What-if and checklist reviews

What-if analysis and checklist analysis are the two simplest structured hazard identification methods, and they are named first in the list of acceptable process hazard analysis methods in the US PSM standard. They are also used everywhere else: in management of change reviews, pre-start-up safety reviews, new equipment purchases, event planning and office moves. Because they are simple, they are often done badly. This lesson explains how to run each method properly, how to combine them into the what-if/checklist method, and how to recognize when they are not enough.

Checklist analysis

A checklist is a list of questions or items based on codes, standards, company experience and past incidents. The team works through the list for the system being reviewed, marking each item as satisfactory, not satisfactory or not applicable, and recording actions. Checklists capture lessons learned: every item on a good checklist is there because something went wrong somewhere. They are fast, require little training and give consistent coverage of known hazards, which makes them ideal for standard designs, audits and routine changes.

Their weakness is equally clear: a checklist can only find what is on it. A new process, an unusual combination of conditions or a hazard nobody has thought of will not appear. Checklists can also become long, generic and mechanical, with reviewers ticking boxes without thinking. Good checklists are specific to the type of system, kept short enough to be used, reviewed after incidents and written as open questions where possible, such as "How is the tank protected against overfilling?" rather than "Is overfill protection provided? Yes/No".

What-if analysis

A what-if analysis is a structured brainstorm. A team familiar with the system asks questions beginning "What if…?" about each part of the process, procedure or activity, and for each question records the consequence, the existing safeguards and any recommendations. Typical questions are "What if the cooling water fails?", "What if the wrong material is delivered?", "What if the operator opens the drain while the tank is under pressure?" and "What if power is lost during the batch?".

What-if analysis is flexible. It works on a concept sketch, a procedure, a building layout or an event plan, and it can be done quickly. Its strength is that it uses the team's experience and imagination. Its weakness is the same: if the team lacks imagination, experience or diversity, important scenarios will be missed. Unlike HAZOP, there is no systematic set of prompts forcing every deviation to be considered, so coverage depends on the facilitator.

Running a what-if review well

A good what-if review has a defined scope and boundary, an experienced facilitator, a scribe, and a team that includes operations, maintenance, engineering and safety, with at least one person who knows the system well and one who will ask naive questions. The facilitator divides the system into sections, such as receiving, storage, transfer, processing and loading, and for each section prompts questions in categories: equipment failure, utility failure, human error, external events, and unusual operating modes such as start-up, shutdown and maintenance.

Pre-written questions help the team get started but should not limit it. Experienced facilitators use the pre-written list as a warm-up, then ask, "What else could go wrong here?" until the team runs dry. Each question is followed to a consequence assuming no safeguards work, then the existing safeguards are listed and judged, and only then is the risk rated. Recommendations should be specific and assigned to an owner with a date.

The combined what-if/checklist method

The what-if/checklist method, described in the Center for Chemical Process Safety (CCPS) Guidelines for Hazard Evaluation Procedures, uses both. The team first brainstorms what-if questions to draw on its creativity, then works through a checklist to fill gaps in coverage. Or the order is reversed: the checklist provides structure and the what-if questions extend it. The combination gives more complete coverage than either alone and is widely used for PHAs of simpler processes and for management of change.

Even combined, these methods have limits. They are less systematic than HAZOP for complex continuous processes, they do not quantify risk unless a matrix is added, and they depend heavily on the team. A reasonable rule is: what-if/checklist for small, simple or well-understood systems and changes; HAZOP or FMEA for complex or novel ones; and LOPA or fault trees when a specific high-consequence scenario needs its safeguards checked.

In Canada, what-if and checklist methods are widely used to meet management of change and pre-start-up review elements of CSA Z767, and many provincial regulators and insurers accept them for lower-hazard facilities. They are also a natural way to carry out the hazard assessment required by OHS law before new equipment or a new process is introduced, as in Alberta OHS Code Part 2.

Documentation and follow-up

Both methods should produce a record listing the scope, team, date, drawings or procedures reviewed, each question or item, consequences, safeguards, risk ratings and recommendations. Recommendations need owners, due dates and a tracking system; a review with 30 open recommendations two years later has not reduced any risk. Where a recommendation is rejected, the reason should be documented and accepted by a responsible manager. Under process safety rules, regulators routinely cite facilities for unresolved PHA recommendations.

Using what-if beyond process plants

What-if analysis is not just for chemical plants. It works well for construction lifts, temporary works, special events, shutdowns and turnarounds, laboratory experiments, office relocations and new software that controls equipment. In each case the facilitator chooses sections that suit the activity, such as phases of an event (setup, entry, performance, exit, teardown) or stages of a lift (planning, rigging, lifting, landing, de-rigging), and prompts the same categories of questions. The method's flexibility is its great advantage: it needs no drawings, only a clear description of the activity and people who know it.

For a special event, for example, questions might include: What if a thunderstorm arrives during the show? What if a stage structure is loaded beyond its rating by crowd surge? What if the main exit is blocked by a vehicle? What if the public address system fails during an evacuation? Each question is followed to consequence, safeguards and recommendations exactly as in a process review, and the output can feed the emergency plan.

A facilitator should also plan what the review will not cover. If the scope excludes the electrical substation or the tank truck route, the report must say so and name who will assess those areas. Gaps between the scopes of separate reviews are a common place for hazards to hide.

Checklists themselves need maintenance. A useful habit is to review the company's checklists once a year and after every significant incident, adding items for new lessons and removing items that no longer apply or that duplicate others. A checklist that has grown to 400 items is rarely used properly; splitting it into short, system-specific lists, such as one for tank farms, one for loading racks and one for warehouses, usually improves both speed and quality. Each item should also show its source, so that reviewers understand why it matters and can judge whether it applies.