Institute of Civil Protection and
Emergency Management
Uniting Academics with Professionals to
Promote Excellence in Civil Protection


Originally published in Loss Prevention Bulletin 257 - October 2017

Tony Moore


In 2013, Judith Hackitt, then IChemE President and Chair of the Health and Safety Executive, congratulated an audience at the Institution of Civil Engineers on the “excellent progress” that had been made in changing “safety culture”, but at the same time, warned that they had done “very little to address issues of process safety” as a result of which such disasters as Buncefield, Texas City, Macondo and “many more” had occurred.1

Difference between personal and process safety

In the context of this paper, the management of personal safety includes such things as ensuring that personnel wear appropriate protective equipment and making efforts to avoid slips and trips on site. There seems to be general agreement that progress has been made on personal safety and it has become “embedded in the chemical and oil and gas sectors.”2 Process safety, on the other hand, focuses on preventing fires, explosions and accidental releases at facilities handling hazardous material, and responding to them should they occur. In its final report on the Macondo accident, published in April 2016, the US Chemical Safety and Hazard Investigation Board (CSB) reported that analysis has repeatedly shown that “imbalanced indicator programs focusing mostly on personal safety without an equal focus on process safety will not adequately inform a company of its emerging major accident risk, yet companies, industry groups, and even regulators continue to rely on such practice.”3

Reporting specifically on the two companies mostly heavily involved, the report said that whilst both British Petroleum (BP) and Transocean “collected, measured, and rewarded personal safety” issues, they failed to give “process safety the same attention”.4

Indeed, BP were accused of making decisions “that increased risk” and of displaying “a lack of oversight and operational discipline” in that what happened in the Macondo accident “were failures in process safety” designed to save “the company time and money”.5


Preparation consists of those measures to be taken to enable organisations to rapidly respond to an impending or actual serious accident, and prevent it from causing further damage. There are four key components to being ready for such an incident:

  • realistically assessing all credible risks;
  • planning;
  • the selection of staff with the right skills;
  • training.

For the four components to be meaningful, chief executive and board support is essential. Top management must be committed in ensuring that all four are, from a practical point of view, part of company policy and not just words written on a piece of paper. Being ready is a continuous process, not just a chore to be forgotten when done once. Strong leadership is vital in ensuring that an organisation devotes sufficient time and effort to prepare for and be ready for such an event. The actions necessary to ensure this is so may be delegated, but responsibility and accountability will always remain with corporate management, so it is essential that they promote an environment in which process safety and production are seen as equally important.6

This does not appear to have been how BP looked at it in 2010 because the company was totally unprepared for the Macondo blowout in the Gulf of Mexico, in which 11 people were killed, and it took 87 days to stem the resultant oil leak. Consequently, in what was the largest accidental oil spill in history, there was extensive environmental damage. The lack of preparedness was later confirmed by Chief Executive Officer (CEO) Tony Hayward who admitted that BP “was not prepared”, that its “contingency plans were inadequate”, and the company was “making it up day to day” in the early stages.7

CEOs and other senior managers must broadly understand the vulnerabilities and risks involved and take responsibility for emergency planning for the range of consequences that could arise from a process safety incident, including the consideration of worse-case scenarios. Experience shows that the events for which a plan has been designed never go exactly as expected. Indeed, the military have a saying, “no plan survives first contact with the enemy”. It is the same with a major accident. No matter how carefully an organisation has planned, something will always occur that has not been considered. Therefore, at some point the plan will need to be modified. Sometimes there are options but there are serious time constraints. So there is likely to be a need for quick decisions. Inaction or inappropriate decisions can produce undesirable consequences and may have far-reaching implications. It takes a particular kind of person to make the right decisions under such circumstances.

In deciding the skills that are necessary to manage an event following a serious accident, there are two schools of thought. The first sees the skills merely as an extension of those used by managers in ensuring that the product is produced, stored or transported. Others see the skills necessary to manage the events following a major accident as distinct from those required in everyday operations.8

As long ago as 1990, Lord Cullen, in his inquiry into the 1988 Piper Alpha disaster, in which 167 people died, claimed that the role of the Offshore Installation Manager (OIM) demanded “a level of command ability which [was] not a feature of normal management.” He then devoted a whole chapter to “training for emergencies” in which he stressed the need for regular and realistic training.9

It is important to recognise that not everyone has the ability to manage emergency situations. Those who have a talent for successfully managing an organisation that is running on an even keel do not necessarily have the skills to manage an incident that involves uncertainty. As Lagadec has pointed out, “a great manager, who excels in periods of calm, will often be completely at sea when his universe topples into what, for him, is something quite unimaginable.” He added that what was needed on such occasions are “people who are prepared to expose themselves,” but unfortunately “such people are not legion”.11


Response relates to those measures that can be taken immediately prior to an accident or emergency, if there is some kind of warning of the impending event, and those measures to be taken during and following the impact. Effectively responding to a serious accident will be the most challenging part of any senior manager’s job, from the Chief Executive Officer down. The ability of an organisation “to respond will be reflected in the effectiveness of their internal communication systems, the preparedness of their staff, and hence the quality of their pre-hazard training, their ability to communicate with potential hazard victims and advise them on appropriate actions, and their ability to mobilise resources for hazard response activities.”12

Taking these four abilities in turn, firstly, an absence of effective internal communications was a factor which led ConocoPhillips (UK) Limited being fined £3 million and ordered to pay costs of almost £160,000 after it admitted at Lincoln Crown Court in February 2016 that it had put workers” lives at risk during gas leaks on a gas platform. The incident happened on the Lincolnshire Offshore Gas Gathering System (LOGGS) between 30 November and 1 December 2012. Gas was released into the atmosphere whilst work was being undertaken to replace a gas pressure control valve. The lives of the 66 workers on board were put in danger of death or serious injury from two sources, particularly if an ignition had resulted in an explosion. A breakdown in communications across the five platforms of LOGGS meant that some workers incorrectly believed the platform was free of gas. In addition, a loss of electrical power made management of the emergency more difficult, the company having failed to consider this as a possibility.13

Secondly, mention has already been made about the preparedness of staff and the quality of pre-hazard training in relation to the Piper Alpha and Texas City disasters. Thirdly, the ability of BP to communicate with potential hazard victims was seriously defective. When an organisation “is grappling” with the results of a serious accident, “it is vital to get your side of the story out” and “you need the news media to transmit information to the public.”14 But, as the company spokesman, CEO Tony Hayward “made a series of mistakes” and he eventually admitted the company had “not [been] prepared” to deal with “the intensity of the media scrutiny.”15 At the outset, BP was accused of being slow to acknowledge there was an initial problem and of not responding quickly enough. The company took four days to realise that the well was leaking; it was slow to express concern, compassion and full apology to victims who were most affected by the spill; and it intentionally underestimated the extent of the spill, stating that only 1,000 barrels (159,000 litres) were actually spewing into the Gulf daily, but quickly revised it upward to 5,000 barrels (795,000 litres) as other sources queried the first figure. To compound these errors, instead of expressing “compassion” towards the victims, Hayward initially took it “lightly”, minimised its impact on the environment by suggesting it was “relatively tiny” in comparison with the big size of the ocean.”16 Finally, given that it took BP nearly three months to stem the leak in the Gulf of Mexico, it was apparent that the company were unable to mobilise the necessary resources to respond to the blowout.

Flawed culture not confined to the process industries

The failure of corporate management to plan for and respond to emergencies is not confined to the process industries. For instance, following the capsizing of the Herald of Free Enterprise in 1987 when 187 people lost their lives after it sailed with the bow doors open, it was revealed that senior managers in Townsend Car Ferries failed to heed the suggestions of the ferry masters over a period of two years prior to the accident that there should be a warning light on the bridge to warn them when the bow doors were still open.17 Consequently, no plans were in place to enable a master and crew to respond to this type of emergency. Whilst it was clear that the initial cause of the accident was the failure of a member of the crew to close the bow doors, the inquiry chairman, Mr Justice Sheen, stressed that “the underlying or cardinal faults lay higher up in the company” adding “from top to bottom the body corporate was infected with the disease of sloppiness”.18 On a slightly different tact, whilst there were plans in place at Stoke Mandeville Hospital to respond to outbreaks of Clostridium difficile between 2003 and 2006, the Healthcare Commission found a “significant failing” by senior managers in that they persistently overrode the advice of the infection control team, i.e. those responsible for implementing the plan to control infection, in their desire to achieve government targets.19 This is similar to organisations that emphasise production over process safety as was apparent in the Pike River mining accident in New Zealand in November 2010, when 29 people lost their lives. The Royal Commission appointed to investigate the tragedy found that “the board’s focus on meeting production targets set the tone for executive managers and their subordinates” and failed to ensure that the workers “were being protected”. The Commission found that the general attitude of the Board Chairman, John Dow, “was that things were under control, unless [he was] told otherwise” but, said the Commission, “this attitude …. exposed the workers at Pike River to health and safety risks.”20

Seven months earlier, in April 2010, a coal dust explosion in the Upper Big Branch Mine in Raleigh County, West Virginia, killed twenty-nine of the thirty-one miners who were at the site at the time. The resultant investigation by the Mine Safety and Health Administration (MSHA) found that there had been flagrant safety violations. The company running the operation, Massey, had deliberately broken the law thus “endangering the lives of their miners”. Alleging that Massey’s corporate culture was the root cause of the tragedy, it found that the company “promoted and enforced a workplace culture that valued production over safety.” The company was issued with 369 citations and orders, including 21 flagrant violations, and the MSHA imposed the largest fine in its history, nearly $11 million.21 But a more serious warning notice came to corporate management in April 2016 when the Chairman and CEO of Massey’s, Donald Blankenship, was sentenced to a year in prison for conspiring to violate federal mining standards. He was also ordered to serve a year of supervised release and pay a fine of $250,000.22


The Royal Commission into the River Pike mining disaster pointed out that protecting the health and safety of workers was “part and parcel of an organisation’s functions and should be embedded in an organisation’s strategies, policies and operations.”23 It briefly outlined what the board should have done. It needed: “to have a company-wide risk framework and keep its eye firmly on health and safety risks. It should have ensured that good risk assessment processes were operating throughout the company. An alert board would have ensured that these things had been done properly. It should have familiarised itself with good health and safety management systems. It would have regularly commissioned independent audit and advice. It would have held management strictly and continuously to account.”24

It follows that the responsibility for ensuring that plans are in place to provide an effective response to major accidents and emergencies rests with the Chief Executive Officer and the Board of the parent company. It is their responsibility to ensure that there are competent management, engineering, and operational personnel at all levels.25 It is their responsibility “to engage with the workforce”, ensuring, amongst other things, that emergency response plans are developed and maintained at all sites within the company and at an organisation-wide level, with appropriate levels of competent resources, both human and technical, available to execute the plans26. But, on too many occasions, senior management have ignored the warning signs of the possibility of a serious accident, sometimes for years, and have allowed organisational and safety deficiencies to exist which has meant that when such an incident did occur the response was less than effective.

Just over twenty-five years ago, Lord Cullen found “the quality of safety management by operators is fundamental to offshore safety”, but he added, “no amount of detailed regulations for safety improvements could make up for the deficiencies in the way that safety is managed by operators.”27 Although Cullen was referring to offshore safety, his comments are equally applicable to any organisation involved in the manufacture, storage or transportation of hazardous materials. Safety, particularly process safety, is an attitude of mind. Over twenty years ago, Patrick Lagadec claimed that, amongst senior management, there was “often a considerable reluctance to learn” about the possibility of serious accidents. Pointing out that such events happen rarely, managers decided “their time [was] best spent on other important issues.”28 But, as Donald Blankenship recently discovered, corporate management has a legal, as well as a moral responsibility to ensure that process safety is at the top of the company agenda.


  1. Hackett, Judith (2013). Process Safety – Do they mean us? Presentation to the ICE (Institution of Civil Engineers) and Costain Health and Safety Lecture. London: Health and Safety Executive.
  2. ibid
  3. US Chemical Safety and Hazard Investigation Board (2016). Investigation Report: Executive Summary – Drilling Rig, Explosion and Fire at the Macondo Well, 11 Fatalities, 17 Injured and Serious Environmental Damage, p.15, paras. 26.
  4. Ibid, para. 27.
  5. Elkind, Peter; Whitford, David; Burke, Doris (2011). BP: An accident waiting to happen. See www.fortune. com/2011/01/24bp-an-accident-waiting-to-happen accessed 3 January 2017
  6. Corporate Governance for Process Safety: Guidance for Senior Leaders in High Hazard Industries. OECD (Organisation for Economic Co-operation and Development) Environment, Health and Safety, Chemical Accidents Programme, June 2012, p. 12.
  7. Lawless, Jill (2010). “Ex-CEO says BP was unprepared for oil spill”. Boston Globe, 9 November
  8. Moore, Tony (2008). Disaster and Emergency Management Systems. London: British Standards Institution, p. 112.
  9. Cullen, The Hon. Lord (1990). Public Inquiry into the Piper Alpha Disaster, Volumes I and II (Cm 1310). London: Her Majesty’s Stationary Office.
  10. US Chemical Safety and Hazard Investigation Board (2007). Investigation Report: Refinery Explosion and Fire. Report No. 2005-04-I-TX, p. 94.
  11. Lagadec, Patrick (1993). Preventing Chaos in a Crisis. London: McGraw-Hill, p.320.
  12. Penning-Rowsell, Edmund (2005). Criteria for the design of hazard mitigation institutions. In Hood, Christopher & Jones, David K.C (2005). Accident and Design: contemporary debates in risk management. London: Routledge, p.134.
  13. . HSE Press Release (2016). “Fuel giant sentenced over offshore platform gas releases, dated 8 February
  14. Bonner, Dr. Allan (2010). An Ounce of Prevention: Navigating your way through Damage Control and Crisis Response. Edmonton: Sextant Publishing, p. 105.
  15. . ( accessed on 11 November 2016)
  16. Mejri, Mohammed and De Wolf, Daniel (2013). Crisis Management: Lessons from the BP Deepwater Horizon Spill Oil. In Business Management and Strategy, Vol. 4, No. 2, p. 79
  17. Ministry of Transport (1987). MV Herald of Free Enterprise: Formal Investigation (Chair: Mr Justice Sheen), Report of Court No. 8074. London: Her Majesty’s Stationary Office, pp.23-25.
  18. Ibid, p.14.
  19. . Healthcare Commission (2006). Investigation into the outbreaks of Clostridium difficile at Stoke Mandeville Hospital. Buckinghamshire Hospitals NHS Trust, p.6.
  20. Royal Commission on the River Pike Coal Mine Tragedy. Wellington: New Zealand Government, Volume 1, chapter 2, para 46.
  21. News Release of the Mine Safety and Health Administration (MSHA), 12 June 2011.
  22. New York Times, 6 April 2016.
  23. . Royal Commission on the River Pike Coal Mine Tragedy, op. cit. 20, chapter 28, para 1.
  24. Ibid, chapter 2, para. 45.
  25. OECD, op. cit. 6, p. 14.
  26. . Ibid, p.15.
  27. Cullen, op. cit. 9, p. 301.
  28. Lagadec, op. cit. 11, p. 320.

Biographical Note

Tony Moore is a former Associate Director of the Resilience Centre at Cranfield University. He was successively Chairman and Vice-President of the Institute of Civil Protection and Emergency Management. He was the co-editor of three issues of Tolley’s Handbook of Disaster and Emergency Management and is the author of the British Standards Institution’s publication on Disaster and Emergency Systems. He is a regular contributor to Crisis Response Journal.


Donate Button Code