Summary

The Macondo well Deepwater Horizon blowout, explosion, and oil spill of 2010 was the nation’s worst offshore disaster, resulting in 11 deaths, 17 serious injuries, and spillage of 5 million barrels¹ of oil in the Gulf of Mexico. In the immediate aftermath of Macondo, national and media attention focused on failures of technology, specifically the blowout preventer, but all multiple independent studies of why the disaster occurred focused on failures or inadequacies of management, organization, and regulation. Consistent with its Statement of Task (SOT), this report focuses on systemic risk management in U.S. offshore oil and gas operations in order to help avoid future catastrophes. The committee defines systemic risk as the overall risk of catastrophic failure associated with the entire system. Thus, it includes design, operations, and regulation throughout the life cycle of offshore oil and gas facilities.

In response to the individual elements of its SOT, this report addresses

• The extent to which recommended reforms following the Macondo incident have been adopted,
• Changes in the offshore industry systemic risk profile over time,
• Critical gaps in systemic risk management,
• The extent to which the U.S. regulatory structure motivates or incentivizes reductions in systemic risk, and
• The role that the Gulf Research Program (GRP) has played and can play in understanding and reducing systemic risks.

___________________

¹ One barrel is equal to 42 U.S. gallons.

ENACTMENT OF RECOMMENDED REFORMS

Important regulatory reforms targeting systemic risk management adopted since 2010 include (a) a reconstituted regulator, the Bureau of Safety and Environmental Enforcement (BSEE), with a singular focus on safety; and (b) mandated safety and environmental management systems (SEMS) intended to avoid repeating the organizational and management lapses that led to Macondo. Also adopted were regulations targeting technology such as tightened regulations for well control and production safety systems. Industry also created the Center for Offshore Safety (COS), which focuses on SEMS implementation. Companies representing two-thirds of offshore production are now actively participating by sharing safety data and shifting management focus in response to concerns raised. Industry has also invested billions of dollars on well-capping capabilities that did not previously exist and updated more than 250 safety-related standards. Although these investments have only recently begun to bear fruit, industry and government have collaborated on improved near-miss and other safety indicator data collection and sharing designed to inform decision making about systemic risk management, with companies representing more than 90 percent of production now participating in the voluntary aspects of SafeOCS. SafeOCS is a BSEE-funded neutral third party that collects and reports data that operators share voluntarily on incidents associated with their operations as well as data they are required to report on performance of blowout preventers and subsea production safety systems.

Some recommended reforms have not materialized as documented in Chapter 2. Congress has not acted on recommendations to fund safety and environmental regulators from royalties and fees imposed on the offshore oil and gas industry, although it has increased BSEE’s funding. Recommendations that the offshore industry make a collective effort to enhance a culture that supports safety have not been implemented. These recommendations target the core values of organizations to ensure that they are motivated to engage in systemic risk management. Recommendations to adopt the safety-case approach used in the North Sea, Canada, and Australia have not been acted on, although the United States has long relied on a similar process for deepwater operations plans. The safety-case approach deliberately and proactively assigns systemic risk management to the sources of risk. BSEE chose to require SEMS instead, but elements of the safety case have long existed within the U.S. offshore regulatory scheme and could be expanded. Recommendations that SEMS incorporate the specific goal of reducing risk as low as reasonably practicable (ALARP) have not been adopted, but ALARP-like language was added to well control regulation in 2016 and could be extended to SEMS. Additional discussion of recommended reforms and response to them is provided in Chapter 2.

SYSTEMIC RISK PROFILE

Concerns have been expressed in the past, including by the National Oil Spill Commission in its report to the President about Macondo, about systemic risk in offshore oil and gas operations. These have generally been broad statements about the existence of systemic risk and concerns that it was not being adequately addressed by the offshore industry and regulators. The work presented here is unique in its attempt to deconstruct systemic risk, a concept that by definition includes all aspects of offshore operations, into its component parts so that these individual risk elements could be analyzed over time. As described in Chapter 4, the committee conducts this analysis in the context of the maturity of industry and regulatory actions to address systemic risk. The committee’s judgment about progress in managing systemic risk provides its best estimate of the systemic risk profile of offshore oil and gas operations.

Despite improvements in data collection and sharing, the lack of trend data related to systemic risk precluded the committee from making quantitative estimates of the industry’s current or past systemic risk profile. It therefore used its judgment and experience in the offshore industry and other safety-critical industries, as well as the briefings it received and review of the related literature, to develop qualitative estimates.

The committee categorized systemic risk management into five areas of risk control: a culture that supports safety, human resources, human-systems integration, hardware and design, and regulatory environment. These systemic risk controls are interrelated and, collectively, represent the status of systemic risk management. These risk control areas are then further decomposed into 15 risk elements, as described in Chapter 4.

The committee assessed the risk elements using a five-level scale based on a maturity model concept, which focuses on how well organizations are managing the hazards they face in drilling and producing hydrocarbons. This scale can be simplified using level 5 as most mature and level 1 as least mature. The most mature assessment is one of continuous improvement and continual risk reduction over time. Importantly, since society’s expectations of safety are constantly rising, companies that are mature today, but stop improving, may not be assessed at the same level in the future. Moreover, it should be expected that public and private organizations, and even individual segments within them, will be at different stages of maturity at any given point in time. Fundamentally important is whether industry and regulatory systemic risk management is progressing up the maturity scale in a consolidated fashion across the 15 risk elements.

The committee’s consensus assessments for the present time and for the Macondo period are discussed in Chapter 4. For many of these determinations, the committee recognized that the heterogeneity of the industry makes it difficult to apply a single assessment to some risk elements.

The committee’s appraisals of risk element maturity indicate that most of industry is approaching the middle stage of maturity in systemic risk management across most risk elements and shows considerable improvement over time. These assessments do not allow themselves to be aggregated as one would with a numerical scale. Thus, the reader is referred to Chapter 4 for the detailed explanations of the meaning of the individual risk element assessments and how the committee arrived at them.

Improvements in offshore oil and gas maturity since Macondo are attributable to industry-wide SEMS implementation, heightened requirements for well control and production safety systems, improved industry data collection and sharing of near-miss and other safety indicators, proactive responses to emerging results from the data, improved industry training in well control, and application of risk-based inspections by BSEE. These and other actions described in Chapters 2 to 4 represent real improvement by both industry and BSEE in systemic risk management.

CRITICAL GAPS

Although offshore systemic risk management is improving, the committee has the following concerns:

• A visible, industry-wide, industry-led commitment to a culture that supports safety is lacking.
• Industry data on process safety indicators from COS and SafeOCS, though improving in terms of reporting and sharing of data on leading indicators, do not yet provide sufficient trends with which to gauge industry progress. Lagging indicators based on fires and loss of containment that are collected from industry by BSEE are generally low, but also show considerable year-to-year variance and lack discernable trends.
• Participation in the voluntary aspects of SafeOCS and in COS falls short of including the entire industry.
• Recommended Practice 75 and SEMS regulations based on it lack guidance on (a) contingent barrier management that depends on human judgment and intervention, and (b) application of human factors standards to safety-critical procedures.
• SEMS, and industry generally, lack specific requirements and standards for education, training, and demonstrations of competence for those in safety-critical positions.
• Operators are required to submit corrective action plans (CAPs) to BSEE in response to audit deficiencies, but the CAPs are not required to examine and address the root causes of the deficiencies.
• Although 80 percent or more of the work offshore is being carried out by contractors, contractors cannot be required by BSEE to

• follow SEMS regulations since BSEE’s authority is limited to leaseholders (operators). BSEE does hold operators fully responsible for safety offshore, as appropriate, and SEMS regulations require operators to ensure that their contractors’ employees can carry out their work safely. In contrast to U.S. offshore regulation, North Sea offshore regulators are able to regulate contractors directly and require that they follow SEMS as part of their safety case. The operator–contractor interface that failed at Macondo remains a concern for the U.S. offshore industry.
• Relatively little progress has occurred in developing and implementing remote real-time monitoring, automation, and the use of operational data specifically to reduce systemic risk through better safety information, management, and decision making.
• Best practices in the development and use of procedures, checklists, and job safety analyses to enhance performance, situation awareness, and engagement during operations, as used in aviation and other safety-critical industries, have received less attention.

REGULATORY INCENTIVES

SEMS regulations and the general duty provisions of existing legislation provide industry with the flexibility to define the hazards of the circumstances in which they are operating and to develop and manage appropriate safety controls. The many prescriptive regulations that exist have not constrained industry from being highly innovative in the development and application of technology for exploration and production in deepwater. These prescriptive regulations, however, do not provide incentives for companies to adopt process and other changes to manage risk beyond minimal requirements. Moreover, the different types of regulations and legal provisions that apply offshore can work at cross-purposes and inhibit safety. The legal liability that industry faces for infractions, for example, makes companies wary about sharing data, despite the many data protections available to companies that voluntarily share data with SafeOCS. Thus, improvements in data sharing, such as through SafeOCS, have taken more than a decade to begin publishing consistently defined aggregated indicators. In addition, BSEE’s policing role in applying prescriptive inspections and fines, while consistent with regulations designed to deter serious infractions by others, can create an antagonistic relationship that makes it difficult for industry and BSEE to work collaboratively in improving SEMS implementation.

ROLE OF THE GULF RESEARCH PROGRAM

GRP activities have general relevance to advancing knowledge about and management of systemic risks in the offshore oil and gas industry, but the

committee is not in a position to assess the impacts of GRP’s activities or whether they have contributed to a better understanding and reduction of the systemic risks in the offshore oil and gas industry. The committee supports the ongoing effort by GRP to estimate the impact of its activities itself.

There are some best practices inherent in GRP activities that can be used as a model for the future, especially those that ensure that the offshore oil and gas industry and other stakeholders, in addition to the already engaged academic community, are appropriately engaged throughout the process for specific activities.

The critical gaps listed above derive directly from the committee’s conclusions as given in the individual chapters of this report and summarized in Chapter 8. The committee sees potential value for GRP to consider its role in addressing these critical gaps, as well as the other topics given in Chapter 6, through funded research and GRP’s convening capabilities.

THE ENERGY TRANSITION AND THE FUTURE

The energy transition and new offshore energy systems as well as other new activities in the offshore will not need new processes and tools to systemically manage risk. The framework that the committee has developed can be applied to help avoid catastrophic failures associated with future activities in the offshore. As described in Chapter 7, these could include carbon dioxide sequestration, hydrogen production and transportation, and the addition of offshore wind farms and solar arrays, which add to an already crowded offshore in the Gulf of Mexico. Continued improvements in managing systemic risk will depend on effective and continuous implementation and use of existing processes including monitoring, learning, and improving.

The key challenge for operators and regulators going forward in the transition is to have a solid unified transition strategy that creates and sustains collaboration and cooperation among the much-expanded mix of companies and contractors and new technologies that are creating this transition in the common U.S. offshore space.

The chapters that follow address the committee’s SOT in greater detail. Conclusions are provided at the end of each chapter and are summarized again in Chapter 8.