ACCIDENT AND INCIDENT INVESTIGATION

INCIDENT CAUSATION ANALYSIS METHODOLOGY (ICAM) FACTORS INFLUENCING OCCURENCE OF INCIDENTS THE CAUSATION PATHWAY
Written by Nigel Pitt IMORSA.com

Incident Accident Investigation - Causation Pathway

June 13, 2013

TABLE OF CONTENTS
TABLE OF CONTENTS 1 SECTION ONE: CAUSES AND CONSEQUENCES OF INCIDENTS 2 SECTION TWO: STATISTICS 3 SECTION THREE: COSTS OF ACCIDENTS 4 SECTION FOUR: PROBABILITY AND LIKELIHOOD 5 SECTION FIVE: MANAGEMENT 6 SECTION SIX: DEFINITIONS 7 SECTION SEVEN: CONTROLLING POTENTIAL INCIDENTS 9 SECTION EIGHT: INCIDENT CAUSATION THEORY 11 SECTION NINE: CAUSATION MODEL 12 SECTION TEN: IDENTIFY THE ABSENT OR FAILED DEFENCES 15 SECTION ELEVEN: IDENTIFY THE INDIVIDUAL / TEAM ACTIONS 16 SECTION TWELVE: IMMEDIATE CAUSES 19 SECTION THIRTEEN: IDENTIFY THE TASK / ENVIRONMENTAL CONDITIONS (Underlying Causes) 20 SECTION FOURTEEN: MANAGEMENT CONTROL 22 SECTION FIFTEEN: RISK ASSESSMENTS 24

v6

Page 1 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION ONE: CAUSES AND CONSEQUENCES OF INCIDENTS

WHY DO ACCIDENTS HAPPEN?
Accidents dont happen they are caused. Many accident investigations reflect the lack of management control and subsequent consequences. Where effective management control is lacking there are exposures in the work place. Safety in the work place is managed by the imposition of policies, rules, regulations, standards, practices, procedures, systems of work, guidelines, specifications and codes of practice. Consider the following and their effect on maintaining a safe work place and systems of work: Lack of leadership, lack of resources, urgency, poor training, lack of compliance, lack of roles responsibilities and accountabilities, inadequate risk assessments and inadequate Job safety plans, inadequate or noncompliance with procedures, lack of competence, production focus a priority, lip service to safety, superficial safety culture, no application of standards, organisational culture, inadequate audits, inadequate inspections and reviews, inadequate contractor management and oversight etc. The failure to comply with systems of work and controls cause most of the incidents. Incident investigations enable the identification of how and why these system failures occur, their consequences and what needs to be done to prevent recurrence.

WHY INVESTIGATE ACCIDENTS?

By identifying the real causes, a similar or perhaps more disastrous incident may be prevented in future provided proper and effective corrective measures are implemented. Viewing the incident as "the consequence of a failure or inadequacy in the safety management system" engenders professional investigative efforts. Identifying a failure in the system will assist with directing one towards uncovering meaningful information regarding the incident.

CONSEQUENCE
Consequence essentially is the final outcome of an event. It is the collective sum of all the issues that the organisation will be confronted with after the event, i.e. after the accident has happened. Consequences might be management intervention strategies, reputational issues, restructuring, litigation, multiple fatalities, dismissals, official enquiry, prosecution, closure of operation, shares devalued, fines, penalties and imprisonment, etc. The degree of severity would be relative to the measure as determined by the organisation. It would relate to the number of people affected, the area affected, the magnitude of the loss incurred and the degree of violation of statutory requirements and dependant on the view the judiciary would take given the seriousness of the offence, etc. BP agrees to pay largest penalty in US history in $4.5bn Gulf oil spill deal Oil giant BP will pay $4.5bn to US authorities and agrees to plead guilty to 11 felony counts of misconduct over fatal rig explosion. BP has agreed to pay the largest criminal fine in US history $4.5bn to resolve all criminal charges arising from the fatal oil rig explosion and catastrophic oil spill in the Gulf of Mexico.

v6

Page 2 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION TWO: STATISTICS

FRANK BIRD STUDY: THE ACCIDENT PYRAMID
In order to understand the history of incident prevention, one needs a good understanding of what it takes to reduce injuries. The accident pyramid model used many years ago will provide some useful information and assist with understanding. In 1969, a study of industrial accidents was undertaken by Frank E. Bird, Jr., who was then the Director of Engineering Services for the Insurance Company of North America. He was interested in the accident ratio of 1 major injury to 29 minor injuries to 300 no-injury accidents first discussed in the 1931 book, Industrial Accident Prevention by H. W. Heinrich. Refer to Figure 1.

Figure 1: Safety Pyramid Developed by H.W. Heinrich (1931) For every reported major injury (resulting in fatality, disability, lost time or medical treatment), there were 9.8 reported minor injuries (requiring only first aid). For the 95 companies that further analysed major injuries in their reporting, the ratio was one lost time injury per 15 medical treatment injuries. Refer to Figure 2.

Figure 2 In 1993 the Health and Safety Executive (HSE) group of the British government published the results of one of its studies. The study was conducted by a team of professionals, including economists, who visited five different locations representing different industry types. Other interesting findings of the British research include: 37% of an organisations annual profit was lost due to incident costs. The equivalent of 8.5% of organisations total annual revenue was lost due to incident costs. The equivalent of 5% of an organisations operating budget was lost due to incident costs. Although there was a wide range of immediate causes for the incidents, there were very common underlying causes. A separate analysis of 80% of the incidents showed that over 8% had the potential to have serious or major consequences.

Considering these studies, it is evident that there is a fundamental relationship between major incidents, minor incidents, and near-misses. This infers that efforts directed at events where there is no consequence are more effective than focusing primarily on serious incidents. Focusing on consequences is reactive not proactive. Evidence suggests that there are more minor incidents than serious incidents in the work place. This confirms the merits of giving attention to the less serious incidents so that the causes can be identified and corrected before more serious incidents occur.
v6 Page 3 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION THREE: COSTS OF ACCIDENTS

There is a direct relationship between direct costs (1) and all the hidden costs (6-53) that arise at a later stage that are not immediately noticeable when an accident occurs. The costs of incidents can be illustrated as an iceberg, illustrated above. The relatively low costs associated with insurance and medical expenses are obvious, like the tip of the iceberg, while the enormous overall costs of incidents are to be found below the surface. It will be noticed by reviewing the iceberg that for every 1 unit of costs, there are 6 to 53 times that amount of loss due to property, environment, assets, reputation, process, material, and miscellaneous cost. These numbers have been derived by researching insurance cost data which supports that the costs of losses reported in the transportation industry (e.g. trucking and railroad), and various manufacturing industries alone is many times the national costs of work related injuries and illnesses. In addition, there have been numerous case studies, involving single sites or companies, which have since been done, which support these numbers as well. For capital-intensive operations the costs tend to be high; whereas for labour-intensive operations they tend to be relatively low. These costs must be carefully monitored or they will go unnoticed. There are various costs associated with incidents. Some are obvious while others are less obvious such as: Business opportunities foregone Corporate brand, image and reputational issues Criminal prosecution Employee morale and commitment Future leverage opportunities Investigation and inquiry costs Loss of investor confidence Market share loss Pain, suffering and anguish Psychological trauma on employees Public relations

v6

Page 4 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

Costs can broadly be categorised under the following headings: Compensation and Benefits Death benefits Long term disability Medical and rehabilitation Pension benefits and lump sum payments Wages for hired labour Operational costs Capital expenditures Equipment replacement Loss of customers and returned products Process / downtime and loss Rental costs for replacement equipment Facility recovery Start-up costs Product recall Miscellaneous Advisory fees Hired plant and machinery costs Labour hire costs Legal/Litigation Attorney and legal counsel fees Fines, penalties, and citations Labour/Union costs Process/Production Cleaning materials Defect production costs Equipment repair

Marketing

Settlements Subject matter experts Third party claims Prosecution

Laboratory costs

PR

Management time

Outsourcing Investigation fees

Overtime Retraining Salvage and clean-up Material recovery

SECTION FOUR: PROBABILITY AND LIKELIHOOD

Likelihood is the hypothetical probability that an event that has already occurred would yield a specific outcome. The concept differs from that of a probability in that a probability refers to the occurrence of future events, while likelihood refers to past events with known outcomes. I.e. it has happened in the industry or company before. These factors affect the degree of likelihood of an occurrence of an event. The probability of loss occurring whenever a particular task is performed is determined by the following factors: Hazardousness (i.e. how inherently dangerous is the task). Difficulty (i.e. is the task prone to quality, production or other problems?) Complexity of the task. The chance that loss will be incurred if the task is performed improperly.

v6

Page 5 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION FIVE: MANAGEMENT

INTRODUCTION
World class organisations have established core fundamentals related to safety, one of which is that safety is a line management responsibility. This philosophy is entrenched in PDO HSE management responsibilities. This infers that top management is responsible for the overall establishment, implementation and maintenance and ultimately the performance of the safety management system. This begs the question Who is Management?

MANAGEMENT
Given that people are generally involved in incidents, either directly or indirectly, it is appropriate that one understands the term Manager. Managers are responsible for managing organisational system processes and it is the failure of these management system processes that needs to be identified. Managers are the people responsible for enabling an organisation to achieve its stated goals and objectives. Managers are responsible for the process of planning; organising; leading, coordinating and controlling the efforts of organisational members and using all organisational resources at their disposal to achieve stated organisational goals. (Mescon et al., 1985) This explains what managers do: Managers require skill and this management skill is explained as getting things done by other people (Parker Follett, 1941). Furthermore, it can be said that the activity of management is the process of optimising personal, material, and financial contributions for the achievement of organisational goals (Mescon et al, 1985).

WHAT MANAGERS DO
Fayol defined the following management functions: Planning: the activities necessary to ensure the achievement of the stated organisational objectives Organising: to ensure the availability and coordination of the material and personal resources within the organisational business units necessary to accomplish the organisational goals Leading: providing direction to employees Controlling: involving the process of monitoring and adjusting organisational activities in order to facilitate the accomplishment of organisational objectives Coordinating: ensuring the organisational resources and activities work together to achieve stated goals.

v6

Page 6 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION SIX: DEFINITIONS

MEANING OF INCIDENT

An unplanned and undesired event or chain of events that has, or could have, resulted in injury or illness, damage to assets, the environment, company reputation, and/or consequential business loss. or the release or near release of a hazard, which exceeds a defined limit or threshold limit value.

MEANING OF MAJOR INCIDENT

Unplanned event which does result in injury, harm and damage

MEANING OF HIGH POTENTIAL INCIDENT (HiPo) An Incident or unsafe/unhealthy condition or near miss where the most serious probable outcome is a Major Incident. A HiPo may not be identified as such at the time of the Incident and it is only after investigation that the true severity of the most serious probable outcome becomes clear. If, after investigation, an incident is found to fit these definitions, it should be reported as a HiPo, even if it is outside the nominated reporting timeframe

It is critical that one understands the characteristics of an accident if one is to prevent them from occurring again. For an accident to be an outcome of an event there has to be damage of some degree. If a person cuts his/her finger on a paper cutter it is an accident. As minor as it may be, an injury is sustained. Where a serious incident occurs resulting in severe injury, illness, harm or damage there has to be some contact with a source of energy or substances which exceed the resistive limit of the body, structure or environmental media. Energy is found in different forms such as chemical, electrical, thermal, kinetic, noise, radiation and potential energy, etc. (page13) The following examples illustrate an accident: An electrician and his assistant were assigned the task of repairing a three phase supply to a pump station. The electrician wanted to determine if there was supply on the load side of the distribution point and attempted to test one of the phases in the main circuit breaker. In so doing he placed the tip of the probe of the multimeter between two of the phase lugs causing a short circuit and a flash over. The consequence was serious burn injuries and a burnt out MCB. The driver of a bulk fuel tanker fell asleep behind the wheel, resulting in the vehicle capsizing and spilling the contents of three of the compartments, thereby contaminating the soil and resulting in a fire and fatality. It is clear from the above that one incident is more severe than the other.

v6

Page 7 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

MEANING OF NEAR MISS An unplanned event that did not result in injury, illness, or damage to assets, the environment or Company reputation but had the potential to do so. Or An incident which under slightly different circumstances could have resulted in injury, harm or damage. A near miss is an event where there is no undesirable consequence or outcome, i.e. no injury, harm, damage or illness is sustained. It is typically an event where had there been a minor variation in circumstances the event would have resulted in an accident rather than a near miss. Where these events occur one must consider the possibility of the outcome having been worse and consider the worst case scenario. Where the potential exists for the consequences to have been severe one should investigate the incident as if it had occurred and resulted in the worst possible outcome.

MEANING OF UNSAFE ACT/CONDITION

Any departure from the required or expected performance or condition of equipment (Plant), procedures (Process), or People (conduct), which if not addressed could result in an Incident, or make a consequence of an incident more severe.

MEANING OF LOSS Loss in environmental terms may be defined as avoidable waste of a resource. Loss in terms of safety is defined as avoidable harm to people, the environment, assets, reputation, systems and process.

MEANING OF SAFETY Control of accidental losses to an acceptable level Judgement of the acceptability of risk The minimisation of loss

MEANING OF CRITICAL FACTORS: Negative actions or undesirable conditions that influence the course of events. Major contributions to the incident. How did this event cause the incident. Why? Actions or conditions, which if eliminated, would have either prevented the occurrence or reduced its severity.

v6

Page 8 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION SEVEN: CONTROLLING POTENTIAL INCIDENTS

PHASES
When one conducts an investigation into an accident and determines the time line of events prior to the critical event occurring that resulted in an accident one realises that there were contributing factors prior to the critical event occurring, the critical event itself and post event issues i.e. consequences and emergency response etc. The accident investigation focuses on all the evidence supporting events leading up to the critical event.

Compressor within the Tedlar unit malfunctioned unit was restarted without the compressor November 8

Internal inspection tank 2 Discovered that the U-leg seal loop on the flash tank overflow line had a fishmouth split in the pipe Tedlar process restarted

October 21

Damaged agitator discovered

Slurry tanks were locked out

The valves on the tank 1 fill and discharge lines were locked out Contractor performed the grinding and welding repairs atop tank 2

November 1

November 1

November 3

November 3

November 6

November 7

November 9

October 22

October 29

Hot work permit completed area around the top of the slurry tanks tested for flammable vapour concentration

Lockout card completed for tank 1

Process shut down. Slurry pumped out of tank 2 and 1

Crew started work

Welding sparks enter vessel (critical event)

Explosion

The Phases of control are explained by reference to pre-contact, contact and post contact control opportunities. Therefore: Pre-contact control; offers opportunities to safeguard against the occurrence of the event, Contact control; offers opportunities to minimise the severity of the impact, and Post contact control; offers opportunities to safeguard against additional losses and mitigate to make less severe the current circumstances.

v6

11.04 am

9 am

Page 9 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

CONTROL AT THE PRE-CONTACT PHASE

In the pre-contact phase one needs to consider the effectiveness of implemented barriers and defences which are the physical and procedural control processes such as policies, rules, regulations, standards, engineering practices, procedures, systems of work, legislation etc. These control processes are necessary to minimise the threats, system or equipment failures, i.e. latent or active failures, and should have evolved out of a hazard identification and risk assessment process.

CONTROL AT THE CONTACT PHASE-

BEFORE THE ACCIDENT

Control at this stage would require considering numerous options at one s disposal in order to minimise the consequences of any impact. What measures were taken to minimise the initial impact? reducing the amount of energy used or released reducing rotational speeds reducing flow rates reducing high pressure to low pressure raising the flashpoint of substances reducing high voltage to low voltage reducing thermal values reducing volumes of stored chemicals placing barriers at point of exposure access control bunding cages explosion bunkers fire walls fume cupboards machine enclosures machine guarding fire resistant suits and equipment separator pits and sumps engaging alternative energy sources or substituting with less harmful substances use of non-flammable substances reduction of toxicity exposure levels in substances or materials replacing manual labour operations with automated systems modify contact surfaces install anti slip tread material install bollards roughen surfaces smoothing edges strengthening body or structure reinforcing structures case hardening of tool parts reinforce glass with film shield protection

CONTROL AT THE POST CONTACT PHASE

RECOVERY AFTER THE ACCIDEN T .

The extent of any loss can and should be controlled to ensure that the loss does not escalate into an uncontrolled state resulting in even greater loss. For example, a fire in a gasification plant in a refinery needs to be contained otherwise the end result could be devastating. This control should ideally be achieved by means of proper crisis management or emergency response procedures and standards. This might include amongst other things: Appropriate training Back-up equipment (e.g. pumps, foam systems, generators, lights, etc.) Disaster management plans Emergency control facilities Emergency response organisations External support Medical response teams and facilities Proto teams Rescue equipment Scenario drills Spill prevention and control Well-developed emergency response/crisis management plans and procedures.

v6

Page 10 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION EIGHT: INCIDENT CAUSATION THEORY

The purpose of accident investigations is to identify those direct and underlying causes that lead to accidents. The ICAM system used here relates to SCAT Systematic Causal Analysis Technique. It is essentially a guide used to direct one through the causation process systematically enabling one to identify the underlying cause of the problem.

UNDERLYING CAUSE
An underlying cause is an initiating cause of a causal chain of events which leads to an outcome or an undesirable effect of interest. The term underlying cause is used to describe the depth in the causal chain where an intervention could reasonably be implemented to change performance and prevent an undesirable outcome.

COMPONENTS OF UNDERLYING CAUSE ANALYSIS

PLANT/EQUIPMENT/MACHINERY/TOOLS/FACILITIES incorrect tool selection inadequate maintenance or design inadequate equipment or tool placement defective equipment or tool work environment disorderly workplace surfaces poorly maintained excessive physical demands of the task MATERIALS defective raw material incorrect material for process absence of raw material material not to specification MANAGEMENT lack of or poor standard of management involvement inattention to task inadequate work planning inadequate supervision inadequate training or education inadequate enforcement of rules psycho social stress METHODS inadequate procedures inadequate guarding inadequate process non-conformance practices (actions) with procedures inadequate communication MANAGEMENT SYSTEMS inadequate systems inadequate implementation inadequate compliance inadequate roles and responsibilities inadequate standards inadequate recognition of hazards inadequate hazard identification and risk assessment

v6

Page 11 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION NINE: CAUSATION MODEL

The causation model is a tool which enables one to follow a logical route necessary to determine underlying causes and conclude a successful investigation. It represents the sequence or stages of events that lead to incidents and is a graphical representation of the theory of causation. The Incident Causation Model is best understood working from the loss section to the Risk Management and Compliance section. This enables one to understand the sequence of events leading up to the loss. A diagram is used to facilitate a better understanding of the relationship between the various aspects of causation as shown below.

For example, a loss was incurred due to a contact (the incident event) with an energy source or substance (hazard) due to a failed barrier, (control) due to immediate causes, (unsafe acts/conditions) emerging from (basic) underlying causes produced by system defects as a consequence of inadequate management control.

M ULTIPLE

CAUSATION

Loss causation theory requires the understanding of the multiple causation theory which states that there are multiple causes underpinning every incident. These multiple causes interact collectively to cause the incident. Once the causation sequence is set in motion, it is unknown as to what the eventual outcome will be. This is best understood when one considers the domino theory. If a number of dominos are aligned and the first domino is tipped, the rest will fall until the last one tumbles.

v6

Page 12 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

LOSS
When an event happens in an organisation and the energies involved exceed the limitations of tolerance of a body or media to resist the effect of the energy on the body often the consequences result in a loss. When a loss is incurred as a consequence of an incident type event occurring it is termed an accident. These losses manifest (apparent) themselves in terms of injuries, illness, harm and damage. They affect people, the environment, assets (tools, plant, equipment, machinery, materials) and reputation, directly i.e. people are injured and become ill, the environment is harmed, and tools, plant, equipment, machinery and facilities are damaged, thereby affecting process and reputation. Harm to People: is the most serious of consequences and warrants the highest level of attention from Management. There are tangible losses associated with injuries (such as trauma, disfigured bodies, compensation costs, rehabilitation costs, absenteeism, overtime costs etc.) as well as personal costs (such as anguish, stress, suffering, psychological trauma, pain, poor morale, etc.) Harm to Environment: includes any negative impact on the environment that the organisation s aspects may present Harm to Assets: includes tools, plant, equipment, machinery, facilities, materials, and parts damage. Harm to Reputation: is often overlooked, yet represents one of the most serious consequences that many organisations never recover from. Consider that BP will never recover their reputation from the Texas City refinery explosion and Deep Water Horizon disaster (Macondo Blow Out)

INCIDENT
The incident or potential loss-producing event immediately precedes the consequence. This is where the contact with a hazard (unsafe act/condition, source of energy or substance) takes place. It is important to realise that there is the potential for an undesirable consequence to occur and this will be dependent on the energies involved. The term potential loss producing event is used in this block because, at this point, the contact with energy or substance may or may not be above the resistive limitation of the body, structure or environmental media that is exposed to this contact. If the energy exchange is below the resistive limit of the body media or structure exposed, the incident sequence stops, i.e. no harm, damage or injury occurs and the event results in a near-miss. If the resistive limit is exceeded, harm takes place and the consequence is an accident. It is important to define the contact to assist one to understand the type of event that takes place. Contacts can be classified into the following underlying types: Caught between - in gears, belt rollers, rotating parts, drive bolts, chains, vehicles and trailers etc Caught in - confined spaces, gears, pinch points, rollers, etc Caught on - projecting or protruding objects, moving parts, etc Caught under - object, material, equipment, plant, machinery, etc Contact with - hot and cold surfaces, objects, materials or substances, toxic substances, energy sources, electrical sources, chemicals, etc Exposure to - toxic fumes, vapours, gasses, mists, extreme temperatures, ergonomic hazard, radioactive substance, noise, chemical emission, etc Fall from elevation to lower level - fall from ladder, platform, roof, stairs, scaffolding, structures, equipment, etc Fall on same level - slip, trip, fall, etc Handling - incorrect stacking, placing, storing, etc Inundation - enter into water of unknown depth (drowning) or material in silos etc Overstress - physical injury due to improper lifting, pushing, pulling, twisting, etc Struck against - protruding objects, structures , etc Struck by - mobile objects, vehicles, loads, etc

v6

Page 13 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

T HE

DIRECT CAUSE OF I N JURY

Whenever an injury occurs, a harmful level of energy is transferred to our body. We should describe the nature of that energy transfer and refer to it as the direct cause of the injury. Here are various forms of energy that could be harmful: 1. Acoustic energy - Excessive noise and vibration. 2. Chemical energy - Corrosive, toxic, flammable, or reactive substances. Involves a release of energy, ranging from "not violent" to "explosive" and "capable of detonation". 3. Electrical energy - Low voltage and high voltage often described as contact with. 4. Kinetic (Impact) energy - Energy from "things in motion" and "impact," and are associated with the collision of objects in relative motion to each other. It includes impact between moving objects, moving object against a stationary object, falling objects, flying objects, and flying particles. Also involves movement resulting from hazards of high-pressure pneumatic or hydraulic systems. This type of event is often described as Struck by . 5. Mechanical energy - Cut, crush, bend, shear, pinch, wrap, pull, and puncture. Such hazards are associated with components that move in circular, transverse (single direction), or reciprocating motion. 6. Potential (Stored) energy - Involves "stored energy." Includes objects that are under pressure, tension, or compression; or objects that attract or repulse one another. Susceptible to sudden unexpected movement. Includes gravity - potential falling objects, potential falls of persons. Includes forces transferred biomechanically to the human body during lifting. 7. Radiant energy hazards - Relatively short wavelength energy forms within the electromagnetic spectrum. Includes infra-red, microwave, ultra-violet, x-ray, and ionizing radiation. 8. Thermal energy - Excessive heat, extreme cold, sources of flame ignition, flame propagation, and heat related explosions.

L ET ' S

TAKE A LOOK AT SOM E EX AMPLES DESCRIBIN G THE DIRECT CAUSE O F INJURY :

If a harsh acid splashes on our face, we may suffer a chemical burn because our skin has been exposed to a chemical form of energy that destroys tissue. In this instance, the direct cause of the injury is harmful due to a chemical reaction. The related immediate cause might be the person working without face protection (unsafe behaviour). If our workload is too strenuous, force requirements on our body may cause a muscle strain. Here, the direct cause of injury is a harmful level of kinetic energy (energy resulting from motion), causing injury to muscle tissue. If a person working at height (hazardous activity) trips and falls from height (event) and strikes the ground 8m below and dies as a result of internal injuries sustained, the direct cause of the injury can be described as a result of fall from higher to lower level the ground. The kinetic energy involved is due to the effects of gravity and exceeds to limitations of the body to absorb the energy on impact.

v6

Page 14 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION TEN: IDENTIFY THE ABSENT OR FAILED DEFENCES

These failures result from inadequate or absent defences that failed to detect and protect the system against technical and human failures. These are the last minute measures, which did not prevent the outcome or mitigate the consequences of an individual or team action that resulted in an incident or near miss. The categories represent successive lines of defence where each defensive layer comes into operation on the failure of its predecessor. Defences in incident investigation: Awareness To understand the nature and severity of the hazardous conditions present at the worksite. Awareness problems reflect continuous shortcomings in those involved on-site or those supervising and managing processes. To provide clear warning of both the presence and the nature of a potentially hazardous situation. To restore people or equipment to a safe state with minimal injury or damage. To limit the adverse consequences of any unplanned release of mass, energy or hazardous material. To evacuate all potential victims from the hazard location as quickly and safely as possible.

Detection Control and Interim Recovery Protection and Containment Escape and Rescue

The above model reflects the failed defences in the deep-water horizon (Macondo) incident.

v6

Page 15 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION ELEVEN: IDENTIFY THE INDIVIDUAL / TEAM ACTIONS

These are the errors or violations that immediately precede the incident. They are typically associated with personnel having direct contact with the equipment, such as operators or maintenance personnel. They are always committed actively (someone did or didnt do something i.e. they acted unsafely or failed to act i.e. an omission) and have a direct relation to the incident. For most of the time however, the defences built into our operations prevent these human errors from causing harm. Once again keep asking why? someone acted (or was allowed to act) in the way they did or didnt act the way they should have leading up to the incident.

HUMAN FAILURE:
There are two main types of human failure: 1. 2. Human error is an unintentional action or decision. Violations are intentional failures deliberately doing the wrong thing.

HUMAN ERROR
There are three types of human error: (skill-based errors) 1. 2. 3. slips lapses mistakes

These types of human error can happen to even the most experienced and well-trained person.

S LI P S

AN D LA P S E S

Slips and lapses occur in very familiar tasks, which we can carry out without much conscious attention, e.g. using a grinder. These tasks are very vulnerable to slips and lapses when our attention is diverted even for a moment. SLIPS Refers to errors in which the right intention or plan is incorrectly executed. Usually occur during well-practiced and familiar tasks in which our actions are largely automatic. Examples of slips include: LAPSES Refers to failures to carry out an action. Largely involve failures of memory. Forgetting to do something, or losing your place midway through a task. Examples of lapses include:
v6

performing an action too soon in a procedure, or leaving it too late, e.g. not putting your safety glasses or ear muffs on before starting the machine; omitting a step or series of steps from a task, e.g. forgetting to connect the lanyard while refuelling the aircraft; carrying out an action with too much or too little strength, e.g. over-torqueing a bolt on a flange; performing an action in the wrong direction, e.g. a MEWP operator pushing the joystick to the left instead of the right; doing the right thing but on the wrong object, e.g. selecting the wrong size wrench for the job; and carrying out the wrong check but on the right item, e.g. checking a pressure gauge but for the wrong value.

forgetting to tighten a scaffold transom; taking your safety glasses off to see properly and then forgetting to put them back on; failing to secure scaffolding because of an interruption; and forgetting to install an earth rod before operating a generator. people confuse two similar tasks; steps in a procedure dont follow naturally;
Page 16 of 31

Slips and lapses occur when:

Incident Accident Investigation - Causation Pathway

June 13, 2013

tasks are too complicated and lengthy; the main activity is completed but the finer details are missed; the task is very familiar and requires little thought; there are too many distractions and interruptions.

MISTAKES Mistakes are decision-making failures. The two main types of mistake are rule-based mistakes and knowledge-based mistakes. They arise when we do the wrong thing, believing it to be right. Typically they involve deficiencies or failures in the judgement process. More subtle, more complex and less well understood than slips and lapses and harder to detect. Examples of mistakes include: making a poor judgement when overtaking, leaving insufficient room to complete the manoeuvre in the face of oncoming traffic; and an operator misinterpreting the sound of a machine breakdown and failing to switch it off immediately. doing too many things at the same time. doing too many complex tasks at once. time pressures. the work environment eg too hot, too cold, poor lighting, restricted workspace, noise. extreme task demands eg high workloads, boring and repetitive jobs, jobs that require a lot of concentration, too many distractions. social issues eg peer pressure, conflicting attitudes to health and safety, conflicting attitudes of workers on how to complete work, too few workers. individual stressors eg drugs and alcohol, lack of sleep, family problems, ill health. equipment problems eg inaccurate or confusing instructions and procedures. organisational issues eg failing to understand where mistakes can occur and implement controls, such as training and monitoring. To avoid rule-based mistakes, increase worker situational awareness of high-risk tasks on site and provide procedures for predictable non-routine, high-risk tasks. To avoid knowledge-based mistakes, ensure proper supervision for inexperienced workers and provide job aids and diagrams to explain procedures.

Why do mistakes occur?

Factors which contribute to people making mistakes

How you can reduce mistakes?

V I O LA T I O N S
These are intentional failures deliberately doing the wrong thing. The violation of health and safety rules or procedures is one of the biggest causes of accidents and injuries at work. Workplace rules are broken for many different reasons: I felt I had no choice (intentional due to the situation or rules). I wasnt particularly concerned about the consequences (intentional violations).

Deliberate deviation from safe operating practices, procedures, standards or rules. ROUTINE (corner cutting/ implicitly accepted). EXCEPTIONAL (unusual circumstances). DELIBERATE ACTS of SABOTAGE (damage intent). Examples of violations include:
v6

scaffolders not clipping on their harnesses above 2 m; plant drivers not wearing seat belts; plant operators not carrying out pre-use safety checks; a site manager allowing untrained drivers to operate plant; a tradesman starting work on a new site without reporting to the site manager or receiving a site induction; and a worker thinking a rule is unsafe and taking off their safety goggles to improve visibility.
Page 17 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

Typical causes of violations include: a lack of understanding of why the rule is in place; being under time pressure; not having enough workers to do the work; not having the right equipment; peer pressure; perception that they wont get caught; perceptions that rules are too strict or unnecessary i.e. the perceived benefits outweigh the perceived penalties; wanting to take the easy option; workers thinking rules dont apply to them;

How you can reduce violations Always think about the possibility of violations when carrying out risk assessments. Ask the workforce to get involved in changes to rules to increase their acceptance. Assess the use of personal protective clothes and equipment (PPE). Have workers got the right equipment to do the job? Is the PPE difficult to use or uncomfortable? Encourage the reporting of any problems (such as job pressures) through open communication. Explain to workers the reasons behind any rules and procedures and their relevance. Improve planning for all jobs to ensure the necessary resources (workers, equipment, and time) are allocated. Improve the working environment. Is the environment unpleasant (e.g. dust, fumes, extreme heat or cold)? Have workers got enough space to work in without discomfort or difficulty completing the task? Make sure rules and procedures are relevant and practical. Are procedures hard to read or out of date?. Provide training for abnormal and emergency situations. Provide workers with appropriate supervision. Try to reduce time pressures on workers to act quickly in unusual situations. You can increase the chances of spotting violations by increasing routine monitoring.

The following diagram shows the various categories used to classify human error, which are initially split into intended or unintended actions.

v6

Page 18 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION TWELVE: IMMEDIATE CAUSES

Every incident has a number of causes that happen immediately before the loss producing event. These causes are referred to as Immediate Causes. Immediate causes are unsafe actions or unsafe conditions that take place or exist in the organisation. They are typical violations of conformance requirements such as policies, rules, standards, legislative requirements, procedures etc. An important aspect of unsafe conditions is that one creates them; they dont just appear out of nowhere. Unsafe conditions are a result of people failing to take corrective action or failing to comply with the management process. An omission to attend to something in the work place results in the creation of an unsafe condition, e.g. if one omits to maintain a piece of equipment an unsafe condition is created. Furthermore these conditions are tolerated, permitted and allowed in the organisation and the question must be asked why?? Unsafe practices are committed by individuals. They typically involve omitting to comply with a predefined standard of performance or regulatory requirement. If the immediate causes are not identified then the underlying causes cannot be identified and corrected. They, immediate causes, are often called unsafe acts and unsafe conditions; however, a more acceptable term would be substandard practices and substandard conditions. By referring to them as sub-standard it infers that there is a standard for these practices or conditions and they are therefore manageable and in the realm of management control. Substandard practices and conditions are indications that underlying problems exist within the management system. These underlying problems may indicate that the system is inadequate, the procedures are inadequate, the standards are deficient, or there is no compliance, etc. Often organisations only look for immediate causes when investigating accidents and fail to investigate further, thereby ignoring underlying causes and never resolving the failures in the system. The consequence is recurrence of the same events with more dire consequences. These underlying causes are influenced by the inadequacies in the systems of work and must be identified and corrected and the necessary improvements made to the HSE management system. Section appendix A lists typical unsafe practices and conditions, which directly cause incidents. All relevant issues that were material in terms of the incident must be considered. Often it may appear as if the incident was brought about due to the non-compliance of an individual and one is encouraged to stop there and look no further. This would be futile as the underlying causes of his or her non-compliance must be identified in order for the management system deficiencies to be addressed. An important step is to ask, "Why?" Why did the individual not conform to the required step or process? This will lead one to the actual underlying cause that precipitated the non-conformance. Importantly when all the relevant evidence is collated and documented in the building blocks and the time line is drawn one must determine which of this evidence is to be accepted as critical factors:

CRITICAL FACTORS
These factors are investigated to determine the underlying causes. They are typically the major contributing factors to the incident without which the event would not have occurred or the severity would have been lessened. 1. Something which did not take place which should have taken place, i.e. an omission and if it had taken place it would have definitely prevented the incident. 2. Something which took place which should not have taken place, and if it had not taken place the incident would definitely not have occurred.
v6 Page 19 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION THIRTEEN: IDENTIFY THE TASK / ENVIRONMENTAL F ACTORS (U NDERLYING C AUSES )

These are the organisational factors or conditions in the work place in existence immediately prior to or at the time of the incident. These are the conditions that directly influence human and equipment performance in the workplace. These are the circumstances under which the errors and violations took place and can be embedded in task demands, the work environment, individual capabilities and human factors. The Task/ Environmental Factors can be categorised in two groups: Human Factors and Workplace Factors. Within the two groups, we can categorise factors which encourage the commission of errors. The factors that can produce violations and the common factors which may promote errors and/ or violations. HUMAN FACTORS
Error Factors Preoccupation, distraction Memory failure Strong motor programmes Perceptual set False sensations False perceptions Confirmation bias Situational awareness Incomplete knowledge Inaccurate knowledge Inference and reasoning Stress and fatigue Disturbed sleep patterns Error proneness Common Factors Insufficient ability Inadequate skill Skill overcomes danger Unfamiliarity with task Poor judgement: illusion of control or least effort Over confidence Performance anxiety Time pressures Arousal state: monotony and boredom, emotional status Violation Factors Age and gender High-risk target Behaviour beliefs Subjective norms condoning violations Personality: unstable extrovert, non-compliant Perceived behavioural control Low morale Bad mood Job dissatisfaction Attitude to the system Misperception of hazards Low self-esteem Learned helplessness

WORKPLACE FACTORS Error Factors Change of routine Negative transfer Poor signal/ noise ratio Designer/ user mismatch Educational mismatch Hostile environment Domestic problem Poor communications Poor mix of hands-on work and written instruction (reliance on undocumented knowledge) Poor shift patterns/ overtime working Common Factors Time shortage Inadequate tools and equipment Poor procedures and instructions Inadequate training Hazards not identified Under manning Inadequate supervision Poor access to job Poor housekeeping Violation Factors Violations tolerated Compliance goes unrewarded Procedures protect the system not the individual Macho culture Perceived license to bend rules Adversarial industrial climate Low operator pay Low operator status Unfair management sanctions

Poor supervisor/ worker ratio Poor working conditions Inadequate mix of experience/ inexperienced workers

Blame culture Poor supervisory example Task allows for easy short-cuts

v6

Page 20 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

UNDERLYING CAUSES: HUMAN AND WORKPLACE FACTORS Underlying (root) causes are the deeper basic causes, which initiate the immediate causes. In order to determine the underlying cause one must consider the evidence and ask how does this eviden ce support the underlying cause? i.e. is there a direct relationship between the underlying cause element and the evidence. For example, the evidence confirms that the supervisor failed to comply with the procedure due to mental stress. The question that needs to be asked is whether this evidence (a critical factor) has got anything to do with 3. Mental state. The answer would be affirmative. Thereafter one needs to determine which sub element applies. The underlying causes are classified under two main headings, namely Human Factors and Work Place Factors. HUMAN F AC T OR S A R E T H O S E F A C T O R S , W H I C H A R E D I R E C T L Y A S S O C I A T E D W I T H T H E P E R S O N ( S ) They support the reason why a person acted the way he/she did. The following case study may illustrate the meaning of Human factors and Work Place factors: An electrician attempted to isolate a high voltage switch and failed to lock out and earth correctly. He contacted 11 kva a nd was badly burnt. One substandard practice would be failing to lock out. If queried as to why the person failed to lock out it might come to light that he had not been trained and hence had no experience of the lock out procedure and the process of locking out. This would mean lack of knowledge or experience is the Human factor. Inadequate training would be the Work Place factor. W OR K P L ACE F AC TOR S A R E T H O S E F A C T O R S W H I C H A R E D I R E C T L Y A S S O C I A T E D W I T H T H E O R G A N I S A T I O N A L
PROCESSES

In the scenario presented, it is very likely that there are other Work Place factors which may support the persons practices such as inadequate training, inspections, audits, reviews, communication, supervision, engineering standards, procurement, tools or equipment etc.

v6

Page 21 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION FOURTEEN: MANAGEMENT CONTROL

I NADEQUATE S YSTEMS C ONTROL
ORGANISATIONAL FACTO RS
Identify the Organisational Factors: These are the underlying organisational factors that produce the conditions which affect performance in the workplace. They may lie dormant or undetected for a long time within an organisation and the repercussions may only become apparent when they combine with the local conditions or errors or violations to breach the systems defences. These may include fallible management decisions, processes and practices. ICAM classifies the system failures into Organisational Factor Types (OFTs) as follows: Organisational Factor Types (OFTs) CO CM DE HW IG MM MC OR PR RM TR Communication Contractor Management Design Hardware Incompatible Goal Maintenance Management Management of Change Organisation Procedures Risk Management Training

Sub-standard acts and conditions are preceded by underlying causes, however, they do not initiate the incident causation cycle. The underlying causes manifest themselves due to the management controls being inadequate. These controls relate to the safety management system and risk management enablers such as leadership, policy and strategy, people, resources, governance, risk management process, compliance, supervision, inspections, maintenance, purchasing, contractor management, planning, scheduling, reviews, instructions, investigations, corrective practices, communications, etc. Effective management control is when all processes and procedures, established to ensure the organisation fulfils its obligations are complied with. In order for the HSE system to be effective, a number of important criteria need to be met: The safety management system must be well developed and thoroughly implemented ii. Roles, responsibilities and authority must be assigned and accepted iii. Policies, rules, regulations and standards need to be well established and understood iv. Compliance with the requirements must be adequate v. There must be suitable systems of work vi. Key competencies must be deployed
i.

v6

Page 22 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

R OLES ,

RESPONSIBILITIES AND AUTHORITIES DEFINE :

the work necessary to meet the organisations objectives who is responsible for the work to be performed who is accountable for what what specific actions are necessary the frequency with which these actions are to be taken who reports what to who, when

S AFET Y M ANAGEMENT S YSTEM

The effectiveness of any safety management system is dependent on the systems design criteria. The design and implementation of an organisations safety management system is influenced by: i. ii. iii. iv. v. vi. vii. viii. Complexity of organisational activities; Established targets and objectives; Legislative, statutory, regulatory and other requirements; Organisational needs; Organisations risk profile; Processes and operations; Products manufactured and services provided; and Size, structure and location of the organisation.

The system should typically be structured to accommodate the elements below: COMMON MANAGEMENT SYSTEM FRAMEWORK HSE MANAGEMENT ELEMENTS: LEADERSHIP AND ACCOUNTABILITY RISK MANAGEMENT SKILLS, TRAINING AND BEHAVIOURS (COMPETENCE) ASSET INTEGRITY BUSINESS CONTINUITY MANAGEMENT COMMUNITY AND STAKEHOLDERS AWARENESS CONTRACTORS AND SERVICE PROVIDERS CORRECTIVE AND PREVENTIVE ACTION SYSTEMS CORPORATE COMMUNICATIONS CRISIS AND EMERGENCY RESPONSE MANAGEMENT CORE PDO HSE MANAGEMENT SYSTEM CP122 ELEMENTS
v6

CUSTOMERS AND PRODUCTS ENVIRONMENTAL MANAGEMENT FACILITIES DESIGN AND CONSTRUCTION INCIDENT MANAGEMENT INFORMATION AND DATA MANAGEMENT MANAGEMENT OF CHANGE OCCUPATIONAL HEALTH OPERATIONS AND MAINTENANCE RECORDS AND DOCUMENTATION ASSESSMENT, ASSURANCE AND IMPROVEMENT

LEADERSHIP AND COMMITMENT POLICY AND STRATEGIC OBJECTIVE ORGANIZATION, REPSONSIBILITES, RESOURCES, STANDARDS, AND DOCUMENTS HAZARDS AND EFFECTS MANAGEMENT PLANNING AND PROCEDURES IMPLEMENTATION AND OPERATION ASSURANCE MONITORING AND AUDIT REVIEW
Page 23 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

SECTION FIFTEEN: RISK ASSESSMENTS

I NADEQUATE R ISK A SSESSMENT
Every organisation has to contend with risk in the work environment. OSHA states: The employer shall make an evaluation of the risk attached to any condition or situation which may arise from the activities of such employer. This requires the employer to conduct a risk assessment to quantify the extent of risk that has to be managed. This is the fundamental point of departure for any safety management system. It involves understanding the exposures in the work place and implementing control measures to safeguard against the risk. Hence the various elements of the safety management system are the measures the organisation puts in place to safeguard its employees from the exposures. It is a process, which is proactive. The organisation should have a documented procedure established, implemented, and maintained for effective identification of hazards, assessment of risks and implementation of appropriate management control processes to ensure that risks are reduced to an acceptable level. Furthermore they should consider all legal, statutory, regulatory and other requirements that the organisation is subjected to. Policies, plans and actions need to be developed Targets and objectives need to be set against the background of the risk assessment and suitable action plans and programs need to be assigned.

v6

Page 24 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

APPENDIX A COMMUNICATION
Failure to communicate when the target is known but the message fails to get through or is late. Involves inadequate hardware and miscomprehension by those involved. Failure to validate understanding Inadequate Communication can be caused by: Inability to make contact with the correct person. Lack of clear line of communication. Language problems and cultural barriers. Missing or excessive information. No standard communication format. Poor feedback. Unreceptive or hostile target. Inadequate Communication can lead to: Missing information, people not informed, do not report. Misunderstanding or incorrect interpretation. Not knowing where information is located. People not knowing who to inform. Taking inappropriate action at the wrong time or place

C ONTRACTOR M ANAGEMENT
The evaluation, selection and retention of contracted services, equipment, personnel and material to ensure risks to people, the environment, equipment or property are reduced to a level which is ARLAP. Inadequate Contractor Management can be caused by: Contract not clearly defining HSE obligations, performance and reporting requirements. Inadequate or poorly conducted contract management process. Inadequate or poorly conducted HSE compliance and performance monitoring and review. Lack of clearly defined work scope. Lack of consideration of risk associated with the contract. Lack of formal contractor evaluation procedure. Poorly defined selection criteria giving undue weight to cost over performance. The failure to identify/ plan bridging requirements between the contractor and many standards. Unclear reporting relationships, lines of communication, roles and responsibilities. Inadequate Contractor Management can lead to: Deferring, conflicting, or poor interface of procedures and systems of work. Deterioration in production and safety performance. Imbalance between contract compliance, production and HSE goals. Lack of reporting of hazards, near misses and incidents. Poor employee / contractor relations, industrial relations issues, high personnel turnover. Requirement for additional supervision. Risk levels above ALARP. Substandard competency and staffing levels.

v6

Page 25 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

D ESIGN
The way in which equipment is constructed to make certain operations difficult or allow unexpected usage. Poor design may require extra effort and unusual maintenance. Inadequate design capacity may lead to extending the equipment beyond limits. Many design failures result from the physical and professional separation of the designer and end user. Inadequate Design can be caused by: No standardisation of equipment or usage. No adapting to human needs and limitations. Poor designer-user communication. Time or financial constraints. No indication of system status provided by design (on/ off, working or not, etc.). Inadequate design premise data. Inadequate Design can lead to: Extra effort to do the job. Unexpected performance of tools and equipment. Inability to operate equipment properly. Inability/ difficulty in controlling processes. Long or repeated training requirements. Equipment is unused or improvised usage.

H ARDWARE
The quality, availability and position in life-cycle of tools, equipment and components. Its concerned with t he materials selected rather than design or poor maintenance of the equipment. Inadequate Hardware can be caused by: Poor stock or ordering system. Poor quality due to the local availability. Poor state of existing equipment. Inadequate maintenance Equipment not fit for purpose. Lack of resources available to buy, maintain or improve equipment. Theft. Inadequate Hardware can lead to: Inappropriate use of tools or equipment. Absence or unavailability of tools or equipment. Improvisation, i.e. using tools unsuitable for the job.

v6

Page 26 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

T RAINING
The provision and imparting of the correct knowledge and skills to employees which are necessary for them to do their job safely. Failure may involve insufficient or too much training, lack of resources or assessment and mismatch of abilities to tasks. Inadequate Training can be caused by: Differing standards of training. Ineffective pre-employment selection process. Lack of appreciation of benefits Making assumptions about a persons knowledge or skills. No assessment of training effectiveness. Poor planning of when training is needed. Training not directed to all the job skill requirements. Training the wrong people. Inadequate Training can lead to: Employees unable to perform their jobs. Excessive supervision. Excessive time spent in training. Increased numbers of people required for the job. Job taking longer, of poor quality, wasting material.

O RGANISATION
Deficiencies in the structure of the organisation, lack of defined responsibility and inappropriate authority to current work. May involve co-ordination, supervision of communication and feedback. Inadequate Organisation can be caused by: Excessive bureaucracy. Frequent reorganisations. Lack of definition of objectives. No structure to co-ordinate different activities. Poor planning. Poorly defined departments or sections. Unclear roles, accountability, authority, responsibility or delegation. Inadequate Organisation can lead to: Multi-layer hierarchy, slow response to changes. Wrong person, or nobody, takes responsibility. Resources used for non-business needs. Decisions delayed or deferred. People are only held responsible, not accountable for their actions/ decisions. Poor control or management of events. Rules and procedures not enforced.

v6

Page 27 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

I NCOMPATIBLE G OAL
The presence of conflicts between production, safety, planning and economic goals as well as conflicts between group and peer pressures and personal goals. Incompatible goals become a problem when senior management provide no guidelines on priorities Incompatible Goal can be caused by: Conflict between appearance and functionality in a design. Conflict between safe work and production priorities. Conflict between work and personal priorities. Imbalance between safety requirements and budget constraints. Taking procedural short-cuts for personal / production gain. Incompatible Goal can lead to: Operating closer than normal to operating limits. Overruling or relaxing procedures. Putting people under pressure. Short-cutting a procedure. Suppressing information about hazards or injuries.

P ROCEDURES
The presence of accurate, understandable procedures which are known and used. Relates to the way in which procedures are written, tested and documented and controlled. Inadequate Procedures can be caused by: Poor knowledge of the procedure writer. Poor feedback on practicality. Poor indexing or retrieval methods. Gaps in the inventory of procedures needed. Non-operational objectives (political/ organisational). Failure to have revision control system. Inadequate Procedures can lead to: Ambiguous, non- comprehensive, incorrect or outdated documents. Difficult access for the users. No procedures for some specific tasks. Too many, overlapping or conflicting procedures. Failure to communicate existing or new procedures. Documents in the wrong language. Difficult procedures which encourage short-cuts Toleration of violations

v6

Page 28 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

M AINTENANCE M AN AGEMENT
The appropriateness of the management of the maintenance system, involving planning, resourcing and type of maintenance rather than the execution of maintenance jobs. Poor practices, involving procedures, tools and training, are covered elsewhere. Inadequate Maintenance Management can be caused by Absent/ inadequate manuals and documents. Incorrect maintenance strategy. Poor planning, controlling, execution and recording of maintenance. Shortage of specialised maintenance personnel. State of equipment not communicated to relevant people. Inadequate Maintenance Management can lead to: Breakdown before life expectancy. Defective or malfunctioning equipment. Equipment not operable in the way intended. Makeshift or unplanned maintenance. Unexpected rapid corrosion.

R ISK M ANAGEMENT
The systematic application of management policies, processes and procedures to the tasks of identifying, analysing, assessing, reducing to ALARP (As Low as Reasonably Practical), and on-going monitoring of risk in man-machine systems that contain a potential to have an adverse effect on people, the environment, equipment, property or the community Inadequate Risk Management can be caused by: Goals, objectives, scope and boundaries of risk management activity not clearly determined Hazard identification process not being systematic, or covering all operations and equipment. Inadequate monitoring of risk control effectiveness. Inadequate or poorly conducted risk management process. Inappropriate selection or poor implementation of risk measures. Level of risk analysis (JSA, QRA, HSE Safety Case, etc.) inappropriate for the degree of risk or phase of lifecycle. Risk assessment conducted without the appropriate competencies and experience Inadequate Risk Management can lead to: Risk levels above ALARP Uncontrolled hazards and consequences High incident and accident rate Inappropriate risk ranking and allocation of risk control resources Incomplete, inadequate, or out of date Risk Register Breach of local regulatory requirements

v6

Page 29 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

M ANAGEMENT

OF

C HANGE

The systematic assessment of change to operations, processes, equipment, services and personnel for potential risk and the application of appropriate action to ensure existing performance levels are not compromised Inadequate Management of Change can be caused by: Inadequate monitoring of the effects of change to existing performance levels. Inadequate or poorly conducted management of change process. Inadequate risk vs. benefit assessment of the impact of change. Inadequate tollgate mechanism to approve proposed change. Objectives and scope of change activity not clearly determined. Poor change implementation plan. Poor communication of change Inadequate Management of Change can lead to: Adverse impact on production and safety performance. Breach of local regulatory requirements. Increase in equipment breakdown or damage. Insufficient manning levels, confusion and low morale. Mismatch between equipment, operating procedures and training. Mismatch between policy, procedures and practice. Risk levels above ALARP. Undefined organisational structures and responsibilities. Unexpected near misses, incident and accidents

v6

Page 30 of 31

Incident Accident Investigation - Causation Pathway

June 13, 2013

References
Cooke, David L. (2003). Learning from incidents (PDF). Proceedings of the 21st International co nference of the System Dynamics Society. http://www.systemdynamics.org/ conferences/2003/proceed/PAPERS/201.pdf Davies, John; Alastair Ross, Brendan Wallace and Linda Wright (August 2003). Safety management: A qualitative systems approach. London: Taylor and Francis. ISBN 0415303710 http://ehstoday.com/news/ehs_imp_32824/ Mescon et al 1985 Parket Follett, 1941 Henri Fayol Hersey and Blanchard Warren Bennis and Dan Goldsmith Paul Birch Patricia Pitcher Bruce Lynn Industrial Accident Prevention, H W Heinrich Rockwell Automation, Proving the value of safety, Justification and ROI of safety programs and machine safety investments, Lyle Masimore, Rockwell Automation. The Compass: Management Practice Specialty News, Why Youve Been Handed Responsibility for Safety, J.J. Keller and Associates, Winter 2000, pp. 1, 4. Bird Frank E., Germain George L., Loss Control Management: Practical Loss Control Leadership, Revised Edition, Det Norske Veritas (U.S.A.), Inc, Figure 1-3, pp. 5, 1996, Adapted for use. Written by Nigel Pitt for IMORSA http://www.imorsa.com/

v6

Page 31 of 31