HID's approach to ALARP decisions
SPC/Permissioning/39
Purpose
1. This note summarises the approach that HID expects inspectors to take when making case-specific decisions on whether risks are as low as reasonably practicable (ALARP) during assessment of safety cases/reports (or other formal documents), or enforcing compliance with the law. This note does not cover the normal management arrangements (adequate supervision, peer review, etc.) that are in place to ensure that the approach is properly implemented. This SPC replaces SPC/Permissioning/09 which has been withdrawn.
Background
2. HID's approach to ALARP decisions mirrors that explained in "Reducing Risks, Protecting People; HSE's decision-making process" and "Principles and Guidelines to assist HSE in its judgements that duty holders have reduced risks as low as reasonably practicable".
3. R2P2 emphasises that people increasingly rely upon regulators like HSE as a source of reassurance about the arrangements put in place by duty holders for protecting people. If that trust is not to be threatened, HID must properly discharge its function to ensure that duty holders have put in place all necessary measures to prevent major accidents and limit their consequences.
4. HID's approach to ensuring compliance with the requirements of the permissioning regimes within its remit needs to be fully consistent with the Governments Enforcement Concordat as amplified in HSE's enforcement policy statement.
5. HID's approach to ALARP decisions needs to ensure that all staff involved in case-specific ALARP decisions:
- have a clear understanding of the interpretation of ALARP (including any cost and proportionality issues); and
- accept and share HSE's approach to these matters.
Interpretation of the legal basis of ALARP judgements
6. Generic guidance on the legal basis for making ALARP judgements is given in the HSE principles and guidelines document. The main points are:
- Reducing risks 'so far as is reasonably practicable' (SFAIRP) or 'as low as is reasonably practicable' (ALARP) call for the same tests to be applied. It follows that when risks are SFAIRP they are also ALARP.
- The risk that has to be addressed is that posed by reasonably foreseeable hazardous events from the duty holders' work activities to employees and others not in their employ.
- On the basis of case law, ALARP decisions require an assessment of the risk that might be avoided;
- an assessment of the sacrifice (in money, time and trouble) involved in taking further measures to avoid that risk;
- the benefits derived from those further measures (in terms of fatalities, etc. avoided); and
- a comparison of the two relative to the baseline risk .
The sacrifice (normally expressed in monetary terms) is that needed to implement additional measures to reduce risks. Benefits gained by duty holders (eg reduced plant replacement costs) should be offset against costs. The comparison is between the net sacrifice and the benefits of risk reduction (lives saved, reduced costs of the emergency services etc). The assessment needs to be proportionate (see sector specific guidance for further information on proportionality).
- For a measure to be not reasonably practicable the degree of disproportion between costs and benefits must be gross ie the test of gross disproportion. The HSE ALARP guidelines state that in all cases 'the disproportion must always be gross' but do not define what is gross. However, it suggests an examination of what was done in comparable circumstances may be useful in coming to a view.
- Both individual risk and societal risk should be considered when applying the test of gross disproportion. Individual Risk should be addressed in terms of hypothetical people at greatest risk. For onshore activities, this includes people off-site. In certain, well defined circumstances, consideration of societal concern may be required (for discussion see Annex), although generally it is only societal risk that needs to be taken into account in the ALARP demonstration, as the other elements of societal concern are taken into account by HSE when developing the regulatory framework (refer R2P2 Appendix 3, particularly Para 7).
- If a measure results in a transfer of risk to other people, the added risk to those people should be offset against the benefits the measures provide. For example, reducing the inventory of a hazardous substance by moving to drums rather than bulk storage on site may be a transfer of risk (reducing the risk to persons offsite, but increasing risk to those operators who have to effect the drum changeovers). The added risk to these workers must be considered when making the ALARP decision, but only to the extent over which the duty holder exercises control.
- Relaxation of control measures will be exceptional, eg when new evidence shows that a substance is far less toxic than originally thought or when there is a significant reduction of the number of people at risk.
- Inspectors should ensure that relevant good practice is in place. This can be found in ACOPs, HSE guidance, recognised standards, and industry practice appropriate to the duty holders' activities. This is the minimum compliance standard. Good practice may not exist for, or be relevant to, some hazards that are regulated through safety case regimes or may exist but be of insufficient scope to fully meet the ALARP standard eg for onshore industries, most guidance does not adequately deal with risks to the public.
- Where good practice fully meets the ALARP requirements, the duty-holder is relieved of the need (but not the legal duty) to take explicit account of individual risk, costs, technical feasibility and the acceptability of residual risk, since these will have been considered when the good practice was established. The duty holder has to demonstrate that the good practice is relevant and up-to-date.
- There is a continuing duty for duty holders to keep risks and possible risk reduction measures under review to take account of changing circumstances, advances in technology, new knowledge and information. Good practice may change over time; new technology may make a higher standard reasonably practicable. Application of the ALARP principle means challenging the adequacy of existing measures and considering any additional practicable measures identified.
- When a number of options for risk reduction exist, all options (or combination of options) that are reasonably practicable must be implemented. The legal requirement to reduce risks as low as is reasonably practicable rules out HSE accepting a less protected but significantly cheaper option. At the design stage, a life-cycle approach should be adopted. (ALARP in Design - Policy and Guidance)
- Evaluation of each of the different options, or combination of options, available for controlling a particular hazard should be made against the same baseline case.
- It may not be reasonably practicable to retrospectively apply a measure to an existing plant, that would be required to reduce risks ALARP for a new plant (even if that measure has become, in effect, good practice for every new plant). Whether the measure can be applied, or not, will depend on the site-specific circumstances, the risk levels, and whether the costs of the measure are grossly disproportionate.
Making ALARP judgements
7. HSE is only concerned with the risks to people, although we should be mindful that measures intended to reduce risks to people may conflict with the need to reduce risks to the environment. For the risks to people to be reduced ALARP all necessary measures must be in place. HID will assess this by scrutinising the duty holders conclusions that:
- 1. the risks to workers - HSW Act S2 risks - are ALARP; and
- 2. the risks to people not in their employ - HSW Act S3 risks - are ALARP.
8. Some duty holders may regard this as a new approach, but it is not. Such an approach is inherent in the 1974 Health and Safety at Work Act.
Judging whether risks to people are ALARP
9. Under the legislation specific to HID, as for the HSW Act, it is for duty holders to demonstrate that the necessary measures are in place to reduce risks ALARP, and for HID to assess that demonstration and/or verify through inspection that duty holders are complying with their legal obligations. How duty holders make the demonstration is for them to decide, but clearly they, at least, need to address the arguments that are outlined in HSE's approach ( see R2P2, particularly Part 3) to decision taking in respect of tolerability of risk.
10. HID will therefore expect that:
- 1. both the level of individual risk and the societal risks created by the activity or process are taken into account - in a proportionate way - when deciding whether a risk is unacceptable, broadly acceptable, or tolerable if ALARP;
- 2. the decision-making process and criteria adopted by duty holders are such that action taken is inherently precautionary, ie when the degree of uncertainty is large or the consequences of the worst-case scenario give rise to significant societal risks, measures that are "prima-facie reasonable" should be implemented.
11. In the interests of transparency and consistency, HID Inspectors should consider HSW Act S2 and S3 risks separately (if appropriate) and proportionately. However, the approach for S2 and S3 risks is identical:
- 1. First consider the site-specific circumstances and decide whether the implementation of relevant good practice makes the risks ALARP; if so implementation of those requirements and those of COMAH (MAPP etc) will suffice.
- 2. When good practice is insufficient to make the risks ALARP, duty holders must consider all risk reduction options, and implement all those that are reasonably practicable or are necessary to reduce risks to a broadly acceptable level. Demonstrations that the costs of implementation are grossly disproportionate must be proportionate and consider both individual risk and societal concerns.
12. If neither HID nor the operator can identify further prima-facie risk reduction measures , over and above the measures described in the duty holders demonstrations, then the risks are ALARP. Views on options for risk reduction measures are a team effort, and face-to-face discussions with the duty holder are required whenever the societal risks are appreciable.
Judging gross disproportion
13. Determining that risks have been reduced ALARP involves an assessment of the risk to be avoided, of the sacrifice (in money, time and trouble) involved in taking measures to avoid that risk, and a comparison of the two. HSE has not provided any specific guidance, but the disproportion between risk and sacrifice must be gross for all possible options.
14. Consistent and proportionate judgments can be supported by the R2P2 TOR framework (see R2P2 paragraphs 118 et seq.) by considering individual and societal risks separately. If either consideration indicates that a risk reduction option is reasonably practicable it must be implemented. The judgement on gross disproportion must be a collective one - by the Assessment Team in the case of safety case/report assessment, or by the Inspection team in the case of enforcement action.
15. Consideration of costs and benefits requires estimates of the likelihood and consequences of particular accidents. Both estimates involve uncertainty, which in the case of event frequency may be an order of magnitude or more. Many decisions can be made by exercising professional judgment based on estimates of the costs of a measure and the number of casualties saved by implementation, possibly informed by a crude cost benefit analysis (CBA).
16. R2P2 (paragraphs 101-108 and Annex 3), discusses CBA and the estimation of the cost of preventing a fatality (CPF, ie the total final cost of the risk reduction measure divided by the total fatalities prevented). By comparing this with the value of preventing a fatality (VPF, ~£1m) an estimate of the disproportion factor (ie CPF/VPF) can be made. Further guidance is given in the CBA Checklist.
17. When the proportion factor is 1 or less (or even 2 or less - remember that the disproportion must always be gross, and 2 may not be significantly different from 1 when uncertainty is considered) the measure must be implemented, even when the risks are close to being broadly acceptable. Judgement on whether the proportion factor is grossly disproportionate depends on the levels of individual and societal risks (and possibly the societal concern in certain circumstances). Inspectors should also consider the significance of uncertainties in the calculation of CPF.
18. Providing the risk analysis is based on cautious best estimates and the costs are realistic (not needlessly inflated beyond the provision of a fit for purpose solution), HID will use the following as the basis for exercising judgement:
- 1. The proportion factor is at least 1 (and possibly at least 2) for risks which are close to being broadly acceptable risks.
- 2. The proportion factor is at least 10 at the tolerable/unacceptable risk boundary.
- 3. For risks between these levels the proportion factor is a matter of professional judgement, but the disproportion between CPF and VPF must always be gross for a measure not to be reasonably practical.
19. HID will attach more weight to consequences where a hazard has attributes which makes it likely that it will give rise to societal risks, such as the potential for severe detriment, eg a major explosion in a built-up area (see Principles and Guidelines document, paragraph 34). Other factors, such as vulnerable groups where societal concerns have previously been expressed, will also be considered as appropriate. For example, for onshore non-nuclear sites, the number of children and elderly persons likely to be affected, and the presence of hospitals and schools may be an input to the ALARP decision.
20. HID will expect new technology to be implemented, in line with HSE's policy on harnessing new technology, unless gross disproportion can be demonstrated unequivocally.
21. The precautionary principle (see R2P2 paragraph 91) will be invoked where:
- 1. there is good reason, based on empirical evidence or plausible causal hypothesis, to believe that serious harm and societal risk might occur, even if the likelihood of harm is remote; and
- 2. the scientific information gathered during the risk assessment is sufficiently uncertain (see R2P2 paragraphs 86 et seq.) to make it impossible to confidently rule out a particular measure by CBA considerations.
22. HID expect that the vast majority of decisions can be made relatively quickly once a safety case/report or other form of demonstration has been assessed. Risk reduction measures that are judged prima facie reasonable should be discussed with the duty holder and the way forward agreed. HID expects inspectors to take a "firm but fair" line to ensure that HID and HSE policy on enforcing what is required by the regulations is not compromised.
Further Information
23. For further information, contact HID CI5A, 2.2 Redgrave Court, Bootle.