Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
Page 1 of 6
USE OF THE RISK ASSESSMENT MATRIX WITHIN THE HEMP PROCESS
1.0
Introduction:
Within the Shell Group HSSE Control Framework HSSE MS Manual, the " Managing Risk" manual
and guidance provides specific HEMP requirements to manage HSSE Risks in assets, facilities,
operations, projects and activities where the Shell HSSE Control Framework applies.
Shell HSSE Control Framework
As specified in this manual, each Shell business must identify the hazards present in their business or
at their site, where and how those hazards can be released, determine whether those release scenarios
are credible and then assess the risks of the worst consequences of those hazard release scenarios.
They must then prepare the Hazard and Effects Register, ensure that the appropriate level of Hazard
Analyses is conducted (Controls and Recovery Measures) for identified Red and Yellow risks and
then demonstrate that these are managed to ALARP. In this set of guidelines we specifically cover
the suggested methodology for completing steps 3 & 4 of the DS HEMP procedure in the DS CoB's
in order to meet the requirements of the HSSE Control Framework "Managing Risk" manual.
The purpose of this guidance is to provide information on how the "Risk Assessment" steps of the
Hazard and Effects Management Process should be applied in the analysis and management of
HSSE Hazards (Health, Environment, Personal and Process Safety). This guidance defines the
suggested approach for Downstream Classes of Business under Shell’s operational control to
conduct and document a hazard identification (HAZID) review within the HEMP process as
outlined in the DS HSSE HEMP Procedure.
Appendix 1 contains information on applicable tools as well as a RAM awareness briefing pack.
More information is available on the DS Hazards and Effects Management Website at the following
link.
DS HEMP and Process Safety Website
1.1
What is HEMP?
HEMP is a systematic hazard analysis process used by Shell companies to identify the hazards
present in our business or operations, assess the risk of their release and identify the controls and
recovery measures that need to be in place to manage that hazard. The HEMP analysis ultimately
identifies HSE critical activities and business processes that enable effective management of these
control and recovery measures and to identify the job function or functions that are responsible for
these control and recovery measures. Downstream CoB's must be able to demonstrate and
document that they have applied the HEMP process to assess and manage their hazard control and
recovery barriers for red and yellow risks to ALARP.
June, 2010, Ver 5.2
Page 1
Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
2.0
Page 2 of 6
STEP 3 - Identification of Consequences and Assessment of Risks
2.1
The Shell Risk Assessment Matrix is used across the Shell Group for risk assessment of
HSSE hazards in our businesses. An update to the yellow guide was released in March 2006 in order
to further clarify the proper use of the RAM. This has been further refined by the current HSSE
Control Framework project to the current four-colour version depicted below.
The RAM is used in the following applications in Shell:
2.2
•
•
•
HEMP (documented demonstration of control to ALARP, decision making and projects,
workplace hazard control, health risk assessment, environmental impact assessment)
Incident Classification and Investigation
Audit Finding Classification
For ALL Shell businesses, the RAM will be used within the Hazards and Effects Management
Process. The majority of these users will use the RAM specifically for Workplace and Process
Hazard Control as well as incident management and reporting..
2.3
The Risk Assessment Matrix (RAM) is used to identify the risk surrounding a hazard release
scenario that is credible to that CoB or site and the worst credible consequence(s) associated with
that credible release scenario. The RAM is a qualitative risk assessment tool developed by Shell. Its
purpose is to identify the risk potential (unmitigated) associated with the consequences of a particular
hazard release scenario in order to understand what level of control and recovery analysis is
required to manage the risk of the release of that hazard to ALARP.
Figure 2
The Shell Risk Assessment Matrix (2010 - HSE Control Framework)
INCREASING LIKELIHOOD
Reputation
Environment
Assets
People
SEVERITY
CONSEQUENCES
No injury or
health
effect
No
damage
No effect
0
No
impact
1
Slight injury
or health
effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury
or health
effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury
or health
effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up
to 3
fatalities
Major
damage
Major
effect
Major
impact
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
5
June, 2010, Ver 5.2
A
B
C
D
Never
heard of in
the Industry
Heard of in
the Industry
Has
happened in
the
Organisation
or more than
once per
year in the
Industry
Has
happened at
the Location
or more than
once per
year in the
Organisation
E
Has
happened
more than
once per
year at the
Location
Page 2
Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
Page 3 of 6
There are four steps in using the Risk Assessment Matrix:
1. Identify potential consequences. Consider all the worst credible consequences arising from
credible hazard release scenarios.
2. Estimate the severity (worst credible) of each potential Consequence. Consider the impact
on people, assets, environment and reputation and rate the severity of each from 1 – 5
(worst).
3. Estimate the likelihood of the potential consequence. The likelihood determination is based
on the historical data of real incidents. Consider historical experience at the location, in the
CoB, in Shell, or in the industry as defined below.
4. Estimate the Risk Rating. Using the RAM, link the severity and the likelihood to rest on a
location on the matrix (e.g. People 4B, Assets 3C).
Figure 3
Using the Shell Risk Assessment Matrix
STEP BY STEP OF USE OF THE RAM
IDENTIFY HAZARD
1
IDENTIFY POTENTIAL CONSEQUENCES (from
credible hazard release scenarios)
2
ESTIMATE SEVERITY OF EACH POTENTIAL
CONSEQUENCE (Worst Credible)
(People, Assets, Environment, Reputation)
3
ESTIMATE LIKELIHOOD OF POTENTIAL
CONSEQUENCE (past experience)
4
ESTIMATE THE RISK RATING
2.4
Guidance on Likelihood Definitions for Downstream: The Shell Control Framework
defines the terms Industry, Organisation and Location in the Control Framework Glossary. It further
states that Shell Businesses will provide detailed guidance on the application of these terms to their
organisations. They should update the guidance as the organisation changes.
For our downstream business, the guidance is this (this is the way that E&P manages this as well):
• Industry means the Petrochemical industry with the exceptions as defined in the CF (i.e. for
broad cross industry non hydrocarbon hazards such as Electrical, working at heights etc.)
• Organization means the DS Class of business (this fits in the definition above... 5-10 times
smaller than the group business)
• Location is the operating site (Distribution, Manufacturing) or the sub business or region in the
case of small CoB's (i.e in B2B, the organization is B2B, the sub business is the location (i.e
Aviation, Marine etc.). In Retail, the organization is Retail business; the locations are the regions
where retail operates in its global business. In Supply and Distribution, the Organization is S&D
June, 2010, Ver 5.2
Page 3
Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
Page 4 of 6
and the locations are the supply regions in the global business (in the case of Supply) or the
specific terminals or pipeline systems in those regions (in the case of Distribution).
2.5
Rules for Use and Application of the RAM:
• Hazard Release Scenarios which generate the consequences must be credible to the CoB or
site
• The RAM is to be used as a screening tool to identify the level of further investigation
required to demonstrate ALARP.
• The RAM gives an assessment of risk potential. No mitigating factors are assumed when
using the RAM. The RAM considers the worst credible consequence. The RAM cannot be
used to give a measure of residual risk once controls have been put in place. Other tools need
to be used to determine residual risk (i.e. Quantitative Risk Assessment - QRA; Layer of
Protection Analysis - LOPA; specifically designed residual risk matrix)
• Likelihood on the RAM is historical and is based on what has happened in the past at the
location (gas plant, refinery), in the organisation (CoB) or in the industry (petrochemical
industry, other Shell Group companies)
• The likelihood must be linked to a worst credible consequence – i.e if the scenario is a tanker
vehicle accident resulting in a loss of containment, fire and multiple fatalities, the likelihood
must correspond to the worst credible consequence (fire leading to multiple fatalities) and
can not be taken as the frequency in the past of tanker vehicle accidents.
• A numerical likelihood is NEVER acceptable on the RAM. The RAM is qualitative and
numbers have no place on the RAM. If the investigation requires probability calculations,
and a Risk Matrix tool is required, there are other risk matrices or tools suitable for that more
detailed analysis.
• RAM is not a criterion for tolerability. For example:
o The red area does not mean risks are intolerable
o The yellow area does not mean risks are tolerable
o The dark blue area does not mean do nothing; you must have a working HSSE
Management System as specified by the HSSE Control framework requirements.
o The light blue area are typically very low priority but it is still assumed that these are
managed within the HSSE MS.
RAM exceptions
• For incident classification and investigation, the actual Rating is obtained for classification
purposes and the potential RAM rating is obtained to identify the level of investigation.
• For chronic health effects, the top event is not exposure to the hazard but, rather, exposure
to concentrations of the hazard above the OEL for that material (occupational exposure
level).
3.0
Step 4 - Identification of Red and Yellow Risks
Based on the RAM assessment, red risks are classed as those with an identified risk potential in the
red areas of the RAM. Similarly, RAM 5 Yellows are those risks sitting in the 5A or 5B box on the
RAM. For these, a detailed BowTie analysis and ALARP assessment must be completed to ensure
that risks associated with them are tolerable and ALARP. A control analysis and determination of
ALARP must also be carried out for all of the other identified yellow risks as well and appropriately
documented in the Hazard and Effects register or on a specific Hazard Control Sheet. Blue risks
(both colours) are assumed to be at ALARP, if the facility or business has a properly functioning
June, 2010, Ver 5.2
Page 4
Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
Page 5 of 6
HSSE MS meeting the requirements of the HSSE Control Framework (as assessed by external audit).
The following diagram (Figure 4) portrays these requirements. More information on the required
analysis protocols can be found on the following link
Link to DS HSSE Hazard Control and Recovery Analysis Guidance
Figure 4 - Hazard Analysis Criteria Based on Risk Potential
Identification Of Hazards, Threats,
Top Event, Consequences And Assessment Of Risks to Determine
Red and Yellow Risks
•
Site discretion for other yellow risks (i.e.
People, Asset, Environment or Reputation) to
apply one of the following
– Shell Engineering Standards (DEP’s,
DEM’s*), Vetted Shell, Industry or
Government Technical Standards
(covering Threats to Consequence
controls);
– Hazard Control Sheets with ALARP
discussion and documentation
– Model or mini-Bowtie with site or
business specific interpretation with
ALARP determination
4.0
INCREASING LIKELIHOOD
Reputation
Environment
Assets
CONSEQUENCES
People
BowTie analysis or equivalent for RAM5
yellow process loss of containment and all
red risks with ALARP discussion and
documentation
SEVERITY
•
No injury or
health
effect
No
damage
No effect
0
No
impact
1
Slight injury
or health
effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury
or health
effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury
or health
effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up
to 3
fatalities
Major
damage
Major
effect
Major
impact
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
5
A
B
C
D
Never
heard of in
the Industry
Heard of in
the Industry
Has
happened in
the
Organisation
or more than
once per
year in the
Industry
Has
happened at
the Location
or more than
once per
year in the
Organisation
E
Has
happened
more than
once per
year at the
Location
Increasing Risk
See DS HSSE HEMP Application Procedure
Blue risks are assumed to be at ALARP, if the facility or
business has a properly functioning HSSE MS (as assessed by
external audit).
* Note: Shell Design Standards (DEP’s, DEM’s or Equivalent).
List of Acronyms and Glossary of Terms
A list of acronyms and glossary of terms can be found at the following Link.
Link to DS HSSE HEMP - List of Acronyms and Glossary of terms
5.0
References:
The 2006 RAM Yellow Guide is withdrawn effective May 1, 2010 and replaced by the RAM
Guidance published in the Shell HSSE Control Framework.
Link to Shell HSSE Control Framework
Link to EP HSSE Control Framework
Link to DS Manufacturing HSSE Control Framework
June, 2010, Ver 5.2
Page 5
Use of the HSSE Risk Assessment Matrix
HEMP Guidelines for Downstream CoB's
Page 6 of 6
Appendix 1
RAM Tools, Templates and Training
RAM Briefing (Slide Pack)
Z2- DS HEC Ram in
Brief Awareness Ver 2.6-06-2010 JDM.pptx
June, 2010, Ver 5.2
Page 6