SECE Management and Verification - Version 2 March 2020

The Offshore SECE Management and Verification Inspection Guide Open Government Status: Fully Open

Publication Date: 01/03/2020

Review Date: 01/03/2023

Review History Date Changes March 2020 Revised for the 2015 Offshore Safety Case Regulations.

Target Audience: OSDR Inspectors Contents ➢ Introduction ➢ Context ➢ Purpose ➢ Harmonisation with Other Inspection Guides ➢ Targeting SM&V Topic Discipline Resource in a Proportionate Manner ➢ SECE Management & Verification Inspections ➢ Meeting the Verifier ➢ Judging Success and Moving On - Performance Ratings for SM&V Topics ➢ Enforcement Expectations ➢ Review and Evaluation of the Inspection Guide ➢ Health and Safety ➢ Appendices Appendix 1 - SECE Management Key Topics for Inspection Topic 1: Organisational Arrangements and Competent Advice Topic 2: SECE Identification and Initial Suitability Topic 3: Performance Standards and Alignment Topic 4: SECE Performance Monitoring and SECE Management Review Appendix 2 - Verification Key Topics for Inspection

Topic 5: The Verification Scheme and Implementation Topic 6: Verification Effectiveness and Review Topic 7: Management of Change to the Scheme Topic 8: Verification, Well Examination and Classification Appendix 3 - Application of EMM and Duty Holder Performance Assessment Appendix 4 - References and Supporting Information

When carrying out inspections covered by this inspection guide (IG) inspectors should: • Assess duty holder responses against the success criteria in Appendices 1 and 2. • Use the performance descriptors in Appendix 3 to determine: o The appropriate performance rating; and o The initial enforcement expectation; and o Consider how and when the issues raised during an inspection are to be closed out.

Introduction 1. This IG supports the Competent Authority’s (CA) programme of regulating major hazards, by establishing a clear framework to inspect safety and environmental critical element (SECE) Management and Verification (SM&V) for offshore installations. It builds on the regulatory requirements set out in the 2015 Offshore Safety Case Regulations, industry guidance and good practice observed through planned interventions.

2. The IG will assist all inspection management team (IMT) inspectors when they inspect SM&V aspects of key safety management and risk control systems and provide them with clear guidelines to help decide when topic discipline SECE management and verification support may be required. In addition, it aims to target SECE management and verification specialist resource where it is needed most, by identifying priority topics for inspection by SM&V topic discipline inspectors.

3. The IG also enables IMT and SM&V topic discipline inspectors to rate the performance of offshore installation duty holders against success criteria for a number of key SM&V inspection topics.

4. Although this IG is aimed primarily at IMT and SM&V topic discipline inspectors, it will help offshore installation duty holders prepare for SM&V inspections and understand the rationale behind SM&V inspections.

Context

5. On 20 April 2010, a blowout of BP’s Macondo well in the Gulf of Mexico led to the deaths of 11 workers on Transocean’s Deepwater Horizon drilling rig, and the release of an estimated 4.9 million barrels of oil. Following this incident, a UK based inquiry led by the Energy and Climate Change Committee was conducted. It sought evidence as to how such an event could not be realised in the UKCS, in particular for deep water activities conducted on the UKCS.

6. Within this inquiry, the then Chief Executive, Oil & Gas UK and the Head of Health and Safety Executive’s Offshore Division gave evidence. Both cited independent verification of well design, well equipment and safety critical elements as one of the differences between UK and US regulatory requirements. Independent verification was also given as a reason that would reduce the likelihood of such an event being realised on the UKCS.

7. In a memorandum to the inquiry, submitted by the Department of Energy and Climate Change, Health and Safety Executive, and Maritime and Coastguard Agency, it was said; ‘The UK offshore regulatory framework, developed after the Piper Alpha disaster in 1988, implements the relevant European Directive 92/91/EEC on the minimum requirements for improving the safety and health of workers in the mineral-extracting industries through drilling’. In response to the question what are the implications of the Gulf of Mexico oil spill for deep water drilling in the UK? the memorandum said that UK regulations also contain a range of additional safeguards to mitigate the health and safety risks associated with offshore drilling. These measures also reduce the risk of an oil pollution incident occurring and included an independent competent person must verify the suitability and state of good repair of safety critical equipment such as blowout preventers (BOPs) on mobile drilling rigs.

Purpose

8. The primary purpose of the IG is to support IMT and all topic discipline inspectors when they plan, undertake and rate SM&V inspections for offshore installations (by sampling key SM&V elements of a duty holders’ systems and arrangements to manage major accident hazards (MAHs)). It will also help IMT inspectors target SM&V specialist resource in a proportionate and effective manner.

9. The IG is not intended to be a detailed inspection tool. Rather, it aims to highlight key milestones for SM&V integration and signpost supporting guidance, such as the Offshore Safety Case Regulations, industry guidance or good practice.

10. Another aim of the IG is to bring transparency to the Competent Authority’s programme of SM&V inspection work. It will help duty holders understand why certain SM&V topics are selected for inspection and how their performance is judged and rated.

11. The Competent Authority believes that SM&V inspection work is central to ensuring that major hazard risks are properly managed. This IG provides a structured framework for IMT and topic discipline Inspectors to verify that offshore installation duty holders have selected appropriate risk reduction measures, and that those measures are being implemented effectively.

Harmonisation with other Inspection Guides

12. It is not intended that this guide be used in place of other guides such as Maintenance Management or Operational Risk Assessment. These guides provide a detailed lead on how

those topics are to be inspected. The SM&V guide is intended to complement all other guides and describe how all systems employed by a duty holder should come together and provide a demonstration of the ongoing suitability of an installations SECEs.

Targeting SM&V Topic Discipline Resource in a Proportionate Manner

13. It is anticipated that IMT Inspectors will carry out and rate certain topic-based inspections without SM&V discipline support. These visits will typically involve the inspection of key safety management and risk control systems. This IG will help IMT Inspectors identify follow-up work where SM&V discipline support may be required. Further guidance is provided in Appendices 1 and 2.

14. IMT Inspectors are encouraged to contact the SM&V team for guidance if they are in any doubt about allocating SM&V resource, or if they require support to plan visits and/or discuss key inspection findings.

SECE Management and Verification Inspections

15. In order to make best use of this guide, and to maximise the effectiveness of the inspection, it is anticipated that there will be three elements to a SM&V inspection. A planning phase, an onshore phase and finally an offshore phase.

16. The inspection planning phase should be conducted one month in advance of the inspection. This is to allow time to read any documentation and consider these documents in line with the requirements of the regulations, ACOPs and associated guidance. Initially the following documents should be requested for the inspection.

• Current safety case (if not already on the Competent Authority Portal) • Current verification scheme • Performance standards (may just be limited to the standards required for any MAH scenario being inspected) • Previous two years of annual status reports provided by the verifier • Previous two years of routine verification reports from the verifier • Letters of concern, letters of reservation, open remedial action recommendations / findings

17. The onshore inspection phase will be conducted at the duty holders’ offices to inspect the arrangements in place. This will also include a meeting with the verifier, ideally at the verifiers’

offices without the duty holder in attendance. This time is used to inspect the arrangements described in the verification scheme, or to drill into issues or omissions that were identified in the planning stage. An inspection of the verification outputs is also to be conducted at this point. Are the requirements of the scheme completed as planned? How are activities recovered if not completed? Are the reports completed by the verifier of sufficient quality and how are findings/remedial actions recommended (RARs) managed?

18. Finally, the offshore inspection is to inspect the knowledge of the management offshore on the scheme and its function. Are those with noted responsibilities in the scheme aware of their responsibilities and what information, instruction or training has been provided to allow them to carry out their functions under that scheme.

Meeting the verifier

19. When using this guide to inspect the arrangements in place for verification, a meeting with the verifier should be conducted too. This meeting is to be undertaken at the verifier offices without the duty holder in attendance. This is an opportunity to ask the verifier how their input and findings are received. Also, who do they report to? What are the systems like for dealing with findings/recommendations? Are they dealt with in a timely manner? How are they tracked? How are comments and responses managed? How often do they communicate? How often do they meet?

20. The meeting should be used to test how the verifier is notified of changes or significant repairs to a SECE, and how they gain access to the required information to comment on the changes or repairs.

21. Information from the verifier and their reports can provide information to take into the inspection. Meeting the verifier also offers an opportunity to discuss information provided in the written reports, the scheme, the contract or the management arrangements that meeting with the duty holder alone may not otherwise allow.

22. Finally, the verifier should be invited to the inspection close out meeting with the duty holder. This is to allow both parties to hear the issues raised, as well as any good practice that has been identified.

Judging Success and Moving On - Performance Ratings for SM&V Topics

23. Success criteria for key SM&V inspection topics are defined in Appendices 1 and 2. By comparing key findings from the inspection with the relevant success criteria in Appendices 1 and 2, duty holder performance should be rated in line with the descriptions/scores in Appendix 3.

24. IMT inspectors should consider a follow-up inspection with an SM&V discipline inspector whenever they assign a rating score of 40, 50 or 60 to the topic, or if they identify significant shortcomings in a specific key area such as maintenance management or operational risk assessment (ORA).

25. The duty holder performance ratings should be entered on the Inspection Rating (IRF) Tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the post inspection report and letter.

Enforcement Expectations

26. Inspectors should use the Enforcement Management Model, including assessment of factors that are specific to the duty holder, to inform their regulatory decisions. Indicative enforcement expectations are included in Appendix 3.

27. If in doubt, IMT inspectors should approach the SM&V team for guidance on SM&V enforcement matters.

Review and Evaluation of the Inspection Guide

28. The Competent Authority will periodically review and evaluate outcomes of this guide and communicate key lessons learned to relevant parties and stakeholders.

Health and Safety

29. No specific health and safety issues relevant to this topic that needs to be considered when conducting the inspection. However, where there is no obstruction to an inspector’s duty, inspectors are advised to follow site specific assessments and permits when witnessing testing of SECEs.

Appendix 1 – SECE Management Key Topics for Inspection Topic 1: Organisational Arrangements and Competent Advice

Topic 1.1: Competent Advice on SECEs

30. For SECE management to be effective in the prevention of a major accident, competent technical advice on the integrity of SECEs must be available to the duty holder.

31. Success in this area will involve a duty holder being able to demonstrate that those responsible for providing advice on SECEs to duty holder management, are competent to do so. A demonstration should be available on how a duty holder established that those making decisions on SECEs understand the work involved, the principles of risk assessment and prevention, the current legislation and health and safety standards. Duty holders mainly concentrate their efforts on ensuring offshore technical staff are competent for their areas, but a duty holder should be able to demonstrate there is an equivalent competency system in place for those who manage and assess SECEs. Example may include technical authorities, engineers, supervisors and managers.

32. This criterion is also applicable to those appointed who may not be employees of the duty holder. For example, individuals who provide professional business services which may have a variety of contractual arrangements. Duty holders must be able to demonstrate how they are satisfied those individuals are able to provide the same level of competence as those in their employment.

33. The appointment of any engineering service provider is critical in the management of SECEs. Duty holders must be able to demonstrate how the competence of any service provider that provides SECE assurance has been deemed competent to do so.

34. When inspecting competency systems or job descriptions, inspectors should be aware of generic terminology. Words such as “knowledge of”, “good knowledge of” or “sound knowledge of” may be used to define different levels of technical responsibility. Questions should be asked to establish if the duty holder has defined meanings for these. If they have, can the duty holder measure these qualitative statements?

35. A key requirement for any person providing competent advice on SECEs is a familiarity of the installation and the plant on it. Inspectors should seek evidence that the technical authorities, engineers and managers periodically visit the installation they provide advice on.

36. Where technical authorities (TAs) are not located within the UK, i.e. global TAs, the duty holder should be able to demonstrate that those TAs understand UK legislative requirements or are provided with local support engineers with adequate authority to advise the TA.

Topic 1.2: Organisational Arrangement for Verification

37. For verification to be effective, the organisational arrangements should be adequately described in the verification scheme and embedded within the duty holder’s safety management system.

38. These arrangements should include a policy that can either be a stand-alone document or part of the verification scheme. This policy should outline leadership commitments to the management of major accident hazards and the implementation of the verification scheme. Roles and responsibilities for delivering the requirements of the verification scheme should also be described in sufficient detail. Finally, the competency arrangements for those who have roles and responsibilities defined in the scheme should be described. This includes the competencies for both the verifier and duty holder personnel.

39. The duty holder must be assured that those undertaking verification activities are independent and qualified to do so. This will include the technical expertise, qualifications and sufficient experience to undertake specific roles.

40. Good practice has seen verifier competence management systems aligned with either generic SECEs or specific to the duty holders own list of SECEs and performance standards. Some verifiers may have their competence management systems UKAS certified.

Key Legal Requirements and Guidance Health and Safety at Work etc. Act 1974, Section 2(2) The Offshore Installations (Offshore Safety Directive) (Safety Case etc) Regulations 2015, Regulations 2, 7, 9, 10 and schedule 4. Management of Health and Safety at Work Regulations 1999, Regulations 5 & 7 Managing for Health and Safety, HSG65

Topic 1: Key Questions Competent Advice on SECEs Organisational Arrangement for Verification • Does the duty holder have in place a verification scheme, is it current, and when • How does the duty holder appoint technical persons responsible for the was it last revised? management of SECEs? For example, technical authorities, system custodians, • Does the verification scheme define the roles and responsibilities of the verifier responsible engineers. and personnel within the duty holder for scheme management and • Other than any appointment process, how does the duty holder ensure those implementation? The descriptions should clearly indicate the levels of technically responsible for the management of SECEs are competent in the duty responsibility and accountability for delivering the requirements of the scheme. holders’ own systems? • Does the verification scheme describe the competency arrangements in place for • In any competence management system for technically responsible persons, is both the verifier and duty holder personnel responsible for delivering the there a requirement to demonstrate knowledge of the relevant statutory provisions requirements of the scheme? applicable to offshore installations? • Are those with noted roles and responsibilities in the verification scheme aware of • How does the duty holder appoint third party service providers into positions for these? How much time do they dedicate to these responsibilities if management the management of SECEs? Who appoints them and how are they deemed of the scheme is an addition to other responsibilities? competent for this process? • Is there more than one verifier? For example, a mechanical, electrical and/or • Where generic phrases such as ‘knowledge of’ or good understanding’ have been marine verifier? Is there a focal point verifier who acts as the ‘project manager’ used to determine the capability of a technically responsible person, has the duty for the verification body? Have their roles been described in the verification holder defined the differences between these phrases to for consistency? scheme? • Are management, technical authority or engineers visits to the installation • For the verifier, does the duty holder rely on the provision of competencies from planned, focussed on key objectives (ref: safety leadership agenda), outcomes the verification body, or do they align the competencies required to the installation recorded, analysed and, where appropriate, lessons learned and shared within SECEs? How does the duty holder satisfy themselves that they are receiving