MANUAL

RISK ASSESSMENT MATRIX

PTS 60.133 MARCH 1996

PREFACE

PETRONAS Technical Standards (PTS) publications reflect the views, at the time of publication, of PETRONAS OPUs/Divisions. They are based on the experience acquired during the involvement with the design, construction, operation and maintenance of processing units and facilities. Where appropriate they are based on, or reference is made to, national and international standards and codes of practice. The objective is to set the recommended standard for good technical practice to be applied by PETRONAS' OPUs in oil and gas production facilities, refineries, gas processing plants, chemical plants, marketing facilities or any other such facility, and thereby to achieve maximum technical and economic benefit from standardisation. The information set forth in these publications is provided to users for their consideration and decision to implement. This is of particular importance where PTS may not cover every requirement or diversity of condition at each locality. The system of PTS is expected to be sufficiently flexible to allow individual operating units to adapt the information set forth in PTS to their own environment and requirements. When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the quality of work and the attainment of the required design and engineering standards. In particular, for those requirements not specifically covered, the Principal will expect them to follow those design and engineering practices which will achieve the same level of integrity as reflected in the PTS. If in doubt, the Contractor or Manufacturer/Supplier shall, without detracting from his own responsibility, consult the Principal or its technical advisor. The right to use PTS rests with three categories of users : 1) 2) 3) PETRONAS and its affiliates. Other parties who are authorised to use PTS subject to appropriate contractual arrangements. Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred to under 1) and 2) which requires that tenders for projects, materials supplied or - generally - work performed on behalf of the said users comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with users, PETRONAS disclaims any liability of whatsoever nature for any damage (including injury or death) suffered by any company or person whomsoever as a result of or in connection with the use, application or implementation of any PTS, combination of PTS or any part thereof. The benefit of this disclaimer shall inure in all respects to PETRONAS and/or any company affiliated to PETRONAS that may issue PTS or require the use of PTS. Without prejudice to any specific terms in respect of confidentiality under relevant contractual arrangements, PTS shall not, without the prior written consent of PETRONAS, be disclosed by users to any company or person whomsoever and the PTS shall be used exclusively for the purpose they have been provided to the user. They shall be returned after use, including any copies which shall only be made by users with the express prior written consent of PETRONAS. The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be held in safe custody and PETRONAS may at any time require information satisfactory to PETRONAS in order to ascertain how users implement this requirement.

AMENDMENT RECORD SHEET

Chapter Section No. No. All All All All All All

Description Original paper issue Conversion for CD-ROM New issue

Correction/ Update

Date Oct 91

Initials

Reference Indicator

Conversion Update

Feb 95 Mar 96

NPC GvdG

SMAD/23 EPS/HE

TABLE OF CONTENTS 1. 2. 3. 4. INTRODUCTION THE RISK ASSESSMENT MATRIX THE APPLICATION IN HSE RISK MANAGEMENT THE APPLICATION IN INCIDENT INVESTIGATION

APPENDIX 1 APPENDIX 2

CONSEQUENCE CATEGORY DEFINITION RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

1.

INTRODUCTION Management of HSE involves an assessment of the risks posed by incidents* that can develop from the release of a hazard. A qualitative assessment of the risk, rather than a quantitative one, is in many cases adequate to identify an appropriate course of action for managing the risk. The potential risk of an incident can be classified by the use of the Risk Assessment Matrix which is intended to replace the Risk Matrix and the Incident Potential Matrix. Historically the Risk Matrix and the Incident Potential Matrix were developed separately. The Incident Potential Matrix was developed first on the basis of earlier Operating Unit initiatives and published in 1991 as a Shell Safety and Health Committee guide. It introduced the concept of "potential consequences", i.e. "what could have gone wrong" in slightly different circumstances, and was used together with a measure of exposure to assess the relative importance of incidents. The vertical "potential consequence" axis of the Incident Potential Matrix has been widely adopted, whereas the horizontal axis has been variously interpreted by the Operating Units with some using a measure of probability or likelihood of occurrence, while others have used some measure of exposure. In some Operating Units, it is considered that only the potential consequence should determine the depth of investigation, without taking the likelihood of occurrence or exposure into consideration. The Risk Matrix was developed later in conjunction with the development of the Hazards and Effects Management Process (HEMP) of the HSE Management System, as a tool to visibly express company policy and to demonstrate compliance with the risk tolerability criteria and the ALARP principle. The vertical axis of the Risk Matrix was identical to that of the Incident Potential Matrix. For the horizontal axis, a qualitative description of probability was used. In order to promote a consistent approach, it is now recommended to use this horizontal probability axis for all assessment of risks from incidents as it makes risk classification easier and takes into account all the elements used in various Operating Units (frequency of activity, number of people exposed to a hazard, likelihood of release of the hazard and functioning of barriers, and other circumstances that may impact on the development of an incident).This guideline describes the Risk Assessment Matrix (defining the horizontal and vertical axes), and gives examples of its use.

2.

THE RISK ASSESSMENT MATRIX Description The Risk Assessment Matrix (Figure 1) is a tool that standardises qualitative risk assessment and facilitates the categorisation of all threats to health, safety, environment and reputation. The matrix axes, consistent with the definition of risk, are Consequences and Probability (or Likelihood).

Figure 1 :

Risk Assessment Matrix

C o nse q u e n c e

Inc re a sing Probability

Rating

People
No injury Slight injury Minor injury Major injury Single fatality Mutiple fatalities

Assets

Environment Reputation

Never heard Heard of of in --incident in -industry industry

Incident has Happens Happens occurred in several times several times our company per year in co. per year in locn.

0 1 2 3 4 5

No damage No effect Slight damage Minor damage Localised damage Major damage Extensive damage Slight effect Minor effect Localised effect Major effect Massive effect

No impact Slight impact Limited impact Considerable impact Major national Major international

A scale of consequences from "0" to "5" is used to indicate increasing severity. The consequences are those of credible scenarios (taking the prevailing circumstances into consideration) that can develop from the release of a hazard. The potential consequences, rather than the actual ones, are used. These are defined as the consequences that could have resulted from the released hazard if circumstances had been less favourable. The probability on the horizontal axis is estimated on the basis of historical evidence or experience that the identified consequences have materialised within the industry, the company or a smaller unit. Note that this should not be confused with the probability that the hazard is released: it is the probability of the estimated potential consequences occurring. Classification of Potential Consequences The consequences of the release of a hazard or effect are identified in each of the four categories (harm to people, asset damage, environmental effect and potential impact on the reputation of the company) by selecting an appropriate row description on the vertical axis of the matrix. The definition of the categories is given in Appendix 1. Risk is described, not only in terms of risk to health, safety and the environment, but also in terms of risk to reputation. Reputation is driven by perceptions and by societal issues. Risk in scientific terms may be reduced to the level reasonably practicable (ALARP), yet the overall risk to reputation may still remain high. Risk to reputation cannot be ignored and advice may be sought from Public Affairs experts. Consequences should be estimated on the basis of what might have resulted under slightly different circumstances. Examples are: Scenario A crane drops a load one meter besides a person. Car rolls over on a desert road. Operator opens wrong valve: diesel fuel polluting river; quickly spotted by someone else. Exposure to H2S: quickly rescued and resuscitated Exposure to benzene exceeding current occupational exposure limits Flare carries over some crude. Actual outcome Damage to load. Potential consequence Fatal injury if a person had been standing under the load.

Damage to car, no injury (seat Serious injury. belt was worn). Minor pollution Major effect if the spill had not been noticed so quickly. in Fatal or permanent total/partial disability. Cancer (leukemia).

2 days observation hospital: minor injury. None.

Sooting flare.

Oil in flare pit. Pit on fire. Heavy smoke. Soot on nearby houses and cars. Complaints. Media publicity. Damage claims.

Assessment of Probability The horizontal axis represents the probability or the measure of likelihood of the occurrence of an undesired event following the release of a hazard. The scale of the horizontal axis is indicatively defined : "A - never heard of in the __ industry", "B - heard of in the __ industry", "C - has occurred in our company", "D - happens several times per year in company", and "E - happens several times per year in location". This assessment is based on experience and is indicative of the likelihood of undesired consequences materialising. Note again that this should not be confused with the probability that the hazard is released: it is the probability of the estimated potential consequences occuring.

In smaller Operating Units or new ventures where experience is limited, it is recommended that the probability is assessed on the basis of knowledge from similar operations in other Operating Units. In new ventures, the potential consequence scale only can be used and investigations carried out for all incidents with potential higher than 3. By doing so, every opportunity is used for learning from the potentially serious incidents, no matter how unlikely their occurence may be. Risk Classification Using the Risk Assessment Matrix, risk is classified by three characters made up as follows: the first character is a measure of the likelihood of an undesired event: A-E the second character is the consequence severity that could occur with that event: 1-5, and the third character shows to which consequence category the assessment pertains - People (P), Asset (A), Environmental (E) nature or Reputation (R).

The intersection of the chosen column with the chosen row is the risk classification. For the same scenario, different classifications may apply to P, A, E, and R. Some examples of incident classification are given in Appendix 2. 3. THE APPLICATION IN HSE RISK MANAGEMENT A suitable overlay for using the Risk Assessment Matrix as an element of the HSE management system to identify actions to reduce risk to ALARP is shown in Figure 2 below. Figure 2 : Risk Management Overlay

(for expressing Company policy and strategic objectives)

Increasing Probability
A B C D E

Rating

Never heard of in --industry

Heard of incident in -- industry

Incident has occurred in our company

Happens several times per year in co.

Happens several times per year in locn.

0 1 2 3 4 5 Manage for continuous improvement Incorporate Risk Reduction Measures Intolerable

Objective setting is at the heart of the HSE Management System and the Risk Assessment Matrix overlay format shown above is a useful tool that can help management in the interpretation of risk (expressed in the policy and strategic objectives of the company) and also help the line in understanding how this policy and these objectives are to be regarded (in terms of tolerable risk) in their day to day operations. The definition of tolerable risk should be derived from the policy and strategic objectives of the company and can be indicated on the Risk Assessment Matrix by company management by shading-in the appropriate areas. The shading indicated in the matrix is recommended practice; deviations can be considered for small operating entities. The focus provided by using the Risk Assessment Matrix in this way enables company management to determine whether the risk levels inherent in the company's operations are tolerable and whether they fit with current corporate policies and objectives. For example, if an operation would result in scenarios which lie

in an area on the Risk Assessment Matrix that the company would normally regard as "intolerable" in policy terms, then alternative ways of carrying out the operation should be investigated. If there are no alternative ways, then management must decide whether the operation should proceed or not. If it has to proceed then special treatment in regard to the level of control must be implemented before the operation takes place. The Risk Assessment Matrix overlay may also be used on a scenario by scenario basis to prioritise risk reduction efforts. It is adaptable to varying levels of information and depths of evaluation. It has a built-in presentation format that lends itself to review. Because it is qualitative and the scales relative, instead of absolute, exact knowledge is not required and thus risk understanding can be reached fairly easily. Examples of risk determination using the Risk Assessment Matrix are included in Appendix 2. A company should consider using the Risk Assessment Matrix as a part of its implementation of the HSE Management System and of HSE Cases (HSE Reports). The use of the Risk Assessment Matrix will: 4. enhance the appreciation of HSE risk tolerability and ALARP at all levels in the company, assist in making the PETRONAS Group policy and standards and local company HSE policies relevant to day to day operations via the setting of clear risk based objectives that can be cascaded into the setting of individual tasks and targets, and provide the basis for the implementation of the risk-based HSE Management System in accordance with PETRONAS Group Guidelines.

THE APPLICATION IN INCIDENT INVESTIGATION For use in incident follow-up, the matrix can be used with an overlay as shown in Figure 3 to decide on depth of investigation, investigation team composition, reporting level, etc Figure 3 : Incident Follow-up Overlay
Increasing Probability A
Never heard of in --industry

B
Heard of incident in -- industry

C
Incident has occurred in our company

D
Happens several times per year in co.

E
Happens several times per year in locn.

Rating

0 1 2 3 4 5 to be investigated and discussed in depth analysis and discussion at management in depth analysis, level management involvement, voluntary reporting to service companies

Suggestions for team composition, reporting and feedback to management are shown below. Company managements are encouraged to review and customise the table. Risk Rating Low risk (unshaded area) Medium Risk (lightly shaded area) High Risk (heavily shaded area) Investigation team composition local supervisor + HSE focal point asset holder + other line staff as required + HSE advisor Member of Management Team + asset holder + HSE advisor + independent person e.g. from corporate organisation + specialists as required Reporting/discussion reporting to department head reporting to OU management reporting to CEO and voluntary reporting to Service Companies

The Incident Follow-up Overlay is intended for use by location personnel after an incident occurrence to: assess the significance of an incident in terms of its ultimate potential for injury, damage, environmental and reputation effects, provide guidance in determining the depth or extent of an incident investigation and its follow-up, and increase the awareness of Health, Safety and Environmental implications of any incident. Application of the tool is expected to: promote near-miss reporting, improve knowledge of potentially serious incidents, enhance the direction of safety efforts and make more efficient use of investigation time, improve management of risk reduction efforts, and focus on where the greatest benefits can be achieved, provide a broad incident occurrence indicator, and assist in media handling by the Public Affairs staff due to an improved insight into the potential severity of an incident.

APPENDIX 1 CONSEQUENCE CATEGORY DEFINITION Harm to People No. 0 1 2 Description No injury or damage to health. Slight injury or health effects (including first aid case and medical treatment case) Not affecting work performance or causing disability. Minor injury or health effects (Lost Time Injury) - Affecting work performance, such as restriction to activities (Restricted Work Case) or a need to take a few days to fully recover (Lost Workday Case). Limited health effects which are reversible, e.g. skin irritation, food poisoning. Major injury or health effects (including Permanent Partial Disability) - Affecting work performance in the longer term, such as a prolonged absence from work. Irreversible health damage without loss of life, e.g. noise induced hearing loss, chronic back injuries. Single fatality - From an accident or occupational illness (poisoning , cancer). Multiple fatalities - From an accident or occupational illness (poisoning, cancer).

4 5 Asset Damage No. 0 1 2 3 4 5

Description (100% costs, USD) Zero damage Slight damage - No disruption to operation (costs less than 10,000) Minor damage - Brief disruption (costs less than 100,000) Local damage - Partial shutdown (can be restarted but costs up to 500,000) Major damage - Partial operation loss (2 weeks shutdown costs up to 10,000,000) Extensive damage - Substantial or total loss of operation (costs in excess of 10,000,000)

Environmental Effect No. 0 1 2 Description Zero effect - No environmental damage. No change in the environment. No financial consequences. Slight effect - Local environmental damage. Within the fence and within systems. Negligible financial consequences. Minor effect - Contamination. Damage sufficiently large to attack the environment. Single exceedance of statutory or prescribed criterion. Single complaint. No permanent effect on the environment. Localised effect - Limited loss of discharges of known toxicity. Repeated exceedance of statutory or prescribed limit. Affecting neighbourhood. Major effect - Severe environmental damage. The company is required to take extensive measures to restore the contaminated environment to its original state. Extended exceedance of statutory or prescribed limits. Massive effect - Persistent severe environmental damage or severe nuisance extending over a large area. In terms of commercial or recreational use or nature conservancy, a major economic loss for the company. Constant, high exceedance of statutory or prescribed limits.

3 4

Impact On Reputation No. 0 1 2 3 Description No impact - No public awareness Slight impact - Public awareness may exist, but there is no public concern. Limited impact - Some local public concern. Some local media and/or local political attention with potentially adverse aspects for company operations. Considerable impact - Regional public concern. Extensive adverse attention in local media. Slight national media and / or local / regional political attention. Adverse stance of local government and/or action groups. National impact - National public concern. Extensive adverse attention in the national media. Regional / national policies with potentially restrictive measures and/or impact on grant of licences. Mobilisation of action groups. International impact - International public attention. Extensive adverse attention in international media. National / international policies with potentially severe impact on access to new areas, grants of licences and/or tax legislation.

APPENDIX 2 RISK ASSESSMENT MATRIX APPLICATION EXAMPLES Examples In HSE Risk Management 1. Risk Scenario: All the tanks in a terminal are within bunds. One of the tanks is receiving gasoline from a tanker. The operation is started at night. The storage tank is overfilled and a large vapour cloud is formed by vaporising gasoline. The vapour cloud is ignited by a passing vehicle. A major explosion and fire develop which destroy 10 of the 15 tanks at the terminal, cause extensive damage, and result in multiple fatalities. Such an accident has not occurred previously in the Operating Unit.
C o n se q u e n c e A
Never heard of in --industry

Inc re a sing Pro b a b ility B

Heard of incident in -- industry

Rating

People
No injury Slight injury Minor injury Major injury Single fatality Mutiple fatalities

Assets

Environment Reputation

Incident has Happens Happens several occurred in several times times per year in our company per year in locn. co.

0 1 2 3 4 5

No damage No effect Slight damage Minor damage Localised damage Major damage Extensive damage Slight effect Minor effect Localised effect Major effect Massive effect

No impact Slight impact Limited impact Considerable impact Major national Major international

Demonstrate ALARP
E R P A

INTOLERABLE

Using the Risk Assessment Matrix (see the figure above), this scenario for people, assets and company reputation plots in the region categorised as Demonstrate ALARP by company management. This means that for this type of loss of containment event a cost benefit analysis should be undertaken to determine if there are additional cost effective measures that could be put in place to further reduce the risks to people, assets and company reputation. The risk to the environment should be managed for continuous improvement. 2. A proposal for a new installation has two product movement scenarios: transport by truck or the installation of a pipeline. For the trucking scenario (indicated by a O on the matrix shown below), the following risk classifications were identified: C5(P), C2(A), D1(E), C1(R). The risk to people is categorised as "intolerable". For this scenario to be undertaken special treatment in regard to protecting people must be implemented. Cost effective measures to reduce the risk to people should be undertaken. For the pipeline scenario (indicated by a on the matrix), the following risk classifications were identified: B2(P), B3(A), B3(E), B1(R). The risks to people, assets, environment and reputation are categorised as tolerable, and if the pipeline scenario is implemented, should be managed for continuous improvement in HSE performance.
Consequence Increasing Probability

B
Heard of incident in -- industry

Rating

People

Assets

Environment

Reputation

Never heard of in --industry

Happens Happens Incident has occurred in our several times several times company per year in co. per year in locn.

0 1 2 3 4 5

No

injury

No damage Slight damage Minor damage Localised damage Major damage

No effect Slight effect Minor effect Localised effect Major effect Massive effect

No impact Slight impact Limited impact Considerable impact Major national Major international

Slight injury Minor injury Major injury Single fatality

R P AE

R A

Demonstrate ALARP

Extensive Mutiple fatalities damage

INTOLERABLE

Examples of Incident Classification 1. During a weekly off loading operation from a supply vessel, a roof section of a container became detached and fell into the sea striking the vessel on the port side. Containers containing chemicals are delivered once a month. The potential consequence to people from this incident is a single fatality. This corresponds to a severity rating code of 4. A similar incident with fatal consequences occurred 3 years ago. Several times per year local damage occurs as a result of loose items falling during off loading. The Incident Potentials determined are: C4(P) - fatality if a person was below falling roof. D3(A) - equipment damage causes partial shutdown. C1(E) - slight environmental effect. 2. Bus carrying contract cleaning staff fails to stop at security check and hits the security gate. There were no injuries. There have been previous occasions in company when sudden stops from hitting obstacles resulted in fractures or bruises. The following classifications are appropriate: D3(P) - injuries from sudden stop. D2(A) - damage to vehicle or obstacles 3. Mechanical digger severed a live 415 Volt underground cable to a laboratory while excavating to lay water pipes. There were no injuries. B4(P) - possible electrocution of driver (one person). C2(A) - loss of ongoing experiment and equipment. Radioactive contamination found on work bench during routine monitoring. This incident would be classified: B4(P) - internal contamination can lead to cancer; cases are known in industry E3(E) - repeated breach of statutory rules. 5. While trying to jump start a car (12V) with a crane battery (24V) the car battery exploded, spraying acid on operator. Actual consequences : damage to clothing and car. C3(P) - possible severe eye injury. C2(A) - damage to car. 6. Filing cabinet drawers are opened adjacent to a busy access route in an office. The cabinet overbalances and falls over, nobody is hurt but people could have been passing. It has occurred once before in the Operating Unit that someone was seriously hurt by such an accident. D3(P) - major injury to person passing. 7. During "start-up" an exchanger joint fails releasing an estimated 5-tonne cloud of propane. The operator jumped away and sprained his ankle. B5(P) - possible multiple fatalities if the gas cloud had been ignited. B3(A) - damage in case of gas cloud explosion. 8. During the loading of diesel from a tank, the ship's hose sprung a leak and the river was contaminated. The contamination was noted within minutes by an outsider who warned the loading master. The damage could have been much worse if it had not been spotted so quickly. Small leaks have occurred earlier in the company, but not a major one. B3 (E) or D2 (E) - spills with minor effects have occurred, more serious local effect has not occurred previously in this company D2 (R) - local population gets worried about frequent minor spills

4.