Date post: | 19-Aug-2015 |
Category: |
Presentations & Public Speaking |
Upload: | terry-penney |
View: | 39 times |
Download: | 0 times |
Inspections and Investigations
&
SAFETY AUDITS &
MANAGEMENT AUDITS
On the one hand, they have to
learn to understand the
organizational aspects and
take them into account in
constructing safety programs.
On the other hand, it is important that they be aware of the fact that the view of
organizations is moving further and further away from the machine concept and
placing a clear emphasis on less tangible and measurable factors such as
organizational culture, behaviour modification, responsibility-raising or commitment.
Today, safety policy is more and more distinctly being viewed as a way of achieving
the two aims of reducing losses and optimizing corporate policy. Safety policy is
therefore increasingly evolving into a reliable barometer of the soundness of the
corporation’s success with respect to these aims. In order to measure progress,
increased attention is being devoted to management and safety audits.
It is not only economic circumstances that have given company heads new insights.
New visions relating to management, organizational theory, total quality care and, in
the same vein, safety care, are resulting in significant changes.
The values, mission and organizational culture of a corporation according to
McKinsey’s 7-S Framework
The fundamental shifts can best be demonstrated on the basis of the model
presented by Scott (1978), which was also used by Peters and Waterman (1982). This
model uses two approaches:
1. The closed-system approaches deny the influence of developments from outside
the organization. With the mechanistic closed approaches, the objectives of an
organization are clearly defined and can be logically and rationally determined.
2. Open-system approaches take outside influences fully into account, and the
objectives are more the result of diverse processes, in which clearly irrational
factors contribute to decision making.
Organizational theories
There has been enormous development in management theory, moving from the
traditional rational and authoritarian machine model (Taylorism) to the human-
oriented organic model of human resources management (HRM).
Organizational effectiveness and efficiency are being more clearly linked to optimal
strategic management, a flat organizational structure and sound quality systems.
Furthermore, attention is now given to superordinate goals and significant values
that have a bonding effect within the organization, such as skills (on the basis of
which the organization stands out from its competitors) and a staff that is motivated
to maximum creativity and flexibility by placing the emphasis on commitment and
empowerment. With these open approaches, a management audit cannot limit itself
to a number of formal or structural characteristics of the organization. The audit
must also include a search for methods to map out less tangible and measurable
cultural aspects.
This fundamental change in the quality care system has taken place cumulatively in
the sense that each foregoing stage was integrated into the next. It is also clear that
while product control and safety inspection are facets more closely related to a
Tayloristic organizational concept, quality assurance is more associated with a
socio-technical system approach where the aim is not to betray the trust of the
(external) customer.
It is clear that there is also a very important difference in emphasis between quality
assurance as described in the ISO standards and the TQL approach of the ISO quality
assurance is an extended and improved form of quality inspection, focusing not only
on the products and internal customers, but also on the efficiency of the technical
processes. The objective of the inspection is to investigate the conformity with the
procedures set out in ISO. TQM, on the other hand, endeavours to meet the
expectations of all internal and external customers as well as all processes within
the organization, including the more soft and human-oriented ones. The involvement,
the commitment and the creativity of the employees are clearly important aspects of
TQM.
From Human Error to Integrated Safety
Safety policy has evolved in a similar manner to quality care. Attention has shifted
from post-factum incident analysis, with emphasis on the prevention of injuries, to a
more global approach. Safety is seen more in the context of “total loss control” - a
policy aimed at the avoidance of losses through management of safety involving the
interaction of people, processes, materials, equipment, installations and the
environment. Safety therefore focuses on the management of the processes that
could lead to losses. In the initial development period of safety policy the emphasis
was placed on a human error approach. Consequently, employees were given a
heavy responsibility for the prevention of industrial incidents.
Only recently, the emphasis in safety policy systems shifted into a social-system
approach, which is a logical step in the improvement of the prevention system. In
order to optimize the human/machine/environment system it is not sufficient to
ensure safe machines and tools by means of a well-developed prevention policy, but
there is also the need for a preventive maintenance system and the assurance of
security among all technical processes. Moreover, it is of crucial importance that
employees be sufficiently trained, skilled and motivated with regard to health and
safety objectives. Modern management entails an open, motivating corporate
culture, in which there is a common commitment to achieving key corporate
objectives in a participatory, team-based approach. In the safety-culture approach,
safety is an integral part of the objectives of the organizations and therefore an
essential part of everyone’s task, starting with top management and passing along
the entire hierarchical line down to employees on the shop floor.
Integrated safety
The concept of integrated safety immediately presents a number of central factors in
an integrated safety system, the most important of which can be summarized as
follows:
A clearly visible commitment from the top management. This commitment is not only
given on paper, but is translated right down to the shop floor in practical
achievements.
Active involvement of the hierarchical line and the central support departments.
Care for safety, health and welfare is not only an integral part of everyone’s task in
the production process, but is also integrated into the personnel policy, into
preventive maintenance, into the design stage and into working with third parties.
Full participation of the employees. Employees are full discussion partners with
whom open and constructive communication is possible, with their contribution
being given full weight. Indeed, participation is of crucial importance for carrying
through corporate and safety policy in an efficient and motivating way.
A suitable profile for a safety expert. The safety expert is no longer the technician or
jack of all trades, but is a qualified adviser to the top management, with particular
attention being devoted to optimizing the policy processes and the safety system. He
or she is therefore not someone who is only technically trained, but also a person
who, as a good organizer, can deal with people in an inspiring manner and
collaborate in a synergetic way with other prevention experts.
A pro-active safety culture. The key aspect of an integrated safety policy is a pro-
active safety culture, which includes, among other things, the following:
� Safety, health and welfare are the key ingredients of an organization’s value system
and of the objectives it seeks to attain.
� An atmosphere of openness prevails, based on mutual trust and respect.
� There is a high level of cooperation with a smooth flow of information and an
appropriate level of coordination.
� A pro-active policy is implemented with a dynamic system of constant improvement
perfectly matching the prevention concept.
� The promotion of safety, health and welfare is a key component of all decision-
making, consultations and teamwork.
� When industrial incidents occur, suitable preventive measures are sought, not a
scapegoat.
� Members of staff are encouraged to act on their own initiative so that they possess
the greatest possible authority, knowledge and experience, enabling them to
intervene in an appropriate manner in unexpected situations.
� Processes are set in motion with a view to promoting individual and collective
training to the maximum extent possible.
� Discussions concerning challenging and attainable health, safety and welfare
objectives are held on a regular basis.
Safety and Management Audits
General description
Safety audits are a form of risk analysis and evaluation in which a systematic
investigation is carried out in order to determine the extent to which the conditions
are present that provide for the development and implementation of an effective and
efficient safety policy. Each audit therefore simultaneously envisions the objectives
that must be realized and the best organizational circumstances to put these into
practice.
Each audit system should, in principle, determine the following:
� What is management seeking to achieve, by what means and by what strategy?
� What are the necessary provisions in terms of resources, structures, processes,
standards and procedures that are required to achieve the proposed objectives, and
what has been provided? What minimum program can be put forward?
� What are the operational and measurable criteria that must be met by the chosen
items to allow the system to function optimally?
The information is then thoroughly analysed to examine to what extent the current
situation and the degree of achievement meet the desired criteria, followed by a
report with positive feedback that emphasizes the strong points, and corrective
feedback that refers to aspects requiring further improvement.
Auditing and strategies for change
Each audit system explicitly or implicitly contains a vision both of an ideal
organization’s design and conceptualization, and of the best way of implementing
improvements.
Bennis, Benne and Chin distinguish three strategies for planned changes, each based
on a different vision of people and of the means of influencing behaviour:
� Power-force strategies are based on the idea that the behaviour of employees can
be changed by exercising sanctions.
� Rational-empirical strategies are based on the axiom that people make rational
choices depending on maximizing their own benefits.
� Normative-re-educative strategies are based on the premise that people are
irrational, emotional beings and in order to realize a real change, attention must also
be devoted to their perception of values, culture, attitudes and social skills.
The famous model devised by Danish risk specialist Rasmussen distinguishes among
the following three sorts of behaviour:
� Routine actions (skill-based behaviour) automatically follow the associated signal.
Such actions are carried out without one’s consciously devoting attention to them -
for example, touch-typing or manually changing gears when driving.
� Actions in accordance with instructions (rule-based) require more conscious
attention because no automatic response to the signal is present and a choice must
be made between different possible instructions and rules. These are often actions
which can be placed in an “if¼then” sequence, as in “If the meter rises to 50 then
this valve must be closed”.
� Actions based on knowledge and insight (knowledge-based) are carried out after a
conscious interpretation and evaluation of the different problem signals and the
possible alternative solutions. These actions therefore presuppose a fairly high
degree of knowledge of and insight into the process concerned, and the ability to
interpret unusual signals.
Strata in behavioural and cultural change
Based on the above, most audit systems (including those based on the ISO series of
standards) implicitly depart from power-force strategies or rational-empirical
strategies, with their emphasis on routine or procedural behaviour. This means that
insufficient attention is paid in these audit systems to “knowledge-based behaviour”
that can be influenced mainly via normative–re-educative strategies. Many audit
systems limit themselves to the question of whether a particular provision or
procedure is present. It is therefore implicitly assumed that the sheer existence of
this provision or procedure is a sufficient guarantee for the good functioning of the
system. Besides the existence of certain measures, there are always different other
“strata” (or levels of probable response) that must be addressed in an audit system
to provide sufficient information and guarantees for the optimum functioning of the
system.
In more concrete terms, the following example concerns response to a fire
emergency:
� A given provision, instruction or procedure is present (“sound the alarm and use the
extinguisher”).
� A given instruction or procedure is also familiarly known to the parties concerned
(workers know where alarms and extinguishers are located and how to activate and
use them).
� The parties concerned also know as much as possible as to the “why and
wherefore” of a particular measure (employees have been trained or educated in
extinguisher use and typical types of fires).
� The employee is also motivated to apply needful measures (self preservation, save
the job, etc.).
� There is sufficient motivation, competence and ability to act in unforeseen
circumstances (employees know what to do in the event fire gets out of hand,
requiring professional fire-fighting response).
� There are good human relations and an atmosphere of open communication
(supervisors, managers and employees have discussed and agreed upon fire
emergency response procedures).
� Spontaneous creative processes originate in a learning organiz-ation (changes in
procedures are implemented following “lessons learned” in actual fire situations).
PAS safety audit elements
PAS safety audit elements Correspondence with ISO
9001
1. Management responsibility
1.1. Safety policy 4.1.1.
1.2. Organization
1.2.1. Responsibility and authority 4.1.2.1.
1.2.2. Verification resources and
personnel
4.1.2.2.
1.2.3. Health and safety service 4.1.2.3.
1.3. Safety management system
review
4.1.3.
2. Safety management system 4.2.
3. Obligations 4.3.
4. Design control
4.1. General 4.4.1.
4.2. Design and development
planning
4.4.2.
4.3. Design input 4.4.3.
4.4. Design output 4.4.4.
4.5. Design verification 4.4.5.
4.6. Design changes 4.4.6.
5. Document control
5.1. Document approval and issue 4.5.1.
5.2. Document
changes/modifications
4.5.2.
6. Purchasing and contracting
6.1. General 4.6.1.
6.2. Assessment of suppliers and
contractors
4.6.2.
6.3. Purchasing data 4.6.3.
6.4. Third party’s products 4.7.
7. Identification 4.8.
8. Process control
8.1. General 4.9.1.
8.2. Process safety control 4.11.
9. Inspection
9.1. Receiving and pre-start-up
inspection
4.10.1.
4.10.3.
9.2. Periodic inspections 4.10.2.
9.3. Inspection records 4.10.4.
9.4. Inspection equipment 4.11.
9.5. Inspection status 4.12.
10. Incidents and incidents 4.13.
11. Corrective and preventive
action
4.13.
4.14.
12. Safety records 4.16.
13. Internal safety audits 4.17.
14. Training 4.18.
15. Maintenance 4.19.
16. Statistical techniques 4.20.
Several other systems are integrated in the PAS system:
� At a strategic level, the insights and requirements of ISO are of particular
importance.
� At a tactical level, the systematics of the “Management’s Oversight and Risk Tree”
encourages people to seek out what are the necessary and sufficient conditions in
order to achieve the desired safety result.
� At an operational level a multitude of sources could be drawn upon, including
existing legislation, regulations and other criteria such as the International Safety
Rating System (ISRS), in which the emphasis is placed on certain concrete
conditions that should guarantee the safety result.
The PAS constantly refers to the broader corporate policy within which the safety
policy is embedded. After all, an optimum safety policy is at the same time a product
and a producer of a pro-active company policy. Assuming that a safe company is at
the same time an effective and efficient organization and vice versa, special
attention is therefore devoted to the integration of safety policy in the overall policy.
Essential ingredients of a future-oriented corporate policy include a strong corporate
culture, a far-reaching commitment, the participation of the employees, a special
emphasis on the quality of the work, and a dynamic system of continual
improvement.
Formal procedures and directly identifiable results are indisputably important in
safety policy. However, it is not enough to base the safety system on this approach
alone. The future results of a safety policy are dependent on the present policy, on
the systematic efforts, on the constant search for improvements, and particularly on
the fundamental optimizing of processes that ensure durable results.
HAZARD ANALYSIS: THE INCIDENT CAUSATION MODEL
Human error is an important contributing cause in at least 90% of all industrial
incidents. While purely technical errors and uncontrollable physical circumstances
may also contribute to incident causation, human error is the paramount source of
failure. The increased sophistication and reliability of machinery means that the
proportion of causes of incidents attributed to human error increases as the absolute
number of incidents decreases. Human error is also the cause of many of those
incidents that, although not resulting in injury or death, nevertheless result in
considerable economic damage to a company. As such, it represents a major target
for prevention, and it will become increasingly important. For effective safety
management systems and risk identification programs it is important to be able to
identify the human component effectively through the use of general failure type
analysis.
The Nature of Human Error
Human error can be viewed as the failure to reach a goal in the way that was
planned, either from a local or wider perspective, due to unintentional or intentional
behaviour. Those planned actions may fail to achieve the desired outcomes for the
following four reasons:
1. Unintentional behaviour:
� The actions did not go as planned (slips).
� The action was not executed (lapses).
2. Intentional behaviour:
� The plan itself was inadequate (mistakes).
� There were deviations from the original plan (violations).
Deviations can be divided in three classes: skill-, rule- and knowledge-based errors.
1. At the skill-based level, behaviour is guided by pre-programd action schemes. The
tasks are routine and continuous, and feedback is usually lacking.
2. At the rule-based level, behaviour is guided by general rules. They are simple and
can be applied many times in specific situations. The tasks consist of relatively
frequent action sequences that start after a choice is made among rules or
procedures. The user has a choice: the rules are not automatically activated, but are
actively chosen.
3. Knowledge-based behaviour is shown in completely new situations where no rules
are available and where creative and analytical thinking is required.
In some situations, the term human limitation would be more appropriate than
human error.
When the situation is completely unknown, knowledge-based rules are applied. The
symptoms are examined in the light of knowledge about the system and its
components. This analysis can lead to a possible solution the implementation of
which constitutes a case of knowledge-based behaviour. (It is also possible that the
problem cannot be solved in a given way and that further knowledge-based rules
have to be applied.) All errors on this level are mistakes. Violations are committed
when a certain rule is applied that is known to be inappropriate: the thinking of the
worker may be that application of an alternative rule will be less time-consuming or
is possibly more suitable for the present, probably exceptional, situation. The more
malevolent class of violations involves sabotage, a subject that is not within the
scope of this article.
A comment often made with regard to a particular incident is, “Maybe the person did
not realize it at the time, but if he or she had not acted in a certain way, the incident
would not have happened.” Much of incident prevention is aimed at influencing the
crucial bit of human behaviour alluded to in this remark. In many safety management
systems, the solutions and policies suggested are aimed at directly influencing
human behaviour.
Six ways to induce safe behaviour and assessment of their cost-effectiveness
No. Way of influencing Cost Long-term
effect
Assessment
1 Don’t induce safe behaviour,
but make the system
“foolproof”.
High Low Poor
2 Tell those involved what to do. Low Low Medium
3 Reward and punish. Medium Medium Medium
4 Increase motivation and
awareness.
Medium Low Poor
5 Select trained personnel. High Medium Medium
6 Change the environment. High High Good
Do not attempt to induce safe behaviour, but make the system “foolproof”
Tell those involved what to do
Another option is to instruct all workers about every single activity in order to bring
their behaviour fully under the control of management. This will require an extensive
and not very practical task inventory and instruction
Reward and punish
Although reward and punishment schedules are powerful and very popular means for
controlling human behaviour, they are not without problems.
Increase motivation and awareness
Sometimes it is believed that people cause incidents because they lack motivation
or are unaware of danger. The effects of motivation enhancement programs are
positive only when coupled with behaviour modification techniques such as
employee involvement.
Select trained personnel
The first reaction to an incident is often that those involved must have been
incompetent.
Change the environment
Most behaviour occurs as a reaction to factors in the working environment: work
schedules, plans, and management expectations and demands.
The Incident Causation Model
In order to get more insight into the controllable parts of the incident causation
process, an understanding of the possible feedback loops in a safety information
system is necessary.
A safety information system
Incident investigation
When incidents are investigated, substantial reports are produced and decision-
makers receive information about the human error component of the incident.
Fortunately, this is becoming more and more obsolete in many companies. It is more
effective to analyse the “operational disturbances” that precede the incidents and
incidents. If an incident is described as an operational disturbance followed by its
consequences, then sliding from the road is an operational disturbance and getting
killed because the driver did not wear a safety belt is an incident. Barriers may have
been placed between the operational disturbance and the incident, but they failed or
were breached or circumvented.
Incident
An incident is a work related event during which:
injury, ill health, or fatality actually occurs, or
injury, ill health, or fatality could have occurred.
An accident is a type of incident. It is a work-related event
during which injury, ill health, or fatality actually occurs.
It is a type of incident.
A close call, near miss, near hit, or dangerous occurrence
is also a type of incident. It is a work-related event during
which injury, ill health, or fatality could have occurred,
but didn’t actually occur
Nonconformity
Nonconformity is the non fulfillment of a requirement or a deviation
from a standard. When an organization fails to meet requirements or
deviates from a standard, a nonconformity exists.
Preventive Action
Preventive actions are steps that are taken to remove the causes of
potential nonconformities or other undesirable situations that have
not yet occurred. Preventive actions address potential problems.
In general, the preventive action process can be thought of as a
risk analysis process.
Risk combines three elements: it starts with a potential event,
and then combines its probability with its potential severity.
In the context of OH&S, the concept of risk asks two future
oriented questions:
What is the probability that a particular hazardous
event or exposure will actually occur in the future?
How severe would the impact on health and safety be
if the hazardous event or exposure actually occurred?
A high risk hazardous event or exposure would have both a
high probability of occurring and a severe impact on OH&S if
it actually occurred. A high risk event or exposure is one that
is likely to cause severe injury or ill health.
Unsafe act auditing
A wrong act committed by an employee is called a “substandard act” and not an
“unsafe act” in this article: the notion of “unsafe” seems to limit the applicability of
the term to safety, whereas it can also be applied, for example, to environmental
problems. Substandard acts are sometimes recorded, but detailed information as to
which slips, mistakes and violations were performed and why they were performed is
hardly ever fed back to higher management levels.
Investigating the employee’s state of mind
Before a substandard act is committed, the person involved was in a certain state of
mind. If these psychological precursors, like being in a state of haste or feeling sad,
could be adequately controlled, people would not find themselves in a state of mind
in which they would commit a substandard act.
General failure types and their definitions
General failures Definitions
1. Design (DE) Failures due to poor design of a whole plant as well as
individual items of equipment
2. Hardware (HW) Failures due to poor state or unavailability of
equipment and tools
3. Procedures (PR) Failures due to poor quality of the operating
procedures with respect to utility, availability and
comprehensiveness
4. Error enforcing
conditions (EC)
Failures due to poor quality of the working
environment, with respect to circumstances that
increase the probability of mistakes
5. Housekeeping (HK) Failures due to poor housekeeping
6. Training (TR) Failures due to inadequate training or insufficient
experience
7. Incompatible
goals(IG)
Failures due to the poor way safety and internal
welfare are defended against a variety of other goals
like time pressure and a limited budget
8. Communication
(CO)
Failures due to poor quality or absence of lines of
communication between the various divisions,
departments or employees
9. Organization (OR) Failures due to the way the project is managed and
the company is operated
10. Maintenance
management (MM)
Failures due to poor quality of the maintenance
procedures regarding quality, utility, availability and
comprehensiveness
11. Defences (DF) Failures due to the poor quality of the protection
against hazardous situations
There are two GFTs that require some further explanation: maintenance
management and defences.
Maintenance management (MM)
Since maintenance management is a combination of factors that can be found in
other GFTs, it is not, strictly speaking, a separate GFT: this type of management is
not fundamentally different from other management functions. It may be treated as a
separate issue because maintenance plays an important role in so many incident
scenarios and because most organizations have a separate maintenance function.
Defences (DF)
The category of defences is also not a true GFT, as it is not related to the incident
causation process itself. This GFT is related to what happens after an operational
disturbance. It does not generate either psychological states of mind or substandard
acts by itself. It is a reaction that follows a failure due to the action of one or more
GFTs. While it is indeed true that a safety management system should focus on the
controllable parts of the incident causation chain before and not after the unwanted
incident, nevertheless the notion of defences can be used to describe the perceived
effectiveness of safety barriers after a disturbance has occurred and to show how
they failed to prevent the actual incident.
Managers need a structure that will enable them to relate identified problems to
preventive actions. Measures taken at the levels of safety barriers or substandard
acts are still necessary, although these measures can never be completely
successful. To trust “last line” barriers is to trust factors that are to a large extent
out of management control. Management should not attempt to manage such
uncontrollable external devices, but instead must try to make their organizations
inherently safer at every level.
Measuring the Level of Control over Human Error
Ascertaining the presence of the GFTs in an organization will enable incident
investigators to identify the weak and strong points in the organization. Given such
knowledge, one can analyse incidents and eliminate or mitigate their causes and
identify the structural weaknesses within a company and fix them before they in fact
contribute to an incident.
Incident investigation
The task of an incident analyst is to identify contributing factors and to categorize
them. The number of times a contributing factor is identified and categorized in
terms of a GFT indicates the extent to which this GFT is present. This is often done
by means of a checklist or computer analysis program.
Profile of an incident type
Some of the GFTs - design, procedures and incompatible goals - score consistently
high in all four particular incidents. This means that in each incident, factors have
been identified that were related to these GFTs. With respect to the profile of
incident 1, design is a problem. Housekeeping, although a major problem area in
incident 1, is only a minor problem if more than the first incident is analysed. It is
suggested that about ten similar types of incidents be investigated and combined in
a profile before far-reaching and possibly expensive corrective measures are taken.
HARDWARE HAZARDS
“Machine” hazards, those which are specific to the appurtenances and hardware
used in the industrial processes associated with pressure vessels, processing
equipment, powerful machines and other intrinsically risky operations. This article
does not address worker hazards, which implicate the actions and behaviour of
individuals, such as slipping on working surfaces, falling from elevations and hazards
from using ordinary tools. Since these hazards threaten anyone present and may
even be a threat to neighbours and the external environment, the analysis methods
and the means for prevention and control are similar to the methods used to deal
with risks to the environment from industrial activities.
Machine Hazards
Good quality hardware is very reliable, and most failures are caused by secondary
effects like fire, corrosion, misuse and so on. Nevertheless, hardware may be
highlighted in certain incidents, because a failing hardware component is often the
most conspicuous or visibly prominent link of the chain of events. Although the term
hardware is used in a broad sense, illustrative examples of hardware failures and
their immediate “surroundings” in incident causation have been taken from industrial
workplaces. Typical candidates for investigation of “machine” hazards include but
are not limited to the following:
� pressure vessels and pipes
� motors, engines, turbines and other rotating machines
� chemical and nuclear reactors
� scaffolding, bridges, etc.
� lasers and other energy radiators
� cutting and drilling machinery, etc.
� welding equipment.
Effects of Energy
Hardware hazards can include wrong use, construction errors or frequent overload,
and accordingly their analysis and mitigation or prevention can follow rather
different directions. However, physical and chemical energy forms that elude human
control often exist at the heart of hardware hazards. Therefore, one very general
method to identify hardware hazards is to look for the energies that are normally
controlled with the actual piece of equipment or machinery, such as a pressure
vessel containing ammonia or chlorine. Other methods use the purpose or intended
function of the actual hardware as a starting point and then look for the probable
effects of malfunctions and failures. For example, a bridge failing to fulfil its primary
function will expose subjects on the bridge to the risk of falling down; other effects
of the collapse of a bridge will be the secondary ones of falling items, either
structural parts of the bridge or objects situated on the bridge. Further down the
chain of consequences, there may be derived effects related to functions in other
parts of the system that were dependent on the bridge performing its function
properly, such as the interruption of emergency response vehicular traffic to another
incident.
Industrial Work Environment
Machine hazards also involve load or stress factors that may be dangerous in the
long run, such as the following:
� extreme working temperatures
� high intensities of light, noise or other stimuli
� inferior air quality
� extreme job demands or workloads.
These hazards can be recognized and precautions taken because the dangerous
conditions are already there. They do not depend on some structural change in the
hardware to come about and work a harmful result, or on some special event to
effect damage or injury. Long-term hazards also have specific sources in the working
environment, but they must be identified and evaluated through observing workers
and the jobs, instead of just analysing hardware construction and functions.
Dangerous hardware or machine hazards are usually exceptional and rather seldom
found in a sound working environment, but cannot be avoided completely. Several
types of uncontrolled energy, such as the following risk agents, can be the
immediate consequence of hardware malfunction:
� harmful releases of dangerous gas, liquids, dusts or other substances
� fire and explosion
� high voltages
� falling objects, missiles, etc.
� electric and magnetic fields
� cutting, trapping, etc.
� displacement of oxygen
� nuclear radiation, x rays and laser light
� flooding or drowning
� jets of hot liquid or steam.
Risk Agents
Moving objects. Falling and flying objects, liquid flows and jets of liquid or steam,
such as listed, are often the first external consequences of hardware or equipment
failure, and they account for a large proportion of incidents.
Chemical substances. Chemical hazards also contribute to worker incidents as well
as affecting the environment and the public. Traffic incidents involving gasoline or
chemical delivery trucks or other dangerous goods transports, unite two risk agents -
moving objects and chemical substances.
Electromagnetic energy. Electric and magnetic fields, x rays and gamma rays are all
manifestations of electromagnetism, but are often treated separately as they are
encountered under rather different circumstances. However, the dangers of
electromagnetism have some general traits: fields and radiation penetrate human
bodies instead of just making contact on the application area, and they cannot be
sensed directly, although very large intensities cause heating of the affected body
parts.
Triggering the Hardware Hazards
Both sudden and gradual shifts from the controlled - or “safe” - condition to one with
increased danger can come about through the following circumstances, which can
be controlled through appropriate organizational means such as user experience,
education, skills, surveillance and equipment testing:
� wear and overloads
� external impact (fire or impact)
� ageing and failure
� wrong supply (energy, raw materials)
� insufficient maintenance and repair
� control or process error
� misuse or misapplication
� hardware breakdown
� barrier malfunction.
Since proper operations cannot reliably compensate for improper design and
installation, it is important to consider the entire process, from selection and design
through installation, use, maintenance and testing, in order to evaluate the actual
state and conditions of the hardware item.
Hazard Case: The Pressurized Gas Tank
Gas can be contained in suitable vessels for storage or transport, like the gas and
oxygen cylinders used by welders. Often, gas is handled at high pressure, affording a
great increase in the storing capacity, but with higher incident risk. The key
incidental phenomenon in pressurized gas storage is the sudden creation of a hole in
the tank, with these results:
� the confinement function of the tank ceases
� the confined gas gets immediate access to the surrounding atmosphere.
The development of such an incident depends on these factors:
� the type and amount of gas in the tank
� the situation of the hole in relation to the tank’s contents
� the initial size and subsequent growth rate of the hole
� the temperature and pressure of the gas and the equipment
� the conditions in the immediate environment (sources of ignition, people, etc.).
The tank contents can be released almost immediately or over a period of time, and
result in different scenarios, from the burst of free gas from a ruptured tank, to
moderate and rather slow releases from small punctures.
The behaviour of various gases in the case of leakage
When developing release calculation models, it is most important to determine the
following conditions affecting the system’s potential behaviour:
� the gas phase behind the hole (gaseous or liquid?)
� temperature and wind conditions
� the possible entry of other substances into the system or their possible presence in
its surroundings
� barriers and other obstacles.
The exact calculations pertaining to a release process where liquefied gas escapes
from a hole as a jet and then evaporates (or alternatively, first becomes a mist of
droplets) are difficult. The specification of the later dispersion of the resultant
clouds is also a difficult problem. Consideration must be given to the movements and
dispersion of gas releases, whether the gas forms visible or invisible clouds and
whether the gas rises or stays at ground level.
Tank strength is affected by the history of tank use - first of all by the normal
wearing processes and the scratches and corrosion attacks typical of the particular
industry and of the application. Other historical parameters of particular interest
include:
� casual overpressure
� extreme heating or cooling (internal or external)
� mechanical impacts
� vibrations and stress
� substances that have been stored in or have passed through the tank
� substances used during cleansing, maintenance and repair.
The construction material - steel plate, aluminium plate, concrete for non-
pressurized applications, and so on - can undergo deterioration from these influences
in ways that are not always possible to check without overloading or destroying the
equipment during testing.
Hazard Analysis
The methods that have been developed to find the risks that may be relevant to a
piece of equipment, to a chemical process or to a certain operation are referred to
as “hazard analysis”. These methods ask questions such as: “What may possibly go
wrong?” “Could it be serious?” and “What can be done about it?” Different methods
of conducting the analyses are often combined to achieve a reasonable coverage,
but no such set can do more than guide or assist a clever team of analysts in their
determinations. The main difficulties with hazard analysis are as follows:
� availability of relevant data
� limitations of models and calculations
� new and unfamiliar materials, constructions and processes
� system complexity
� limitations on human imagination
� limitations on practical tests.
To produce usable risk evaluations under these circumstances it is important to
stringently define the scope and the level of “ambitiousness” appropriate to the
analysis at hand; for example, it is clear that one does not need the same sort of
information for insurance purposes as for design purposes, or for the planning of
protection schemes and the construction of emergency arrangements. Generally
speaking, the risk picture must be filled in by mixing empirical techniques (i.e.,
statistics) with deductive reasoning and a creative imagination.
Different risk evaluation tools - even computer programs for risk analysis—can be
very helpful. The hazard and operability study (HAZOP) and the failure mode and
effect analysis (FMEA ) are commonly used methods for investigating hazards,
especially in the chemical industry. The point of departure for the HAZOP method is
the tracing of possible risk scenarios based on a set of guide words; for each
scenario one has to identify probable causes and consequences. In the second
stage, one tries to find means for reducing the probabilities or mitigating the
consequences of those scenarios judged to be unacceptable. Fault trees and event
trees and the modes of logical analysis proper to incident causation structures and
probability reasoning are in no way specific to the analysis of hardware hazards, as
they are general tools for system risk evaluations.
Tracing hardware hazards in an industrial plant
To identify possible hazards, information on construction and function can be sought
from:
� actual equipment and plant
� substitutes and models
� drawings, electrical diagrams, piping and instrumentation (P/I) diagrams, etc.
� process descriptions
� control schemes
� operation modes and phases
� work orders, change orders, maintenance reports, etc.
By selecting and digesting such information, analysts form a picture of the risk
object itself, its functions and its actual use. Where things are not yet constructed -
or unavailable for inspection - important observations cannot be made and the
evaluation must be based entirely on descriptions, intentions and plans. Such
evaluation might seem rather poor, but in fact, most practical risk evaluations are
made this way, either in order to seek authoritative approval for applications to
undertake new construction, or to compare the relative safety of alternative design
solutions. Real life processes will be consulted for the information not shown on the
formal diagrams or described verbally by interview, and to verify that the information
gathered from these sources is factual and represents actual conditions. These
include the following:
� actual practice and culture
� additional failure mechanisms/construction details
� “sneak paths”
� common error causes
� risks from external sources/missiles
� particular exposures or consequences
� past incidents, incidents and near incidents.
Most of this additional information, especially sneak paths, is detectable only by
creative, skilled observers with considerable experience, and some of the
information would be almost impossible to trace with maps and diagrams. Sneak
paths denote unintended and unforeseen interactions between systems, where the
operation of one system affects the condition or operation of another system through
other ways than the functional ones. This typically happens where functionally
different parts are situated near each other, or (for example) a leaking substance
drips on equipment beneath and causes a failure.
For a pipeline, failure modes would consider items such as:
� a reduced flow
� a leak
� a flow stopped due to blockage
� a break in the line.
The effects of leaks seem obvious, but sometimes the most important effects may
not be the first effects: what happens for example, if a valve is stuck in a half-open
position?
The hardware components are very seldom the guilty parts in incident development;
rather, there are root causes to be found in other links of the chain: wrong concepts,
bad designs, maintenance errors, operator errors, management errors and so on.
Several examples of the specific conditions and acts that may lead to failure
development have already been given; a broad collection of such agents would take
account of the following:
� collision
� corrosion, etching
� excessive loads
� failing support and aged or worn-out parts
� low-quality welding jobs
� missiles
� missing parts
� overheating or chilling
� vibration
� wrong construction material used.
Controlling the hardware hazards in a working environment requires the review of all
possible causes and respect for the conditions that are found to be critical with the
actual systems.
ORGANIZATIONAL FACTORS - MORT
Through industrialization, workers became organized in factories as the utilization of
energy sources such as the steam engine became possible. As compared to
traditional handicraft, mechanized production, with sources of higher energy at its
disposal, presented new risks of incidents. As the amount of energy increased,
workers were removed from the direct control of these energies. Decisions that
affected safety were often made at the management level rather than by those
directly exposed to these risks. At this stage of industrialization, the need for safety
management became evident.
The MORT Diagram and Underlying Principles
The intent of MORT was to formulate an ideal safety management system based on a
synthesis of the best safety program elements and safety management techniques
then available. As the principles underlying the MORT initiative were applied to the
contemporary state of the art in safety management, the largely unstructured safety
literature and expertise took on the form of an analytical tree.
A version of the MORT analytical tree
The MORT Diagram
MORT is used as a practical tool in incident investigations and in evaluations of
existing safety programs.
When the branches of the MORT diagram are elaborated in detail, there are elements
from such different fields as risk analysis, human factors analysis, safety information
systems and organizational analysis. In total, about 1,500 basic events are covered
by the MORT diagram.
Application of the MORT Diagram
The MORT diagram functions as a screening tool in planning the analyses and
evaluations. It is also used as a checklist for comparison of actual conditions with
the idealized system. In this application, MORT facilitates checking the
completeness of the analysis and avoiding personal biases.
At bottom, MORT is made up of a collection of questions. Criteria that guide
judgements as to whether specific events and conditions are satisfactory or less
than adequate are derived from these questions.
The ideal is a well-structured organization with clear and realistic goals and well-
defined lines of responsibility and authority. MORT is thus best suited for large and
bureaucratic organizations.
WORKPLACE INSPECTION AND REGULATORY ENFORCEMENT
Inspection Systems
Auditing has been defined as “the structured process of collecting independent
information on the efficiency, effectiveness and reliability of the total safety
management system and drawing up plans for corrective action”.
The workplace inspection therefore is not only the final stage in setting up a safety
management program but is also a continuing process in its maintenance. It can be
conducted only where a properly devised management system for safety has been
established. Such a system first envisages a formal policy statement from
management setting out its principles for creating a healthy and safe working
environment and then establishing the mechanisms and the structures within the
organization whereby these principles will be effectively implemented. Management
must furthermore be committed to providing adequate resources, both human and
financial, to support the system’s mechanisms and structures. Thereafter, there
must be detailed planning for safety and health, and the defining of measurable
goals. Systems must be devised to ensure that safety and health performance in
practice can be measured against established norms and against previous
achievements. Only when this structure is in place and is operating can an effective
management audit system be applied.
Complete safety and health management systems can be devised, produced and
implemented from within the resources of larger enterprises. Additionally, there are
a number of safety management control systems which are available from
consultants, insurance companies, government agencies, associations and
specialist companies. It is a matter for the enterprise to decide whether it should
produce its own system or obtain outside services.
Management Inspections
The inspection procedure must be as painstaking and objective as the company’s
financial inspection. The inspection must first determine whether the company’s
statement of policy on safety and health is properly reflected in the structures and
mechanisms created to implement it; if not, then the inspection may recommend
that the fundamental policy be reappraised or suggest adjustments or alterations to
the existing structures and mechanisms. A similar process must be applied to safety
and health planning, to the validity of the goal-setting norms, and to the
measurement of performance. The results of any inspection must be considered by
the top management of the enterprise, and any correctives must be endorsed and
implemented through that authority.
In practice it is undesirable, and often impractical, to undertake a complete
inspection of all of a system’s features and their application throughout every
department of the enterprise at one time. More usually, the inspection procedure
concentrates on one feature of the total safety management system throughout the
plant, or alternatively on the application of all the features in one department or even
subdepartment. But the objective is to cover all the features in all departments over
an agreed period in order to validate the results.
To this extent management inspection should be regarded as a continuous process
of vigilance. The need for objectivity is clearly of considerable importance. If
inspections are conducted in-house then there must be a standardized inspection
procedure; inspections should be undertaken by staff who have been properly trained
for this purpose; and those selected as inspectors must not assess the departments
in which they normally work, nor should they assess any other work in which they
have a personal involvement. Where reliance is placed on consultants this problem is
minimized.
Inspections by Inspectorates
The legal framework which is designed to afford protection to people at work must
be properly administered and effectively applied if the purpose of the regulatory
legislation is to be achieved. Most countries have therefore adopted the broad model
of an inspection service which has the duty of ensuring that safety and health
legislation is enforced.
Additional powers are often provided to enable inspectors to rectify conditions which
might be an immediate source of danger or ill health to the workforce. Again there is
a wide variety of practices. Where standards are so poor that there is an imminent
risk of danger to the workforce, then an inspector may be authorized to serve a legal
document on the spot prohibiting the use of the machinery or plant, or stopping the
process until the risk has been effectively controlled. For a lower order of risk,
inspectors can issue a legal notice formally requiring that measures be taken within
a given time to improve standards. These are effective ways of rapidly improving
working conditions, and are often a form of enforcement preferable to formal court
proceedings, which may be cumbersome and slow in securing remediation.
Legal proceedings have an important place in the hierarchy of enforcement. There is
an argument that because court proceedings are simply punitive and do not
necessarily result in changing attitudes to safety and health at work, they should
therefore be invoked only as a last resort when all other attempts at securing
improvements have failed.
Every inspection service has to determine the proper balance between providing
advice and enforcing the law in the course of inspection work. The technique must
be to encourage and stimulate, rather than to immediately enforce the law by
punitive action. But even here the balance is a difficult one. People at work are
entitled to safety and health standards irrespective of the size of the enterprise, and
it would therefore be wholly misguided for an inspection service to ignore or
minimize risks and to curtail or even forgo enforcement simply to nurture the
existence of the economically fragile small enterprise.
Consistency of Inspections
In the view of the complex nature of their work - with its combined needs for legal,
prudential, technical and scientific skills, inspectors do not - indeed should not -
adopt a mechanistic approach to inspection. This constraint, combined with a
difficult balance between the advisory and enforcement functions, creates yet
another concern, that of the consistency of inspection services. Industrialists and
trade unions have a right to expect a consistent application of standards, whether
technical or legal, by inspectors across the country. In practice this is not always
easy to achieve, but it is something for which the enforcing authorities must always
strive.
Frequency of Inspections
How frequently should the inspectorates undertake inspections of the workplace?
Again there is considerable variation in the way this question may be answered. The
International Labour Organization (ILO) holds the view that the minimum requirement
should be that every workplace should receive an inspection from the enforcing
authorities at least once each year. There are different approaches to determine how
frequently inspections should be made. One approach has been purely cyclical.
Resources are deployed to provide inspection of all premises on a 2-yearly, or more
likely a 4-yearly, basis. But this approach, though possibly having the appearance of
equity, treats all premises as the same regardless of size or risk. Yet enterprises are
manifestly diverse as regards safety and health conditions, and to the extent that
they differ, this system may be regarded as mechanistic and flawed.
A different approach, adopted by some inspectorates, has been to attempt to draw
up a program of work based on hazard; the greater the hazard either to safety or
health, the more frequent the inspection. Hence resources are applied by the
inspectorate to those places where the potential for harm to the workforce is the
greatest.
Inspection Goals
Inspection techniques in the workplace vary according to the size and complexity of
the enterprise. In smaller companies, the inspection will be comprehensive and will
assess all hazards and the extent to which the risks arising from the hazards have
been minimized. The inspection will therefore ensure that the employer is fully aware
of safety and health problems and is given practical guidance on how they may be
addressed. But even in the smallest enterprise the inspectorate should not give the
impression that fault-finding and the application of suitable remedies are the
function of the inspectorate and not of the employer. Employers must be encouraged
by inspection to control and effectively manage safety and health problems, and they
must not abdicate their responsibilities by awaiting an inspection from the
enforcement authorities before taking needed action.
Inspection Findings
The final element in an inspection is to review the inspection findings with the most
senior member of management on the site. Management has the prime responsibility
to comply with legal requirements on safety and health, and therefore no inspection
should be complete without management’s being fully aware of the extent to which
it has met those duties, and what needs to be done to secure and maintain proper
standards. Certainly if any legal notices are issued as a result of an inspection, or if
legal proceedings are likely, then senior management must be aware of this state of
affairs at the earliest possible stage.
Company Inspections
Company inspections are an important ingredient in maintaining sound standards of
safety and health at work. They are appropriate to all enterprises and, in larger
companies, may be an element in the management inspection procedure. For smaller
companies, it is essential to adopt some form of regular company inspection.
Reliance should not be placed on the inspection services provided by the
inspectorates of the enforcing authorities. These are usually far too infrequent, and
should serve largely as a stimulus to improve or maintain standards, rather than be
the primary source for evaluating standards. Company inspections can be
undertaken by consultants or by companies who specialize in this work, but the
current discussion will concentrate on inspection by the enterprise’s own personnel.
How frequently should company inspections be made? To some degree the answer is
dependent on the hazards associated with the work and the complexity of the plant.
But even in low-risk premises there should be some form of inspection on a regular
(monthly, quarterly, etc.) basis. If the company employs a safety professional, then
clearly the organization and the conduct of the inspection must be an important part
of this function. The inspection should usually be a team effort involving the safety
professional, the departmental manager or foreman, and either a trade union
representative or a qualified worker, such as a safety committee member. The
inspection should be comprehensive; that is to say, a close examination should be
made both of the safety software (for example, systems, procedures and work
permits) and the hardware (for example, machinery guarding, fire-fighting equipment,
exhaust ventilation and personal protective equipment). Particular attention should
be paid to “near misses” - those incidents which do not result in damages or
personal injury but which have the imminent potential for serious incidental injuries.
There is an expectation that after an incident resulting in absence from work, the
inspection team would immediately convene to investigate the circumstances, as a
matter outside the normal cycle of inspection. But even during routine workshop
inspection the team should also consider the extent of minor incidental injuries
which have occurred in the department since the previous inspection.
It is important that company inspections should not seem to be consistently
negative. Where faults exist it is important that they be identified and rectified, but it
is equally important to commend the maintenance of good standards, to comment
positively on tidiness and good housekeeping, and to reinforce by encouragement
those who use personal protective equipment provided for their safety
ANALYSIS AND REPORTING: INCIDENT INVESTIGATION
It is a paradox that the prevention of work-related incidents did not emerge very
early as an absolute necessity, since health and safety is fundamental to work itself.
In fact it was not until the beginning of the twentieth century that incidents at work
ceased to be considered inevitable and their causation became a subject to be
investigated and used as a basis for prevention. However, incident investigation long
remained cursory and empirical. Historically, incidents were first conceived of as
simple phenomena—that is, as resulting from a single (or principal) cause and a
small number of subsidiary causes. It is now recognized that incident investigation,
which is aimed at identifying the causes of the phenomenon so as to avert its
reoccurrence, depends both on the concept underlying the process of investigation
and on the complexity of the situation to which it is applied.
Causes of Incidents
It is indeed true that in the most precarious situations, incidents are often the result
of a fairly simple sequence of a few causes that can be rapidly traced to basic
technical problems that even a summary analysis can reveal (equipment badly
designed, working methods undefined, etc.). On the other hand, the more closely that
the material elements of work (machines, installations, the arrangement of the
workplace, etc.) conform with the requirements of safe work procedures, standards
and regulations, the safer the work situation becomes. The result is that an incident
can then occur only when a group of exceptional conditions are present
simultaneously—conditions that are becoming ever more numerous. In such cases,
the injury or damage appears as the final result of a frequently complex network of
causes.
Principal concepts of the incident phenomenon, their characteristics and the
implications for prevention
Concept or
“incident
phenomenon”
Significant elements
(objectives, procedures,
limits, etc.)
Main consequences for prevention
Basic concept
(incident as
phenomenon
with few causes
The objective is to identify
“the” single or main cause
No particular method
Little time devoted to the
Simple prevention measures
concerning the immediate
antecedent of the injury (individual
protection, instructions about
or even one
cause)
investigation
Role of chance and fate often
referred to
taking care, protection of
dangerous machines)
Concept focused
on regulatory
measures
Focus on looking for who is
responsible; the “enquiry”
essentially identifies
infringements and faults
Rarely concerned about the
conditions generating the
situations examined
Prevention usually limited to
reminders about existing
regulatory requirements or formal
instructions
Linear (or quasi-
linear) concept
(“domino” model)
Identification of a
chronological succession of
“dangerous conditions” and
“dangerous acts”
Frequent use of checklists
The investigation depends
very much on the
investigator’s experience
Weak preventive component
(dangerous nature of acts
determined a posteriori)
Conclusions generally concerned
with the dangerous acts
Multifactorial
concept
Exhaustive research to
gather the facts
(circumstances, causes,
factors, etc.)
Focus placed on the
contingent character of each
incident situation
No criteria of relevance in
the facts gathered Need for
complex statistical
treatment
Concept not conducive to the
search for solutions case by case
(clinical analysis) and better
adapted to the identification of
statistical aspects (trends, tables,
graphs, etc.)
Systematic
concept (tree of
causes, STEP)
Identification of the network
of factors of each incident
Use of logical relationships
Need for training of
investigators
Methods centred on clinical
analysis (carried out in
participatory manner)
Possibility of use for all undesired
events (incidents, breakdowns)
Nowadays, a work incident is generally viewed as an index (or symptom) of
dysfunction in a system consisting of a single production unit, such as a factory,
workshop, team or work position. It is the nature of a system that its analysis
requires the investigator to examine not only the elements that make up the system
but also their relationships with one another and with the work environment. Within
the framework of a system, the incident investigation seeks to trace to its origins
the sequence of basic dysfunctions that have resulted in the incident and, more
generally, the network of antecedents of the undesired event (incident, near incident
or incident).
The application of methods of this kind, such as the STEP method (sequentially
timed events plotting procedures) and the “tree of causes” method (similar to fault or
event trees analyses), allows the incident process to be visualized in the form of an
adjusted graph that illustrates the multicausality of the phenomenon.
These are the antecedents of the incident, of which there are two types:
1. those of an unusual nature (changes or variations) in relation to the “normal” or
expected course of the work
2. those of a permanent nature that have played an active part in the occurrence of
the incident through the medium of or in combination with the unusual antecedents.
The information gathering is carried out at the location of the incident itself as soon
as possible after its occurrence. It is preferably carried out by persons who know the
operation or process and who try to obtain a precise description of the work without
limiting themselves to the immediate circumstances of the damage or injury. The
investigation is initially effected mainly by means of interviews, if possible with the
worker or operator, victims and eyewitnesses, other members of the work team, and
the hierarchical supervisors. If appropriate it is completed by means of a technical
investigation and the use of outside expertise.
The investigation seeks to identify, in order of priority, the unusual antecedents, and
to determine their logical connections. An effort is made at the same time to reveal
the permanent antecedents that have allowed the incident to occur. In this way the
investigation is able to go back to a stage more remote than the immediate
antecedents of the incident.
Logical links used in the "tree of causes" method
The logical coherence of the tree is checked by asking the following questions for
each antecedent:
� If X had not taken place, would Y nevertheless have occurred?
� In order for Y to occur, was X, and only X, necessary?
Moreover, the construction of the tree of causes in itself induces the investigators to
pursue the information-gathering, and therefore the investigation, to a point well
before the incident occurred. When completed, the tree represents the network of
antecedents that have given rise to the injury—they are in fact the incident factors.
STEP method
Analysis by the Tree of Causes Method
Making use of the tree of causes for the purposes of incident analysis has two
objectives:
� making the reoccurrence of the same incident impossible
� averting the occurrence of more or less similar incidents - that is, incidents whose
investigation would reveal common factors with the incidents that have already
occurred.
Effectiveness of Preventive Measures
The effectiveness of a preventive measure can be judged with the help of the
following criteria:
The stability of the measure. The effects of a preventive measure must not disappear
with time: informing the operators (in particular, reminding them of instructions) is
not a very stable measure because its effects are often transient. The same is
moreover true of some protective devices when they are easily removable.
The possibility of integrating safety. When a safety measure is added on - that is,
when it does not contribute directly to production - it is said that safety is not
integrated. Whenever this is so, it is observed that the measure tends to disappear.
Generally speaking, any preventive measure entailing an additional cost for the
operator should be avoided, whether it is a physiological cost (increasing the
physical or nervous load), a psychological cost, a financial cost (in the case of salary
or output) or even a simple loss of time.
The non-displacement of the risk. Some preventive measures may have indirect
effects that are detrimental to safety. It is therefore always necessary to foresee the
possible repercussions of a preventive measure on the system (job, team or
workshop) in which it is inserted.
The possibility of general application (the notion of potential incident factor). This
criterion reflects the concern that the same preventive action may be applicable to
other jobs than the one affected by the incident under investigation. Whenever
possible, an effort should be made to go beyond the particular case that has given
rise to the investigation, an effort that often requires a reformulation of the problems
discovered. The information obtained from an incident may thus lead to preventive
action relating to factors that are unknown but present in other work situations
where they have not yet given rise to incidents.
Effectiveness. In order to be effective, incident investigation requires that four
conditions are satisfied concurrently:
1. an evident commitment on the part of the top management of the establishment,
who must be able to ensure the systematic implementation of such procedures
2. training of the investigators
3. management, supervisors and workers fully informed concerning the aims of the
investigation, its principles, the requirements of the method and the results
expected
4. real improvements in safety conditions that will encourage those involved in
future investigations.
Limitations. Even when carried out very well, incident investigation suffers from a
double limitation:
� It remains a procedure for investigating risks a posteriori (in the manner of systems
analysis), with the aim of correcting existing situations. It does not therefore
dispense with the need for a priori (prospective) investigations, such as the
ergonomic investigation of jobs or, for complex systems, safety investigations.
� The usefulness of incident investigations also varies with the safety level of the
establishment where they are applied. In particular, when the safety level is high
(the incident rate is low or very low), it is evident that serious incidents result from
the conjunction of numerous independent random factors that are relatively
harmless from the safety viewpoint when considered outside the context under
investigation.
The Need for Reporting and Compiling Incident Data
The primary purpose of assembling and analysing occupational incident data is to
provide knowledge for use in the prevention of occupational injuries, fatalities and
other forms of harm such as toxic exposures with long-term effects. These data are
also useful in assessing needs for compensating victims for injuries previously
incurred. Additional, more specific purposes for the compilation of incident statistics
include the following:
� to estimate the causes and magnitude of incident problems
� to identify and prioritize the need for preventive measures
� to evaluate the effectiveness of preventive measures
� to monitor risks, issue warnings and conduct awareness campaigns
� to provide feedback for those involved in prevention.
Often, an overview of the number of incidents occurring on an annual basis is
desired. A frequency is often used for this purpose, comparing the number of
incidents to a measure relating to the risk group and expressed, for example, in
terms of incidents per 100,000 workers or per 100,000 working hours.
The need for incident information pertains to the following three levels of function
that make use of it:
� At the workplace level within the individual enterprise, incident data are used in
local safety activities. The best opportunities for tackling specific risk factors are to
be found immediately at the workplace itself.
� At the level of authority responsible for legislation, incident data are used to
regulate the working environment and to promote safety at the workplace. It is
possible not only to exert control over the workplace at this level but also to carry
out general statistical analyses for use in overall preventive work.
� At the level of authority responsible for payments of compensation to incident
victims, incident data are used to help determine rates.
Reporting Incident Information to Safety Authorities
Legislation requiring the reporting of occupational incidents varies widely from
country to country, with the differences chiefly relating to the classes of employers
and others to whom the laws apply. Countries that place significant emphasis on
safety at the workplace usually mandate that incident data be reported to the
authority responsible for supervising compliance with safety legislation. (In some
cases, legislation requires reporting of occupational incidents that result in absence
from work, the duration of such absence varying from 1 to 3 days in addition to the
day of the incident.) Common to most legislation is the fact that reporting is linked
with some sort of penalty or compensation for the consequences of incidents.
What Information is to be Compiled?
There are three basic classes of information obtainable by means of incident
recording:
� Information identifying where the incidents occur - that is, sectors, trades, work
processes and so on. This knowledge can be used to determine where preventive
action is needed.
� Information showing how the incidents occur, the situations in which they occur
and the ways in which the injuries come about. This knowledge can be used to
determine the type of preventive action needed.
� Information relating to the nature and seriousness of the injuries, describing, for
example, the parts of the body affected and the health consequences of the injuries.
Such knowledge is to be used for prioritizing preventive action in order to ensure
that action is taken where the risk is highest.
Incident identification number. All occupational incidents must be assigned a unique
identifying number. It is especially advantageous to use a numerical identifier for the
purpose of computerized filing and subsequent processing.
Personal identification number and date. Registration of the victim is an essential
part of incident identification. The number can be the worker’s birthday, employment
number, social security number or some other unique identifier. Recording both a
personal identification number and the date of the incident will prevent duplicated
registration of the same incident event, and also enables a check to be made as to
whether the incident has been reported. The link between information contained in
the incident report with the personal identification number can be protected for the
The work process. A vital component of information relating to occupational
incidents is a description of the work process carried out at the time the incident
occurred. Identification of the work process is a prerequisite for accurately targeted
prevention. It should be noted that the work process is the actual work function
which the victim was performing at the time of the incident and may not necessarily
be identical to the work process that caused the injury, fatality or exposure.
The incident event. An incident event normally comprises a chain of events. There is
often a tendency on the part of investigators to focus on the part of the event cycle
in which the injury actually occurred. From the point of view of prevention, however,
a description of that part of the event cycle in which something went wrong, and of
what the victim was doing when the event occurred, is just as important.
The consequences of the incident. After the injured part of the body is specified and
the type of injury described (this is done partly by coding from a checklist and partly
from the description in the event cycle), information is recorded describing the
seriousness of the injury, whether it resulted in absence from work (and for how
long), or whether it was fatal or involved invalidity. Detailed information in terms of
longer-duration absence from work, hospitalization, or disablement is normally
available from compensation offices and the social security system.
For recording purposes, the examination of incident events is therefore divided into
the following three information components:
� The activity associated with an incident is that which was being carried out by the
victim at the time of the incident. It is recorded by means of an action code and a
technology code.
� The injury event is the deviant event which led to the incident. This is recorded by
means of a code for the deviation and by one or two codes for the technology which
formed part of the deviation.
� The mode of injury is recorded by using a code for the manner in which the victim
came into contact with the injury-causing factor and another code for the technology
which caused the injury.
Establishment of priorities
Establishment of priorities is the selection of the most important risk areas or work-
environment problems for preventive action. Through the results of mapping surveys
and monitoring and warning activities, a register of occupational incidents can be
built which can contribute to this establishment of priorities, the elements of which
might include the following:
� risks involving serious consequences
� risks which carry a high probability of injury to a large proportion of the exposure
group
� risks to which large groups of people are exposed.
Data drawn from a register of occupational incidents can be used in the
establishment of priorities on several levels, perhaps at the overall national level or
at the more particular enterprise level. Whatever the level, the analyses and
assessments can be made on the basis of the same principles.
Prevention
Analyses and documentation which are used for preventive purposes are generally
highly specific and concentrated in limited areas which are, however, treated in
great depth. Leadership and culture are the two most important considerations
among the conditions necessary to achieve excellence in safety. Safety policy may
or may not be regarded as being important, depending upon the worker’s perception
as to whether management commitment to and support of the policy is in fact
carried out every day. Management often writes the safety policy and then fails to
ensure that it is enforced by managers and supervisors on the job, every day.