Your Safety Case Lives or Dies on Independence

Ask yourself these questions. If you answered ‘no’ to any of them, you have a gap between compliant and safe that is worth closing before your next cycle:

On 6 July 1988, 167 men died on Piper Alpha, an oil platform in the North Sea. It was run under the strict, rule-based safety system of the time.

Two years later, Lord Cullen’s public inquiry concluded that following those rules had never been the same as being safe. This led to their replacement by the safety case regime built on a principle bought at a terrible price. A company cannot be the only judge of whether its own risk is under control.

Thirty-eight years on, that lesson is slowly being lost on live sites across the country. Nobody is choosing to ignore it. It’s being worn down by stretched teams, retiring experts and smaller budgets.

It’s also never deliberate. It happens one small shortcut at a time, until a site is marking its own homework and calling the folder proof that it’s safe.

We have been here before. Yet we keep acting as if it were the first time.

If you run an upper-tier COMAH site, your safety report is the onshore version of the same system.

Every five years, a new report lands on your desk. It is a folder four to six inches thick. It covers your whole risk management system, and your name is somewhere near the front.

The HSE expects it. You produce it. On paper, you are compliant.

But compliance is the floor, not the ceiling.

There are two different claims here, and only one of them protects you.

Compliant means the document exists and ticks the boxes. Safe means the document is right. Your hazards are understood and well managed. And the numbers behind your major accident hazard scenarios can be defended.

The gap between those two claims is where a major accident hazard gets missed.

That gap almost never opens because someone ignored a hazard. It opens because the team that owned the study had no time and no distance to spot its own blind spot. Cullen saw this in 1990. We have been saying it for over 10 years.

A safety case is not really one document. It is a bound set of evidence. Each study answers a different question, and each one is another chance to get the answer wrong.

These studies are judgements, not box-ticking. The whole case is only as strong as its weakest judgement.

Most of that evidence is produced by people who are very good at engineering and who have a direct stake in a clean result.

EPCs are the engineering, procurement and construction contractors who design and build on the operator’s behalf. They have more engineering skill than anyone. They can size the vessel, design the relief system and lay out the whole rig.

What they cannot do, under the regulations, is run the safety studies that check their own design. That is the whole point of the rules. You do not let the people who built something certify that it is safe.

This is more than good practice. And offshore, it is the law.

Under the 2015 offshore safety case regulations, the operator must run a verification scheme. In it, an independent competent person confirms that the safety-critical parts of the installation are sound, and stay sound for its whole life. That person must be independent enough from whoever is responsible for the thing being checked. The law does not trust the duty holder to mark its own work, and it says so plainly.

So the studies go out to tender. An independent party comes in to chair them, review them and put their name to them. “Marking your own homework” is not our phrase. It is the phrase that stuck to the building industry after Grenfell, where the system had been left to check itself. The failure is the same. Only the hazard is different.

The weak point is how the work is awarded. The EPC is tied to a contract, so its instinct is to give the verification to the lowest bidder, the same way it would for steel or scaffolding. For most line items, that is good sense. For the one study that confirms the risk is under control, it is exactly the wrong way round.

The cheapest name on the page is often a lone contractor. There is no second reviewer behind them, no team to escalate to, and no liability insurance behind their signature.

It is your risk, not the EPC’s.

You should care who signs it off, not only what the signature costs. But going the other way is no safer. The biggest name in the room is not always the most independent. Paying more, or getting a report on grander letterhead, does not make the check any more independent from your design. What you are paying for is a reviewer who is independent enough to fail your case, and senior enough to make that failure stick.

Independence is not an optional extra added to the process. It is the load-bearing wall. This is the work we do. Not the design, not the engineering, but the verification. We look over the shoulder of what is being proposed. We ask the questions the people in the room are too close to ask.

In practice, it is change management for the whole risk picture, at every stage from concept to decommissioning.

On the work that matters, the operator does not accept the EPC’s choice. It picks the chair itself.

Not the firm, the person.

One of our consultants was vetted and approved to chair these studies for a global operator. At the time, only a handful of people in the country held that approval. The operator asked for our consultant by name, over whoever the EPC would have put forward.

When the client picks the referee instead of the contractor, the regulation is working exactly as it was meant to. That kind of approval is slow to earn and hard to copy, and that is the point.

The pattern behind Piper Alpha, Texas City and Grenfell is older than any of them. It keeps repeating for three reasons.

It fails slowly, then all at once. The gap rarely announces itself. Take a MoPO based on a SimOps study from three or four years ago. It still sets who can work where, and when. Since then, the plant has changed. A new tie-in was added on one side. More product is being pushed through the same line. A walkway was moved to make room. Each change was small and sensible. None was big enough on its own to trigger a new study. But the matrix still allows a lift over ground that the walkway now crosses. The crew reading the permit has no reason to doubt it. The people who could spot the mismatch wrote the matrix and have not looked at it since. Someone independent, walking the floor with the matrix in hand, can spot it in an afternoon. The site team has walked past it for three years. For a long time, nothing happens. Until the day it does.

The gap is capacity, not competence. Your team is already behind. The review backlog on a live site is never zero. The people who held the basis of safety for half the units are retiring, and their knowledge is leaving with them. Asking that same team to also be the calm, independent second pair of eyes on its own case is asking for the two things it has least of. Distance and time.

Independence is the part nobody can fake. An operator can hire the same engineers as anyone else. What it cannot create in-house is a reviewer with nothing to gain from the answer. That reviewer has no stake in the design, and no software or method of their own riding on the result. That is the real value of the signature. A safety case that a regulator, an insurer or a court cannot pull apart is never one written only by the people racing the deadline.