Managing risk assessments, human factors and capstone: a chemical storage workshop

The methods in this course are only as good as the system around them. A brilliant HAZOP filed in a cabinet, a bowtie whose critical controls are never checked, or a JHA written by someone who has never seen the job will not prevent a single injury. This final lesson looks at how organizations manage risk assessments as a system: competence, team composition, quality review, records, revalidation and links to management of change. It then looks at the human and organizational factors that make assessments fail, and finishes with a capstone workshop that applies several methods to one realistic case: a chemical storage and dispensing building.

Risk assessment as a managed system

ISO 45001 clause 6.1.2 and ISO 31000 both treat risk assessment as a continuing process, not a one-off event. A mature organization has a written procedure that says which methods are used for which situations, who may lead each type of study, how teams are formed, how results are recorded and approved, how recommendations are tracked, and when assessments must be reviewed. It keeps a register of its significant risks and assessments, so that managers can see which assessments are current, which are overdue and which recommendations remain open.

In the US, ANSI/ASSP Z10.0 describes these elements for occupational risks, and OSHA PSM 1910.119 adds them for covered processes: PHA revalidation every five years, management of change in paragraph (l), pre-start-up review in paragraph (i) and employee participation in paragraph (c). EPA RMP has matching requirements for Program 3 processes.

Competence and team composition

Different methods need different competence. Anyone trained can contribute to a JHA, but a HAZOP needs a trained, experienced facilitator; LOPA and SIL work need people competent under IEC 61511; and QRA needs specialists in consequence modeling and reliability. Good practice is to define the competence required for each role in the procedure, to keep records of training and experience, and to use independent facilitators for major studies so that the design team does not mark its own homework. Diversity matters too: teams that include operators, maintainers, contractors and, where relevant, people with different backgrounds identify more scenarios.

Human and organizational factors in risk assessment

Assessments fail for human reasons as often as technical ones. Groupthink makes a team converge too early on a comfortable answer, especially when a senior person speaks first. Anchoring makes the first number suggested stick, even if it was a guess. Optimism bias leads people to underestimate the likelihood of failures in systems they designed or operate. Normalization of deviance, a term from sociologist Diane Vaughan's study of the Challenger disaster, describes how repeated small departures from standards become accepted as normal because nothing bad has happened yet. And production pressure can push teams to finish quickly or to rate risks lower to avoid costly recommendations.

Facilitators counter these with technique. They ask junior members and workers for their views first, before senior people speak. They ask the team to estimate independently before discussing. They use data and anchors to check likelihood estimates. They challenge assumptions explicitly: "What would have to be true for this to happen?" They record dissenting views. And they make sure the study is given enough time; a HAZOP that is squeezed into half its proper duration will miss things.

Organizational factors shape the whole system. The Chemical Safety Board's investigation of the 2005 Texas City refinery explosion and the Baker Panel review found that risk assessments existed but had not addressed the siting of temporary trailers near the isomerization unit, that management of change was weak and that process safety performance was measured by personal injury rates, which were good. In Canada, the Lac-Mégantic rail disaster of 2013 showed how risk assessments of single-person train crews and securement practices failed to anticipate a catastrophic combination of events. Both cases show that assessment quality depends on leadership, resources and the willingness to hear bad news.

Revalidation and change

Assessments go out of date. Equipment is modified, procedures change, staff turn over, new knowledge emerges and incidents reveal scenarios that were missed. Management of change should trigger review of the relevant assessment before any change is made. Periodic revalidation, every five years for PSM PHAs in the US and at a similar interval in most company standards elsewhere, checks that the whole assessment still reflects the facility. A revalidation is not a rubber stamp: it should review all changes and incidents since the last study, check whether recommendations were implemented and effective, and consider new knowledge such as updated failure data or lessons from industry incidents.

Capstone workshop: the case

A manufacturer is building a new chemical storage and dispensing building. It will hold flammable liquids (toluene and isopropyl alcohol in 205-liter drums, up to 40 drums), corrosives (sulfuric acid and sodium hydroxide solution in 1,000-liter totes, up to 6 totes) and oxidizers (sodium hypochlorite, up to 4 totes). Operators will dispense toluene from drums into 20-liter safety cans for the production area, about 30 times a week. An office building with 60 workers is 25 meters away. The company asks for a risk assessment before construction is complete, to confirm that the design is adequate and to identify any changes.

Step 1: choose the methods

Following Lesson 2, the team starts simple and escalates. A checklist based on the fire code and the company's chemical storage standard checks segregation, ventilation, electrical classification, containment and emergency equipment. A what-if review covers deliveries, storage and abnormal events. A JHA covers the dispensing task. Scenarios with potential fatalities go to a simple LOPA. A bowtie for the top event "loss of containment of flammable liquid in the building" is prepared for operators and managers, and its critical controls are added to the site's verification program. A full QRA is not justified for this inventory, but the team checks the separation distance to the office.

Step 2: what-if and JHA

The what-if review asks questions such as: What if a drum is punctured by a forklift? What if the wrong tote is delivered to the oxidizer bay? What if the ventilation fan fails during dispensing? What if a fire starts in the flammable bay while the office is occupied? The JHA for dispensing breaks the task into steps: move the drum to the dispensing station, bond and ground, open the bung, fit the pump, dispense to the safety can, close and label, return the drum. Energy-based hazards at each step include gravity (drum handling), chemical (vapor and splash) and fire (static ignition).

The result looks alarming, and it should be examined: are the probabilities realistic? Many real dispensing operations have fewer fires than this suggests, partly because not every missed bond produces a spark in a flammable mixture. But even if the estimates are ten or a hundred times too high, the risk remains well above the target. The lesson for the team is that a frequent manual task with a high-energy hazard needs engineering and inherent safety solutions, and that LOPA is useful precisely because it makes this visible.

Step 3: bowtie and critical controls

The bowtie for loss of containment of flammable liquid shows threats (forklift puncture, drum corrosion, overfilling the safety can, valve or pump leak) and consequences (pool fire, flash fire, vapor exposure, fire spreading to the office). Prevention barriers include forklift-free zones and drum racks with impact protection; mitigation barriers include spill containment, fire suppression, gas detection with ventilation interlock and a fire separation wall facing the office. The team selects four critical controls: bonding with interlock, spill containment, fire suppression and the fire separation. Each gets a performance standard, an owner and a monthly field verification.

Step 4: report and follow-up

The final report states the scope, methods and team; lists the findings and recommendations with owners and dates; records the risk before and after recommendations; identifies the critical controls and how they will be verified; and states the limits of the study, such as that it did not model off-site toxic dispersion from a chlorine release. It is reviewed independently, approved by the responsible manager and entered in the risk register. A pre-start-up safety review confirms the recommendations are complete before chemicals are brought in.