8

Summary of Chapter Conclusions

The committee’s overall response to its Statement of Task (SOT) is provided in the Summary. Detailed assessments of the committee in response to its SOT are contained in the conclusions provided at the end of each chapter. For the reader’s convenience, this chapter repeats the conclusions reached in the preceding chapters.

INTRODUCTION (CHAPTER 1)

Chapter 1 does not contain specific conclusions. It summarizes the findings of other reports on the technical, management, and regulatory inadequacies that were unable to prevent the Macondo disaster. It also discusses the genesis of the concept of systemic risk and, in response to an element of the SOT, defines systemic risk for the purpose of this report as “The overall risk of catastrophic failure associated with the entire system. Thus, it includes design, operations, and regulation throughout the life cycle of offshore oil and gas facilities.” It defines the systemic risk profile that it was asked to provide as “The temporal description of systemic risk. A risk profile examines the nature and level of the threats faced by organizations, the likelihood of adverse effects occurring, the level of disruption and costs associated with each type of risk, and the effectiveness of controls in place to manage those risks.”

CHANGES IN OFFSHORE SAFETY SINCE 2010 (CHAPTER 2)

This chapter focuses on the SOT element that asks the committee to assess whether the recommendations made in post-Macondo reports have been

adopted. It also highlights the impact on systemic risk management of independent industry and regulatory actions and identifies critical gaps in capabilities for systemic risk management.

Conclusion 2-1: A number of strong, positive improvements have been made offshore since Macondo, such as the creation of BSEE with a singular focus on safety; the mandate for and implementation of SEMS; issuance of new rules for well control and oil and gas production safety Systems; adoption of risk-based inspections by the Bureau of Safety and Environmental Enforcement (BSEE); industry creation of the Center for Offshore Safety and formation of companies with deepwater well-capping capability; updating of more than 250 American Petroleum Institute (API) standards and recommended practices; improved well-control training; and improved and enhanced incident data reporting and sharing. Collectively these changes have had a positive impact on the industry systemic risk profile, even though implementation is incomplete and further improvements are needed as described in the following conclusions. In addition, more than 1,800 older wells in shallow water have been decommissioned since 2010, which reduces overall offshore risk.

Conclusion 2-2: Some major reports reviewed in the chapter that were issued after Macondo recommended greater focus on and improvement in a culture that supports safety (i.e., safety culture). Some operators and contractors have long paid close attention to nurturing and improving their cultures that support safety, but an industry-wide emphasis on strengthening a culture that supports safety and guidance for all operators and contractors in this regard is not apparent. The industry is thereby missing a collaborative approach of knowledge and resource sharing between companies with well-developed cultures that supports safety and companies less experienced in this area. After providing significant leadership on this issue in the 2012-2016 period by publishing a set of safety culture principles and encouraging industry adoption of them, it is not apparent that BSEE has focused on this area since then.

Conclusion 2-3: The National Commission, among others, recommended that the United States adopt the safety-case approach in use by North Sea nations as well as Australia and Canada. The U.S. response to Macondo was to adopt safety and environmental management systems (SEMS) instead. However, the Department of the Interior, acting through BSEE and the Minerals Management Service before it, has long used a process quite similar to the safety case in review and approval of Deepwater Operations Plans (DWOPs), and has done so

with notable success. From an engineering standpoint, the data cited in the chapter indicate that this process has worked. BSEE could expand this approach further, but BSEE would need a considerable expansion in technical expertise beyond well design and production engineering as well as regulatory capacity. It would require using multiday inspections compared to current practice of inspections lasting a day or less to replicate application of the safety-case approach as practiced in the North Sea. The DWOP process introduced the principle of reducing risk “as low as reasonably practicable” (ALARP) into deepwater operations, and this could be further extended to the entire regulatory remit of BSEE.

Conclusion 2-4: Several reports recommended that the SEMS regulations be enhanced, including adding the use of reducing risk to the ALARP level as a goal. As described in the chapter, ALARP is a process of following recognized good practice rather than a specific number, except for brand-new technologies or practices for which a quantitative estimate is required. There are two important dimensions in assessing the degree to which the ALARP concept is applied on the Outer Continental Shelf (OCS): (a) its use, as a practical matter, in existing offshore engineering standards and (b) adoption of ALARP-like language in BSEE regulation as an element of the Well Control Rule in 2016. Offshore designs and engineering standards developed in recent decades are based on best practices and elimination of risks that are consistent with ALARP. However, the ALARP concept has not been explicitly followed for operational practices, nor is it explicitly referenced in official SEMS guidance despite the presence of the concept in regulation.

Conclusion 2-5: In general, the development and execution of technology offshore for oil and gas exploration and production on the OCS has been exceptional. However, offshore process safety practice has lagged other high-hazard industries and has lagged offshore technology development and implementation in some cases. Process safety concepts have been adopted in offshore design and hardware standards, but less so in operational practice. Recommended Practice (RP) 75, Third Edition, for example, makes no mention of barrier management for those controls that depend on human action. Nor have BSEE or industry offered guidance on contingent barrier management as a part of process safety. Indeed, RP 75, Third Edition, merely indicates that application of human factors standards to the design and execution of procedures “may” rather than “should” be considered. RP 75, Fourth Edition, attempted to be more expansive about human factors, but ultimately was still vague about use of existing human factors standards

in design and operations, and the Fourth Edition has not yet been included in regulations. There has been limited attempt by the industry to adopt human-systems integration methodologies and approaches to improve the efficacy of contingent barriers and human–system interfaces. Nor has industry or SEMS regulations emphasized the importance of training in nontechnical skills among drilling teams and managers (such training is available through the International Association of Drilling Contractors [IADC]). SEMS, of course, are general enough that process safety, barrier management, and application of human-systems integration methodologies (including human factors standards) can be folded into them. Some companies incorporate human-systems integration and human factors into safety management, but many do not. Neither industry nor BSEE has provided sufficient guidance to assist companies in these areas. Although design and construction of physical controls have generally been good, the performance of these controls during operations requires that they are understood by operational staff and are continually monitored, verified, and maintained. The safety benefits of RP 75, SEMS, and associated recommended practices and regulation would be enhanced by incorporating process safety principles and human-systems integration principles and methodologies.

Conclusion 2-6: Another significant remaining gap in SEMS is that BSEE can only require SEMS of operators and not the contractors who carry out 80 percent or more of the work done offshore. BSEE does require that operators ensure that their contractors’ employees are “knowledgeable and experienced in the work practices necessary to perform their job in a safe and environmentally sound manner” (30 CFR § 250.1914(b)). BSEE cannot enforce SEMS for contractors but can evaluate the effectiveness of operators’ SEMS based on contractor performance. (30 CFR § 250.1924(a)). In contrast, North Sea offshore regulators are able to regulate contractors directly and require that they have effective SEMS. The operator–contractor interface that failed at Macondo remains a concern for the U.S. offshore industry.

Conclusion 2-7: Whereas the collaboration between major operators, service providers, and contractors representing most of production and BSEE on SafeOCS is beginning to bear fruit, not all operators and contractors are participating in SafeOCS. SafeOCS would be more robust if participating companies define and report all of their process safety events (PSEs) in the four tiers defined by the International Association of Oil & Gas Producers (IOGP). Doing so would highlight incidents associated with breakdowns in barrier management.

AVAILABLE EMPIRICAL INDICATORS OF OFFSHORE INDUSTRY RISK PROFILE (CHAPTER 3)

This chapter focuses on how industry and BSEE have responded to the recommendations in several reports that much better data that serve as indicators of systemic risk be collected, shared, and analyzed by industry to prevent major disasters.

Conclusion 3-1: Voluntary and mandatory data reporting to SafeOCS demonstrate considerable progress in development of safety indicator data. Companies representing 92 percent of OCS hydrocarbon production are now providing company data voluntarily to the SafeOCS Industry Safety Data (ISD) program. Missing, as yet, is estimation of safety incident rates, such as by hours worked, that would normalize trends. Reporting of PSEs into IOGP’s four tiers would increase the availability and value of the data being reported, especially for tiers 3 and 4, which could serve as leading indicators of systemic risks tracing back to organizational management. Mandatory reporting to SafeOCS of well control and production safety system equipment performance indicates that such equipment failures resulting in loss of containment are infrequent, but there are apparent issues on nonreporting of safety and pollution prevention equipment data. Improvements in industry data collection, sharing, and reporting to SafeOCS offer promise for future trend analyses of the offshore industry risk profile, but more complete reporting of voluntary data, particularly process safety indicators, will be needed before such empirical information can inform judgments about the industry risk profile.

Conclusion 3-2: Available trends for safety indicators from COS offer a mixed picture. Safety Performance Indicator (SPI) 1 and 2 events both decreased in 2021, after trending up over previous years, but these appear to be driven by events related to occupational injury rather than systemic risk. COS selects and analyzes particular safety incidents to better understand why they occurred. COS classifies causes of Learning from Incident (LFI) events into “Areas for Improvement” (AFIs). The most frequently cited causes identified in AFIs all point to management and human performance issues.

Conclusion 3-3: Trends in available BSEE process-safety incident data are inconclusive. The frequency of such events is generally low. Some trends appear to be improving, but others, such as loss of well control, are volatile, which makes it difficult assess trends in systemic risk.

Conclusion 3-4: Reports based on SEMS audits and corrective action plans (CAPs) show progress in industry commitment to safety

management and BSEE commitment to making SEMS more effective. However, BSEE reports that these audit results show large differences in the commitment of companies to SEMS. Reports on audit deficiencies and CAPs can also serve as indicators of the offshore industry’s commitment to reducing the risk of their operations. In addition, BSEE oversight of this process can serve as an indicator of its role in enforcing safety management. For example, operators are required to submit CAPs to BSEE in response to audit deficiencies, but the CAPs are not required to examine and address the root causes of the deficiencies. BSEE has indicated that it may need to correct this deficiency through rulemaking.

Conclusion 3-5: Although industry-wide safety performance indicator data have been developed and substantially improved since Macondo, the data are not sufficiently mature to estimate the industry’s systemic risk profile. Today, assessment of the industry risk profile will have to depend on qualitative indicators and expert judgment rather than good empirical indicators.

Conclusion 3-6: Whereas BSEE collects and posts much of its data on a public-facing website, safety data for operator and facility profiles are not publicly disclosed but are kept and tracked internally by BSEE. Many of these disaggregated data are not available external to BSEE, but are used in the agency’s risk-based inspections and as part of its annual operator performance review. Benefits in understanding industry maturity and performance could be derived from further availability and analysis of these data.

A MODEL FOR ASSESSING INDUSTRY RISK PROFILE (CHAPTER 4)

This chapter has provided the committee’s judgment about the existing systemic risk profile and what has changed over the last decade. To arrive at its judgments, the committee developed a framework that looked at systemic risk based on individual risk elements that are grouped into three systems: People, specifically looking at culture and human resources, Human-Systems Integration, and Systems, with a focus on barriers and the regulatory environment.

The committee’s collective assessments of the risk elements were influenced by the maturity model concept, wherein the highest level of maturity from a safety perspective is always evolving toward a higher standard. Thus, it is not expected that many companies have reached the most mature level. The industry is also highly variable, with a few companies mature in managing systemic risk and others at lower stages of maturity. The assessments for the risk elements reflect this heterogeneity.

Conclusion 4-1: The committee’s assessments of the 15 risk elements in its model cannot be aggregated into a single measure of the industry systemic risk profile, but it is possible to generalize from them and describe overall trends and gaps.

1. A Culture That Supports Safety as it applies to systemic risk has three risk elements: Definition of a Culture That Supports Safety, Elements of a Culture That Supports Safety, and Assessment and Measurement of That Culture. The industry-wide assessments of maturity for these risk elements range from concerning, Level 2, to neutral, Level 3, within an industry with some companies that are actively supporting a culture of safety and are at Level 4, but many are not, or only lightly, engaged.
2. Human Resources as a risk control has two risk elements, Education and Training and Worker Empowerment. Assessments of current maturity for these risk elements range from Level 2 to Level 3. There has been improvement over the past decade due in part to SEMS and their requirements around worker empowerment and stop-work authority; collaboration among companies with BSEE to improve and share reporting of near misses and incidents through SafeOCS; and improved industry training in well control.
3. Human-Systems Integration is made up of four risk elements: Integrated System Design, SEMS Implementation, the use of Checklists, Procedures, and JSAs, and Behaviors. The industry assessments for these elements range from concerning, Level 2, to neutral, Level 3, while individual companies range from negative, Level 1, to good, Level 4. Improvements over time are primarily associated with the SEMS elements and training approaches. For SEMS elements, these can be attributable to SEMS implementation maturing from a voluntary practice adopted by some operators, to required implementation by all, with progress seen over time in the quality of implementation.
4. Hardware and Design as risk controls have three risk elements: Barrier Identification, Barrier Integrity, and Technology Enhancement such as remote real-time monitoring (RRTM), automation, and utilizing operational data. Current industry maturity assessments for these risk elements are at Level 2 and Level 3, which represents significant improvement over the last decade. The concerns illustrated in the current assessment are in two areas. There continues to be a focus on hazards rather than barriers, and new technologies are not being consistently applied to help with managing risk and human factors. As with other risk control areas, there is variation across industry with some very positive, Level 4, performers and some strongly negative, Level 1, performers. Relatively little progress has occurred in implementing advanced technologies

4. such as automation and utilizing data to specifically assist industry in systemic risk management, and industry and SEMS lack guidance and good practices for ensuring barrier integrity that depend on human intervention and management.
5. Regulatory Environment as a mechanism for risk controls has three risk elements: requirements for Barrier Verification, Inspections; and requirements for Worker Certification. Current maturity assessments are generally neutral, Level 3, with some operators at Level 4 that are building on SEMS to exceed requirements. Although SEMS are in place and being implemented more effectively over time, both it and RP 75 nonetheless lack reference to modern process safety barrier concepts, including contingent barrier management. The maturity of BSEE’s inspection regime is assessed as mostly neutral, but with some positive indicators such as implementing risk-based inspections. Improvements over the last decade are due to heightened regulatory requirements around well control and production safety systems and BSEE’s development and implementation of a more formal system of risk-based inspections. Even so, there has been little improvement in testing for and demonstrating worker competence in safety-critical tasks.

Conclusion 4-2: Based on the committee’s evaluation and judgment of industry maturity for the risk elements, its assessment is that industrywide performance in systemic risk management has improved over time, but much additional work is needed to move more of industry, as well as government oversight, to a more mature level.

1. Industry technical and equipment standards have long provided a foundation for safety since the hardware on which offshore operations depend rarely fails when maintained and used within design and operating assumptions. Use of more modern concepts of process safety, and application of human factors standards to procedures and design of jobs, is expanding though far from complete.
2. Adoption and use of SEMS are maturing over time by both BSEE and industry.
3. Industry development and sharing of safety indicator data, as supported by the collaboration of companies representing more than 90 percent of production in SafeOCS and participation of companies in COS representing more than 60 percent of offshore operations, are important and valuable developments in identifying and managing systemic risk.

Conclusion 4-3: Further improvements in systemic risk management since Macondo are limited by several gaps:

1. Industry has yet to embrace the value and importance of instilling a culture that supports safety across the entire industry.
2. SEMS regulations, and industry generally, lack guidance on contingent barrier management aspects of process safety and use of human factors standards.
3. Despite the fact that contractors now carry out 80 percent of the work offshore, BSEE’s authority extends directly only to operators. This violates good practice in safety of placing responsibility for safety management directly on the creator of the risk. However, SEMS regulations do require operators to ensure that their contractors’ workforces are capable of carrying out their duties safely. Some operators have good practices for integrating their SEMS systems across the systems and practices of their contractors.
4. SEMS regulations have general requirements for workforce training and competence but lack specific requirements for competency. Moreover, the general requirements do not specifically identify nontechnical skills important for effective teamwork of identifying, communicating, and managing hazards during operations. Such training for well control is available through IADC.
5. Whereas industry has an exemplary record for developing technologies to enhance efficiency, it has not yet taken full advantage of adapting available technologies in areas such as RRTM, automation, and data utilization to enhance safety and systemic risk management.
6. Best practices in the development and use of checklists, procedures, and JSAs to enhance situation awareness and engagement during operations used in other safety-critical industries have received scant attention.
7. Application of available human factors standards in the development of procedures, and engagement of the workforce in the development and revision of procedures, is not robust.
8. Participation in SafeOCS and COS falls short of including the entire industry.

Conclusion 4-4: A model of systemic risk that recognizes the overall risk profile as a sum of its parts is important for understanding the current state as well as progress made in improving the risk profile. Future improvements in the risk profile of offshore energy operations will be the result of concerted effort by operators and regulators to address shortcomings of individual risk elements with specific actions and programs. Addressing the individual risk elements and improving industry’s maturity level with respect to them, will result in an overall improvement in the Systemic Risk Profile for offshore energy operations.

INCENTIVES OF THE OFFSHORE OIL AND GAS INDUSTRY REGULATORY STRUCTURE (CHAPTER 5)

This chapter responds to the SOT element that asks the committee to assess how the regulatory structure incentivizes, or not, systemic risk management. The committee made this assessment using a framework developed in a 2018 National Academies report Designing Safety Regulations for High-Hazard Industries.

Conclusion 5-1: Micro-means regulations, often referred to as “prescriptive” regulations, do not incentivize technological, organizational, or process changes to address systemic risk. Micro-ends regulations, often referred to as “performance” regulations, incentivize technological and process innovations, but not necessarily organizational changes. Neither type is sufficient to address the complex and varied hazards that exist in the offshore environment. Macro-means and macro-ends regulations incentivize technological, organizational, and process changes to address systemic risk. The chapter’s overview of the four different types of regulation makes clear that the incentives of the various regulatory types do not necessarily align in practice. The lack of alignment across regulatory types has not inhibited technological innovation offshore.

Conclusion 5-2: Macro-means regulations specify that a safety management system process must be followed, but they give operators considerable flexibility in identifying and managing hazards that are unique to their circumstances and address the kind of organizational safety management failures seen at Macondo. Thus, SEMS specify what must be done, but the offshore operator determines how hazards are identified and assessed and how barriers are applied to mitigate risks specific to their operations. In principle, if industry and BSEE together implement SEMS as intended, the incentives should foster greater attention to identifying and managing systemic risks.

Conclusion 5-3: The regulatory structure that applies offshore includes all four types of regulations, which do not always align and sometimes conflict. One example of how the interacting effects of various regulatory actions affect safety is the mixed incentives of macro-means (especially SEMS) and macro-ends (especially liability) regulations. The use of SEMS to focus on systemic risks would be enhanced by more open sharing of accident precursor data, especially regarding process safety near misses or organizational lapses in barrier management. However, most companies appear to be reluctant to share information that may raise liability concerns established in general duty or liability regulation

and appear to worry about regulators being able to maintain data confidentiality because of open-records laws, Freedom of Information Act obligations, and the legal discovery process.

BSEE, by operating through SafeOCS, has gone to great lengths to protect companies during the legal discovery process from being identified as the source of near-miss data. Nonetheless, although a few major companies representing 90 percent of offshore production now participate in the SafeOCS ISD program, it has taken more than a decade to achieve this level of participation and the results are only just beginning to be useful for systemic risk management. Industry participation is much higher for the SafeOCS fail-safe systems, because provision of data to those databases was made mandatory in the Well Control and Oil and Gas Production System Safety rules of 2016.

The protections from disclosure of sensitive data are considerable for federal statistical agencies, which includes the agency that BSEE relies on for SafeOCS. However, a highly confidential system such as SafeOCS ISD has disadvantages. The results delivered publicly have to be high level and generalized to avoid industry concerns about liability. Doing so, however, does not support good dialogue, collaboration, and interaction between the regulator and individual companies, since the regulator does not know the source of the individual company data shared in SafeOCS.

Conclusion 5-4: As noted in Chapter 2, the offshore industry lacks the legal, regulatory, and policy protections available to commercial aviation that protect providers from having their safety precursor data used against them in enforcement or legal proceedings (if the data are collected, shared, and analyzed for the purpose of enhancing safety). The application of the data protections and policies used in aviation to the offshore is a worthwhile topic for further consideration and research.

Conclusion 5-5: The mixed incentives of the different regulatory types pull BSEE in different directions. BSEE’s history as a regulator has been partly driven by its mandate to inspect every offshore facility at least once per year based on compliance with micro-means regulations, which it enforces through Incidents of Noncompliance (INCs) and fines and punishment for operators who do not comply. (Typically, the fines assessed are not large but their reputational damage can be.) Micro-means regulations, as well as macro-ends liability regulations, fit within a regulatory philosophy based on deterrence theory, whereby detection and punishment of offenders is meant to send a message to others to comply with the rules. Of course, regulations must be obeyed, but this

model places BSEE in a policing role, which can result in an antagonistic and litigious relationship with industry.

In contrast, SEMS macro-means regulations work best when they encourage collaborative problem identification and solving between regulator and operator, as is more common in nations with the safety-case approach. Third-party audits play more of the inspection role in this regime, but they are different. A good audit would focus on how well an operator is carrying out its own SEMS plan. The results provide an opportunity for BSEE’s safety experts and the operator to discuss how the operator can and should improve, and it gives both parties metrics that can be used to measure progress. For operators with a culture of safety, this process could motivate continual improvement. Whether BSEE can be perceived by operators as a trusted partner in this process depends in part on how much BSEE is perceived as characterized by its policing and compliance role and by how much it is perceived as being insightful and capable of assisting in effectively managing systemic risk. BSEE is striving to add these capabilities, but it will require (a) leadership by the executive and legislative branches to support it in doing so and (b) expansion of the expertise of its workforce in the variety of disciplines needed for safety management systems. The Transportation Research Board’s 2021 report on reforming the BSEE inspection program has several recommendations that would help BSEE reorient its safety efforts to maximize the benefits of SEMS (NASEM, 2021, pp. 131-149).

GULF RESEARCH PROGRAM ACTIVITIES: CONTRIBUTIONS TO A BETTER UNDERSTANDING OF SYSTEMIC RISK REDUCTION (CHAPTER 6)

Conclusion 6-1: The committee assessed that GRP activities have general relevance to advancing knowledge about systemic risks in the offshore oil and gas industry.

Conclusion 6-2: Because the committee could not assess the impact of GRP activities, it could not ascertain whether GRP activities have contributed to a better understanding and reduction of the systemic risks in the offshore oil and gas industry. As previously discussed, GRP is in the best position to make this determination.

Conclusion 6-3: There are some best practices inherent in some GRP activities that can be used as a model for the future. The committee recognizes the importance of ensuring that the offshore oil and gas industry and other stakeholders outside the academic community are appropriately engaged throughout the process for specific activities.

Conclusion 6-4: In evaluating significant gaps or priorities for future needs for increased understanding, communication, and management of systemic risk related to the offshore oil and gas industry, the committee identified nine critical gaps in systemic risk management in previous chapters and as listed in the Summary. The committee encourages GRP to consider its potential role in addressing all of these critical gaps through (a) R&D and (b) the GRP’s convening capabilities.

Conclusion 6-5: Although the committee could not make a quantitative estimate of the offshore systemic risk profile for this report, the ongoing improvements in BSEE and industry systemic risk precursor data may make such a quantitative estimate possible in the future (while it is also recognized that there are inherent uncertainties of such an estimate). GRP could invest in (a) R&D in precursor data enhancement and (b) development of appropriate analytical methods to help achieve this goal.

ENERGY TRANSITION AND SYSTEMIC RISK MANAGEMENT IN THE OUTER CONTINENTAL SHELF (CHAPTER 7)

Conclusion 7-1: The oil and gas industry and offshore regulators have a long track record of managing systemic risk well in most cases. Safety management systems (SMSs) including SEMS and process safety are proven methods of identifying hazards, creating barriers to escalation, and systemically managing risk—if done well and effectively and as part of a continuous process of learning and improvement including sharing and collaboration. The energy transition and new offshore energy systems as well as other new activities in the offshore will not need new processes and tools to systemically manage risk. However, success depends on effective and continuous implementation and use of existing processes including monitoring, learning, and improving. The key challenge for operators and regulators going forward in the transition is to (a) have a solid unified transition strategy that creates and sustains collaboration and cooperation among the much-expanded mix of companies and contractors and new technologies that are creating this transition in the common U.S. offshore space and (b) includes regular assessment of progress because change is not fully predictable could be rapid.

It will be crucial for duty holders to (a) ensure that the risks of health and safety are not overlooked under the pressures of a rapid transition and the pursuit of green objectives and (b) recognize that the evolution of SMSs will need to evolve for many decades to come as offshore activities evolve.

REFERENCE