Appendix A

Recommendations from Key Reports

This appendix compiles the main recommendations from the following reports in chronological order:

• National Commission on the BP Deepwater Horizon Offshore Oil Spill and Offshore Drilling. 2011. Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling. Report to the President. Government Printing Office, Washington, DC. https://www.govinfo.gov/app/details/GPO-OILCOMMISSION.
• Chief Counsel, National Commission on the BP Deepwater Horizon Offshore Oil Spill and Offshore Drilling. 2011. Macondo: The Gulf Oil Disaster National Commission, the General Chief Counsel’s Report, 2011. Government Printing Office, Washington, DC. https://permanent.fdlp.gov/gpo4390/C21462-407CCRforPrint0.pdf.
• NAE and NRC (National Academy of Engineering and National Research Council). 2012. Macondo Well Deepwater Horizon Blowout: Lessons for Improving Offshore Drilling Safety. The National Academies Press, Washington, DC. https://doi.org/10.17226/13273.
• TRB (Transportation Research Board). 2012. TRB Special Report 309: Evaluating the Effectiveness of Offshore Safety and Environmental Management Systems. The National Academies Press, Washington, DC. https://doi.org/10.17226/13434.
• ABS (American Bureau of Shipping). 2015. Process Safety Assessment Final Report. https://www.bsee.gov/sites/bsee.gov/files/taptechnical-assessment-program/732aa.pdf.

• CSB (Chemical Safety and Hazard Investigation Board). 2016. Investigative Report: Drilling Rig Explosion and Fire at the Macondo Well, U.S. Chemical Safety and Hazard Investigation Board, Volumes I-IV. https://www.csb.gov/macondo-blowout-and-explosion.
• NASEM (National Academies of Sciences, Engineering, and Medicine). 2016. TRB Special Report 321: Strengthening the Safety Culture of the Offshore Oil and Gas Industry. The National Academies Press, Washington, DC. https://doi.org/10.17226/23524.
• NASEM (National Academies of Sciences, Engineering, and Medicine). 2021. TRB Special Report 338: Modernizing the U.S. Offshore Oil and Gas Inspection Program for Increased Agility and Safety Vigilance. The National Academies Press, Washington, DC. https://doi.org/10.17226/26095.

Note that the numbering applied to recommendations for each report is based on what is used by the report if it used numbering. Findings of reports are included when important for understanding the report recommendations. Even though it did not make recommendations, the Chief Counsel’s report is included because of the relevance of its findings and their influence on the recommendations of the National Commission and other subsequent reports. Also note that, in several cases, findings and recommendations from reports are summarized, edited, or revised rather than quoted directly to provide greater context. For exact quotes from any report listed below, refer to the report itself.

NATIONAL COMMISSION RECOMMENDATIONS

The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling issued a 400-page report in January 2011 that contains 26 recommendations. These are summarized below, with greater detail provided on ones addressing safety, oil spill responses, and funding for the U.S. Department of the Interior (DOI) and other regulatory agencies, and less detail provided on those regarding environmental science, restoration, and compensation for damages done by the Deepwater Horizon–Macondo oil spill. The report’s first seven chapters describe the disaster and explore the causes, consequences, and history of regulating the offshore and other hazardous industries but do not make specific findings.

Improving Safety

A1. DOI should enhance its prescriptive safety and pollution-prevention regulations to be at least as rigorous as the leasing terms and regulatory requirements in peer oil-producing nations.

A2. DOI should develop a proactive, risk-based performance approach for individual facilities, similar to the “safety case” used in other nations.

A3. In concert with other regulators, DOI should identify those standards that best protect offshore workers and the environment; initiate new standards and revisions to fill gaps; and apply these standards on the Outer Continental Shelf (OCS) and globally. These efforts would include:

1. Benchmarking, with the assistance of an independent competent engineering consultant, the United States against the highest international standards in developing new and revised standards;
2. Requiring operators to justify their plans with a safety case, starting initially with rigs in 5,000 feet or more water depth;
3. Expanding safety and environmental management systems (SEMS) to include regular third-party audits every 3 to 5 years;
4. For new and transferred leases, requiring operators to participate in a new safety institute, or agree to audits, and for leases to require operator assurances of ability to contain and respond to an oil spill and pay compensatory damages;
5. Work through the National Academy of Engineering to develop criteria for high-risk wells and a methodology to assess those risks and develop in-house expertise to perform such risk assessments;
6. Establish an interagency research and development (R&D) program to develop safer systems, equipment, and practices to prevent future failures of design and equipment;
7. Develop more detailed requirements for incident and near-miss reporting and take the lead with other international regulators in developing international standards for such reporting;
8. Lead in the development of shared international standards; and
9. Provide protection for “whistleblowers” who notify authorities about lapses in safety.

A4. Congress and DOI should create an independent agency with enforcement authority within DOI to oversee all aspects of offshore drilling safety.

This agency would

1. Consolidate all aspects of safety, including giving the agency the lead over those authorized for the U.S. Coast Guard (USCG) and the U.S. Department of Transportation (DOT) (pipeline safety); and
2. Congress should consider amending existing legislation to consolidate safety-related responsibilities for this agency in a new statute.

A5. Congress and DOI should create a mechanism, including using revenues from increased leasing and inspection fees, to fund offshore regulatory authorities (DOT, USCG, National Oceanic and Atmospheric Administration) to ensure that they can carry out their duties.

Environmental Protection, Including Oil Spill Response

Recommendations offered on the topics in this section that appear to be beyond the scope of the current project are described in brackets.

B1. [This recommendation addresses revisions to strengthen the National Environmental Policy Act process in all stages of OCS planning, leasing, exploration, and development processes.]

B2. [This recommendation would reduce the environmental risks of offshore production by tasking DOI with strengthening the environmental science behind decisions about oil and gas production on the OCS.]

B3. [This recommendation asks Congress to enact legislation imposing fees on industry to fund environmental science and regulatory review by DOI and collaborating federal agencies regarding oil and gas production on the OCS.]

C1. DOI should create a rigorous, transparent, and meaningful oil spill risk analysis and planning process for the development and implementation of better oil spill risk response.

C2. EPA and the USCG should establish distinct plans and procedures for responding to a “Spill of National Significance.”

C3. EPA and the USCG should bolster state and local involvement in oil spill contingency planning and training and create a mechanism for local involvement in spill planning and response similar to the Regional Citizens’ Advisory Councils mandated by the Oil Pollution Act of 1990.

C4. Congress should provide mandatory funding for oil spill response R&D and provide incentives for private-sector R&D.

C5. [This recommendation is addressed to EPA regarding review and approval of dispersants used during oil spills.]

C6. [This recommendation is addressed to the USCG about not using offshore berms and dredged barriers in spill response.]

D1. Regarding containing spills, the National Response Team [for spills of national significance] should develop and maintain expertise in source control [that was lacking at Minerals Management Service (MMS) and USCG in 2010]. [This recommendation addresses frustrations about the inability at the time to contain the flow of oil and gas from the Macondo well.]

D2. DOI should require offshore operators to provide detailed source control plans as part of their oil spill response plans and permits to drill.

D3. The National Response Team should maintain within the federal government the expertise to obtain accurate information about flow rate or spill volume early in the national response effort.

D4. DOI should require operators seeking approval of well designs to ensure (a) that they include sensors or other tools to obtain accurate diagnostics about such items as pressures and position of blowout preventer (BOP) rams and (b) that wells are designed to mitigate risks to well integrity during post-blowout containment efforts.

[Recommendations E1-E7 address long-term restoration and compensation, and are not included here.]

F1. Congress should significantly increase the liability cap and financial responsibility requirements for offshore facilities.

F2. Congress should increase the per-incident payouts from the Oil Spill Liability Trust Fund.

F3. With regard to financial responsibility from worst-case oil spills, DOI should enhance auditing and evaluation of the risk of offshore drilling activities by operators, drillers, and service companies, and, in collaboration with other entities, engage in oversight to discourage unqualified companies from entering the market for offshore oil and gas exploration.

F4. [This recommendation asks the U.S. Department of Justice to conduct an evaluation of the compensation offered through the Gulf Coast Claims Facility, which is not directly relevant to the committee’s task.]

G1. [This recommendation addresses steps Congress should take to enhance its awareness of the risks of offshore oil and gas drilling and production.]

G2. To help ensure adequate funding for safety oversight and environmental review of offshore oil and gas drilling and production on the OCS, Congress should enact a mechanism whereby offshore companies would provide ongoing and regular funding of the agencies regulating offshore oil and gas development.

CHIEF COUNSEL, NATIONAL COMMISSION REPORT, 2011

Technical Findings

1. The root technical cause of the blowout is now clear: The cement that BP and Halliburton pumped to the bottom of the well did not seal off hydrocarbons in the formation. While we may never know for certain the exact reason why the cement failed, several factors increased the risk of cement failure at Macondo. They include the following: First, drilling complications forced engineers to plan a finesse cement job that called for, among other things, a low overall volume of cement. Second, the cement slurry itself was poorly designed; some of Halliburton’s own internal tests showed that the design was unstable, and subsequent testing by the Chief Counsel’s team raised further concerns. Third, BP’s temporary abandonment procedures—finalized only at the last minute—called for rig personnel to severely underbalance the well before installing any additional barriers to back up the cement job.

2. BP missed a key opportunity to recognize the cement failure during the negative pressure test that its well site leaders and Transocean personnel conducted on April 20. The test clearly showed that hydrocarbons were leaking into the well, but BP’s well site leaders misinterpreted the result. It appears they did so in part because they accepted a facially implausible theory suggested by certain experienced members of the Transocean rig crew. Transocean and Sperry Drilling rig personnel then missed a number of further signals that hydrocarbons had entered the well and were rising to the surface during the final hour before the blowout actually occurred. By the time they recognized that a blowout was occurring and activated the rig’s BOP, it was too late for that device to prevent an explosion. By that time, hydrocarbons had already flowed past the BOP and were rushing upward through the riser pipe to the rig floor.

Management Findings

1. The Chief Counsel’s team concluded that all of the technical failures at Macondo can be traced back to management errors by the companies

involved in the incident. BP did not fully appreciate all of the risks that Macondo presented. It did not adequately supervise the work of its contractors, who in turn did not deliver to BP all of the benefits of their expertise. BP personnel on the rig were not properly trained and supported, and all three companies failed to communicate key information to people who could have made a difference.

Among other things:

1. BP did not adequately identify or address risks created by last-minute changes to well design and procedures. BP changed its plans repeatedly and up to the very last minute, sometimes causing confusion and frustration among BP employees and rig personnel.
2. When BP did send instructions and procedures to rig personnel, it often provided inadequate detail and guidance.
3. It is common in the offshore oil industry to focus on increasing efficiency to save rig time and associated costs. But management processes must ensure that measures taken to save time and reduce costs do not adversely affect overall risk. BP’s management processes did not do so.
4. Halliburton appears to have done little to supervise the work of its key cementing personnel and does not appear to have meaningfully reviewed data that should have prompted it to redesign the Macondo cement slurry.
5. Transocean did not adequately train its employees in emergency procedures and kick detection, and did not inform them of crucial lessons learned from a similar and recent near-miss drilling incident.

2. What the men and women who worked on Macondo lacked—and what every drilling operation requires—was a culture of leadership responsibility. In remote offshore environments, individuals must take personal ownership of safety issues with a single-minded determination to ask questions and pursue advice until they are certain they get it right.

Regulatory Findings

1. The Chief Counsel’s team found that the MMS regulatory structure in place in April 2010 was inadequate to address the risks of deepwater drilling projects like Macondo. Then-existing regulations had little relevance to the technical and management problems that contributed to the blowout. Regulatory personnel did not have the training or experience to adequately evaluate the overall safety or risk of the project.

NAE AND NRC REPORT, 2012

The NAE and NRC report has an extensive set of findings and observations about the causes of the failures on the DWH that led to loss of well control, explosion, fire, 11 deaths, multiple injuries, and a massive oil spill, and has multiple recommendations to reduce the risk of future disasters. These are summarized in 7 summary findings, 6 summary observations, and 13 summary recommendations. In addition to the summary recommendations, Chapter 2 has 10 detailed findings on well design, construction, operation, cementing, and monitoring, along with 6 observations and 5 recommendations on these same topics. Chapter 3 has 21 detailed findings on the BOP, along with 2 observations and 9 recommendations for improvements in design, monitoring, and testing of BOPs and automated well shutdown and emergency riser disconnect. Chapter 4 addresses operations on the rig during the emergency with 6 findings, 4 observations, and 22 recommendations that cover instrumentation and expert system decision aides; safety system design; automatic diversion of hydrocarbons overboard; recovery of emergency power; capturing and preserving data for accident investigations; alarms and indicators; education and training; chain of command; and system safety certification. Chapter 5 addresses management issues including systems safety management; safety culture; education, training, and certification; near-miss information; R&D; and other topics. It has 1 finding, 8 observations, and 6 recommendations. Chapter 6 addresses regulatory reform with 3 observations and 26 recommendations.

Summary Findings

1. The flow of hydrocarbons that led to the blowout began when drilling mud was displaced with seawater.
2. The decision to proceed with temporary abandonment was made despite being unable to verify the integrity of the cement barrier.
3. The approach chosen for well completion failed to provide adequate margins of safety and led to multiple potential failure mechanisms.
4. Loss of well control was not noticed for 50 minutes after hydrocarbon flow; the blind shear ram failed to seal the well; and the emergency disconnect of the riser failed to separate the Deepwater Horizon from the well.
5. The BOP was neither designed nor tested for the conditions that prevailed when well recovery was attempted. The design, testing, operation,

5. and maintenance of the BOP were inconsistent with a system safety approach.
6. The magnitude of gaseous hydrocarbons and prevailing wind conditions made ignition all but inevitable.
7. The actions, policies, and procedures of the companies involved were inconsistent with a system safety approach and revealed a weak safety culture.

Summary Observations

1. Although the geologic conditions of the Macondo well posed challenges, there were alternative available processes for temporary abandonment.
2. The inability of the operator and drilling contractor to maintain adequate margins of safety were complicated by the multiple contractors engaged in the drilling process.
3. The regulatory regime was ineffective in addressing the risks of the Macondo well.
4. The training and expertise of key personnel, both in industry and among regulators, was inconsistent with the complexities of the Macondo well.
5. Neither the companies involved nor the regulator made use of real-time monitoring, incident and near-miss data, or lessons learned from similar accidents to adjust standards and practices.
6. Industry and government R&D has placed inadequate emphasis on safety.

Summary Recommendations

1. Guidelines should be developed to ensure that well design approaches address credible risks during drilling and abandonment.
2. Cemented and mechanical barriers should be adequately tested according to established procedures and subject to independent review by a credible independent authority.

3. BOP systems should be redesigned to fit the conditions in which they are to be used; testing and maintenance procedures developed; training enhanced; and all done in a system safety context.
4. Instrumentation and expert decision aides should be used to provide timely warning of loss of well control and, if warnings are not acted on in a timely manner, autonomous operation of BOP, riser disconnect, general alarm, and other safety systems should occur.
5. Industry should develop and provide timely access to well capping and containment systems.
6. The United States should develop a hybrid regulatory system with a few prescriptive regulations combined with a goal-oriented health, safety, and environmental (HSE) risk management system.
7. The Bureau of Safety and Environmental Enforcement (BSEE) and other regulators should identify and enforce safety-critical points during well construction and abandonment that warrant explicit regulatory review and approval.
8. A single federal agency should be designated with responsibility for an integrated system safety approach for offshore safety.
9. Operating companies should have ultimate responsibility and accountability for well integrity, but the drilling contractor should be responsible and accountable for the operation and safety of the offshore equipment.
10. Industry should greatly expand safety R&D across multiple topics in engineering, human factors, and management systems to instill a stronger industry safety culture.
11. BSEE and other regulators should train their personnel in system safety to support its proper implementation.
12. Industry, BSEE, and other regulators should improve corporate and industry-wide systems of incident reporting and disseminate widely the results of analysis for training and strengthened standards.
13. Industry, BSEE, and others should enhance safety culture through training, human factors principles, system safety, and continued measurement of leading indicators.

TRB REPORT ON EVALUATION OF OFFSHORE SAFETY AND ENVIRONMENTAL MANAGEMENT SYSTEMS, 2012

This 2012 report was commissioned by the MMS while it was developing the SEMS 1 rule and before BSEE, its successor, issued the SEMS 1 and SEMS 2 rules. The committee was asked to advise BSEE on how to evaluate and assess SEMS and SEMS implementation. The committee offers 15 conclusions and 8 recommendations, one of which, regarding audits, has 10 subcomponents.

Conclusions

1. To enhance safety culture, assessment of SEMS should focus on attitudes and actions rather than just documentation and paperwork.
2. The SEMS elements specified in regulation are necessary but not sufficient for creating a culture of safety. SEMS can become a compliance exercise rather than a vehicle for emphasizing and focusing on safety. For SEMS to be effective, its tenets must be adopted by entire organizations from leadership to frontline workers.
3. The operator is responsible and accountable for the implementation of SEMS.
4. To be effective, safety and environmental management must evolve and be reflected in regulators’ actions.
5. BSEE can enhance or harm SEMS effectiveness in how it measures and enforces SEMS.
6. A holistic combination of methods is necessary to assess the effectiveness and continuous improvement of an operator’s SEMS program. Both occupational and process (or system) safety need to be verified.
7. The regulator’s role should be one of developing a process of SEMS evaluation that leads to enhanced safety rather than simple compliance with BSEE-specified procedures or corrective actions.
8. The routine presence of BSEE inspectors on offshore facilities is essential for ensuring compliance with regulations and can provide indicators of SEMS compliance.

9. Inspectors need to spend enough time on facilities to observe multiple activities.
10. Audits in and of themselves are not sufficient to improve safety.
11. BSEE is responsible for ensuring that the implementation of SEMS is audited, but the primary responsibility for auditing a SEMS program rests with the operator. A truly independent internal audit is potentially more effective than a third-party audit. However, BSEE is responsible for ensuring that these audits are properly motivated and conducted.
12. BSEE is responsible for ensuring that quality audits are carried out and acted on appropriately.
13. Conducting a quality audit requires sufficient qualified personnel and time on facilities. It also requires a mechanism for qualifying auditors, an audit team with appropriate skills for the audit, and an understanding of how those carrying out their work perceive SEMS in addition to SEMS documentation.
14. The skills required to be an inspector differ from those required to be a SEMS auditor.
15. Because BSEE will have access to all information about SEMS implementation, including audits, the agency is in the best position to identify trends and best practices, and to disseminate this information.

Recommendations

1. BSEE should establish a combination of efforts: compliance inspections, audits, key performance indicators, and a whistleblower program to ensure that SEMS programs are adequate and promote a positive safety culture.
2. SEMS inspections by BSEE staff should focus on whether it is promoting a positive safety culture rather than relying on a compliance checklist.
   1. BSEE should train its inspectors to use other methods than simple checklists for assessing safety culture;
   2. BSEE should re-examine the costs and benefits of not allowing its staff to stay overnight, eat operator-provided food, or use operator-provided transportation as necessary to allow staff sufficient time and opportunity to observe and examine facilities.

3. BSEE should also consider increasing fees to operators to cover costs of inspections and audits.
4. BSEE should develop and implement a risk-based audit program.
5. The BSEE audit program should have the following characteristics: operator ownership, audit team independence, auditor training and certification, access to top management and audit reports, a defined audit frequency, and a scheme for audit quality assurance.
   1. Audits should not be pass/fail but a system of informing management of the state of their SEMS and safety culture.
   2. Operator staff should be involved in audits; and, if a third-party audit team must be used, then operator staff, excluding ones in day-to-day management, should be included.
   3. BSEE should conduct audits when triggered by inspection reports, reviews of audit reports, incidents, events, or safety culture assessments.
   4. Internal audit teams should be fully independent and separate from the day-to-day managers or staff of facilities and should report to the highest-level authority within a company.
   5. Auditors should be trained and certified by a BSEE-approved process.
   6. The Center for Offshore Safety (COS) should develop an auditor certification process, develop audit standards, and establish an audit process.
   7. BSEE should ensure that audit teams report to senior management, obtain sign-off on findings and areas of improvement, receive a copy of each audit report, and receive a report of follow-up actions taken.
   8. Rather than follow regulatory requirements of an audit every 3-5 years of 15 percent of facilities, operators should propose their own audit frequency and scope to account for facility complexity and risk, subject to BSEE approval.
   9. BSEE should audit a sample of audits on an ongoing basis to assure quality.
   10. BSEE should hire or train a sufficient number of qualified auditors.
6. BSEE should develop key performance indicators of SEMS development and implementation in concert with the best international regulators and distribute information and lessons learned to industry through a variety of methods.

7. BSEE should have an anonymous reporting system covering both operators and BSEE staff and follow up on reports with BSEE audits and inspections as appropriate.
8. BSEE should analyze its budget to ensure that it has adequate resources to implement these recommendations.

ABS REPORT TO BSEE ON PROCESS SAFETY IMPROVEMENTS, 2015

The assessment commissioned by BSEE revealed opportunities to strengthen the management system approach to preventing major process safety incidents by incorporating additional requirements or guidance within 30 CFR Part 250, Subpart S or within the American Petroleum Institute (API) Recommended Practice (RP) 75, which is incorporated by reference into the Subpart S regulation. Additional guidance and specificity on topics such as the consideration of human factors, the use of performance indicators, and the quantification of risk can reduce confusion and improve focus throughout the offshore industry.

The following set of recommendations resulted from the process safety assessment.

1. Establish a framework for reporting leading and lagging indicators.
2. Provide guidance on implementation of barrier management strategies to improve the overall barrier management approach, building on Norway’s Petroleum Safety Authority’s comprehensive guidance offered in 2013.
3. Adopt a comprehensive human factors standard, such as ASTM F1166, Standard Practice for Human Engineering Design for Marine Systems, Equipment, and Facilities, and require qualitative or quantitative human reliability analysis for each process or operation based on API 770, A Manager’s Guide to Reducing Human Errors: Improving Human Performance in the Process Industries, Section 4.
4. Incorporate components of the “as low as reasonably practicable” (ALARP) concept and risk tolerability into the SEMS regulations or API RP 75.
5. Incorporate barrier performance measurement guidance into the SEMS regulations or API RP 75. The majority of requirements from the

5. IADC mobile offshore drilling unit (MODU) HSE guidelines are covered across the various elements of the SEMS regulations, with the exception of performance measurement.
6. Establish SEMS guidance for MODU owners and contractors…. SEMS regulations do not require a MODU owner or contractor to develop a SEMS program because that responsibility resides with the leaseholder. It is recommended that BSEE consider referencing IADC guidance for drilling contractors. In lieu of incorporation by reference, given the shared jurisdiction of MODU operations, it is important that BSEE provide clear guidance for MODU contractors to ensure safe operations.
7. Incorporate the risk management framework, process, and best practices described in ISO 31000:2009 [since updated to 31000:2018] into the current risk management approach in SEMS regulation.
8. Incorporate guidance on the selection and application of risk assessment techniques…. No significant gaps were identified between Subpart S and ISO 31010 as the standard is a guidance document on various tools and techniques that can used to perform the risk assessment; however, it is recommended that Subpart S or API RP 75 take into consideration and/or reference the information available regarding the selection and application of risk assessment techniques described in ISO 31010.
9. Provide additional guidance on active barrier management, measurement, and maintenance…. SEMS provides a framework to identify the barrier, but does not provide clear guidance on how to maintain the barrier and measure its performance. Barriers become weak or degrade over time if they are not maintained. Maintenance and regular inspection required by the Mechanical Integrity element of Subpart S are good practices to ensure that barriers are maintained; however, this practice involves gaps between periodic inspections and lacks continuous oversight.

CSB REPORT, 2016

In April 2016, CSB completed its four-volume report on the Macondo Well blowout, explosion, and oil spill. The report has 57 key findings and conclusions and 15 recommendations to multiple parties covering safety issues. Please note that the wording is a summary of the CSB findings and recommendations and not quotes.

Summary of Key Findings

Blowout Preventer

• Design and operating procedures do not address compression (buckling) of drill pipe within BOP;
• Miswiring of the emergency shutdown switch on the Deepwater Horizon BOP prevented it from working as expected; and
• Failures such as those in the Deepwater Horizon BOP would not be detected in the enhanced BOP testing implemented following Macondo.

Human and Organizational Factors

• Multiple human decisions were needed to close a BOP manually before well pressures overwhelmed BOP design capability.
• No effective testing or monitoring of the redundant systems for BOP emergency shutdown switch existed on the Deepwater Horizon.
• Size of the drill pipe used on the Deepwater Horizon on almost all days exceeded the BOP blind shear ram design capability.
• Miswiring of the emergency shutdown switch could not have passed manufacturer’s factory acceptance testing procedures.
• Preset of the diverter to the mud-gas separator (MGS) rather than overboard (the MGS would have been overwhelmed in any case) and crew decision to close diverter caused multiple eruptions of gas on the rig.
• At present, early-stage gas-in-riser situations may be undetectable and quickly become unmanageable, indicating the need for improved kick detection capability.
• Technical competence has to be supplemented with nontechnical skills to manage complex, imperfect systems.
• Neither BP nor Transocean bridged the gap between work as imagined and work as done in the temporary abandonment process through steps such as written work plans or safety-critical procedures, and Transocean did not follow its own policies to meaningfully engage its workforce in identifying effective barriers.
• Safety indicator programs continue to focus mostly on personal safety and underemphasize process safety.
• Complexities of multiparty risk management led to inadequately defined safety roles, and both BP and Transocean failed to implement their own policies and capabilities to manage risk on the Deepwater Horizon.

• At the time of Macondo, BP did not have an independent board member with adequate expertise in drilling complex wells such as Macondo.
• Few specific elements of companies’ HSE operations are required to be disclosed in U.S. law or regulation.
• BSEE issued a safety culture policy statement post-Macondo, but did not identify the role of boards of directors in establishing a strong safety culture and did not require companies to assess their cultures or follow up with corrective actions.

Regulatory Factors

• Missing or inadequate regulatory attributes post-Macondo included:
  • continual effort to reduce risk to ALARP or similar risk-reduction target;
  • regulatory adaptability to drive industry to continual improvement;
  • allocation of safety responsibility to those that create or control major risks;
  • required written accident safety documentation by duty holders;
  • active workforce participation supported by regulator or regulation;
  • proactive regulatory assessment, verification, and intervention;
  • collection and use of process safety indicators;
  • regulatory transparency; or
  • independent, qualified, and adequately funded regulator.
• SEMS rules post-Macondo do not include advancements in process safety over the past 20 years. The rules:
  • specify activities but not setting of specific goals and risk reduction steps to reach them;
  • require causal assessments of incidents but focus on immediate causes rather than safety management system or organizational factors; and
  • do not require that corrective action plans reduce risk to ALARP.
• Offshore regulations do not require operators or drilling contractors to
  • implement barriers and management systems to reduce risk to ALARP;
  • document efforts to effectively control hazards or demonstrate use of best practice in process safety;

• • identify and manage all safety-critical tasks through defined process standards;
  • demonstrate and verify the role of human factors in risk reduction in designing, planning, and executing critical well operations; or
  • complete assurance and verification activities to affirm appropriateness and effectiveness of SEMS and barriers relied on throughout safety-critical operations.
• API’s RP 75 [as of 2016], which the SEMS rule incorporates by reference, lacks sufficient guidance on
  • human factors requirements for avoiding major accidents and investigation of accidents and near misses;
  • incorporation of hierarchy of control principle for identifying, establishing, and implementing barriers to avoid major accidents;
  • roles of corporate governance and boards of directors in major accident risk management;
  • workforce involvement and engagement in all aspects of SEMS;
  • leading and lagging indicators of process safety;
  • expanded and defined roles for managing against major accident risks between operators and contractors and ones best capable of SEMS implementation and oversight; and
  • incorporation of reducing risk to ALARP in all elements of SEMS.
• There is a dearth of U.S. guidance on improving human performance in safety-critical situations.
• “Best available and safest technology” (BAST) requirement in BSEE authorization is viewed as compliance with existing regulation and BSEE has a high regulatory hurdle in demonstrating that more stringent regulation would be cost beneficial.
• Acceptance of documentation that duty holder is managing risk to ALARP level is not required before work begins.
• BSEE’s ability to require contractors to meet same regulatory requirements as operators is ambiguous.
• BSEE regulations do not hold contractors as liable to the management of risk within their control, which contradicts a basic principle of high-risk industry safety management.
• Worker engagement in safety management in SEMS does not cover contractors that represent the majority of the workforce, over-relies on stop-work authority, lacks worker protection from retaliation, and other shortcomings.
• BSEE neither has nor tracks SEMS indicators.

• BSEE collects safety statistics, but does not use them to drive industry performance.
• Many companies have implemented SEMS but are not using it to manage their HSE risks.
• BSEE is not using its own authority to inspect company implementation of SEMS but is, instead, relying on third parties. Without its own SEMS verification process, BSEE is giving up an important safety oversight tool.
• Unlike in other countries, U.S. operators and drilling contractors are not required to make public their safety-related documentation or statistics.
• Several issues impinge on BSEE’s capabilities to be an effective regulator: technical expertise, overall staffing, ability to compete in salary with private industry, retirement eligibility of a large share of its workforce, and sufficient and reliable funding. In other parts of the world, a fee-for-service model has resulted in a reliable funding stream.
• Reorganization of BSEE within DOI does not give it sufficient independence, and DOI retains internal conflicts between revenue generation through leasing and safety and environmental protection.

Summary of Key Recommendations

1. BSEE/DOI should revise BSEE regulation to ensure management of all safety-critical elements (SCEs) [physical and organizational barriers] by all responsible parties, including contractors, to reduce risk to ALARP level, including, at a minimum, identification, monitoring, documentation, independent verification, corrective action plans, and development of process safety indicators for SCEs.
2. BSEE should develop and publish guidance to responsible parties for the identification and management of SCEs as described in Recommendation 1 to ALARP level.
3. API should publish an offshore safety standard for SCE identification and management with goal of reaching ALARP level of safety.
4. API should publish a revised standard for BOPs to add requirements for testing to verify reliability of redundant BOP systems for shutting down wells.
5. API should revise RP 75 to expand SEMS responsibilities beyond just the operator; include explicit and expanded responsibilities for human

5. factors, corporate governance, workforce involvement, contractor oversight, key performance indicators, and incorporation of principles of (a) risk reduction to ALARP and (b) hierarchy of controls for identifying, establishing, and implementing barriers.
6. DOI should develop guidance to assist industry in incorporation of human factors principles in systematic analysis of major accident hazards, development of SEMS programs, and preparation of major hazard report documentation.
7. DOI should develop guidance on roles and responsibilities of boards of directors and executives for major accident prevention, including how boards and executives can best communicate major accident safety risks to their shareholders and use corporate-level strategies to effectively manage those risks.
8. DOI should establish a process safety culture improvement program that periodically administers process safety culture assessments and implements identified major accident prevention programs.
9. The Sustainability Accounting Standards Board should update, revise, and strengthen its provisional Oil and Gas Exploration and Production Sustainability Accounting Standard to recommend disclosure of leading and lagging indicators and adding indicators of safety barriers to be communicated to the workforce and investors and distinguish between personal safety and process safety, the latter of which being a better predictor of major accidents.
10. The Ocean Energy Safety Institute should conduct further study of and understanding of the gas-in-riser hazard.
11. DOI should revise its offshore safety regulations, including SEMS, to establish a framework with a specific goal of reducing risk of major accidents to ALARP level. Included would be clear and consistent responsibilities by companies having primary control over hazardous activities; documentation of efforts to reduce risk to ALARP level, including identification of major hazards and barriers, use of the hierarchy-of-control principle, identification of safety critical elements, use of quantitative and qualitative methods to determine that barriers and management systems reach ALARP level of risk; and identify all U.S. and global standards to be used in risk management and justification for use of alternatives. These regulations should require responsible parties to fully implement all documented practices and to verify that they are used throughout the life cycle of the operation and facility.

12. DOI should (a) strengthen oversight by BSEE to ensure review of documentation recommended in CSB Recommendation 11 (above) by qualified personnel who have capability and authority to require modification either before work begins or while under way and (b) establish a program for preventive, comprehensive inspections by technically qualified staff to ensure that responsible parties can demonstrate risk reduction commitments made in their major hazards reports.
13. DOI should further enhance the qualifications, technical competency across a range of disciplines and skills, and diversity of BSEE staff through enhanced recruitment, retention, compensation, and training. The Secretary should seek the funding and authorities from Congress, as needed, to achieve these goals.
14. DOI should improve its regulatory reporting program to drive continual improvement by industry through a program that collects, tracks, and analyzes safety performance indicators and
    • Requires responsible parties to report safety indicator data;
    • Emphasizes process safety leading indicators for prevention of major accidents;
    • Uses incident data to identify safety-specific trends, set performance goals, communicate to the public those trends, and allocate BSEE resources accordingly; and
    • Uses lagging indicators in decision-making processes for leasing and permits to drill.
15. DOI should strengthen worker engagement in safety management by issuing participation regulations and training requirements for workers that include:
    • Worker-elected representatives to safety committees for each staffed offshore facility, with the authority to stop work if unsafe and seek regulatory intervention in unresolved disputes;
    • Holding an annual tripartite forum involving workforce representatives, management, and regulator to advance initiatives for major accident reduction; and
    • Worker protections and redress from retaliation, including reporting of unsafe working conditions, near misses, and use of stop-work authority.
16. DOI should incorporate by reference revisions to API RP 75 that incorporate Recommendation 11 above.

TRB SPECIAL REPORT 321 ON OFFSHORE INDUSTRY SAFETY CULTURE, NASEM (2016)

This report provides a framework for understanding and strengthening the safety culture of the offshore oil and gas industry. It has 17 summary recommendations based on findings and recommendations in individual chapters addressing the definition and characteristics of safety culture (5 findings and 1 recommendation); history of offshore safety efforts (4 findings); offshore safety regulation (10 recommendations); safety culture assessment and measurement (12 recommendations); and implementing change in offshore safety culture (7 recommendations).

Summary Recommendations

1. Offshore industry and regulators should adopt the BSEE definition of safety culture and its essential elements as a guide for assessment and practice.
2. Industry leaders should encourage collective and collaborative action to affect change in the fragmented offshore industry.
3. The offshore industry should define the optimal mix of regulation and voluntary action needed to foster a strong safety culture throughout the offshore industry.
4. Industry as a whole should create additional guidance for establishing safety culture expectations and responsibilities among operators, contractors, and subcontractors. Regulators should assist in these efforts and ensure consistency.
5. The offshore industry should implement the recommendation of the National Commission to create an independent institution solely devoted to safety. COS, though a good beginning, remains organized within API. Industry membership in and support of COS should be a fitness-to-operate criterion for all offshore companies operating on the OCS.
6. API’s RP 75 committee should incorporate safety culture and add a chapter on this subject in the ongoing revision of this standard.
7. Operators and contractors should assess their safety cultures on an ongoing basis as part of their SEMS programs.

8. Companies should use multiple assessment methods, including leading and lagging indicators and quantitative and qualitative indicators of safety culture.
9. Offshore companies should determine whether to rely on internal or external expertise in safety culture assessment but should, in any case, acquire internal expertise in safety culture assessment and incorporation of their results.
10. Company senior leadership should commit to and be engaged in the long and uncertain safety culture journey.
11. Regulators should make greater use of risk principles in determining inspection frequencies and methods; shift from compliance to SEMS inspections; and incorporate SEMS audit results in scheduling and conducting inspections.
12. Regulators, with assistance from industry, should define the critical factors necessary for understanding the precursors to accidents, data that should be submitted by industry, and mechanisms for regular data collection.
13. Regulators should make public all accident, incident, inspection results, and reports of near misses while taking into account necessary confidentiality protections.
14. The Secretary of DOI and the Commandant of the Coast Guard should seek prominent leaders of the offshore industry to champion the nine characteristics of safety culture in BSEE’s definition and facilitate information exchange and experience in strengthening safety culture.
15. The three offshore regulators should develop a memorandum of understanding regarding the safety culture concepts and implementation of plans regarding safety culture and responsibilities and accountabilities for doing so among them.
16. Offshore regulators should enhance their safety culture assessment capabilities through appropriate hiring, training, and reliance on third parties and assist companies in their safety culture assessments.
17. The offshore industry should work collectively on enhancing safety culture. BSEE should support this activity by serving as a clearinghouse for, and facilitator of, lessons learned and benchmarking.

TRB SPECIAL REPORT 338 ON BSEE INSPECTIONS PROGRAM, NASEM (2021)

Findings

1. To meet an expectation to visit approximately 1,700 to 1,800 facilities per year, BSEE emphasizes inspection speed accomplished with a “checklist-like” process for verifying that individual components and equipment are in regulatory compliance. Inspectors often have limited time to observe operations at the system level or to engage with facility personnel for the purpose of learning about and improving safety processes and assessing the safety culture of the operator. This emphasis also limits BSEE’s ability to carry out more thorough and more targeted inspections of activities and facilities that are identified as presenting higher occupational and process safety risks.
2. BSEE needs to improve the consistency, timeliness, and completeness of its Incidents of Noncompliance (INCs) records, incident reports, and other databases (possibly including data gleaned from SEMS audits) to improve the efficiency and effectiveness of traditional inspections and SEMS oversight functions. Opportunities for the latter include determining what new and different data could yield more value and be more analyzable to inform better safety management practices by offshore operators.
3. BSEE’s inspection program remains centered on physical components and equipment and on identifying and seeking to correct the proximate causes of noncompliance and equipment failures. Insufficient attention is given to human-systems integration and the role of human factors and organizational systems in ensuring safe operations, implementing SEMS programs, and developing a safety culture.
4. Developments in technology such as remote real-time monitoring are providing many new opportunities for BSEE to enhance and improve the effectiveness and efficiency of its inspection program. BSEE, however, has limited ability to capitalize on them, in part because it lacks the personnel having the requisite technical expertise and industry backgrounds to build on technological advances.
5. Numerous factors, including some that BSEE has little control over, hinder the agency’s ability to adapt to a changing offshore industry. However, BSEE must adapt or risk becoming an outmoded and less effectual safety regulator.

Recommendations

1. BSEE should ensure that its inspections are focused on avoiding workplace safety incidents and catastrophic events, supported by a sophisticated and continually refined and validated risk modeling capability for effective, outcome-oriented targeting of inspection resources.
2. BSEE should invest in more advanced and creative data collection, analytic and visualization tools, and infrastructure; corresponding data management, analysis, and evaluation capabilities among its personnel; and an outward-facing, online data system that can be navigated with ease and kept current across all fields for the purpose of encouraging and facilitating safety analyses.
3. BSEE should reposition and reshape its inspection and SEMS audit and oversight programs so that they work in concert to improve regulatory compliance; strengthen safety management planning, execution, and effectiveness; and exhort, support, and sustain the conscious efforts of operators to build and maintain a strong safety culture.
4. BSEE should articulate a vision for how advances in offshore technology can be leveraged to fulfill its safety oversight and inspection functions. BSEE should collaborate with industry on the expertise and management processes that will be required to pilot and then implement new strategies that make effective use of technological advancements. Consideration should be given to how the BAST process can be used to encourage the development and introduction of technologies that can improve offshore oil and gas safety and environmental management and performance while also providing BSEE with the capabilities needed to fulfill its safety oversight and inspection functions.
5. BSEE should give priority to increasing its organizational agility to keep pace with the fast-evolving offshore oil and gas industry. An important starting point will be for BSEE to develop and institute an internal management system, similar to that of the U.S. Coast Guard, that establishes agency-level priorities and that guides and supports the full complement of needed adjustments in resources and personnel competencies and deployments to further those priorities—for example, by ensuring that its districts and associated inspector workloads and distances traveled reflect the location of offshore facilities and their risk profiles and by making timely corrections and adjustments when they do not. BSEE must overcome the mindset that traditional approaches should be preserved in the face of

1. change—such as the judicious use of third-party inspections to augment its program, the use of technology to supplement and substitute for some onsite inspections, and the creative makeup and deployments of ad hoc inspector teams.