How safe organisations can drift into disaster
Article published in the Regulator | Issue 4: 2017
Investigations into major accident events in high-risk industries often identify patterns of gradual and unrecognised increases in risk. This change in risk often follows a lengthy period of safe operations. The following article has been prepared to consider the concepts of ‘disaster incubation’ and ‘drift’ and the steps the offshore petroleum industry can take to ensure risks remain as low as reasonably practicable (ALARP).
How do disasters happen in ‘safe’ organisations?
Offshore petroleum organisations operate in a highly competitive, commercial environment with limited resources. Within this environment, economic, workload and safety constraints create boundaries to productivity. Pressures to improve productivity create pressure on workload and safety constraints, resulting in incompatible goals (e.g. faster, cheaper, better at the expense of safety). For operations to proceed, individuals at all levels of the organisation engage in a constant, often subconscious, process of goal negotiation and trade-off between economic, workload and safety goals. Examples of this include:
reducing workforce numbers (due to cost-reduction or competition for talent) without reducing the volume of work accordingly
deferring planned or routine inspection and maintenance activities to allow for prioritisation of production-related activities
removing implemented control measures for the purposes of saving money using a reverse-ALARP argument.
These types of decisions are generally perceived as unremarkable due to a shared belief in the infallibility of control measures, leading to complacency. This belief allows such decisions to be made in favour of economic goals without any consideration of the potential encroachment into safety boundaries. The consequent accumulation of many small concessions for economic goals gradually increases the overall potential for a major accident event because safety controls have been eroded.
How can organisations identify ‘drift’ and intervene before disaster?
Vigilance and monitoring of ‘weak signals’ is critical to continued safe operations. Weak signals are small anomalies that appear innocuous and are easily dismissed but may be indicative of impending larger problems, only becoming significant in hindsight. Weak signals are reflected in cultural trends symptomatic of drift; these include ‘decrementalism’ and ‘normalisation of deviance’.
Decrementalism refers to incremental steps away from an established safe standard. When a slight departure from an established safe standard is ‘successful’ (i.e. an economic goal is met without an obvious impact on safety), a new norm is created. This new norm is then used as the basis from which to depart slightly again. The incremental nature of the departures makes them unremarkable and unreportable, but over time, the distance between the original established safe standard and the current ‘safe’ norm increases, and safety margins are eroded. Examples of decrementalism include:
increasing the interval for a planned inspection or test without evidence that it is safe to do so, for example without inspection data, engineering assessments or alternative forms of inspection
removing or softening established limits, specifications or standards requirements from procedures and instructions
deviating from established performance standards without evidence to demonstrate that risk remains ALARP.
Normalisation of deviance occurs when signs of potential danger are acknowledged but then rationalised and normalised, allowing continued operation under conditions that have been reclassified as ‘safe’ (i.e. it was fine last time so it will be fine this time). This process is repeated in the face of increasing signs of danger, resulting in incremental steps towards greater risk. Examples of normalisation of deviance include:
long-term holds or overrides on ‘nuisance’ alarms without investigation, corrective action or risk assessment
continued operation despite documented actual performance not conforming with defined parameters
failure to act on classification and verification report recommendations
inspection and maintenance records signed off as complete, despite steps being skipped or maintenance issues noted (e.g. corrosion) with no corrective action raised.
NOPSEMA strongly encourages all duty holders to identify and monitor weak signals via thorough auditing processes, rigorous decision-making protocols, and personnel taking a ‘devil’s advocate’ role in group discussions. NOPSEMA will also continue to monitor duty holders’ responses to weak signals through regular inspections. If necessary, we will take actions to ensure that any concerning trends are appropriately addressed and that risk remains ALARP.