risk criteria - when is low enough good enough

7/29/2019 Risk Criteria - When is Low Enough Good Enough

1/8

12 June 2007 Page 1 of 8

Risk Criteria When is low enough good enough?By Steve Lewis, Director, Risktec Solutions Limited

ABSTRACT

Criteria are used to help decide whether the riskassociated with a project or activity is low enough toproceed. The key question then, is when is lowenough good enough?

This paper describes the flexible framework in use inthe oil, gas and petrochemical industries for decidingon the tolerability of risk. The levels of individual riskthat are generally accepted world-wide as intolerableare presented. The situation is not so straight-forward for societal risk, where there is a widevariation in both regulatory and operator criteria.

In reality, the risks associated with most facilities liein the middle band of the risk tolerability framework

the ALARP region. This paper describes theprocess used to demonstrate that risk levels havebeen reduced to ALARP. Insights are provided onthe appropriate tools to apply during the life of afacility. It is concluded that, in practice, this amountsto taking a balanced view and reaching a defensibleconsensus amongst stakeholders.

INTRODUCTION

No industrial activity is entirely free from risk and somany companies and regulators around the worldrequire that safety risks are reduced to acceptablelevels. The key question then is what level of risk isconsidered to be low enough? A subsidiary questionis also what risk are we talking about, individual riskor societal risk? This paper attempts to answer thesequestions.

Why have Risk Criteria?

Risk criteria are standards used to translatenumerical risk estimates, e.g. 10-7 per year, asproduced by a quantitative risk assessment (QRA),into value judgements such as negligible risk thatcan then be set against other value judgements suchas high economic benefit in the decision-makingprocess (CMPT 1999).

Put more simply, criteria are used to help decidewhether the risk associated with a project or activityis low enough to proceed.

A Framework for Risk Criteria

The most common and flexible framework used for

risk criteria divides risks into three bands (HSE2001):

An unacceptable region, where risks areintolerable except in extraordinarycircumstances, and risk reduction measures areessential.

A middle band, or ALARP region, where riskreduction measures are desirable, but may notbe implemented if their cost is disproportionateto the benefit achieved.

A broadly acceptable region, where nofurther risk reduction measures are needed.

This framework is shown in Figure 1.

Figure 1 Framework for Tolerability of Risk

Unacceptableregion

Broadlyacceptableregion

TolerableALARP regionRisk is taken onlyif a benefit isrequired

Risk cannot be justifiedsave in extraordinarycircumstances

Tolerable only if riskreduction is impracticableor if its cost is grosslydisproportionate to theimprovement gained

Tolerable if cost ofreduction would exceedthe improvement

Necessary to maintainassurance that riskremains at this level

To define these bands, two levels of risk criteria arerequired; a maximum tolerable criterion above whichthe risk is intolerable and a broadly acceptablecriterion below which the risk is insignificant.

Risk Measures for Loss of Life

Risks to people may be expressed in two main forms:

1. Individual risk the risk experienced by anindividual person

2. Societal (or group) risk the risk experiencedby the whole group of people exposed to thehazard. Where the people exposed aremembers of the public, the term societal risk isoften used. Where workers are isolated andmembers of the public are unlikely to beaffected, the term group risk is often used.Here, the term societal risk is used to

encompass both public and worker risk.


2/8


The maximum tolerable (upper) criterion and thebroadly acceptable (lower) criterion in use in the oil,gas and petrochemical industries are described in thispaper, firstly for individual risk and then for societal

risk.

INDIVIDUAL RISK

Individual risk criteria are intended to show thatworkers or members of the public are not exposed toexcessive risk. They are largely independent of thenumber of people exposed and hence may be appliedto a broad range of activities.

Individual risk is calculated by identifying all sourcesof fatality risk to a given individual, deriving thecontribution from each source and then summingthese to give the overall risk. For typical oil, gas and

petrochemical workers the primary sources of riskare:

Occupational, e.g. slips and falls, drowning Transport, e.g. road traffic accidents, air

transport accidents

Hydrocarbon related, e.g. loss of containmentleading to toxic releases, fires or explosions

What are the levels of the Upper and LowerCriteria for Individual Risk?

Individual risk criteria are most commonly expressedin the form of individual risk per annum (IRPA).

Today, the following IRPA values for these criteriaare generally regarded internationally as applicablefor hazardous industries:

Table 1 Individual Risk Criteria

Workers Members of Public

Maximum tolerablecriterion

10-3

per yr 10-4

per yr

Broadly acceptablecriterion

10-6

per yr 10-6

per yr

An IPRA of 10-3

per year was first used by the UK

HSE as the maximum tolerable criterion because itapproximated to the risk experienced by high riskgroups in mining, quarrying, demolition and deep seafishing (HSE 1992). As such, it would appear quitelenient for offshore and onshore oil, gas andpetrochemical facilities. This is borne out by typicalrisk levels on offshore installations (which generallyhave higher risk levels than onshore facilities) shownin Figure 2 (HSE 1995).

Figure 2 Risks on Representative OffshoreInstallations

Risks on Representative UK OffshorePlatforms

1.0E-04 1.0E-03

Large, old integrated

Semi-sub drill rig

J ack-up drill rig

Small integrated

Large, modern

integrated

Bridge-linked complex

IRPA

Comparing risks is not a straight-forward task, but

nevertheless Table 2 shows how many risky activitiesan individual would need to undertake in one year to

reach an IRPA of 10-3

per year (derived from HSE2001).

Table 2 Risky Activities

Activity

Number of activities in oneyear that equals and IRPA of

10-3

per year

Hang-gliding 116 flights

Surgical anaesthesia 185 operations

Scuba diving 200 dives

Rock climbing 320 climbsThis further illustrates that 10-

3per year is actually

quite high. However, in practice, few modernfacilities with proactive risk reduction strategies have

risk levels approaching 10-3

per year. This tends tobe recognised in company risk tolerability standards,where benchmark design targets are often set for

new facilities in the region of 3x10-4

to 1x10-4

per

year. Risk levels are rarely ever insignificant, i.e. less

than 10-6

per year and therefore tend to lie in themiddle band of the risk tolerability framework the

ALARP region.

Summary Individual Risk Criteria

The maximum tolerable IRPA criteria of 10-3

per year

for site workers and 10-4

per year for members of the

public are generally accepted internationally.However, these levels are rather lenient for mostfacilities and companies often set more stringentcriteria as much as 10 times lower for new designs.


3/8


SOCIETAL RISK

All fatal accidents are a cause for regret, but societygenerally tends to be more concerned about multiple

fatalities in a single event. While such low-frequencyhigh-consequence events might represent a verysmall risk to an individual, they may be seen asunacceptable when a large number of people areexposed. Such incidents can significantly impactshareholder value and, in some cases, the companynever recovers (Sedgwick 2002).

The concept of societal risk is illustrated in Figure 3.Situations A and B have equal individuals risk levels(IR and IR) but B has a larger societal risk (SR)because more people are exposed (Jonkman 2003).If the individual risk levels are acceptable, when is

the societal risk not acceptable?Figure 3 Societal Risk

Risk source

A

IR

IR

Risk source

A

IR

IR

Risk source

B

IR

IR

IRA = IRBSRA < SRB

Criteria may be defined to limit the risk of majoraccidents and help target societal risk reductionmeasures such as restrictions on concurrent activitiesor land use, enhanced engineered safeguards, andimproved building siting or protection.

Multiple-fatality accidents cansignificantly impact shareholder value

and, in some cases, the companynever recovers

FN-Diagram

A common form of presenting risk tolerability criteriafor societal risk is on an FN-diagram, where twocriteria lines divide the space into three regions where risk is intolerable, where it is broadlyacceptable and where it requires further assessmentand risk reduction as far as is reasonably practicable,as shown in Figure 4. This is the same frameworkfor risk tolerability as shown in Figure 1 above.

Figure 4 Illustrative FN-Criteria

1.0E-09

1.0E-08

1.0E-07

1.0E-06

1.0E-05

1.0E-04

1.0E-03

1.0E-02

1.0E-01

1 10 100 1,000 10,000

Number o f Fatalities (N)

Freq

uencyofEventswithNorMoreFatalities(perye

ar)

Intolerable

Further assessment

& risk reductionBroadly

acceptable

Example FN-curv e

exceeds criteria here

FN-criteria are not without their drawbacks but theyare undoubtedly helpful when used in context. Theyclearly show the relationship between frequency andsize of accident. A steep criterion slope also builds inmultiple fatality aversion and favours design conceptswith lower potential for large fatality events. Thepros and cons of FN-criteria are summarised in Table

3.

Table 3 Pros and Cons of FN-Criteria

Pros Cons

Clearly shows relationshipbetween frequency & size ofaccident

Allows judgement on relativeimportance of different sizesof accident

Slope steeper than -1provides explicitconsideration of multiplefatality aversion & favoursconcepts with lower potentialfor large fatality events

Allows company to manageoverall risk exposure fromportfolio of all existing andfuture facilities

Cumulativeexpression makes itdifficult to interpret,especially by non-risk specialists

Can be awkward toderive

May be difficult touse if criterion isexceeded in onearea but otherwiseis well below

Much debate aboutcriterion lines


4/8


What are the levels of the Upper and LowerCriteria for Societal Risk?

Unfortunately, unlike individual risk criteria, there areno single one-size-fits-all criteria for societal risks in

use by operators and regulators in the major hazardindustries world-wide. Indeed, the variation inregulatory criteria is very wide, as shown by theupper tolerability criterion lines in Figure 5, whichspan a factor of over 100. The Dutch criterion is sorestrictive that it raises a question about its merits.

Figure 5 Regulatory Upper TolerabilityFN-Criteria

A number of operators, including US corporations, dohave their own FN-criteria or guidelines for theirfacilities but many others, including Europeancorporations, do not. A review of a relatively smallsample of international operators FN-criteria shows asimilarly wide variation to that seen in regulatorycriteria, Figure 6.

Figure 6 Operator Upper TolerabilityFN-Criteria

For a company operating in regions where there areno regulatory criteria to meet, the choice of criteriato help decision-making therefore largely comesdown to one of company values, i.e. the perceptionsof the stakeholders directly affected by the decision

and the values of the company in terms of its safetycommitment and reputation.

When is too big too often?

Expressed from a dispassionate business perspective,the company must decide how frequently large-fatality accidents would need to occur before thecompanys survival is put severely at risk due to theadverse reaction of shareholders, the regulator,media and public.

To illustrate this point, assume for example that acompany believes that its future survival would be

severely threatened if an accident causing 10 ormore fatalities occurred more regularly than onceevery 10 years across all of its facilities, and if anaccident causing 100 or more fatalities occurred moreregularly than once every 300 years. A straight linecan then be drawn between these two points andextrapolated to higher values of N. The slope of theline will determine whether large fatality aversion isincluded or not; in this example the slope is -1.5,implying a relatively high aversion.

Furthermore, if the company operated 30 facilities, itmight decide to allocate its risk evenly between each

facility. The resulting company upper criterion isshown in Figure 7 below, together with the single


5/8


facility criterion line if the company operated 30facilities.

Figure 7 Illustrative Company-wideFN-Criteria

1.0E-09

1.0E-08

1.0E-07

1.0E-06

1.0E-05

1.0E-04

1.0E-03

1.0E-02

1.0E-01

1.0E+00

1 10 100 1,000 10,000

Number o f Fatalities (N)

FrequencyofEventsw

ithNorMoreFatalities(peryear)

Company "risk appetite" upper criterion (illustrative)

Equal risk allocation between 30 facilities

10 fatalities every 10 year s

100 fatalities

every 300 years

An FN-curve for a single facility that lies on thewrong side of the facility criterion line would use upan excessive proportion of the company risk appetite.

In practice, the criterion line may be a reporting line,above which a higher level of corporate scrutinywould be applied. Only then can the decision bemade by senior corporate management to proceedwith the project or continue existing operations.

This example assumes the company allocates thetotal risk evenly between each of its 30 facilities. Avariation on this is to allocate the total risk inproportion to the size of facility. While the approachhas some merit (it recognises larger facilitiesgenerate greater economic value), it has one majordisadvantage in that it may be misused to keepfacilities on the right side of the criteria.

PLL Criteria as an Alternative to FN-Criteria

The other main measure for societal risk is theannual fatality rate, where the frequency and numberof fatalities are combined into a potential loss of life(PLL), which is a convenient one-dimensionalmeasure of the total number of expected fatalities.

PLL is well suited for comparing alternative solutionsfor the same facility, is relatively easy to understandfor non-risk specialists and must be calculated to beable to derive the cost-effectiveness of risk reduction

options. However, no information is provided on therelationship between frequency and size of theaccident, it is difficult to draw meaningful conclusions

from completely different facilities, and it oftenfavours the concept that has the lowest manninglevel.

As such, there is little benefit to be gained in limiting

PLL by explicit criteria. It is extremely rare(unknown) for organisations to have such limits.

Risk Contour Criteria as an Alternative

There are some other surrogate measures of riskwhich do not explicitly show the relationship betweenfrequency and consequence, but neverthelessprovide a proxy for group risk in that usefulinferences can be drawn to protect against largefatality events.

Risk contours are amongst the most common, whereiso-risk contour plots represent the geographical

variation of the risk for a hypothetical individual whois positioned at a particular location for 24 hours perday, 365 days per year. This is also known aslocation-specific individual risk (LSIR).

Although there is no consideration of the totalnumber of expected fatalities or of any explicitaversion to low-frequency high-consequence events,an approach of lowering the risk contour criteria withdistance away from a facility reflects an attempt todo this. Risk contour criteria tend to be used for landuse planning purposes, with the local planningauthority left to enforce land use controls.

For example, the Major Industrial Accidents Councilof Canada (MIACC) recommends individual risk levelsfor use in respect to hazardous substances includingthe risk contributions from all sources, with the innerzone criteria of LSIR from 10-4 to 10-5, middle zone10-5 to 10-6 and outer zone beyond 10-6 per year.Restrictions are placed on activities or structureswithin the various zones, as shown in Figure 8.

Figure 8 Canadian Risk Contour Criteria

The guidelines are thought to be realistic in terms ofexisting practices of risk management and levels ofrisk. They are also compatible with criteria that havebeen selected and implemented in other industriesand other countries.


6/8


FN, PLL or Risk Contour Criteria?

In the absence of regulatory FN-criteria, someinternational operators have set their own FN-criteriabut other operators believe there are simply too

many issues associated with defining the upper andlower criterion lines. The preferred, quantitative,way for such operators of comparing risk reductionoptions in design and layout is through determiningthe change in PLL and the change in risk contourprofiles.

Summary Societal Risk Criteria

In the absence of regulatory criteria, the choice ofsocietal risk criteria largely comes down to one of thecompanys values. But whatever criteria areselected, they need to be workable in practice ifthey are too severe or too relaxed they will lose theirusefulness and should be based on a soundassessment of current good practice in industry.

ALARP

Whether considering individual risk or societal risk,safety risks need to be reduced to levels that are AsLow As Reasonably Practicable, or ALARP. The

ALARP region lies between unacceptably high andnegligible risk levels.

If Risk is in the ALARP Region is it ALARP?

No, this is a common misconception. Even if a level

of risk for a baseline case has been judged to be inthis ALARP region it is still necessary to considerintroducing further risk reduction measures to drivethe remaining, or residual, risk downwards.

The ALARP level is reached when the time, troubleand cost of further reduction measures becomeunreasonably disproportionate to the additional riskreduction obtained.

When does the ALARP Principle Apply?

Risk can be reduced by avoidance, adopting analternative approach, or increasing the number and

effectiveness of controls.At the concept stage of a new project there is thegreatest opportunity to achieve the lowest residualrisk by considering alternative options, e.g. for anoffshore oilfield development, options may rangefrom fixed legged platforms to floating productionvessels to subsea facilities.

Once the concept is selected and the early designprogresses, the attention shifts to consideringalternative layout and system options to optimiseinherent safety. In the detailed design phase, thefocus moves on to examining alternative options forimproving safety systems.

During operations, the attention is on collectingfeedback, improving procedures and personnelcompetence, and managing change to maintain theresidual risk at an ALARP level. However, with

advances in technology, what is ALARP today maynot be ALARP tomorrow, so periodic reviews will benecessary.

The concept stage provides thegreatest opportunity to achieve thelowest residual risk by considering

alternative options

How is ALARP Demonstrated?

The definition of ALARP implies there is amathematical formula to wield at the problem, and itis true that there is one. Having selected a range ofpossible risk reduction options, a QRA can be re-runfor each option to identify the associated reduction inrisk. Combining this improvement with the total costof each option enables the options to be ranked inorder of cost-effectiveness. The Implied Cost of

Averting a Fatality (ICAF) is expressed in terms of $per statistical fatality averted and comprises thefollowing generally annualised elements:

ICAF = Net cost of option

Potential saving of lifewhere Net cost of option =

Cost of option - Reduction in loss of assets & production

This calculation takes account of the fact thatmeasures to reduce risk to people are also likely toreduce the potential damage to assets and loss ofproduction.

The derived ICAF values for the proposed optionsmay then be ranked and compared against companystandards for ICAF. The typical ICAF value used bythe UK offshore industry is around 6,000,000, i.e. insimplistic terms a measure that costs less than6,000,000 and saves a life over the lifetime of aninstallation is reasonably practicable, while one thatcosts significantly more than 6,000,000 is grosslydisproportionate and therefore is not justified. TheUK HSE considers this to be the minimum level forthe application of CBA in the offshore industry (HSE2006).


7/8


In reality there is no simple cut-off and often a bandof ICAF values is applied, as illustrated in Table 4.

Table 4 ICAF Guidelines

ICAF (US$) Guidance

$100,000,000 IneffectiveCost grossly disproportionate

Discussion on this subject can be emotive and caremust be taken to provide an explanation as to why itis necessary to venture into this seemingly sensitivearea of option evaluation. However, experience isthat derivation of ICAF achieves not only a ranking ofimprovement options but also provides a spur to thecreative development of yet safer and moreeconomic options.

So is ALARP Demonstrated by QRA and CBA?

This is another common misconception. QRA andCBA are inexact and a high variability in results isoften seen. This variability can arise from poorstandards in performing the study, e.g. omittinghazards or making calculation errors, as well asgenuine uncertainty in data and modelling methods.The use of numerical estimates of risk, bythemselves, can be misleading and can result indecisions that either do not meet adequate levels ofsafety, or overestimate the real risks.

The formula approach therefore should be used verycautiously and only in support of qualitative orengineering arguments. In general an approach thatuses information from engineering and operationalanalysis, supplemented where appropriate by QRA,will lead to more robust decisions.

Demonstrating ALARP is a process rather than simplya calculation. The steps to follow are shown inFigure 9.

Figure 9 ALARP Process

Identify & assess hazards

Confirm minimum acceptance criteriaare met

Identify complete range of possiblerisk reduction measures

Implement each measure unless provento be not reasonably practicable

1

2

3

4

The critical step of this process is step 3, the need toidentify a complete range of possible risk reductionmeasures. They should be based on modern goodpractice and be targeted at the largest risk

contributors. This is best achieved throughbrainstorming workshops to identify technicallyfeasible improvements that may:

Eliminate the hazardReduce the exposure of personnel to the hazardReduce the frequency of occurrenceMitigate the consequences if the event does

occur

Improve evacuation if control is lostRisk levels are only ALARP once every measure

identified during step 3 has either been implementedor proven to be not reasonably practicable. It issurprising how many people need reminding that risklevels will remain the same, or even increase, untilreal improvements are fully implemented. A formalrisk assessment can generate a large number ofrecommendations and they need to be properlymanaged.

What Tools are Available to Help DemonstrateALARP?

The tools available for demonstrating risks arereduced to levels that are ALARP are illustrated in

Figure 10 (UKOOA 1999):

Figure 10 ALARP Tools

Codes & standards

Good practice &engineering judgement

Risk assessment & cost-benefit analysis

Peer review &

benchmarking

Stakeholderconsultation

Increasingcomplexityand risks


8/8


In general, the more complex the project, the morecomplex the decisions and the more sophisticated thetools required. Also, the higher the risk, the morecomprehensive and robust the ALARP assessment

needs to be.For example, in many common engineeringsituations, what is reasonably practicable may bedetermined simply by reference to the relevant codeor current practice. The majority of decision makingwill usually fall into this category. The codes andstandards capture the lessons from past experienceand try to reflect best use of current technology andunderstanding.

In other cases, outside established codes andstandards, the use of risk assessment and costbenefit analysis may be appropriate. A risk based

approach can go some way towards addressingsituations where, for example, there is highcomplexity, high costs, conflicting risks anduncertainty. It can provide a clearer picture of thedecision implications and the pros and cons of thevarious decision options.

There may also be the need to take into account theviews and concerns of those stakeholders affected bythe decision. Their perception of the risks andbenefits may be different from that analysed,affecting what they believe to be reasonablypracticable as a solution. What one organisation may

deem as the appropriate solution to manage the risksmay be different from another organisation and inexcess of that required by regulation.

Summary - ALARP Assessment

In practice ALARP decision making amounts to takinga balanced view and reaching a defensible consensuson prioritised improvements. A convincing ALARPdemonstration lies in the documented considerationof improvement options, both implemented anddiscounted, at a level of resolution of detailappropriate to the facility life-cycle and magnitude of

risk.Current Industry Initiatives

Risk criteria are currently very topical. The Centrefor Chemical Process Safety (CCPS) in the USA will,this year, develop a guideline book providing aframework for establishing quantitative safety risktolerance criteria. The book will show how todevelop criteria reflecting company-specific operatingneeds, while maintaining consistency with industrywide practices.

CONCLUSION

There is a high degree of commonality in individualrisk criteria internationally, but societal risk criteria

show a large variation. QRA is inexact and anyquantitative criteria should be seen as guidelines.The risks associated with most facilities lie in themiddle band of the risk tolerability framework the

ALARP zone - and require qualitative and sometimesquantitative demonstration of risk reduction to ALARPlevels. In practice, this amounts to taking a balancedview and reaching a defensible consensus amongststakeholders.

Steve Lewis can be contacted at:

Risktec Solutions LimitedWilderspool Park

Greenalls AvenueWarrington WA4 6HLUnited KingdomTel +44 1925 611200Fax +44 1925 [email protected]

References

CMPT 1999. A Guide to Quantitative Assessment forOffshore Installations, Publication 99/100a, TheCentre for Marine and Petroleum Technology (CMPT),

1999.

HSE 1992. The Tolerability of Risk from NuclearPower Stations, 1992.

HSE 1995. Update of the UKCS Risk Overview, OTH94-458, 1995.

HSE 2001. Reducing Risks, Protecting People HSEsDecision-Making Process, 2001.

HSE 2006. Offshore Installations (Safety Case)regulations 2005 Regulation 12 DemonstratingCompliance with the Relevant Statutory Provisions,

HSE Offshore Information Sheet No. 2/2006.Jonkman 2003. An Overview of Quantitative RiskMeasures for Loss of Life and Economic Damage,Journal of Hazardous Materials A99 (2003) 130,Jonkman SN, van Gelder PHAJM, Vrijling JK, 2003.

Sedgwick 2002. The Impact of Catastrophes onShareholder Value, A Research Report Sponsored bySedgwick Group, Rory F. Knight & Deborah J. Pretty,The Oxford Executive Research Briefings, 2002.

UKOOA 1999. Industry Guidelines on a Frameworkfor Risk Related Decision Support, UKOOA, Issue 1,

May 1999.
mailto:[email protected]://www.risktec.co.uk/http://www.risktec.co.uk/mailto:[email protected]

risk criteria - when is low enough good enough

Documents