icmm health and safety critical control managment good practice guide

7/21/2019 ICMM Health and Safety Critical Control Managment Good Practice Guide

http://slidepdf.com/reader/full/icmm-health-and-safety-critical-control-managment-good-practice-guide 1/32

HEALTH AND SAFETYCRITICAL CONTROLMANAGEMENTGOOD PRACTICE GUIDE

http://www.icmm.com/



Foreword 3Introduction 4

Definitions and acronyms 5

Critical control management 7

Summary 7

Step 1: Planning the process 8

Step 2: Identify material unwanted events (MUEs) 9

Step 3: Identify controls 10

Step 4: Select the critical controls 12

Step 5: Define performance and reporting 14Step 6: Assign accountability 16

Step 7: Site-specific implementation 18

Step 8: Verification and reporting 19

Step 9: Response to inadequate critical control performance 20

Appendices 23

Appendix A: The CCM journey model and mapping tool 23

Appendix B: Guidance on critical controls 24

Appendix C: CCM lead and lag indicators 26

Appendix D: References 28

Acknowledgements 30



This document, one of a range ofdocuments on good practice inhealth and safety management,is designed to support theprinciple of continualimprovement. It providespractical guidance on preventingthe most serious types of healthand safety incidents, referred tohere as material unwantedevents (MUEs).

This guidance document providesadvice on how to identify andmanage critical controls that caneither prevent a serious incidentoccurring in the first place orminimize the consequences if aserious incident were to occur.Both types of control are needed.Evidence from major incidentsin mining and metals, and inother industries, indicates thatalthough the risks were known,

the controls were not alwayseffectively implemented.Therefore, this documentprovides specific guidance on:

• identifying the critical controls

• assessing their adequacy

• assigning accountability fortheir implementation

• verifying their effectiveness

in practice.

The approach described in thisdocument is called criticalcontrol management (CCM).

CCM is well established andin use in many high-hazardindustries. However, this isthe first time this approachhas been captured in a singledocument designed specificallyfor the mining and metalsindustry. This would not havebeen possible without theguidance and support ofICMM member companies.

As with most new organizationalinitiatives, the successfulimplementation of CCM requiressenior executive support.This support is required interms of not only establishingCCM within companies, but inits ongoing implementation.The approach enables seniorleaders to more effectivelyexercise their leadership rolein safety as a result of the

transparency brought to bearby applying CCM. Under CCM,critical controls should beclearly described, and theirrequired performance and theaccountability for implementingthe controls should be madeexplicit. This should permitsenior leaders to participateeven more effectively inmanaging the risks of majorincidents. Committed leadership

through the active monitoringof CCM across the mining andmetals industry is essentialfor the long-term success ofthe approach.

Health and safety critical control management Good practice guide 3

FOREWORD

R. Anthony HodgePresident, ICMM

The global mining andmetals industry hasmade great progress inimproving health andsafety performance.One of the sustainabledevelopment principlesof the InternationalCouncil on Mining andMetals (ICMM) is to seekcontinual improvementin health and safetyperformance.



Aim

The document provides advice onhow to identify and manage criticalcontrols that can either prevent aserious incident occurring in the firstplace or minimize the consequencesif a serious incident were to occur.This document provides specificguidance on:

• identifying the critical controls

• assessing their adequacy

• assigning accountability for theirimplementation

• verifying their effectiveness inpractice.

Structure

This guidance document utilizes anumber of steps that an organizationcan use to structure their approach toCCM. This document describes:

• the background and aim of theCCM process

• guidance to prepare an organizationfor the CCM process

• nine steps to develop the CCMprocess

• annexes providing additionalguidance on:

– a CCM journey model andmapping tool to help organizationsassess status and progress

– critical controls

– lead and lag indicators.

Preparation for theCCM process

The CCM process outlined here is astep-by-step approach where theprocess is divided between planningand implementation. It is importantfor an organization undertaking CCMto have the right skills, experienceand resources to implement it to ahigh standard. The organizationshould also have buy-in from seniorexecutives. Such support is a

fundamental characteristic of theorganizational maturity required tosucceed with CCM.

If an organization is unsure whetherit is mature enough to begin, it isrecommended that the organizationundertake a review of its readiness toadopt CCM. This guidance documentincludes an analysis tool that mighthelp identify that readiness: the CCM journey model and mapping tool.The tool is structured as a journeychart, with each step of the journey

describing an increased level ofcontrol management culture andpractices. The tool can help map theorganization’s current status, as wellas provide ideas for moving towardsCCM by establishing the requiredfoundation (see Annex A).

Once an organization has assessedits maturity and established theappropriate foundation, it is ready toproceed with the process.

4 Health and safety critical control management Good practice guide

INTRODUCTION

This documentprovides advice onMUEs – guidance onmanaging criticalcontrols that alignsrisk management andgood managementpractice. CCM is anintegral part of riskmanagement andaids in identifyingthe priority risks ina company andimplementing criticalcontrols to preventan incident ormitigate its impact.



Bowtie analysis (BTA)An analytical method for identifyingand reviewing controls intended toprevent or mitigate a specificunwanted event.

CauseA brief statement of the reason for anunwanted event (other than the failureof a control).

ConsequenceA statement describing the finalimpact that could occur from the

material unwanted event (MUE). It isusual to consider this in terms of themaximum foreseeable loss.

ControlAn act, object (engineered) or system(combination of act and object)intended to prevent or mitigate anunwanted event.

Critical controlA control that is crucial topreventing the event or mitigating

the consequences of the event.The absence or failure of a criticalcontrol would significantly increasethe risk despite the existence of theother controls. In addition, a controlthat prevents more than one unwantedevent or mitigates more than oneconsequence is normally classifiedas critical.

Critical control management (CCM)A process of managing the risk ofMUEs that involves a systematicapproach to ensure critical controls

are in place and effective.

HazardSomething with the potential forharm. In the context of people, assetsor the environment, a hazard istypically any energy source that, ifreleased in an unplanned way, cancause damage.

Material unwanted event (MUE)An unwanted event where thepotential or real consequence exceedsa threshold defined by the companyas warranting the highest level ofattention (eg a high-level health orsafety impact).

Mitigating controlA control that eliminates or reducesthe consequences of the unwantedevent.

Preventing control

A control that reduces the likelihoodof an unwanted event occurring.

RiskThe chance of something happeningthat will have an impact on objectives.It is usually measured in terms ofevent likelihood and consequences.

Unwanted eventA description of a situation wherethe hazard has or could possiblybe released in an unplanned way,

including a description of theconsequences.

Verification activitiesThe process of checking the extent towhich the performance requirementsset for a critical control are beingmet in practice. Company health andsafety management systems mightuse a variety of terms for “verification”activities. Common terms includeaudit, review, monitoring and activemonitoring.

DEFINITIONS AND ACRONYMS


This is not a definitivelist of risk managementterminology. The focusis on some of thekey definitions andacronyms associatedwith critical controlmanagement usedin this document.



I m a g e c o u r t e s y o f

A n g l o A m e r i c a n

Committed leadershipthrough the activemonitoring of CCMperformance isessential for thelong-term success ofthe process.



Summary

CCM consists of nine steps, six ofwhich are required to plan the CCMprogram before implementing themin the last three steps, as seen inFigure 1.

This document provides guidance foreach step in the process, as well askey actions and selected health andsafety examples.

Each step might require revisitingthe previous step to achieve thedesired outcome. For example,the loop from Step 7 to Step 6indicates the potential need torevisit information from the planningsteps when site implementation isdefined. This might occur becausethe site control performance variesfrom assumptions made at theplanning stage.

Each step in the process has a targetoutcome that should be achieved

before moving to the next step.Table 1 summarizes all steps andoutcomes.

The following pages provide astep-by-step outline of the CCMprocess.


CRITICAL CONTROL MANAGEMENT

Figure 1: The critical control management process

Table 1: Critical control management steps and target outcomes

TARGET OUTCOMESTEP

P l a n n i n g s t e p s

I m p l e m e n t a t i o n

1 A plan that describes the scope of the project, including what needs to be done, by whom and the timescales.

2 Identify MUEs that need to be managed.

3 Identify controls for MUEs, both existing controls and possible new controls. Prepare a bowtie diagram.

4 Identify the critical controls for the MUE.

5 Define the critical controls’ objectives, performance requirements and how performance is verified in practice.

6 A list of the owners for each MUE, critical control and verification activity. A verification and reporting plan is requiredto verify and report on the health of each control.

7 Defined MUE verification and reporting plans, and an implementation strategy based on site-specific requirements.

8 Implement verification activities and report on the process. Define and report on the status of each critical control.

9 Critical control and MUE owners are aware of critical control performance. If critical controls are underperforming orfollowing an incident, investigate and take action to improve performance or remove critical status from controls.

1

Planning theprocess

3

Identify controls

4

Selectthecritical controls

8

Verification andreporting

5

Defineperformance andreporting7Site-specific implementation

6

Assign accountability

9Response to inadequate

critical control performance

2

Identifymaterial unwantedevents (MUEs)

Planning steps

Impementation steps

Feedback loop




CRITICAL CONTROL MANAGEMENTSTEP 1: Planning the process

The first step of the CCM process is tocarefully scope out and plan the work.This includes planning what definitions,criteria and actions will need to becarried out, what areas of an organizationand/or specific people will be involved,and over what timeframe. The followingquestions should be considered (each iselaborated on in subsequent steps):

• What is the organizational context?Are there existing projects at a corporate,business unit or site level thatcomplement or conflict with this work?

• What is the objective and what are thespecific deliverables of the project?

• What sections of the business will beinvolved?

• What method will be used to identifypotential hazards?

• What methods will be used to identifyunwanted events?

• What methods will be used to assess therisk of the identified unwanted events,including the criteria for a MUE?

• What method will be used to review MUEcontrols?

• What will the criteria be for criticalcontrol selection?

• What will the criteria be for assessingthe objectives and performance of thecritical controls?

• How will the verification processes bedefined?

• How will ownership and accountability

be defined?

• How can critical control information beadapted to become site-specific?

• How will critical control performance beverified in practice and what actions willbe taken if requirements are not met?

• What methods will be used to investigatecritical control underperformance?

• How will the impact of the CCM initiativewill be measured?

Scoping for a major initiative shouldconsider additional resources such asleadership, facilitation, project teammembership, timing and budget.

Key actions• Develop a plan that describes the scope of the project.

This includes:

– organizational context

– project objectives

– responsibilities

– business sections involved.

• Develop methods to:

– identify potential hazards and unwanted events

– assess risk

– review MUEs

– select critical controls– assess objectives and performance of critical controls

– investigate critical control underperformance

– measure impact of the project

– identify ownership and accountability.

Target outcome

A plan that describes the scope of a project, including what needs to bedone, by whom and the timescales.

1

Planning theprocess

3

Identify controls

4


8


5

Defineperformance andreporting

7

Site-specific implementation

6


9

Response to inadequatecritical control performance

2





CRITICAL CONTROL MANAGEMENTSTEP 2: Identify material unwanted events (MUEs)

Identify material unwanted events (MUEs)Identification of MUEs needs to considerhistorical as well as foreseeable eventsgiven the operations and activities atindividual sites. As a result, identification ofMUEs needs to include suitably experiencedpersonnel and a review of relevant data.This will need to include the history fromthe site, company and the industry morewidely. This is because some incidents,while rare, are potentially disastrous.For example, underground ignition ofmethane by lightning is rare but it isforeseeable and potentially disastrous.

Materiality criteriaMateriality criteria define the thresholdthat a risk must exceed before beingconsidered a material risk. The perceivedlikelihood of an event by any one individualmight be inaccurate, especially forlow-probability/high-consequence events.It is recommended that materiality shouldbe defined based on consequences, suchas the maximum foreseeable loss.

Examples of MUEs

The following table is a list of typicalmining- and metals-related MUEs basedon historical analysis.

Key actions• Understand major hazards and identify potential MUEs.

• Apply selection criteria to MUEs with a focus on the consequences.

• Identify design opportunities to address the hazard, reducing thepotential consequences and eliminating the MUE from theCCM process.

• Describe the identified MUE, including the relevent hazard,mechanism of release and nature of the consequences.

Target outcome

Identify the MUEs that need to be managed.

1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2


Table 2: Typical mining- and metals-relatedMUEs based on historical analysis

MINING AND METALS MUEs

Aviation

Underground ground control

Underground fire/explosionHeavy mining equipment

Dropped objects

Pressurized systems

Confined spaces

Inrush/inundation

Explosives

Highwall stability

Flammable gas

Light vehicles

Work at height

Electricity

Hazardous materials




CRITICAL CONTROL MANAGEMENTSTEP 3: Identify controls

The purpose of Step 3 is to identify allthe controls – both existing ones andpotential new ones – before identifyingwhich of the controls are the criticalcontrols in Step 4.

Identify controlsIn most cases, controls will already existas a result of previous risk-assessmentwork, experience within the company orindustry from incidents, or as a result oflegislation and associated guidance. Thisstage recommends that each identifiedMUE should be reviewed to check that the

appropriate controls have been identified.

What is a control?Deciding on what is or is not a control isa key step. The following guidance isavailable:

• the definitions at the start of thisdocument

• the control identification decisiontree (see Figure 2)

• example of a critical control system

given in Step 5 (see Table 3).

Key actions• Identify the controls.

• Prepare a bowtie diagram.

• Assess the adequacy of the bowtie and the controls.

Target outcome

Identify controls for MUEs, both existing controls and possible newcontrols. Prepare a bowtie diagram.

Figure 2: Control identification decision tree

Source: Adapted from Hassall, M, Joy, J, Doran, Cand Punch, M (2015).

NO

NO

NO

YES

NOT ACONTROL

A CONTROL

Is performancespecified, observable,

measurable andauditable?

Does it preventor mitigate an

unwanted event?

Is it a human act,object or system?

YES

YES

1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2





CRITICAL CONTROL MANAGEMENTSTEP 3: Identify controls continued

Too many controlsExperience from other industriessuggests that it is possible to identifya large number of plans, processesand tools that can be inappropriatelyclassified as controls. This leads tounnecessarily complex bowtiesthat dilute the attention needed toeffectively implement those controlsthat can have a direct impact onpreventing and/or mitigating an MUE.Some examples of inappropriatecontrols are:

• management plans

• risk-assessment techniques suchas Step Back 5 x 5

• behaviour-based safety tools.

All of the above are important partsof health and safety managementsystems but are not specific topreventing or mitigating an MUE.Management plans might describecontrols, risk-assessment techniquesmight lead to controls being identified

and behaviour-based safety toolsmight tell us something about howcontrols are working or not working.However, they are not controlsthemselves as defined by thisguidance document.

This guidance document mightdemonstrate that many activities,previously thought to be controls, donot fit the definition or the purpose.For example, previously mentionedprocedures, rules and expectedpractices are not controls. Similarly,

training, supervision, maintenanceand other plans are not controls.

What is a good control?Good controls meet the definitionsgiven in this document and meet thecriteria in the control identificationdecision tree in Figure 2. In addition,they have the following

characteristics:• they are specific to preventing an

MUE or minimizing itsconsequences

• the performance required of thecontrol can be specified

• their performance can be verified.

Further guidance on controlsAdditional information and guidanceon controls can be found in Annex B.

Prepare a bowtieProprietary tools are available, butbowties can also be drawn by hand(eg on a whiteboard) or developed withstandard office productivity software.

There is no one right way to developa bowtie (see as an example inFigure 3). However, this is a criticalstage and the bowtie should beprepared by careful reference to thedefinitions at the start of thisdocument and the additional guidance

given on controls in Annex B.

It is usual to start with the MUE byasking:

• What are the possible causes thatcould lead to the MUE?

• What controls are in place (or could

be put in place) to prevent the causeleading to the MUE?

• What are the maximum foreseeableconsequences of the MUE?(It is usual at this stage to assumethere are no controls in place,which is sometimes referred to aslow-risk.)

• What controls are in place or couldbe introduced to reduce thepossibility of the consequencesoccurring?

Assess the adequacy of the bowtieand the controlsOnce the bowtie is developed, itshould be reviewed:

• to confirm that the controls areappropriate and relevant for eachcause and/or consequence

• against the hierarchy of control –is there overdependence onpeople-type controls compared withengineering controls, which arehigher up the hierarchy of control?

Figure 3: Bowtie diagram indicating preventative and mitigating controls

Unwantedevent

Hazard

Control

Control

Control

Control

Consequence

Consequence

Cause

Cause

PREVENTATIVE MITIGATING



CRITICAL CONTROL MANAGEMENTSTEP 4: Select the critical controls

What is a critical control?The starting point for this step isthe bowties developed in Step 3.The controls identified on the bowtieshould be assessed to determine ifthey are critical controls.

The following questions can help todetermine if a control is critical:

• Is the control crucial to preventingthe event or minimizing theconsequences of the event?

• Is it the only control, or is it backedup by another control in the eventthe first fails?

• Would its absence or failuresignificantly increase the riskdespite the existence of the othercontrols?

• Does it address multiple causes orof mitigate multiple consequencesthe MUE? (In other words, if itappears in a number of placeson the bowtie or on a number ofbowties, this may indicate that it

is critical.)

Critical control decision treeThe decision tree in Figure 4 providedby an ICMM member may also helpdetermine if a control is critical.

Note that the decision tree indicatesthat selecting a critical control may bean iterative process and could involvereviewing several aspects of a controlbefore deciding whether it meets thecriteria for a critical control.

Key actions• When identifying critical controls, apply the critical control definition

and guidance in this section.

• Consider the performance requirements of the potential criticalcontrols and how they could be verified.

• The final set of critical controls for an MUE should represent thecritical few that, when managed using CCM, can effectively managethe MUE risk.

Target outcome

Identify the critical controls for the MUE.


1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2





CRITICAL CONTROL MANAGEMENTSTEP 4: Select the critical controls continued

Figure 4: BHP Billiton critical control decision tree

Source: Adapted from BHP Billiton.

Does controlprevent, detect or

mitigate a materialrisk?

Does controlprevent event

initiation?

Does controlprevent or detectevent escalation?

Is controleffective for multiple

risks?

Is controlindependent?

Is controlthe only barrier?YES

NONO

NO

YES

NO

NO

Not a critical control

Identified control

Critical control

YES

YES

YES

YES

NO



CRITICAL CONTROL MANAGEMENTSTEP 5: Define performance and reporting

Step 5 involves examining theobjectives, performance requirements(including current performance) andreporting mechanisms for a criticalcontrol. The following questionsshould be considered when definingeach of these points:

• What are the specific objectives ofeach critical control?

• What performance is required of thecritical control? (This is sometimesreferred to as a performancestandard.)

• What activities support or enablethe critical control to perform asrequired and specified?

• What checking is needed to verifythat the critical control is meetingits required performance? Howfrequent is the verification needed?What type of verification is needed?

• What would initiate immediateaction to shut down or change anoperation or improve the

performance of a critical control?

Control information summaryFor each critical control the followinginformation is needed:

• The name of the critical control

• What are the specific objectives ofthe critical control?

• What performance is needed fromthe critical control?

• What activities support the

performance of the control to thestandard?

• What verification activities areneeded to ensure the critical controlis meeting its requiredperformance?

An example of a critical controlsystem for a specific MUE is providedin Table 3.

Key actions• Define objectives and performance requirements for each critical

control.

• Identify current activities that affect the critical control’sperformance.

• Describe activities to verify performance and reportingrequirements.

• Identify what would trigger immediate action to stop or change theoperation and/or impose the performance of the critical control.

Target outcome

Define the critical controls’ objectives, performance requirements andhow performance is verified in practice.


1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2





CRITICAL CONTROL MANAGEMENTSTEP 5: Define performance and reporting continued

Table 3: Health example (a critical control system)

1 What is the name of the critical control for diesel particulate overexposure (MUE)?Enclosed cab on mining equipment

2 What are its specific objectives related to the MUE?To restrict the access of diesel particulates into the operators’ environment to levels well below the occupational exposure limit

6 What is the target performance for critical control?

100 per cent of inspection and tests either satisfactory or repair is done before truck is put back into operation

7 What is the critical control performance trigger for shutdown, critical control review or investigation?5 per cent of inspections and tests indicate cab ventilation issues that cannot be resolved or are not resolved before truck returnedto service

3 What are the critical controlperformance requirements to meetthe objectives?

Positive pressure cabin environmentmaintained to level that prevents ingress of

diesel particulates

Pressure differentiator indicator thatalarms when pressure drops belowcritical level

Air intake filter operating at greater than99% efficiency

4 What are the activities within themanagement systems that supporthaving the critical control able to dowhat is required?

Scheduled maintenance and calibration ofindicator according to manufacturer’s

requirements

Pre-shift filter housing inspection fordamage

Filter inspection at planned maintenanceevery 500 hours

Filter change-out every 1,000 hours

5 What can be sampled from the set ofactivities for verification, providing aclear image of the critical controlstatus?

Review maintenance and calibrationrecords

Review alarm log and corrective actiontaken

Review documented pre-start inspections

Review 500-hour inspection records

Review 1,000-hour change-out records



CRITICAL CONTROL MANAGEMENTSTEP 6: Assign accountability

To ensure the risk of an MUE is beingmanaged, the controls must beworking effectively. This requires thehealth of the controls to be monitoredthrough verification activities that areassigned to specific (or multiple)owners. This can be described in averification and reporting plan.

The verification and reporting planmust include:

• an MUE owner (this should be asenior line manager responsible for

the operation)

• a critical control owner, who shouldbe a line manager responsible foroperations (they are responsible formonitoring the health of the criticalcontrols through review ofverification activity reports)

• a verification activity owner,responsible for undertaking andreporting the verification activityoutcome

• a communication plan among all

owners (see as an example Figure 5)

• a description of verification activities

• an owner for the review ofverification reports at a senior linemanagement level.

An example of a verification andreporting plan for a health MUE ispresented in Table 4.

Key actions• Assign owners for MUEs, critical controls and verification activities.

• Describe reporting plan for the health of critical controls.

• Assign owner for review of reports.

Target outcome

A list of the owners for each MUE, critical control and verificationactivity. A verification and reporting plan is required to verify and reporton the health of each control.


1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2





CRITICAL CONTROL MANAGEMENTSTEP 6: Assign accountability continued

Figure 5: A sample CCM management framework

Table 4: Example of a critical control verification and reporting plan for an MUE

MATERIAL UNWANTED EVENT (MUE)Diesel particulate overexposure

MUE ownerUnderground mine manager

Role of MUE owner:

• Review reports monthly* fromrelevant critical control owners.

• Decide on required action.

CRITICAL CONTROLPositive pressure cabin environmentmaintained

Critical control ownerUnderground mine maintenancesuperintendent

Role of critical control owner:

• Review verification activity reportsweekly*.

• Report summary to the MUE owner.

VERIFICATION ACTIVITYReview maintenance and calibrationrecords

Verification activity ownerMaintenance supervisor who overseesthe relevant equipment/task

Role of verification activity owner:

• Gather and review information-basedverification activity requirements andcompare to expectations.

• Initiate actions.

• Submit weekly* verification summaryreport to the critical control owner.

Note: * this is an example timeline only.

D E F

I N E D E X P E C T A T I O N

V E R I F Y A N D R E P O R T

MUE OWNER ACCOUNTABILITY

Critical Control 1owner accountability

VerificationActivity 1

owner


owner


owner


owner

Critical Control 2owner accountability

Critical control 1 Critical control 2



CRITICAL CONTROL MANAGEMENTSTEP 7: Site-specific implementation

Steps 1 to 6 may have taken place at thecorporate or business unit level in acompany that has similar sites and thereforecommon MUEs. Step 7 requires that theprevious steps be reviewed to ensure theyare appropriate and applicable to each site.

Figure 6 describes the process required todevelop a site specific MUE control strategyand subsequent implementation and rollout. It involves taking the corporate orbusiness unit MUE control strategydeveloped in steps 1 to 6 and adjusting it tosuit the local context.

A site-specific approach for a MUE shouldinclude an overall MUE verification andreporting plan, subsections of which define aspecific critical control owner’s verificationplan and the individual verification activitiesfor a critical control. The site specificstrategy may need to be tested with thecorporate or business unit level beforeproceeding. Once agreed, a plan toimplement the strategy at the site willneed to be developed. The plan shouldinclude leadership, accountabilities, a

communications plan, standards anddeveloping knowledge and understandingrelated to the critical controls.

The feedback loop between Steps 6 and 7,as shown in the CCM process diagramabove, indicates the iterative aspect ofStep 7 where the site submits their CCMplans to the corporate or business unitbefore finalization.

Key actions• Critical control information must be specific to a site or asset.

• Adjust the critical control definition, performance information andverification requirements as necessary to suit the local context.

• Site-specific planning for implementation may involve aniterative process.

• Site-specific planning should include establishing a foundation forCCM that includes leadership, communication and appropriatedevelopment of knowledge and understanding related to thecritical controls.

Target outcome

Defined MUE verification and reporting plans, and an implementationstrategy based on site-specific requirements.


Figure 6: Developing a site specific controlstrategy adjusted to suit local requirements

FILTERSite specific context

Corporate MUE control strategy

Site specific MUE control strategy

Includes adjusted: • critical control definition• performance information• verification requirements

Site implementation and roll out

Leadership Knowledge Accountabilities

Communication Standards

1

Planning theprocess

3

Identify controls

4


8


5


7


6


9


2





CRITICAL CONTROL MANAGEMENTSTEP 9: Response to inadequate critical control performance continued

For the inadequate performance of thecritical control in an incident:

• What critical controls failed?

• How did the critical control fail orperform inadequately?

• What were the causes of the failureor inadequate performance of thecritical control? In order todetermine the cause it can behelpful to ask the “5 Whys”.

Based on the answers to the last

question, the following sample criticalcontrol questions might also behelpful:

• Was the critical control designed tooperate in the incident situation?

• Was the description of the criticalcontrol performance requirementsadequate?

• Did the defined critical controlperformance requirements includethe management activities that arerequired to ensure its function inthe circumstances of the incident?

• Did the owners and operators of thecritical control understand itsobjective, design and operation(ie are they suitably trained and/orexperienced)?

• Was the appropriate critical controldocumentation available to allrelevant control operators?

• Did the verification activities checkthe status of the control in a manner

that could have avoided theincident?

• Did the verification reporting systemcommunicate critical control statusprior to the incident to initiaterequired action and to prevent theincident?

The investigation of critical controlfailures and a subsequent criticalcontrol review process shouldestablish required improvements orchanges related to the critical control,including modification of performancerequirements and the verificationactivities, or even replacement of thecritical control with another control.

As such, critical control failureinvestigation and review providesimportant lessons learned forcontinuous improvement of the CCM

– hence, its circular design.

Note that investigation might alsosuggest a review of the MUE or theaddition of a new MUE, requiring areturn to Step 2.




R i o T i n t o

Buy-in from seniorexecutives is a

fundamentalcharacteristic ofthe organizationalmaturity required tosucceed with CCM.




APPENDIX BGuidance on critical controls

Method to assess control adequacyFigure B1 shows a sample controladequacy analysis method developedby an ICMM member. This exampleincludes three control schemes:people based, system based andengineering based.

The illustration shows seven levelsof event severity where Level 7 is thehighest. It also suggests that the mosteffective controls for the highest-severity levels are engineering based(or objects), that is Control Level 4, 5

and 6. Note that control levels equateto levels of reliability.This frameworkcan assist with discussion on theadequacy of controls for severeconsequences or an MUE.

Following is an overview of the supportinformation for Figure B1.

People-based controlsThese rely on the skills, knowledgeand experience of individuals orgroups. Control actions (or acts) are

initiated by individuals based on theirskills, knowledge and experience andon their interpretation of theorganization’s values and objectives.Given the reliance on people, thereliability of people-based controlsmay vary over time. People-basedcontrols (or acts) have three levels ofadequacy based on considerationssuch as degree to which peopleunderstand the roles andresponsibilities, how skilled andtrained they are and the overall levelof process discipline. Note that even

the highest-level control, a Level 3,is not seen to be adequate for high-severity consequences or MUEs.

System-based controlsThese are executed by individualswithin the bounds of a managementsystem. Execution is based on aprescribed approach either as acommon practice or as a definedprocedure and in some instances,input from people is governed bysystem-set rules and protocols.

Control reliability is achieved throughthe system surrounding the control,including management review andfollow-up. Systems-based controlspotentially range in adequacy fromLevel 1 to Level 5, where Level 5 is

suitable for an MUE. A Level 5 system-based control has a documentedprocedure including document control,there are system-set rules andprotocols (access, authority levels,expected control range), operators aretrained in the procedure including

periodic assessment, control outcomeperformance is clearly defined andverified (similar to the suggestedCCM approach) and the system designis covered by a rigorous changemanagement process.

Engineering-based controls (or objects) These execute automatically and donot require human intervention.Engineering-based controls mayinclude both hardware and automatedIT-based controls. Engineering controlsare designed to achieve a specific

repeatable level of control to a set levelof availability. Reliability of engineeringcontrols is achieved through themanagement system surrounding theongoing review and improvement ofthe controls performance. Engineeringcontrols can achieve the highest levelof adequacy ranging from 4 to 6.Levels 5 and 6 are suitable for MUEs.These controls are designed andimplemented to specific performancecriteria (availability and reliability), aremanaged as part of a preventative

maintenance system, have a system-generated alarm/notification in theevent of control failure and havemanagement follow-up of systemdeficiencies, and there is a rigorousmanagement of change.

This method can be used to establisha control level for an individual controlby assigning the relevant adequacyrating (green, yellow or red) based onconsideration of the control level andpotential consequence. The methodcan be repeated for all controls in the

MUE bowtie analysis (BTA). Also, thegraphic BTA can be modified to showthe relevant colour for each control.

Once every control in the BTA iscategorized red, yellow or green, theBTA can be evaluated to consider theoverall risk-control strategy. As aguide, tolerable risks will have atleast one green control per cause.As a result of applying this controladequacy analysis method to an MUEBTA, there should be an opportunity to:

• confirm that the overall MUE controlstrategy is adequate and the risk istolerable, or

• identify causes for which controlenhancements are required.

Successful definition of a well-derivedBTA for the selected MUE, whichincludes agreement that the overallcontrol strategy is adequate, willprovide the basis for critical controlselection in Step 4. An example of aBTA is provided in Figure B2.

Other analysis methods for examiningcontrol design adequacy or overallcontrol effectiveness are availablein Hassall, M, Joy, J, Doran, C andPunch, M (2015).

Figure B1: Example control adequacy analysis method

Sources: BHP Billiton and MMG.

Control design likely to be appropriateControl design may require enhancement

Control design likely to require enhancement

Response type

CONTROLLEVEL

6

5

4

3

2

1

Peoplebased

Systembased

Engineeringbased

Response by CONTROL SCHEME

M i n i m u m

r e c o m m e n d e d

c o n t r o l l e v e l

Potential risk severity

1 2 3 4 5 6 7

6

5

4

3

2

1




APPENDIX BGuidance on critical controls continued

C O N S E Q U E N C E S

T H R E A T S / C A U S E S

C O

N T R O L S

C O N T R O L S

Figure B2: Health BTA example

P u r c h a s e d a s p e r

T i e r 3 o r 4 p o l i c y

B i o d i e s e l f u e l

u s e d

L o w s u l p h u r

d i e s e l u s e d

( 1 0 p p m

)

L o w a s h o i l s

u s e d

C l o s e d c r a n k c a s e

v e n t i l a t i o n d e s i g n

F i l t e r e d o p e n

c r a n k c a s e


C l o s e d c r a n k c a s e


F i l t e r e d o p e n

c r a n k c a s e


F u l l - f l o w d i e s e l

p a r t i c u l a t e f i l t e r

u s e d

P a r t i a l - f l o w d i e s

e l

p a r t i c u l a t e f i l t e r

u s e d

D i e s e l o x i d a t i o n

c a t a l y t i c f i l t e r

u s e d

F i l t r a t i o n s y s t e m

w i t h d i s p o s a b l e

f i l t e r e l e m e n t s

u s e d

L i m i t i n g t h e

n u m b e r o f

v e h i c l e s i n a n a r e a

R o a d s m a i n t a i n e

d

t o m i n i m i z e

e n g i n e l o a d

“ N o i d l i n g p o l i c y ”

f o l l o w e d

E q u i p m e n t

o p e r a t e d c o r r e c t

l y

f o r e m i s s i o n

m i n i m i z a t i o n

F u e l a d d i t i v e s

u s e d

D i e s e l v e h i c l e

m a i n t a i n e d t o

p l a n

P o s t - s e r v i c e

t a i l - g a s

m e a s u r e m e n t s

t a k e n a n d r e v i e w

e d

P r e -

s h i f t t a i l - g a s

m e a s u r e m e n t s

t a k e n a n d r e v i e w e d

S y n t h e t i c f u e l s

u s e d

E n g i n e r e p l a c e d

a s p e r p l a n

E

x c e s s i v e

e x

p o s u r e t o

d i e s e

l p a r t i c u l a t e

m

a t t e r a n d

g a s e s

O l d e n g i n e

t e c h n o l o g y

F u e l a n d

l u b r i c a t i n g o i l

c o m p o s i t i o n

C r a n k c a s e

e m i s s i o n s

N o e x h a u s t

a f t e r - t r e a t m e n t

P o o r o r i n a d e q u a t e

m a i n t e n a n c e

p r a c t i c e s

O p e r a t i n g

c o n d i t i o n s

I n a p p r o p r i a t e

v e h i c l e

o p e r a t i o n

E x c e s s i v e d i e s e l

p a r t i c u l a t e m a t t e r

a n d g a s e s

a c c u m u l a t i o n i n

t h e w o r k p l a c e

a t m o s p h e r e

E x c e s s i v e d i e s e l


a n d g a s e s

a c c u m u l a t i o n a t

t h e o p e r a t o r

p o s i t i o n

P e r s o n a l e x p o s u r e

t o d i e s e l


a n d g a s e s

I l l - h e a l t h e f f e c t s

f r o m

e x c e s s i v e

e x p o s u r e 1

S p o t v e n t i l a t i o n

s y s t e m

D i l u t i o n b y

v e n t i l a t i o n

s y s t e m

M e d i c a l

s u r v e i l l a n c e

p r o g r a m

O c c u p a t i o n a l

h y g i e n e p r o g r a m

O p e r a t o r e n c l o s e d

i n e n v i r o n m e n t a l

c a b i n

R e s p i r a t o r y

p r o t e c t i v e

e q u i p m e n t u s e d

U n a c c e p t a b l e

d i e

s e l e n g i n e

e m i s s i o n s i n t o

w

o r k p l a c e

a t m o s p h e r e

1

O c c u p a t i o n a l h y g i e n e m o n i t o r i n g a n d m e d i c a l s u r v e i l l a n c e a r e

u s e d t o m o n i t o r t h e e f f e c t i v e n e s s o f c o n t r o l s o n

t h e

“ l e f t h a n d ” s i d e o f t h e u n w a n t e d e v e n t b u t a

r e a l s o r e g a r d e d a s c o n t r o l s i f u s e d t o r e d u c e

t h e s e v e r i t y o f t h e c o n s e q u e n c e o n t h e

“ r i g h t h a n d ” s i d e .



APPENDIX CCCM lead and lag indicators continued

The UK HSE suggests that both lagand lead indicators should be usedfor MUE risk management.The illustration below is from theirguide, Developing process safety indicators (Health and Safety Executive(HSE) 2006). Their focus is the “riskcontrol system”, which we canconsider synonymous with our CCMsystem – the result of applying theCCM process in this document.

Like the UK HSE, this documentrecommends that both lag and lead

indicators be established to measurethe CCM system.

These measures can also be usedto define key performance indicatorsat various levels of the organization.The CCM process defines verificationand reporting activities. For additionalinformation relating to the importanceof developing key performanceindicators, please refer to InternationalAssociation of Oil & Gas Producers(2011).

This ICMM document alsorecommends regular review of theentire CCM process and system in

order to identify the degree to whichthe initiative is being implemented andoperated to expectations. An annualreview of the CCM initiative couldinvolve a gap analysis comparingactual status with the original scopeand the detailed execution of allsteps in the process, including themeasurement of performance and theuse of key performance indicators.

This information can also assist withthe continuous improvement of theCCM process.

Additional information on leadingindicators can also be found in theICMM publication Overview of leading indicators for occupational health and safety in mining (ICMM 2012).


Figure C2: UK HSE illustration of “Dual assurance – leading and lagging indicators measuring performance of eachcritical risk control system”

Source: Health and Safety Executive (HSE) 2006.

Use the information from indicators to:

RISK CONTROL SYSTEM (RCS)

Follow up adverse findingsto rectify faults in the safety

management system

ACTIVE MONITORING

Leading indicator:Process or input indicators

Processes or inputs are theimportant actions or activities

within the RCS that are necessary to deliver the desired

safety outcome

REACTIVE MONITORING

Lagging indicator:Outcome indicator

An outcome is the desiredsafety condition that the RCS

is designed to deliver

Regularly review performanceagainst all indicators to check

effectiveness of safety managementsystem and suitability indicators



APPENDIX DReferences


Hassall, M, Joy, J, Doran, C and Punch, M (2015).Methods for selection and optimisation of critical controls . ACARP report no C23007.Available atwww.acarp.com.au/reports.aspx (March 2015).

Health and Safety Executive (HSE) (2006).Developing process safety indicators: a step-by-stepguide for chemical and major hazard industries . HSG254.Available atwww.hse.gov.uk/pubns/priced/hsg254.pdf.

ICMM (2009).Leadership matters: the elimination of fatalities .

London, ICMM.

ICMM (2012).Overview of leading indicators for occupationalhealth and safety in mining .Report. London, ICMM.

International Association of Oil & Gas Producers (2011).Process safety: recommended practice on key performance indicators . IOGP report no 456.Available atwww.iogp.org/pubs/456.pdf.

National Offshore Petroleum Safety and EnvironmentalManagement Authority (NOPSEMA) (2012).Control measures and performance standards .Guidance note N04300-GN0271, Revision no 4.Available atwww.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0271-Control-Measures-and-Performance-Standards.pdf.

http://www.acarp.com.au/reports.aspx

http://www.hse.gov.uk/pubns/priced/hsg254.pdf

http://www.iogp.org/pubs/456.pdf

http://www.nopsema.gov.au/assets/Guidance-notes/N-04300-GN0271-Control-Measures-and-Performance-Standards.pdf



http://www.acarp.com.au/reports.aspx

http://www.hse.gov.uk/pubns/priced/hsg254.pdf

http://www.iogp.org/pubs/456.pdf







R i o T i n t o

CCM is an integral partof risk managementwith a focus on theidentification and

performance monitoringof critical controls toprevent the realizationof material risks.



ACKNOWLEDGEMENTS

This document wasprepared based ona review of ICMMmember practices.The additional inputfrom the followingpeople and companiesis gratefullyacknowledged.

Consulting team

The process outlined in the documentwas developed by Jim Joy (Jim Joy &Associates Pty Ltd), Michael Byrne(Michael Byrne & Associates Inc.) andJeff Burges (Mel and Enid ZuckermanSchool of Public Health, University ofArizona). An independent technicalreview and edit was provided by PeterWilkinson (Noetic Risk Solutions).It was edited by Stu Slayen, proof readby Richard Earthy and designed byDuo Design.

ICMM members

The development of the document wasoverseen by an ICMM working groupwith additional technical supportprovided throughout the process.ICMM is indebted to the following fortheir contributions to the research andtheir engagement on iterative draftswhich led to the final document.

Working group

Chair: Andrew Lewin (BHP Billiton)

Nerine Botes Schoeman(African Rainbow Minerals)

Cas Badenhorst (Anglo American)

Frank Fox (Anglo American)

Gareth Williams (Anglo American)

Craig Ross (Barrick)

André Fey (Hydro)

Barries Barnard (Lonmin)Phil Stephenson (Newmont)

Additional technical support

Ian Home (Anglo American)

George Coetzee (AngloGold Ashanti)

Felipe Fuentes (Barrick)

Rob McDonald (BHP Billiton)

Tony Egan (Glencore)

Andrew McMahon(Minerals Council of Australia)

Martin Webb (MMG)

Ben Huxtable (MMG)

Anthony Deakin (Rio Tinto)

ICMM team

Hannes Struyweg and Mark Holmesled the process to develop thisdocument on behalf of the ICMMsecretariat. Communication supportwas provided by Holly Basset andLaura Pocknell.

PhotographsFront cover – copyright © Rio Tinto

Page 6 – copyright © Anglo American

Page 22 – copyright © Rio Tinto

Page 29 – copyright © Rio Tinto




DisclaimerThis publication contains general guidanceonly and should not be relied upon as asubstitute for appropriate technicalexpertise. While reasonable precautionshave been taken to verify the informationcontained in this publication as at the dateof publication, it is being distributedwithout warranty of any kind, either expressor implied.

In no event shall the International Councilon Mining and Metals (“ICMM”) (or itsaffiliates or contributors, reviewers or

editors to this publication) be liable fordamages or losses of any kind, howeverarising, from the use of, or reliance onthis document. The responsibility for theinterpretation and use of this publicationlies with the user (who should not assumethat it is error-free or that it will be suitablefor the user’s purpose) and ICMM assumesno responsibility whatsoever for errors oromissions in this publication or in othersource materials which are referenced bythis publication.

The views expressed do not necessarilyrepresent the decisions or the stated policy

of ICMM. This publication does not constitutea position statement or other mandatorycommitment which members of ICMM areobliged to adopt under the ICMM SustainableDevelopment Framework.

We are not responsible for, and make norepresentation on, the content or reliabilityof linked websites, and linking should not betaken as endorsement of any kind. We haveno control over the availability of linkedpages and accept no responsibility for them.

The designations employed and thepresentation of the material in this

publication do not imply the expression ofany opinion whatsoever on the part of ICMMconcerning the legal status of any country,territory, city or area or of its authorities,or concerning delimitation of its frontiersor boundaries. In addition, the mentionof specific entities, individuals, sourcematerials, trade names or commercialprocesses in this publication does notconstitute endorsement by ICMM.

This disclaimer should be construed inaccordance with the laws of England.

Publication detailsPublished by the International Council onMining and Metals (ICMM), London, UK.

© 2015 International Council on Mining andMetals. The ICMM logo is a trade mark ofthe International Council on Mining andMetals. Registered in the United Kingdom,Australia and Japan.

Reproduction of this publication foreducational or other non-commercialpurposes is authorized without prior writtenpermission from the copyright holders

provided the source is fully acknowledged.Reproduction of this publication for resaleor other commercial purposes is prohibitedwithout prior written permission ofthe copyright holders.

ISBN: 978-1-909434-13-4

Available from:ICMM, www.icmm.com, [email protected]



mailto:[email protected]







ICMM

35/38 Portman SquareLondon W1H 6LRUnited Kingdom Follow us

About ICMMThe International Council on Mining and Metals is anindustry body created by leading mining and metalscompanies to catalyze strong environmental and socialperformance in the sector; and to enhance understanding ofthe benefits, costs, risks and responsibilities of mining andmetals in contemporary society. It works as a not-for-profitorganization, engaging with all parts of society andcollaborating with 21 major mining and metals companiesand 35 national mining and commodity associations thatare its members.

ICMM is governed by the CEOs of the following companies:

African Rainbow Minerals

AngloGold Ashanti

Anglo American

Antofagasta Minerals

Areva

Barrick

BHP Billiton

Codelco

Freeport-McMoRan

Glencore

GoldcorpGold Fields

Hydro

JX Nippon Mining & Metals

Lonmin

Mitsubishi Materials

MMG

Newmont

Rio Tinto

Sumitomo Metal Mining

Teck

icmm health and safety critical control managment good practice guide

Documents