and mitigating any adverse HSE effects
 ensuring satisfactory interaction with other components of the management system, such as
quality management
 assessing the effectiveness of the above measures.
The implementation of the corrective action will not be deemed to have been completed until the
effectiveness of all the above has been demonstrated and the appropriate changes made in the
procedures, documentation and records.
Where corrective action may involve the initiation of a project over a significant time scale, this will
form part of the management plan.

EP 95-0100 Revision 0 19 October 1995 75

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

6.5 Incident Reporting

The organisation should maintain procedures for the internal recording and reporting of incidents
which affected, or could have affected, HSE performance, so that the relevant lessons can be learned
and appropriate actions taken (see 'Incident follow-up' 6.6).
There should be a defined mechanism for the reporting of incidents to regulatory bodies, to the extent
required by law or to such greater extent as the policy of the company on external communication
may require.
It is important that staff report all incidents so that lessons can be learnt and the HSE MS improved.
This requires an open approach to communication and a 'blame-free' approach to reporting and
follow-up.
The key data which reporting systems acquire include, as appropriate:
 Details of any injuries, occupational illness or adverse environmental effects
 Details of involved and/or injured person(s)
 A description of the circumstances
 Details of the event
 Details of the outcomes
 Potential consequences
 The contribution made to the incident by any failures of the HSE MS.
Generally, reporting of incidents resulting in injury or property damage is prompt and
comprehensive. However, incidents which do not result in injury or property damage (so-called
'near-misses') are more frequent and their causes may have the potential to bring about a major
incident under slightly different circumstances. Such near-misses—and the valuable information they
encapsulate—often go unreported, either because their potential significance is not realised or
because staff are discouraged from reporting them by, for example, the fear of blame or the
complexity of the reporting system.
Thus, reporting systems need to be kept simple to encourage reporting of near-misses and
identification of higher-potential near-misses, consistent with the acquisition of key data.

Shell guides and reports

Guidance on incident investigation, analysis and reporting is provided in the following
series of Shell Guides and reports (Refs. 14, 16 to 22).
Ref. 22 describes both continuous and incidental emissions.
Figure 6.1 provides a route map to the relationship between these documents and this HSE
Manual.

76 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

Figure 6.1 Route map of Shell guidelines on incident reporting

SSHC Incident
Investigation and Analysis
Guide
(Ref. 19)

SPSECC Recommendations to
SSHC Guide for Safety SSHC Guide for Health
Functions for Reporting
Performance Reporting Performance Reporting
Environmental Performance
(Ref. 17) (Ref. 14)
Statistics (Ref. 18)

EP 89-2460
SSHC Incident SPSECC Guide to Opcos on
EP 95-0321 Guidelines for Inventory
Potential Matrix External Environmental
Tripod-BETA Monitoring and
(Ref. 20) Reporting (Ref. 21)
Reporting (Ref. 22)

The investigation and reporting sequence

Ref. 19 is the prime reference for EP activities and should be used throughout Opcos.
EP Companies within the Shell Group are obliged to report all high potential incidents and
fatalities to SIPM. The requirements for this are described in Ref. 19.
It describes the notification procedures, the preparation and conduct of the investigation and
the subsequent analysis and follow-up.

Classification of incidents for notification and investigation

For incidents where there is a need for medical or other support activities, the initial
notification from site should be by the most rapid means available. Subsequent notification
requirements are determined by classifying the incident according to its severity or potential
severity. The classification system is described in Ref. 17.

Incident classification for investigation

Every incident should be investigated, although the extent of an investigation varies and
depends on the actual and potential consequences of the incident. The classification system
used to establish the extent of the investigation required and the investigation team, is
described in Ref. 19.

Investigation, analysis and determination of underlying causes

The investigation should aim to establish clearly the sequence of events that occurred prior
to the incident. The use of incident trees is a method of ensuring that such information is
assembled correctly and to identify where information, essential to an understanding of the
underlying causes, might be missing. A detailed explanation of the incident tree
methodology is given in Ref. 19 and EP 95-0321.

EP 95-0100 Revision 0 19 October 1995 77

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

6.6 Incident Follow-up

Both the immediate circumstances of the incident, and the underlying HSE MS weaknesses which
caused it, should be identified to enable judgements to be made by those responsible for authorising
the necessary follow-up action.
The mechanism and responsibilities for follow-up of incidents should be clearly defined. The
mechanism should be broadly similar to the procedures for implementing corrective action in cases of
non-compliance with the HSE MS (see 'Non-compliance and corrective action' 6.4).
The defined responsibilities for follow-up of an incident should be appropriate to the severity of its
real or potential consequences.
All incidents, including higher-potential near-misses, require appropriate investigation in order to:
 Establish their root cause and identify actions to minimise the chance of recurrence
 Satisfy any statutory requirements for reporting and investigation
 Provide a factual record of the circumstances of the incident.
The investigation process comprises the following basic steps:
 Notification, initial assessment and incident report
 Decision on the need for further investigation, and appointment of investigation team
 The investigation itself, comprising review of the incident site and circumstances, interview of
witnesses, and analysis of operating conditions, data and other evidence
 Preparation of investigation report and agreement of remedial actions
 Issue of report and plan of action for follow-up.
The first step following the report of the initial assessment of an incident is to decide the appropriate
level of investigation. This will depend on the seriousness of the incident and its actual or potential
consequences. The significance of the actual consequences should be clear, but that of the potential
consequences may not. The potential significance of an incident can be established by asking 'what if'
questions.
The size and composition of the investigating team will depend on the particular incident. It is
important that the team members are properly trained to carry out the task objectively, impartially
and effectively. It should be noted that the investigation may be conducted in parallel to an external
investigation by the authorities.
The primary function of an investigation is to identify the likely cause(s) of an incident and identify
appropriate remedial actions. Thus the team will need to have the support and authority of company
management to obtain the necessary information, and to secure agreement for any remedial action
identified.
Progress in implementing remedial actions will need to be monitored, and will not be deemed to have
been completed until their effectiveness has been demonstrated. Where action may involve the
instigation of a project over a significant time-scale, this will be integrated into the HSE Plan.

78 EP 95-0100 Revision 0 19 October 1995

 6 Implementation and Monitoring

In Shell Opcos the responsibility for agreeing the follow-up and action parties is normally
vested in a hierarchy of HSE committees. The important feature is the clear definition of
responsibilities and terms of reference of these committees.

EP 95-0100 Revision 0 19 October 1995 79

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

This page intentionally left blank

80 EP 95-0100 Revision 0 19 October 1995

 7 Audit

7 AUDIT
('Auditing and Reviewing' in the E&P Forum HSE MS Guidelines has been split into chapters 7
and 8 in this manual)

Chapters 7 and 8 address the periodic assessment of system performance, effectiveness and inherent
suitability.

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

The company should maintain procedures for audits to be carried out, as a normal part of business
control, in order to determine:
 whether or not HSE management system elements and activities conform to planned
arrangements, and are implemented effectively
 the effective functioning of the HSE MS in fulfilling the company’s HSE policy, objectives and
performance criteria
 compliance with relevant legislative requirements
 identification of areas for improvement, leading to progressively better HSE management.
For this purpose, it should maintain an audit plan, dealing with the following:
 specific activities and areas to be audited. Audits should cover the operation of the HSE MS and
the extent of its integration into line activities, and should specifically address the following
elements of the HSE MS model:
– organisation, resources and documentation
– evaluation and risk management
– planning

EP 95-0100 Revision 0 19 October 1995 81

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

– implementation and monitoring.

 frequency of auditing specific activities/areas. Audits should be scheduled on the basis of the
contribution or potential contribution of the activity concerned to HSE performance, and the
results of previous audits
 responsibilities for auditing specific activities/areas.
Audit protocols and procedures should be established and maintained. The following points should be
covered:
 allocation of resources to the auditing process
 personnel requirements and specifically that the audit team has:
– adequate independence from activities audited to enable objective and impartial judgement
– the necessary expertise in relevant disciplines
– support, if necessary, from a wider range of specialists.
 methodologies for conducting and documenting the audits, which may involve the use of
questionnaires, checklists, interviews, measurements and direct observations, depending on the
nature of the function being audited
 procedures for reporting audit findings in a controlled manner to those responsible for the
activity/area audited, who should take timely action on reported corrective actions and
opportunities for improvement (see 'Incident follow-up' 6.6). Reporting should address:
– conformity or nonconformity of the HSE MS elements with specified requirements
– effectiveness of the implemented HSE MS in enabling objectives and performance criteria
to be met
– implementation and effectiveness of corrective actions from previous audits
– conclusions and recommendations.
 system for auditing and tracking implementation status of audit recommendations
 distribution and control of audit reports.
Audits may be internal (carried out by personnel from within the company, but independent of the
part being audited) or external (carried out using resources selected by the company). In either case
the persons conducting the audit will require training to carry out the task objectively, impartially
and effectively. The company should identify and make arrangements for independent, external
verification of audits where required.
The audit team will require broad knowledge of HSE matters and experience in auditing practices
and disciplines; specialist HSE or other technical expertise may also be necessary. Audit teams
require personnel with operational experience in the area being audited, or access to such personnel.
To ensure audit effectiveness, the company will need to ensure that audit personnel have the support
and authority to procure the necessary information.
Audits may suggest remedial measures to overcome problems, or they may simply note the nature of
the problems and require the management of the audited function to devise and implement an
appropriate solution. In either case, the recommendations should be agreed and followed-up in the
next audit cycle, to ensure that necessary improvements have been made.
The audit report will be submitted to line management of the activity/area being audited and to the
management representative for distribution and action as appropriate.
In addition to establishing an independent audit procedure, companies may find it beneficial to
encourage line management to carry out similar self-assessment procedures.

82 EP 95-0100 Revision 0 19 October 1995

 7 Audit

In EP, wide and varied use is made of audits as a means to provide independent advice and
assurance on the maintenance and improvement of a well-balanced business control
framework appropriate to the organisation. HSE audits are specifically evaluating the
elements of the HSE MS and focus on Health, Safety and Environment or any combination
thereof. Auditors selected should be independent of the process audited and should have
relevant experience. It is not the role of audit to ensure compliance with controls: nor should
periodic audit replace the responsibility of accountable managers to assess and appraise
from their own resources on a continuing basis. Cross-audit and review (sometimes called
peer review) is to be encouraged as it forms an important part of the cultural change and the
process of continuous improvement in HSE performance. Corrective actions arising should
be logged and actioned as for any other audit action.
The audits may be carried out by internal audit teams for some of which SIPM would
provide a leader. The involvement of SIPM in the Opco HSE audit schedule provides the
following benefits:
 it is a service to the Opco, offered to assist Opco management in ensuring that their
verification process is adequate and stands up to independent scrutiny
 it serves the transfer of know-how, between Opcos, between Opco and SIPM and,
through registration of the audit report as an SIPM document, provides feedback
(learning) to SIPM as input to the development of Group standards
 it assists in the consistent implementation of the HSE policy and principles as well as
in implementation of the HSE MS structure
 in new ventures, it strengthens the Opco’s position vis-à-vis (international) contractors
in enhancing safety of the operation
 it provides a training opportunity for staff
 it represents one of the means for SIPM to discharge its responsibilities as Technical
Adviser.
Additionally, it endeavours to contribute to the enhancement of safety, health and the
environmental management in the Opco.
It should be noted that SIPM’s involvement in Opco auditing is provided under the terms of
the applicable Service Agreement and at the Opco’s request. The SIPM-led audit should be
considered an integral part of the internal Opco auditing programme, which is approved by
the Chief Executive.

EP 95-0100 Revision 0 19 October 1995 83

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Audit Plan
Opcos should have a rolling (eg five year) audit plan of which the HSE audits form an
integral part. This plan should provide full coverage of all facilities and activities on a fixed
timescale, which is appropriate to the facility/activity and the criticality of the operation.
The first year plan should be detailed and, as far as feasible, 'frozen' before the end of the
previous year. Any SIPM-led HSE audit should by then have been agreed, in order to enable
timely resourcing.
SIPM audit reports, audit reporting and follow-up
The current practice in SIPM-led HSE auditing includes for the report to be drafted in the
Opco with wording and contents agreed by all audit team members and Opco management
endorsement of the wording of the main findings. This final draft is taken to SIPM (copies
are left with the Opco for follow-up initiation) where final editing is completed and the
report formally issued as a confidential Group EP report.
The Opco is responsible for the follow-up of the recommendations made, HSE audits should
be subjected to the same follow-up procedure as the other audits and reviews. For SIPM-led
HSE audits SIPM wishes to monitor the progress made in implementing the
recommendations. The purpose is to assure that the areas of concern identified during the
audit are adequately understood and considered and that in case of variations and rejections
of recommendations, proper attention has been paid to the elimination of the concerns.
Contractor auditing
In EP operations, contractors play a key role in executing work that is not considered part of
core activities. As a consequence, contractor working practices will require verification, if
the overall HSE norms are to be maintained.
In this respect, SIPM’s attention is particularly focused on the large international
contractors, for two main reasons:
 Group HSE experience with the contractors needs to be disseminated in a manner
similar to all other technical experience
 in new ventures, the less mature Opco requires the Group support and influence to
ensure that Group HSE norms are adhered to by the contractors.
Opcos need to focus their attention on their large, local contractors as well as on the smaller
(international) body-shop type contractors. Because of the high level of involvement of
contractors in EP operations, Opcos should encourage contractors to participate as team
members in auditing of contractor operations.
Further information and references
Reference is made to EP 93-1600 (Ref. 23) which states SIPM-EP’s recommendations with
respect to internal auditing in EP Opcos including audits carried out by SIEP. The various
types of audits and reviews are discussed together with the Group’s policy on internal
auditing and the SIPM-EP recommendations regarding the audit and review process.
The guideline addresses the planning of an audit programme in an Opco and provides
general guidance on the implementation of the programme.
More detailed guidance on the conduct of HSE audits is included in EP 95-0130.

84 EP 95-0100 Revision 0 19 October 1995

 8 Review

8 REVIEW
('Auditing and Reviewing' in the E&P Forum HSE MS Guidelines has been split into chapters 7
and 8 in this manual)

Leadership and Commitment

Policy and Strategic Objectives

Organisation, Responsibilities
Resources, Standards and Doc.

Hazards and Effects

Management
Corrective
Planning and Procedures Action

Implementation Monitoring

Audit Corrective Action and

Improvement

Corrective Action and

Management Review
Improvement

The company’s senior management should, at appropriate intervals, review the HSE MS and its
performance, to ensure its continuing suitability and effectiveness. The review should specifically, but
not exclusively, address:
 the possible need for changes to the policy and objectives, in the light of changing
circumstances and the commitment to strive for continual improvement
 resource allocation for HSE MS implementation and maintenance
 sites and/or situations on the basis of evaluated hazards and risks, and emergency planning.
The review process should be documented, and its results recorded, to facilitate implementation of
consequent changes.
Reviews should be used to reinforce continuous efforts to improve HSE performance.
The scope of reviews includes the company and its activities, products and services with a focus on
HSE MS and HSE-critical activities. Thus, for example, a review of the HSE MS elements for
designing a new facility would examine the extent to which the HSE objectives for the project
required revision, judge whether or not resource allocation to the project was satisfactory in relation
to HSE matters, and determine the extent to which any audit recommendations had been successfully
implemented.

EP 95-0100 Revision 0 19 October 1995 85

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Reviews are to be carried out by appropriate members of, or competent independent personnel
appointed by, the company’s senior management. Issues to be addressed as part of the process will
typically include:
 any recommendations which have been made in audit reports, and whether or not these have
been implemented
 the continuing suitability of HSE policy, and possible revision to address, for example:
– Emerging/growing HSE concerns in specific areas
– Developing understanding of HSE issues
– Potential regulatory developments
– Concerns of employees, contractors, customers, government agencies and the public
– Market pressures
– Changing company activities and locations
– Changes in the sensitivity of the environment.
 the continuing suitability of, and possible revisions to, HSE objectives, and consequent
amendments to the HSE Plan and other HSE MS elements and documentation.
Reports of reviews need to make clear why they were conducted (eg routine procedure, organisational
changes, developments in understanding of HSE issues, changes in environmental sensitivity,
regulatory developments, reported deficiencies in HSE MS).
Reviews should be used to reinforce the continuous efforts to improve HSE performance.

Senior management should at appropriate intervals review the effectiveness and suitability
of the HSE Management System. Reviews should be structured to appraise each of the
seven elements of the Model Management System and where appropriate assistance should
be sought from the technical advisers in SIEP. Recommendations from reviews of
performance against HSE Plans, audits, operations reviews and management facility
inspections are useful input into the HSE MS. Results from the appraisal process should
form part of the annual pre-programme or programme discussion cycle.
HSE Cases should be reviewed periodically, and no less than every three years. Review of
the effectiveness of the HSE Case should also take place after changes to the organisational
structure, an unsatisfactory HSE audit, major modifications to the facility or subsequent to
an incident on the facility where consequences may have been or were significant.
At department level annual HSE Plans should be monitored on a regular basis and form part
of a continuous appraisal process. Performance against the department HSE Plan should be
reviewed on a monthly basis.

86 EP 95-0100 Revision 0 19 October 1995

 Appendix I Group Policy Guidelines on Health, Safety and the Environment

APPENDIX I
GROUP POLICY GUIDELINES ON HEALTH, SAFETY AND
THE ENVIRONMENT
It is the policy of Shell companies to conduct their activities in such a way as to take foremost account
of the health and safety of their employees and of other persons, and to give proper regard to the
conservation of the environment. They aim to be among the leaders in their respective industries in
these matters.
From the starting point of full compliance with legislative requirements, Shell companies pursue this
policy through company strategies and action plans, through visible management commitment and
through the individual contributions of their employees, supported by education and training.

Health
 Shell companies seek to conduct their activities in such a way as to avoid harm to the health of
their employees and others, and to promote, as appropriate, the health of their employees.

Safety
 Shell companies work on the principle that all injuries should be prevented and actively promote
amongst all those associated with their activities the high standards of safety consciousness and
discipline that this principle demands.

Environment
Shell companies:
 pursue in their operations progressive reductions of emissions, effluents and discharges of waste
materials that are known to have a negative impact on the environment, with the ultimate aim of
eliminating them
 aim to provide products and services supported with practical advice which, when used in
accordance with this advice, will not cause injury or undue effects on the environment
 promote protection of environments which may be affected by the development of their
activities and seek continuous improvement in efficiency of use of natural resources and energy.

Common HSE aspects

Shell companies:
 assess health, safety and environmental matters before entering into new activities and reassess
them in case of significant change in circumstances
 require contractors working on their behalf to apply health, safety and environmental standards
fully compatible with their own
 recognise the concerns of shareholders, employees and society on health, safety and
environmental matters, provide them with relevant information and discuss with them related
company policies and practices
 develop and maintain contingency procedures, in co-operation with authorities and emergency
services, in order to minimise harm from any accidents
 work with governments and others in the development of improved regulations and industry
standards which relate to health, safety and environmental matters

EP 95-0100 Revision 0 19 October 1995 87

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

 conduct or support research towards the improvement of health, safety and environmental
aspects of their products, processes and operations
 facilitate the transfer to others, freely or on a commercial basis, of know-how developed by
Shell companies in these fields.

The Steering Committee for Safety and Environmental Conservation

Endorsed by the Committee of Managing Directors, June 1991

88 EP 95-0100 Revision 0 19 October 1995

 Glossary

GLOSSARY
For the purposes of these HSE MS Guidelines, the following definitions apply.
acceptance criteria Expresses the level of health, safety and/or environmental
performance deemed acceptable for a given period or phase of
activities. They may be defined both in quantitative and
qualitative terms.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
accident See 'incident'.
activity Work to be carried out as part of a process characterised by a
set of specific inputs and tasks that produce a set of outputs to
meet customer requirements.
Source: EP 92-0945 Service Business Process Guidelines (Ref.
25)
activity specification sheet The documentation of activity that outlines the hazard
management objectives when undertaking the activity, the
methods used to achieve the objectives, the business controls
used to ensure achievement of the objectives and the person
accountable for achievement of the objectives.
acute effect Effects which occur suddenly and in a short time following
exposure.
As Low As Reasonably To reduce a risk to a level which is as low as reasonably
Practicable practicable involves balancing reduction in risk against the
(ALARP) time, trouble, difficulty and cost of achieving it. This level
represents the point, objectively assessed, at which the time,
trouble, difficulty and cost of further reduction measures
become unreasonably disproportionate to the additional risk
reduction obtained.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
assessment (or evaluation) The process of analysing and evaluating hazards. It involves
both causal and consequence analysis and requires
determination of likelihood and risk.
barrier A measure put in place to prevent the release of a hazard, or to
provide protection once a hazard or effect is released. Barriers
may be physical (shields, isolation, separation, protective
devices) or non-physical (procedures, warnings, training, drills).
‘bow-tie’ diagram A pictorial representation of how a hazard can be hypothetically
released and further developed into a number of consequences.
The left hand side of the diagram is constructed from the fault
tree (causal) analysis and involve those threats associated with
the hazard, the controls associated with each threat and any
factors that escalate likelihood. The right hand side of the
diagram is constructed from the hazard event tree
(consequence) analysis and involves escalation factors and
recovery preparedness measures. The centre of the bow tie is
commonly referred to as the ‘top event’.

EP 95-0100 Revision 0 19 October 1995 89

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

causal analysis The process of determining potential combinations of

circumstances leading to a top event.
chronic release The continuous or ongoing release of a hazard or effect
normally in the form of a discharge, emission or exposure.
company An organisation engaged, as principal or contractor, directly or
indirectly, in the exploration for and production of oil and/or
gas. For bodies or establishments with more than one site, a
single site may be defined as a company.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
cost benefit analysis The means used to assess the relative cost and benefit of a
number of risk reduction alternatives. The ranking of the risk
reduction alternatives evaluated is usually shown graphically.
critical activities Activities that have been identified by the Hazards and Effects
Management Process as vital to ensure asset integrity, prevent
incidents, and/or mitigate adverse HSE effects.
defences All controls, barriers and recovery preparedness measures, in
place to manage a hazard.
environment The surroundings and conditions in which a company operates
or which it may affect, including living systems (human and
other) therein.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
environmental effect A direct or indirect impingement of the activities, products and
services of the company upon the environment, whether adverse
or beneficial.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
environmental effects A documented evaluation of the environmental significance of
evaluation the effects of the company's activities, products and services
(existing and planned).
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
escalation An increase in the consequences of a hazardous event.
escalation control Measures put in place to block or mitigate the effects of
escalation factors. Types include guards or shields (coatings,
inhibitors, shutdowns), separation (time and space), reduction in
inventory, control of energy release (lower speeds, safety
valves, different fuel source) and non-physical or administrative
(procedures, warnings, training, drills).
escalation factor Conditions that lead to increased risk due to loss of controls or
loss of recovery capabilities (mitigation or life saving).
Escalation factors include: abnormal operating conditions, eg
maintenance mode, operating outside design envelope;
environmental variations, eg extreme weather and tidal

90 EP 95-0100 Revision 0 19 October 1995

 Glossary

conditions; failure of barriers, eg maintenance failure, due to

explosion or fire, introduction of ignition source; human error,
eg lapses, rule violations; no barrier provided, eg not possible or
too expensive. Escalation Factors may concurrently affect the
control and/or recovery of more than one hazard.
evaluation see 'assessment'
event An occurrence or situation represented as a node in event and
fault trees (eg gas leak, status of gas detection system, status of
ESD system).
event tree A tree-like diagram consisting of nodes and connecting lines
used to formulate potential escalation scenarios. The nodes
correspond to the different stages in an escalating incident
sequence, and the two lines which lead out of the nodes
correspond to the paths of success or failure in mitigation of the
incident. Event tree analysis evaluates the potential outcomes
following a hypothetical top event. With event trees one looks
'forward' in time to determine what could occur, eg
consequence of an event.
fault tree A tree-like diagram showing how hardware faults and human
errors combine using 'and/or' logic to cause system failures.
When quantified, fault trees allow system failure probability to
be calculated. With fault trees one looks 'backwards' in time to
determine what has to happen for an event to occur.
hazard The potential to cause harm, including ill health and injury,
damage to property, products or the environment; production
losses or increased liabilities.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24) and Successful Health and Safety
Management UK Health and Safety Executive HMSO
Publication (Ref. 26)
hazard analysis The systematic process of developing an understanding of
hazards. The process consists of hazard identification,
assessment and risk determination.
hazard assessment The process whereby the results of an analysis of a hazard are
considered against either judgement, standards, or criteria
which have been developed as a basis for decision making.
Source: ISO/CD 14.690 HSE MS (Ref. 27)
hazardous event The 'release' of a hazard. The undesired event at the end of the
fault tree and at the beginning of an event tree. The centre point
in a Hazard 'Bow-Tie'.

Where one hazardous event is followed by others, then the 'Top

Event' is the first hazardous event. (see Top Event)

Hazardous events include: Loss of Containment, Structural

Failure, Dropped Objects, Exceeding Occupational Exposure
Limit, Loss of Control, Falls to Same Level, Falls to Lower
Level, Oxygen Deficiency, Loss of Separation, Electrical
Shock, and Explosion.

EP 95-0100 Revision 0 19 October 1995 91

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

Hazards and Effects The structured hazard analysis methodology involving hazard
Management Process (HEMP) Identification, Assessment, Control and Recovery and
comparison with screening and performance criteria. To
manage a hazard completely requires that all four steps must be
in place and recorded.
Hazards and Effects Register A hazard management communication document that
demonstrates that hazards have been identified, assessed, are
being properly controlled and that recovery preparedness
measures are in place in the event control is ever lost.
Health, Safety and The company structure, responsibilities, practices, procedures,
Environmental Management processes and resources for implementing health, safety and
System (HSE MS) environmental management.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
Health, Safety and The broad goals, arising from the HSE policy, that a company
Environmental (HSE) strategic sets itself to achieve, and which should be quantified wherever
objectives practicable.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
In Shell terminology this means objectives. Goals which the
organisation wishes to achieve over the long-term provides a
basis for judging progress and achievements. Strategies provide
the framework for plans to achieve the objectives used as a
screen for possible plans.
Health, Safety and A public statement of the intentions and principles of action of
Environmental (HSE) Policy the company regarding its health, safety and environmental
effects, giving rise to its strategic and detailed objectives.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
incident An event or chain of events which has caused or could have
caused injury, illness and/or damage (loss) to assets, the
environment or third parties. (The word 'accident' is used to
denote an incident, which has caused injury, illness and/or
damage, but the term also has connotations of 'bad luck' in
common speech and is therefore avoided by others. In this
manual, only the
term 'incident' has been used - in the above sense which
embraces the concept of 'accident').
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24), and SHSEC publication 'Incident
Investigation and Analysis'
(Ref. 26)
An incident involves the release or near release of a hazard.
initiating factor See 'threat'.
likelihood analysis The process of estimating the likelihood of an event. Also
referred to as probability analysis.
mitigation Measures taken to reduce the consequences of a potential

92 EP 95-0100 Revision 0 19 October 1995

 Glossary

hazardous event. Mitigation measures include:

 'active' systems intended to detect and abate incidents

(gas, fire, and smoke alarms, shutdowns, deluge)

 'passive' systems intended to guarantee the primary

functions (fire and blast walls, protective coatings, drain
systems) and

 'operational' systems intended for emergency management

(contingency plans, training, drills).

Manual of Permitted Defines the limit of safe operation permitted for a particular
Operations (MOPO) asset if control and/or mitigation measures are reduced and/or
removed with the objective of maintaining a tolerable level of
risk. Considers combinations of hazards and hazardous events.
performance criteria Performance criteria describe the measurable standards set by
company management to which an activity or system element is
to perform. (Some companies may refer to performance criteria
as goals or targets.)
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
performance indicator Comparative, quantitative measures of actual events, against
previously specified targets, which provide a qualitative
indication of future projected performance based on current
achievement.
physical effects modelling The estimation of the magnitude of a potential 'top event' using
mathematical models and correlations. The models and
correlations are typically design tools, such as: dispersion, fire-
heat flux and temperature versus time, explosion overpressures
and structural response.
prevention Completely eliminating a threat, escalation factor or a hazard.
procedure A documented series of steps to be carried out in a logical order
for a defined operation or in a given situation.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
process A logical sequence of inter-related activities.
Source: EP 92-0945 Business Process Management Guidelines
(Ref. 25)
Quantitative Risk Assessment Quantitative evaluation of the risk imposed by a system design,
(QRA) whether those risks are from human, hardware or software
failures, or environmental events, or from combinations of such
failures/events.
recovery preparedness All technical, operational and organisational measures that limit
measures(sometimes 'recovery the chain of consequences arising from the first hazardous event
measures') (or 'top event'). These can 1) reduce the likelihood that the first
hazardous event or 'top event' will develop into further
consequences and 2) provide life saving capabilities should the

EP 95-0100 Revision 0 19 October 1995 93

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

'top event' develop further.

risk A term which combines the chance that a specified undesired
event will occur and the severity of the consequences of the
event.
Source: HSE MS ISO/CD 14 690 (Ref. 27)
risk classification A rating used to derive an appreciation of the relative risk from
a hazard. The Risk Matrix may be used to assist to determine
this rating. Both the relative probability and the potential
consequence are categorised by 5 point scales. The product of
the two is the risk classification.
risk matrix The matrix portraying risk as the product of probability and
consequence, used as the basis for qualitative risk
determination. Considerations for the assessment of probability
are shown on the horizontal axis. Considerations for the
assessment of consequence are shown on the vertical axis. Four
consequence categories are included: impact on people, assets,
environment and reputation. Plotting the intersection of the two
considerations on the matrix provides an estimate of the risk.
routine release See 'chronic release'.
safe A condition in which all hazards inherent in an operation have
either been eliminated or are controlled such that their
associated risks are both below a tolerable threshold and are
reduced to a level which is as low as reasonably practicable.
Safety (HSE) Case A demonstration of how the Company HSE objectives are being
met in a methodical and auditable reference document. A
completed Case will provide a reference document to all
information relevant to the safety and health of the operations
personnel, environment and resources on an installation.
screening criteria The values or standards against which the significance of the
identified hazard or effect can be judged. They should be based
on sound scientific and technical information and may be
developed by the company and industry bodies, or provided by
the regulators.
Source: E&P Forum Guidelines for the Development and
Application of Health, Safety and Environmental Management
Systems 1994 (Ref. 24)
shortfall An area for improvement.
statement of fitness An affirmation by the asset holder that (HSE) conditions are
satisfactory to continue operation.
task A set pattern of operations which alone, or together with other
tasks, may be used to achieve a goal.
threat A possible cause that will potentially release a hazard and
produce an incident. Threat classes include damage caused by:
thermal (high temperature), chemical (corrosion), biological
(bacteria), radiation (ultraviolet), kinetic (fatigue), electrical
(high voltage), climatic condition (poor visibility), uncertainty
(unknowns) or human factors (competence).
threat barrier All measures taken to reduce the probability of release of a
hazard. Measures put in place to block the effect of a threat.

94 EP 95-0100 Revision 0 19 October 1995

 Glossary

Types include guards or shields (coatings, inhibitors,

shutdowns), separation (time and space), reduction in inventory,
control of energy release (lower speeds, safety valves, different
fuel source) and administrative (procedures, warnings, training,
drills).
tolerability criteria Expresses the level of risk deemed tolerable for a given period
or phase of activities. May be expressed qualitatively or
represented quantitatively on the Risk Matrix by shaded areas.
top event The 'release' of a hazard. The undesired event at the end of the
fault tree and at the beginning of an event tree. The centre point
in a 'Bow-Tie' Diagram.
worst case consequence The worst possible HSE consequence in terms of harm resulting
from a hazardous event. For this to occur, all critical defences in
place must have failed.

EP 95-0100 Revision 0 19 October 1995 95

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

REFERENCES
1 PL88 R03, Country Business Planning - Group Planning Publication, SIPC.
2 Drugs and Alcohol Abuse Employment Guidelines, SIPC, December 1993.
3 AIDS - Employment Guidelines SIPC, December 1993.
4 HSE Division Digest No 55, Smoking and Passive Smoking at Work, SIPC, March 1995.
5 Health Risk Assessment, SHSEC, September 1994.
6 Chemical Hazards: Health Risk Assessment and Exposure Evaluation, SSHC, 1995.
7 Personal Protective Equipment Guide, SSHC, 1989.
8 DEP 80.00.10.10, Hazardous Area Classification, SIPM, 1995 (in preparation).
9 EP 93-2015, Operations Reference Plan for Assets, SIPM, 1993.
10 EP 90-400, The Project Management Guide, SIPM, 1990 (under revision).
11 Medical Emergency Guidelines for Management, SHSEC, 1994.
12 HSE 94023, Medical Emergency Guidelines for Health Care Professionals and First Aiders,
January 1995.
13 HSE 94023a, Guidance to First Aiders, January 1995.
14 Guide for Health Performance Reporting, SSHC, November 1993.
15 Unsafe Act Auditing, SSC, 1987.
16 Safety and Environment Management Inspection, SIPM, November 1994.
17 Guide for Safety Performance Reporting, SSHC, December 1992.
18 Recommendations to Functions for Reporting Environmental Performance Statistics,
SPSECC, August 1992.
19 Incident Investigation and Analysis Guide, SSHC, August 1993.
20 Incident Potential Matrix, SSHC, October 1991.
21 Guide for Operating Companies on External Environmental Reporting, SPSEC, 1992.
22 EP 89-2460, Guidelines for Inventory Monitoring and Reporting, SIPM, 1989.
23 EP 93-1600, EP Guideline on Audits and Reviews, SIPM, 1993.
24 Report No. 6.36/210, Guidelines for the Development and Application of Health, Safety
and Environmental Management System, E&P Forum, July 1994.
25 EP 92-0945, Service Business Process Guidelines, SIPM, 1992.
26 HS(G)65, Successful Health and Safety Management, Health and Safety Executive,
HMSO, 1991.
27 ISO/CD 14 690, Health, Safety and Environmental Management Systems, ISO.

96 EP 95-0100 Revision 0 19 October 1995

 References

This page intentionally left blank

EP 95-0100 Revision 0 19 October 1995 97

HSE Manual EP 95-0100 Health, Safety and Environmental Management Systems

INDEX Government agencies, 23, 28, 87, 99

GUARD, 83
A
H
Accountability, 1, 17, 35
Hazard assessment, 45, 66
Active monitoring, 82, 84
Hazards register, 62
ALARP, 33, 44, 50, 54
Health surveillance, 48, 81
Alcohol and drugs, 60
HSE Adviser, 24
Asset integrity, 59, 67
HSE Case, 16, 29, 31, 33, 37, 42, 55, 73, 99
Asset management, 17
HSE Committee, 24, 92
Authority, 14, 15, 17, 72, 87, 91
HSE department, 16
Awareness, 6, 23, 29, 44, 76
HSE Plans, 3, 24, 64, 81, 84, 99
B HSE rules, 27
Belief, 1 HSE-critical activities, 19, 35, 56, 71, 81, 98
Biological agents, 47, 48
I
C Incident classification, 89
Change control, 67, 73 Incident investigation, 3, 27, 88
Chemicals, 48, 62, 73 Incident Potential Matrix, 51
Chronic incidents, 59 Inspection, 16, 27, 67, 83, 86, 99
Cognisance, 9
J
Commitment, 1, 2, 6, 8, 18, 37, 56, 59, 79, 84, 100
Job description, 19
Competence assurance, 19

Corrective action, 37, 78, 81, 87, 91, 95, 96 L

Culture, 27, 64 Language, 23, 27, 44, 69
Custodian, 12, 31, 71, 73 Latent failures, 82
Customers, 6, 8, 23, 87, 99 Legislation, 11, 20, 23, 31, 33, 49, 51, 62, 64, 72

Life cycle, 12, 44

D
Line management, 9, 11, 17, 27, 38, 96
Discharges, 6, 9, 49, 59, 81, 100

E M
Management HSE inspections, 84
Education, 6, 100
Meetings, 24
Emergency response, 23, 59, 63, 67, 74, 75
Mitigation measures, 23, 59
Emergency situations, 18, 28, 43, 60, 75
Motivation, 26, 27
Engineering standards, 51

Environmental quality standards, 51 N

EP Business Model (EPBM), 15, 35, 71 Near-miss, 81, 88, 91
Ergonomic factors, 46, 47, 48 Non-compliance, 81, 86, 87

G O

98 EP 95-0100 Revision 0 19 October 1995

 Index

Occupational exposure, 44, 51, 56 Structured review techniques, 16, 46

Operations Reference Plan, 68 Support services, 14

P T
Participation, 1, 6, 14, 24, 31, 43, 56 Targets, 7, 24, 65, 81, 82, 85

Performance indicators, 26, 42, 58, 82, 85 Technical integrity, 69

Permit-to-Work, 21, 62, 69 Tolerability, 42

Physical agents, 48 Tripod, 84

Preventive actions, 87
U
Probability, 8, Error! Not a valid bookmark in index entry on
page 53, 59 Unsafe act auditing, 82, 84

Q W
QRA, 18, 50, 52 Waste, 6, 9, 47, 62, 65, 81, 85, 100

Qualification, 19, 67 Work instructions, 28, 55, 60, 69, 79, 81

Quality assurance, 60, 67 Workplace, 6, 8, 20, 42, 46, 66, 82

Quality control, 81

Quality management, 35, 79, 83, 87

R
Reactive monitoring, 81, 82

Recognition, 9, 26

Records, 20, 21, 50, 55, 81, 86, 87

Recruitment, 19

Regulations, 11, 20, 23, 27, 31, 56, 64, 101

Regulatory requirements, 6, 18, 28, 55, 64, 72, 86

Reporting relationship, 15

Reputation, 49

Risk tolerability, 8, 52

Risk/benefit analysis, 52

S
Screening criteria, 36, 40, 42, 47, Error! Not a valid bookmark
in index entry on page 52, 59

Severity, 36, 47, Error! Not a valid bookmark in index entry on

page 51, 59, 82, 85, 89

Shareholders, 8, 11, 101

Skills, 19

Stakeholders, 11

Steering group, 24

Strategies, 8, 43, 65

EP 95-0100 Revision 0 19 October 1995 99