WORKING PAPER1

September 28, 2017

The Safety Culture Journey for Industry and Regulators:Lessons from the Offshore Oil and Gas Industry

in the North Sea and U.S. Outer Continental Shelf

Stephen GodwinScholar, Transportation Research Board,

National Academies of Sciences, Engineering, and Medicinesgodwin@nas.edu

The offshore oil and gas industry provides an instructive example of regulatory safety policy and how it can shift as an industry becomes increasingly technologically sophisticated in order to address increasingly challenging conditions. In the timespan of a few decades, the offshore industry evolved rapidly from drilling from piers and barges and vessels near the shore, to waters hundreds of feet deep on newly-designed platforms affixed to the seabed, to waters thousands of feet deep from floating platforms supported by hundreds of workers living and working in close proximity to highly hazardous operations. Initially this technologically innovative industry was regulated world-wide in a similar fashion as other high-hazard industries have been, with detailed rules and standards enforced through inspections by regulators. The rapid pace of technological innovation by industry made it challenging for regulators to keep up with this regulatory model. By the 1980s, innovation and the race to exploit natural resources outpaced caution. Catastrophic accidents such as the capsizing of the Alexander Kielland semi-submersible drilling rig and the 1988 explosion and fire at the Piper Alpha platform in the North Sea resulted in the loss of nearly three hundred lives.

Major innovations in regulatory approaches subsequently followed in the North Sea countries of Norway and the United Kingdom (UK). The 2010 Macondo/Deepwater Horizon blowout and explosion in the Gulf of Mexico led to a less complete, but nonetheless significant, shift in direction by U.S. regulators. What these regulatory reforms share is a shift away from relying only on compliance with rules and standards to an equal, if not greater, emphasis on managing risk more broadly and encouraging a stronger safety culture in industry to make this management effective.2 Some individual companies moved even faster than regulators along this path. The

1 Comments welcome. Please send to author at sgodwin@nas.edu. The author appreciates the review of drafts of this paper by Elmer “Bud” Danenberger, (ret.) U.S. Minerals Management Service and Thomas Menzies, Transportation Research Board, National Academies of Sciences, Engineering, and Medicine, and for the assistance of Paul Bradley, U.K. Health and Safety Executive, in understanding the capabilities of HSE’s inspector workforce. 2 The contrast between a regulatory emphasis on firms complying with myriad standards and rules that target specific contributors to risk and a regulatory emphasis on a firms establishing internal management systems to reduce overall risk is often referred to as a “prescriptive” vs. “performance” regulatory approach, but a recent report of a Transportation Research Board/National Academies committee points out that these labels are simplistic and can be misleading. Requirements for management systems are seldom “performance-based” in the sense that they require a specific, typically numeric, performance outcome to be achieved such as a demonstrable reduction in the frequency of incidents. What are usually referred to as performance-based regulatory regimes, including those described in this paper, would be more accurately referred to as “management-based” regulations, because they

1

following sections of this draft describe examples of the safety culture journey in the North Sea and U.S. offshore oil and gas industry for both the regulated and the regulators. This leads to a discussion about barriers in the United States to greater reliance on organizational safety culture as a safety-enhancing regulatory strategy and research and policy questions to address these barriers.

Why Promote Industry Safety Culture?

Before turning to the questions that motivate this paper, it is worth briefly reviewing the principal reason why regulators should want to promote a positive industry safety culture. In high-hazard industries like offshore oil and gas exploration and production, nuclear power, chemical processing, and commercial transportation, catastrophic accidents happened with some regularity that injure or kill workers and innocent people and pollute the environment. Fortunately, such events now occur less often in the United States, but increasingly technologically complex systems can fail in complex ways, often including failures of leadership and organization that regulations typically do not address directly. Companies with effective safety management systems and strong safety cultures should be better aware of the risks they face and manage them in ways that can exceed regulatory requirements.3 Thus, as explored below, regulators should want to encourage companies to go beyond compliance with regulations in order to reduce risk. The focus on safety culture by both industry and regulators, however, is not an easy transition, especially for those regulatory regimes that have been heavily compliance focused.

An International Oil and Gas Company Example4

Each of the major oil and gas companies has its own safety culture story to tell. The study committee for TRB Special Report 321 chose the Royal Dutch Shell international oil and gas company as an example because of the company’s global reach, willingness to share details, and the many lessons this example provides.5

Starting in 1986, Shell was the sponsor of the research behind Reason’s (1990) Swiss cheese model of accident propagation and an early adopter of these new safety concepts. The company made progress in safety, but saw less improvement after about 1993. In the early 1990s, the company was implementing safety cases and safety management systems in the post-Piper Alpha

focus on processes to improve performance rather than achieving a specific safety end-state. Although they can be enforced by emphasizing compliance with regulatory commands, management-based regulations tend to give firms more flexibility in customizing their management systems to address context-specific risks and are thus generally viewed as being more compatible with the goal of fostering a stronger safety culture. See Designing Safety Regulations for High-Hazard Industries, TRB Special Report 234, National Academies of Sciences, Engineering, and Medicine, Washington, D.C.3 Transportation Research Board (TRB) Special Report 321, Strengthening Offshore Oil and Gas Industry Safety Culture. National Academies of Sciences, Engineering, and Medicine, Washington, D.C. 4 This section excerpted (and edited for this paper) from Chapter 6, Implementing Change in the Offshore Oil and Gas Industry, of Strengthening the Safety Culture of the Offshore Oil and Gas Industry. 2016. Chapter 6, in turn, was heavily influenced by P. Hudson’s 2007 article describing Shell’s safety culture journey: Hudson, P. 2007. Implementing a Safety Culture in a Major Multi-National. Safety Science 45, 607-722. 5 See also Hudson, P. 2007 for more discussion about the strategies employed and tools developed.

2

period and benefited from having strong senior management support for safety initiatives and a psychologist on the core implementation team. By 1996, there was concern within the company that safety performance had plateaued, and new approaches were needed. In a business improvement workshop, senior management embraced the concept of a workforce intrinsically motivated to be safe; however, the change management team believed that changing the safety culture would be somewhat easier and more acceptable than improving intrinsic motivation, and would have a similar impact on the company’s safety performance. After convening researchers and industry experts from several companies, the change team focused on the safety culture development ladder shown in Table 1.

The change team conducted interviews in multiple locations to identify aspects of culture that more than 50 percent of respondents could agree represented each step on the ladder. The result was the Hearts and Minds program (a name used by British Army operations in several parts of the world during the mid-20th century), designed to create engagement between workers and managers that would stimulate and signify managerial commitment (from top managers down to supervisors) in the area of health, safety, and environment. The program included an engagement

TABLE 1 Safety Culture Development Ladder6

1. Pathological: Compliance with statutory requirement. May conceal unfavorable

information. “No one cares about safety as long as we are not caught.”

2. Reactive: Respond to accidents. Worry about costs and immediate causes of accidents. “We do a lot about safety every time we have an accident.”

3. Calculative: Focus on objective statistics, number of reports, following rules, hazard analyses. “We have procedures in place to manage all accidents.”

4. Proactive Investigate the causes, look for trends, benchmark others, audit, try to be the best. “We try to anticipate safety problems before they arise.”

5. Generative: Benchmark inside and outside the industry, full audit system, engage entire workforce and contractors, no compromises. “Safety is how we do business around here.”

and assessment tool (the most recent version of which asks about where the organization could realistically be in 24 months and where it is now) and an evolving set of simple Hearts and Minds tools7 (e.g., Managing Rule Breaking, Risk Assessment Matrix, Working Safely, Improving Supervision) with associated training and workshop experiences to support use of the tools. The program also was made available by the U.K. Institute (a professional association) for the entire industry to use.

6 Westrum, R. 1991. Cultures with Requisite Imagination. In Verification and Validation in Complex Man-Machine Systems (J. Wise, P. Stager, and J. Hopkin, eds.), Springer, New York, pp. 401–416 as subsequently revised by Hudson as described in Hudson (2007).7 http://www.eimicrosites.org/heartsandminds.

3

In the mid-2000s, the company had these tools but no shared safety vision or strategy across different business units and locations. After several years of discussion, senior leaders agreed upon Goal Zero, which set the expectation that zero incidents and injuries for employees and contractors was the only acceptable outcome. Goal Zero represented a fundamental shift in mind-set away from viewing the oil and gas industry as inherently dangerous toward leadership recognition of and commitment to good safety performance as essential to good operationalperformance. Building on the Hearts and Minds program, the company focused on getting employees and contractors to accept behavioral rules, starting with simple measures to protect personal safety, such as holding handrails, and then shifting to more complex procedures intended to reduce higher-risk (including process safety) exposures. Safety measures were incorporated in all aspects of the business and benchmarked internally and externally to make performance transparent and motivate improvement.

In mid-2009, the company implemented its 12 Life-Saving Rules globally. Five of these rules relate to personal safety, 4 to process safety, and 3 to road safety. Based on an analysis of worldwide fatalities in the prior 10 years, safety leadership estimated that had these rules been in place earlier, compliance with them might have prevented 80 percent of those fatalities. These rules also have been made available to the oil and gas industry through the International Association of Oil & Gas Producers. At first glance, these rules appear to place the entire burden of maintaining safety on workers; however, they in fact highlight leadership’s responsibility to clarify the rules and to establish the conditions that make compliance possible (e.g., having the right equipment available, ensuring that procedures are aligned with rule requirements). Although following these rules became a condition of working for the company and people were terminated for noncompliance, the rules were framed as a means of saving lives and demonstrating care for people: The shared assumption was that if one could not follow the Life-Saving Rules, it would be only a matter of time until one hurt oneself or others.

The broad acceptance and institutionalization of Goal Zero and the Life-Saving Rules provided a new momentum for safety and improved performance. In a major project in Qatar, for example, which took nearly 7 years to construct and employed as many as 50,000 workers, the company achieved outstanding safety performance. Historical performance would have predicted 20 to 30 work-related fatalities; yet this project had only 1. The change in expectations and behaviors led to tangible results across Shell’s world-wide operations – global fatalities across all company activities dropped from 26 in 2008 to 5 in 2014.

Lessons LearnedSome valuable lessons emerge from this example:

1. The safety culture journey is lengthy, bumpy, and uncertain. The potential always exists to backslide, or for parts of the organization to lag behind. New initiatives took hold in this company but reached a plateau over some years, and leaders had to maintain their commitment and rekindle momentum with innovative concepts and initiatives that came partly from outside and partly from within the company. Even now, there is variability across the company and its contractors. Whereas in 2004 the company was in general working to reach the calculative stage in the safety culture development ladder, people in the company believe many of its parts have now attained the proactive stage. The strategic goal is not necessarily to get everyone to highest stage of the ladder but to keep

4

everyone engaged in assessment and improvement, thereby moving up the ladder within a dynamic business, with a continuously changing workforce, and with heightened societal expectations.

2. Extensive support from and access to top management were critical to make current performance transparent through continual assessment, to acknowledge when performance was unacceptable, and to reenergize the organization when progress began to flag. When leadership is about one step higher on the safety culture ladder than most of the organization, it can provide an effective vision of the future and be a catalyst for change. On the other hand, leadership that is lagging will find it difficult to champion change, while leadership that is too far ahead will have difficulty communicating an understandable message about safety improvement that people believe is achievable and worthy of their commitment.

3. Having in-house social science capability was critical in this company for generating and implementing ideas and marshaling global experts for help. Culture change is a people challenge, requiring the ability to engage and motivate people as well as to understand organizations and cultures.

4. The strategies that move an organization from one step on the safety culture ladder to the next are not the same at each step. Moving from the pathological to the reactive stage requires a decision from the top to take action, which then results in a suite of programs and tools that may or may not be implemented. Moving from reactive to calculative involves actually implementing the programs and tools, although they may have varying utility and impact. Making the programs and tools more effective and improving performance brings the organization to the proactive level. Moving beyond programs and tools, the organization can progress toward the generative stage when it embeds and sustains leadership behaviors that demonstrate engagement and care for people.

Assessment: An Integral Part of the Journey8

Shell’s reliance on social scientists and commitment to assessing the safety culture of the organization are important parts of the organization’s lessons learned. The measurement of safety culture is not an end in itself, but a means of assessing, understanding, and influencing both safety and the overall mission of the organization. The measurement activity takes place within an existing safety culture and, more generally, within a broader organizational culture and the cultural ecology within which the organization operates (e.g., suppliers, customers, industry groups, professional associations, regulators, governments, the public, markets). Hence, the measurement of safety culture is one step in a set of conversations, decisions, and actions aimed at directing organizations toward safer and more sustainable performance.

As important as assessment is, the assessment process is one input into a much broader conversation regarding organizational and safety culture, formal and informal organizational structures, power, relationships with contractors, and other strategic goals (productivity, cost, quality). With these assumptions in mind, the committee that prepared TRB Special report 321 believes it is important for organizations to conduct periodic assessments of their organizational and safety culture for the following five reasons:

8 This section heavily drawn from Chapter 5, Safety Culture Assessment and Measurement, Strengthening the Safety Culture of the Offshore Oil and Gas Industry. 2016.

5

1. Move from vague to specific – given that perceptions of safety culture within an organization often differ between management and front-line workers, it’s important to understand and investigate sources of discrepancies.

2. Track progress – regular assessments allow management (and others) to detect and reinforce slow changes in an organization’s culture that may be beneficial to safety, as well as to identify and address slow changes that may produce a drift into failure.

3. Provide motivation and feedback – ongoing assessment allows individuals throughout the organization to receive feedback, set goals, and seek to improve the organization’s safety management. It also, if its results are sufficiently communicated, can help close the communication loop when frontline employees have raised safety concerns (or concerns about work and managerial practices that are not specified as related to safety). Even in the absence of tangible progress, it is important for management to communicate to frontline employees that they are being heard and that management is investigating how to address the issues they have raised.

4. Identify strengths, weaknesses and gaps, and potential improvements – an assessment spanning different subgroups, functions, and operational areas of the organization can provide an opportunity to examine the consistency of the culture and tailor improvement efforts to specific concerns.

5. Provide leading indicators – a growing body of research9 and recent meta-analyses10 show that safety culture can predict both safety behaviors and accidents/injuries. Assessments of safety culture hold promise for providing leading indicators of safety issues that can trigger proactive interventions and serve as complements to lagging indicators, such as incident rates.

Unfortunately for managers eager to implement an assessment of their organizations, there is no one right way or proven way to assess culture, in part because of its complexity and difficulty of observing it. The committee that prepared Special Report 321 relied on the work of Edgar Schein, a leading theorist of organizational culture.11 Schein’s influential model of culture asserts that there are surface features of culture that can be seen and heard, including visible artifacts and communicated values and beliefs, whereas the essence of culture, comprising underlying assumptions, is “deeper” and difficult even for cultural insiders to perceive and articulate.

The committee outlined assessment options and ranked them in terms of their overall cost and potential benefits:

9 See, for example, Zohar, D. 2010. Thirty Years of Safety Climate Research: Reflections and FutureDirections. Accident Analysis and Prevention, Vol. 42, pp. 1517–1522 and Morrow, S. L., G. K. Koves, and V. E. Barnes. 2014. Exploring the Relationship Between Safety Culture and Safety Performance in U.S. Nuclear Power Operations. Safety Science, Vol. 69, pp. 37–47.10 See Christian, M. S., J. C. Bradley, J. C. Wallace, and M. J. Burke. 2009. Workplace Safety: A MetaAnalysis of the Roles of Person and Situation Factors. Journal of Applied Psychology, Vol. 94, pp. 1103–1127 and Narhgang, J., F. P. Morgeson, and D. A. Hofmann. 2011. Safety at Work: A MetaAnalytic Investigation of the Link Between Job Demands, Job Resources, Burnout, Engagement, and Safety Outcomes. Journal of Applied Psychology, Vol. 96, pp. 71–94.11 Schein, E. H. Organizational Culture and Leadership, 4th ed. John Wiley, Hoboken, N.J., 2010.

6

Ethnography – a detailed assessment over weeks or months by a skilled ethnographer can provide an in-depth assessment, but skilled ethnographers are rare and results are difficult to replicate.

Episodic field work and document review – these methods include combinations of direct observation of work practices by individuals or teams of visitors over a period of a ten to fourteen days, interviews of individuals or groups, and analysis of documentation. This method is typically used by internal and external auditors (e.g., quality assurance personnel, regulators), consultants, benchmarking teams, and peer assist teams. Document review can include safety procedure manuals, indicators, accident reports, and reports of incidents and near misses.

Surveys and guided self-analysis -- Safety culture and climate surveys using questionnaires with rating scale measures of various cultural attributes have become increasingly popular in recent years, and regulators are requiring such surveys more routinely, especially of organizations suspected of having a weak safety culture. However, use of the scores calculated from survey responses to monitor and manage is the most visible and least important aspect of culture assessment and change. Instead, surveys can prompt conversations about and broaden understanding of the organization’s safety processes, as well as participation in generating innovative paths forward and continuing conversation to learn from these efforts.12 It is also important to recognize that this learning process can succeed only if senior leaders are engaged, listening, and pushing for improvement; otherwise, the self-analytic activity will come to a halt, leaving behind a residue of cynicism, mistrust, and resistance to change. Guided self-analysis relies primarily on cultural insiders to analyze their own culture through one or more workshops or meetings (hence, self-analysis), while also recognizing the need for skilled facilitation by either an internal specialist or an external consultant (hence, guided). The process engages a cross section of participants who are knowledgeable about the culture but also have the curiosity and critical thinking skills to step outside their own culture. Individuals who are already bicultural, such as those who have worked in another company or in another part of the same company that has a different culture, may be a good choice as participants.

Episodic field work (by itself) . See above. Guided self-analysis (by itself) . See above. Surveys and focus groups . For surveys, see above. Many organizations use focus

group interviews following a survey to discuss its results and to obtain specific examples and details as to what the responses mean to workers, supervisors, and managers.

Interviews and focus groups. See above. Climate surveys . See above. Document reviews. See above.

Lacking a proven process of assessment, the committee encouraged companies to consider combinations of the assessments above, conducted on a quarterly or semi-annual basis to

12 Carroll, J. S. 2015. Making Sense of Ambiguity Through Dialogue and Collaborative Action. Journal of Contingencies and Crisis Management, Vol. 23, pp. 59–65.

7

inform management decision making. The bottom line is that companies require an ongoing process of assessment (plan, do, check, act) to guide the safety culture journey. Unfortunately, publicly accessible case studies of how companies have matured and assessed their safety cultures, such as Hudson’s study of Shell (see footnote 2 for reference), are quite rare. Any corporate leader interesting in advancing his/her company’s safety culture would do well to spend time with Hudson’s paper and Shell’s evolutionary approach.

Regulators’ Safety Culture Journey

Regulatory reforms initiated after catastrophic accidents in the North Sea ultimately led to significant changes in regulators’ approach to safety in both Norway and the United Kingdom. Introduction in 2002 of a focus on safety culture as part of the Norwegian offshore regulatory transformation included the following requirement for companies:

A sound health, safety and environment culture that includes all phases and activity areas shall be encouraged through continuous work to reduce risk and improve health, safety and the environment.

This requirement initially resulted in confusion among regulators about the vagueness of safety culture as a concept and the perceived difficulty of enforcing it.13 Norway’s Petroleum Safety Authority (PSA), a highly engineering-oriented agency, had many staff who were uncomfortable with “soft” concepts like culture and how it might be enforced. In general, the revision of Norway’s regulatory approach shifted from meeting specific requirements to achieving broader goals (although the industry still follows recognized standards for safe practices as outlined in their safety case). There was also worry about safety culture oversight being reduced to some sort of compliance check list, which did not occur because of PSA’s commitment to avoid a strict and narrow enforcement of the safety culture requirement. Over time, introduction of the safety culture requirement did encourage PSA’s engineers to begin thinking more broadly about safety and the organizational role in it. Apparently, however, it took years for the concept to mature in the understanding of the regulatory staff and for them to learn how to use it to engage with industry around organizational and cultural approaches to enhancing safety. The collaborative model among regulator, unions, and industry later reinforced in a 2011 regulatory revision, also placed considerable new demands on the capability and judgment of the inspector work force to determine whether company plans and strategies were adequate.14

PSA’s safety culture journey from a focus on compliance to a focus on a broader concept of safety was likely made more tractable by the evolution in its regulatory structure that encouraged this approach. Similarly, the U.K.’s “safety case”15approach, including its emphasis on safety

13 Antonsen, S, M. Nilson, P. Almklov. 2017. Regulating the Intangible: Searching for Safety Culture in the Norwegian Petroleum Industry. Safety Science 92, 232-240.14 Lindoe, P., M. Baram, and G.S. Braut (2012) suggest that the demands placed on inspectors may exceed their expertise. See page 1722 of Empowered Agents or Empowered Agencies? Assessing the Risk Regulatory Regimes in the Norwegian and U.S. Offshore Oil and Gas Industry. In, G. Berenger and G. Soares (eds.), Advances in Safety, Reliability, and Risk Management, Taylor and Frances, London.15 Health and Safety Executive. 2015. The Offshore Installations (Offshore Safety Directive) (Safety Case, etc.) Regulations. L154, First Edition.

8

culture, evolved from the Health and Safety at Work Act 1974, which was “a fundamentally different, less prescriptive regulatory system based on general goal-setting duties in a framework supported by regulations, codes of practice and guidance, all developed in an open, consultative process with stakeholders whereby employers and employees could become co-operatively engaged in self-regulation.”16 In the aftermath of the Piper Alpha disaster, the Health and Safety Executive (HSE) took over the regulation of offshore safety regulation in the U.K.; its inspectors were already well versed in risk-based enforcement and regulation. Such inspectors are recruited and formally trained and assessed against post-graduate regulatory requirements (Masters Level) through an accredited regulatory training program. There is also a suite of regulatory training for offshore inspectors and continuous professional development, alongside their own specialist skills.17

In the United States, the Bureau of Safety and Environmental Enforcement (BSEE) is the principal safety regulator, but the U.S. Coast Guard (USCG) also regulates elements of occupational safety offshore, and the Pipelines and Hazardous Materials Safety Administration (PHMSA), regulates the safety of pipelines that connect to offshore platforms. Historically, offshore safety regulation has largely based on a set of required procedures, operating practices, equipment maintenance and adherence to standards that is enforced through an inspection program. This is a typical compliance-based model applied to hazardous industries throughout the United States. BSEE’s initial regulatory moves in the direction of enhancing industry safety culture has been mainly carried out through its Safety and Environmental Management (SEMS) regulations (described later).

Claudine Bradley’s recent dissertation develops a compelling theory of how regulators ought to act to reinforce and encourage industry safety culture. 18 Bradley posits six key traits of regulators with strong safety cultures:

1. Leadership and Political Independence (versus politicized mission);2. Learning Culture (versus a punitive culture);3. Innovation (versus bureaucratic inertia);4. Commitment to Technical Excellence (versus tolerance of inadequate capacity and

competency);5. Risk Consciousness (versus compliance mentality);6. Systems Thinking (versus preoccupation with active failures).

Among the key attributes of these traits are regulatory behaviors such as:

Strengthened relationship building with stakeholders in order to improve trust and openness to share safety data and intelligence (including related vulnerabilities)

Open and transparent sharing of information with industry members to improve clarity of regulatory expectations

Implementation of formal mechanisms for regular/periodic meetings with regulated entities to have a two-way discussion about safety and operational performance

16 Eves, D. Two Steps Forward, One Step Back: A Brief History of the Origins, Development, and Implementation of Health and Safety Law in the United Kingdom, 1802-2014, http://www.historyofosh.org.uk/brief/index.html 17 Personal correspondence with Paul Bradley, Operations Manager, HM Principal Inspector of Health & Safety (Mechanical), Energy Division 6, Health & Safety Executive.18 Bradley, C.S. 2017. Regulator Safety (Oversight) Culture: How as Safety Regulator’s Culture Influences Safety Outcomes in High-Hazard Industries. Doctoral Dissertation. Fielding Graduate University.

9

Implementation of formal mechanisms for ongoing engagement with company leaders about safety culture in order to promote self-reflection, learning, and advancement

Awareness and understanding of the unintended consequences associated with the employment of certain enforcement actions and tools

Existence of a questioning attitude and sensitivity to bureaucratic inertia Development of internal capacity and competency related to risk consciousness and

systems thinking Implementation of formal mechanisms for viewing and evaluating company safety and

risk management performance holistically (through the operational life cycle) Effective and recurring leader and staff training on risk, including risk awareness,

assessment, prioritization, and management Development and use of more effective risk tools by the regulator Re-evaluation of current compliance and enforcement activities and tools in order to

include an effective risk oversight lens as opposed to strict compliance approach

While likely needed and effective in enhancing industry’s focus on safety culture, all of the above regulatory behaviors stand in contrast to the compliance model relied upon by U.S. regulators. Bradley indicates that the model she has developed is “designed to answer the question: What new framework best describes/explains regulator safety culture and its influence on industry safety culture and performance?” The case she makes for how regulators should act to foster stronger industry safety culture, described in more detail in her dissertation, has intuitive appeal. Whether these behaviors can be implemented in the U.S. within the U.S. regulatory framework, however, is a key question.

The U.S. Regulators’ JourneyArguably, the safety culture journey of the U.S. regulatory workforce is just beginning and its future direction uncertain. Top officials, including former BSEE directors James Watson and Brian Salerno and their senior advisors have clearly understood the issues. As described by the committee that prepared Special Report 321,19 U.S. safety regulators have a fundamental responsibility to implement laws, but influencing safety culture in positive ways will require that they undertake new and different initiatives. Goals for offshore safety culture shared between the industry and regulators would help define new activities focused on those goals, such as coaching, sharing lessons learned, and independently assessing the achievement of such a culture. Ideally, the role of the regulators is to ensure that the operating companies have systems to optimize their safety performance; the regulators’ role is not to do the operators’ jobs for them. However, the transition of regulators from compliance officials to assessors of safety culture and serving as coaches, when appropriate and needed, will require training and time, as it did in Norway’s case.

BSEE’s workforce of inspectors is capable of analyzing the strength of a company’s first-line of defense against major failures (adherence to protocols, standards, and safe work practices). In order to be more proactive, they would also need to become capable of analyzing what Hudson

19 Much of this paragraph is taken from Chapter 4, U.S. Safety Regulation Pertaining to Safety Culture, Strengthening Offshore Oil and Gas Industry Safety Culture, Special Report 321, Transportation Research Board, National Academies of Sciences, Engineering and Medicine, Washington, D.C., pp. 129-130.

10

and Hudson (2015) refer to as the second (supervisory and management) and third (culture) lines of defense.20

Following the 2010 Deepwater Horizon/Macondo blowout and explosion, BSEE implemented Safety and Environmental Management System (SEMS) regulations that reflect a shift beyond simply relying on compliance with existing standards and regulations. SEMS made mandatory an industry recommended practice [API Recommended Practice (RP) 75] that had formerly been voluntary and was not fully embraced by offshore operators and their contractors. SEMS and other Safety Management Systems (SMS) provide a regulatory mechanism for addressing industry safety culture.21 They vary across industries, but share common elements for safe operations, including requiring specific written plans for operating practices, hazards analysis, safe work practices, training, mechanical integrity, emergency response, incident reporting, and ongoing, independent audits of performance.22 SMS are suited to industries involved in high-risk endeavors in a variety of ways, including an emphasis on risk assessment to avoid catastrophic failures. They have multiple parallels with safety culture, particularly the emphasis on hazards analysis (inquiring attitude; hazard analysis and risk management); incident reporting (environment for raising concerns; effective safety communication); safe work practices; and strong support from top leadership in order to be effective.

RP 75 was developed, in part, to compensate for the long-standing reliance of Outer Continental Shelf regulators on physical inspections of offshore facilities, which focus on mechanical systems integrity and standards compliance rather than on organizational performance. The designers of the offshore industry’s SMS were interested in shifting away from simple compliance to encouraging industry to place a greater emphasis on safety more broadly. Because of the many parallels with safety culture principles, SMS’s can provide regulators with opportunities to reinforce a strong safety culture in industry, but only if a company truly values safety rather than simply complying with SMS requirements in a “check the box” fashion. The open question is whether BSEE’s safety culture journey will or can move in this direction.

U.S. policy makers and regulators tend to follow a deterrence model view of safety regulation across all high-hazard industries; up until SEMS, this has certainly been the principal approach for the offshore oil and gas industry. The deterrence model sets laws, rules, standards, and processes that must be followed, which are enforced through inspections, fines, and other sources of punishment. The general deterrence model of enforcement recognizes that the risks of actually being caught are not necessarily high; it achieves its compliance goals through the surety and severity of penalty when companies’ failure to follow requirements is detected, intending, thereby, to heighten the perception within industry of the importance of compliance.

Whereas the North Sea regulatory structure encourages a more cooperative approach between regulator and industry, even while stressing industry’s singular responsibility for safety, the U.S. 20 Hudson P., and T. Hudson. 2015. Integrating Cultural and Regulatory Factors in the Bowtie: Moving from Hand-Waving to Rigor. In Ontology Modeling in Physical Asset Integrity (V. Ebrahimapour and S. Yacout, eds.), Springer, Netherlands, pp. 171–198.21 This and the following paragraph heavily drawn from Godwin, S. 2017. Offshore Oil and Gas Regulation: Implications for Commercial Transportation Safety Regulation. TR News 308, p. 17-22. Transportation Research Board, National Academies of Sciences, Engineering, and Medicine, Washington D.C. 22 Transportation Research Board Special Report 308. 2012. Evaluating the Effectiveness of Safety and Environmental Management Systems. National Academies of Sciences, Engineering, and Medicine, Washington, D.C.

11

structure by its nature leads to antagonism between regulator and industry and places greater responsibility on the regulator to define safe performance.23 Moreover, its focus on checklist compliance risks over-emphasizing risks that can be easily defined (such as equipment), and therefore regulated, while missing a broader focus on organizational and process safety. The U.S. emphasis on compliance extends beyond the role of individual regulators. The governing laws (both safety and environmental) are many and complex and include general liability enforced through the legal (tort) system.24 Civil litigation is adversarial by design. In this context, legal counsels for industrial firms presumably would prefer a regulatory system that defines clear standards and rules, since following a required standard is a strong defense against negligence; this stance, however, reinforces a compliance-oriented regulatory system.25 In contrast, Norway has modified its law to give prosecutors discretion in pursuing litigation in the case of alleged industry wrong-doing,26 which reinforces the opportunity for the regulator and industry to solve problems in the interest of enhancing safety rather than simply applying punishment.

The U.S.’s hybrid regulatory approach has yielded success in isolated performance-based approaches. BSEE’s Deepwater Operations Plans (DWOP) program (30 CFR, Subpart B §250.285 to §250.295) is a god example.27 In the absence of regulations and industry standards for deepwater production facilities, the Minerals Management Service (MMS) had to assess projects in a holistic manner. DWOP, which are analogous to safety cases and are dependent on comprehensive risk and barrier assessments, became the primary means of regulating deepwater development projects. The DWOP program has been extremely successful; since its implementation in 1995, more than 7 billion barrels of oil and 20 trillion cubic feet of gas have been produced from deepwater (greater than 1,000 feet) facilities with only one fatality (a crane incident) and no significant pollution incidents. Through 2013, 1,271 DWOP had been approved for 410 deepwater projects. This is a success story that merits much wider attention that it has received.

The SEMS regulations adopted in 2012 provide an opportunity for BSEE to shift its emphasis more toward the PSA and HSE models, but two questions remain

(a) whether offshore regulators will have the commitment and resources to retrain, expand, and strengthen the current U.S. inspector workforce so that it is capable of assessing and supporting industry safety culture anytime soon.

(b) whether U.S. policy makers are willing to shift away from their heavy reliance on the deterrence model and give offshore regulators the freedom to work in the manner that Bradley recommends. Unlike in Norway or the UK, the U.S. hybrid regulatory model includes contradictory elements with a heavy emphasis on compliance with a new emphasis on organizational improvement through the SEMS approach. Whether these

23 Lindoe, Baram, and Braut. 2012. See Figure 1, p. 1723.24 Baram, M. 2014. The U.S. Regulatory Regime for Preventing Major Accidents in Offshore Operations, In, H. Lindoe, M. Baram, and O. Renn, eds, Risk Governance of Offshore Oil and Gas Industries. Cambridge University Press. See also Lindoe, P., M. Baram, and G.S. Braut. 2012, p. 1720.25 There are other characteristics of the U.S. offshore industry that reinforce a preference for simple, specific rules that must be followed, most notably the thousands of small firms that serve as contractors and subcontractors to major operators and independent drillers.26 Lindoe, P., M. Baram, and G.S. Braut. 2102, p. 1722. 27 This example excerpted from Chapter 4, U.S. Safety Regulation Pertaining to Safety Culture, Strengthening Offshore Oil and Gas Industry Safety Culture, Special Report 321, p. 105.

12

different regulatory approaches will also allow for the coaching, collaboration, and mutual learning by regulator and industry to reinforce a strong industry safety culture is a part of the journey that lies before us.

Questions for Policy Analysis and Research

The shift from relying on compliance with rules to achieve safety to also addressing the importance of management and cultural factors has proven to be a complex and lengthy journey both for firms that have chosen to follows this path as well as for regulators. For high-hazard industries, this journey shows potential to enhance worker and public safety beyond what can be achieved through specific equipment standards and operating regulations alone. Despite the new U.S. requirements for safety management systems offshore, and in contrast with reforms in Norway and the U.K., the deterrence, compliance-based safety regulatory model remains preferred by many U.S. policy makers. If the management-based safety-culture supportive regulatory approach is to get broader acceptance, more compelling evidence is needed that it works. Understandably, this is a hard evaluation to conduct when catastrophic accidents are fairly rare and the environment is constantly changing.28 It should be the case that proxy measures are available to compare company performance in the North Sea with those operating in U.S. and Canadian waters, albeit the Macondo/Deepwater Horizon blowout proved that a company with a good record for occupational safety (based on the proxy measure of lost time incidents) could be highly vulnerable to a system safety/safety culture failure. Such geographic comparisons are further complicated by the fact that companies with good safety cultures operate in both domains. Moreover, data on potential safety indicators, such as loss of well control, are not collected consistently and systematically enough to allow for analysis across geographic areas, but may permit comparisons of companies within regions.29 Lacking more complete industry-level analysis, more case studies like Hudson’s reporting on Shell International’s safety culture journey would be especially valuable, though this would require companies to invite independent evaluators in and not restrict their ability to publish.

Government research programs can partner with industrial partners in pilot tests of safety culture interventions. The U.S. Federal Railroad Administration was able to work out arrangements with U.S. railroads to allow modestly-scaled safety culture pilot projects to go forward and be evaluated independently, with encouraging results.30 More positive results from government-industry partnerships such as these could help inform policy makers about the benefits of a SMS-based/safety culture approach to safety and encourage them to give regulators more flexibility in working with industry to focus more on improving their safety performance than imposing penalties for lapses. Documenting the success of BSEE’s safety-case oriented DWOP could provide similarly supportive evidence.

28 See concluding paragraphs of Hudson (2007). 29 Blakstad, H.C. 2014. Safety Indicators Used by Authorities in the Petroleum Industry of the United Kingdom, the United States, and Norway. In, H. Lindoe, M. Baram, and O. Renn, eds, Risk Governance of Offshore Oil and Gas Industries. Cambridge University Press. 30 For an overview of these FRA projects and evaluations, see Ranney, J. M., M. K. Zuschlag, J. Morrell, M. K. Coplen, J. Multer, and T.G. Raslear. Evaluations of Demonstration Pilots Produce Change: Fourteen Years of Safety Culture Improvement Efforts by the Federal Railroad Administration. TR News, No. 286, May–June 2013, pp 28–36.

13

It’s rather surprising that the world-wide requirements for safety management systems that have been imposed in recent decades has not been followed by a greater degree of evidence about the safety benefits these systems are expected to provide. Careful evaluations are rare and, while not definitive, are at least consistent and suggestive about the benefits.31 Company data on incidents and near misses instigated by SEMS, as well as audit reports, could be another source of data for analyzing the effectiveness of safety management systems over time (albeit there are open questions about the comparability of audits by different auditors). Companies may not be willing to share internal incident and audit data with regulators, but might be convinced to pool and anonymize data and make it available to independent researchers. The U.S. offshore industry’s Center for Offshore Safety (COS), created in the aftermath of the Macondo/Deepwater Horizon blowout, might be a mechanism to collect and protect such data. COS could also take the lead in supporting the development of standardized safety climate surveys appropriate for offshore operations that its members would agree to conduct periodically and share with one another. Allowing independent researchers to analyze anonymized data and publish their results could provide credible support for industry progress.

Safety regulation of the offshore industry in the North Sea and the U.S. Outer Continental Shelf provide important lessons on how policy and regulation can evolve with a rapidly advancing industry. For the United States, which has embraced safety management systems for the offshore industry as well as other high-hazard industries, there are broad policy questions about the appropriate regulatory and legal environment needed for advancing safety and further reducing the risk of catastrophic accidents in high-hazard industries. This is a ripe area for policy analysis and research.

31 Robson, et al. 2007. The Effectiveness of Occupational Health and Safety Management System Interventions: A Systematic Review. Safety Science, 45, pp. 329-353. See also M. Thomas. 2012. A Systematic Review of the Effectiveness of Safety Management Systems. Australian Transport Safety Bureau. ATSB Transport Safety Report XR-2011-002. Final Report.

14