You are on page 1of 26

KOC.SA.

042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 1 of 26

Kuwait Oil Company

Guidelines for As Low As


Reasonably Practicable (ALARP)
Demonstration

Document Number: KOC.SA.042


Document Team Leader
Document Author: Team Leader Safety
Coordinator: Standards

Approved by: HSEMS Procedures Sub-committee

Authorized by: HSSE Implementation Committee

Original Issue Date: 9 March, 2014 Control Tier: Tier 2

Revision/Review Date: 9 March, 2014 Next Review Date: 8 March, 2019


KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 2 of 26

Rev.
DATE REMARKS
No.
Initial draft circulated within the H2S Core Working Group for
A 19 January, 2013
review.

0 9 March, 2014 Approved and authorized by HSSE Implementation Committee


KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 3 of 26

Table of Contents

1.0 Introduction 4
1.1 Objectives 4
1.2 Scope 4
2.0 Applications 4
3.0 Reference Documents 5
4.0 Definitions 5
5.0 Abbreviations 8
6.0 The ALARP Principle 8
6.1 General 8
6.2 KOC Risk Tolerability Criteria (RTC) and the ALARP Principle 9
6.3 The Use of the Precautionary Principle and the ALARP Principle 11
6.4 The ALARP Principle and Cost-Benefit Analysis (CBA) 12

7.0 Demonstration of ALARP 12


7.1 General 12
7.2 Risk Levels and ALARP Demonstration 13
7.3 The ALARP Demonstration Process 14
7.4 Documentation of the ALARP Demonstration Process 15

8.0 Bases for Decision Making 15


8.1 Framework for Risk-Based Decision Making 15
8.2 Risk Assessment within the Framework 16

9.0 ALARP Assurance 17

Appendices

A: Decision Bases ...................................................................................................................18

B: Means of Calibrating the Decision Bases ............................................................................19

C: Cost Benefit Criteria for Risk to Persons .............................................................................20

D: ALARP Demonstration Process ..........................................................................................22

E: Tenets of the ALARP Principle (derived from Reference 13) ...............................................26


KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 4 of 26

1.0 Introduction
The As Low As Reasonably Practicable (ALARP) principle is key to the tolerability of risk
framework used by KOC in managing the risks of hazardous facilities. The ALARP principle
provides a sensible basis for managing process risks.

The ALARP principle embodies the key concept of “reasonably practicable” in reducing risk that
entails weighing a risk against the money, time, and trouble, (that is, the sacrifice), needed to
control it. Thus, the ALARP principle is used to describe the level to which risks should be
controlled.

A documented demonstration that safety risks are both tolerable and are reduced to a level that
is ALARP, is a requirement of KOC’s HSEMS expressed in HSEMS Procedure KOC.SA.018 for
“Safety Risk Assessment” (Ref. 3).

This document provides guidance and a decision framework to assist and promote consistent
risk-based decision making for risk reduction efforts in KOC. This includes guidance on
determination of risk tolerability and justification that risks have been reduced to a level that can
be considered to be ALARP. Consequently, in addition to this document, KOC’s approach to
ALARP is documented in and shall be read in conjunction with KOC’s Risk Tolerability Criteria
established in HSEMS Procedure KOC.SA.018 for “Safety Risk Assessment” (Ref. 3).

The guidance and decision framework provided in this document are based on the best
practices used by the international Oil & Gas industry, and also on published sources that are
widely known and accepted (see references).

1.1 Objectives
The objective of these guidelines is to define the process for demonstrating that risks during the
entire safety lifecycle of a facility are both tolerable and ALARP. Demonstrating that risks are
tolerable and ALARP meets the requirements of HSEMS Procedure KOC.SA.018 for “Safety
Risk Assessment” (Ref. 3).

It is important to note that the application of the ALARP demonstration process is an integral
part of KOC’s Element 03 “Risk Assessment, Compliance and Management” of the HSEMS,
and contributes to the development of the various technical safety issues required for the safe
design, operation and maintenance of KOC’ facilities.

1.2 Scope

These guidelines provide a decision framework to assist and promote consistent risk-based
decision making for KOC facilities. This includes guidance on determination of risk tolerability
and justification that risks have been reduced to a level that can be considered to be ALARP.

Although the guidance is specifically aimed at major hazard facilities, the general principles are
also applicable to any other safety risk-based decision making.

2.0 Applications
These guidelines are applicable to the entire lifecycle of any KOC project, facility or activity.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 5 of 26

3.0 Reference Documents


1. KOC HSE Management System Guide
2. KOC.GE.001- KOC HSE Management System Manual
3. KOC.SA.018 - Safety Risk Assessment Procedure
4. KOC.SA.037 - Risk Management Framework in KOC
5. KOC.SA.040 - Guidelines for Quantitative Risk Assessment
6. KOC.SA.037 - Risk Management Framework in KOC
7. UKOOA “Industry Guidelines on A Framework for Risk Related Decision Support”, ISBN 1
903003 00, United Kingdom Offshore Operators Association, London, May 1999
8. AICHE/CCPS, “Guidelines for Chemical Process Quantitative Risk Analysis”, Second
Edition, Center for Chemical Process Safety, American Institute of Chemical Engineers,
New York, 2000.
9. AICHE/CCPS, “Guidelines for Risk Based Process Safety”. Center for Chemical Process
Safety, American Institute of Chemical Engineers, New York, 2007
10. AICHE/CCPS, “Guidelines for Developing Quantitative Safety Risk Criteria”. Center for
Chemical Process Safety, American Institute of Chemical Engineers, New York, 2009
11. NORSOK Standard Z-013, “Risk and Emergency Preparedness Analysis”, Norwegian
Technology Center, Norway, 2001.
12. Lees, F. P. “Loss Prevention in the Process Industries”, Second Edition, Butterworth,
London, 1989.
13. UK HSE, “Reducing Risks, Protecting People-R2P2”, available at:
http://www.hse.gov.uk/risk/theory/r2p2.pdf
14. UK HSE, “ALARP Suite of Guidance”, available at:
http://www.hse.gov.uk/risk/theory/alarp.htm
15. UK HSE, “The Precautionary Principle: Policy and Application”, available at:
http://www.hse.gov.uk/aboutus/meetings/ilgra/pppa.htm
16. P. Baybutt, “Analytical methods in process safety management and system safety
engineering—Layers of protection analysis,” Handbook of Loss Prevention Engineering,
Wiley, New York, 2013

4.0 Definitions

As Low As Reasonably Practicable (ALARP) - Expresses that the risk level is reduced,
through a documented and systematic process, so far that no further cost effective measure is
identified.

Note: The requirement to establish a cost effective solution implies that risk reduction is
implemented until the cost of further risk reduction is grossly disproportional to the risk reducing
effect.

ALARP Demonstration - Formal documentation of the ALARP process to demonstrate that:


 Efforts have been made to identify hazards with the potential to cause major harm to
people;
 The potential consequences for each hazard have been identified;
 The risk has been evaluated for each consequence, either qualitatively or by using
QRA;
 The existing (or proposed) measures to reduce the risks to people affected by those
hazards have been identified. These measures may prevent an incident from occurring
or, less preferably, mitigate to reduce the effects of an incident if it occurs;
 Measures are identified that may reduce the risk; further
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 6 of 26

 The added benefit of each risk reduction measure is assessed to determine whether it
is viable or whether the benefit is grossly disproportionate to the sacrifice involved in the
measures necessary for averting the risk (whether in money, time or trouble);

Once all risk reduction measures have been considered and the justification for acceptance or
rejection recorded, it will be effectively documented that risks to people have been reduced to
the lowest level that is reasonably practicable.

ALARP Process - A systematic process of analyzing potential risk reduction measures to


ensure that all measures that are ‘Reasonably Practicable’ are implemented

Best Practice - In the context of these guidelines, best practice refers to standards/procedures
for controlling risk above the level provided by the application of good practice.

Cost Benefit Analysis (CBA) - Methodology that offers a framework for comparing the benefits
of reducing risks against the costs incurred for a particular option for managing risks.

Good Practice - In the context of these guidelines, good practice refers to


standards/procedures for controlling risk which have been judged and recognized by KOC as
satisfying all the requirements when applied to a particular case in an appropriate manner. In
this sense, written good practice is that contained in KOC standards, KOC HSEMS Procedures
and other engineering standards produced by globally recognized organizations such as: NFPA,
API, ISO, etc.

Intolerable Risk - The level of risk that exceeds the levels stated in KOC’s Risk Tolerability
Criteria established in HSEMS Procedure KOC.SA.018 for “Safety Risk Assessment” (Ref. 3).

Mitigation - To moderate or reduce the severity of the undesirable consequences of a particular


event

Reasonably Practicable - Potential measures taken to reduce risk can only be ruled out if the
sacrifice in taking them (cost, time, trouble) would be grossly disproportionate to the benefits of
the risk reduction, i.e. the greater the risk, the more should be spent on reducing it and the
greater the bias towards the side of safety

Residual Risk - The risk remaining after controls have been applied to associated hazards that
have been identified, quantified to the maximum practicable, analyzed, communicated to the
proper level of management and tolerated after proper evaluation.

Risk - The risk associated with an event is defined as the product of the likelihood of the event
and the magnitude (severity) of the outcome of that event. The likelihood is defined in terms of
the annual frequency of the outcome. The magnitude of the outcome is defined as the number
of fatalities caused by the event. The risk is the product of these quantities and is expressed in
terms of fatalities per year. Note that the calculated risk is linear with respect to both frequency
and number of fatalities. Public and media response to incidents shows significant aversion to
accidents involving multiple fatalities. Therefore events which may be estimated to give the
same numerical risk may give rise to very different levels of public and media concern and/or
impact on Company reputation.

There are several risk measures which are defined below:


KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 7 of 26

i. Location Specific Individual Risk (LSIR)


Location Specific Individual Risk (LSIR) provides a measure of the inherent hazard
associated with different geographic locations within a plant or facility. The basis for the
calculation of the location specific risk is that each target location considered is
permanently inhabited by a single individual. The LSIR is evaluated (typically) at points
on an orthogonal grid covering the area of interest. The calculated risks are typically
presented as iso-risk contours, which provide an easily understood graphical presentation
of the risks.

LSIR contours are indicative of the potential magnitude or intensity of the risk, but the
risks will only be realised at a given location if personnel will be present at that location
24/7.

LSIR only considers those sources of risks which themselves have fixed locations. LSIR
does not therefore take account of transportation risks, occupational risks, etc.

ii. Individual Risk (IR or IRPA)


Individual Risk (IR or IRPA) is determined on a case by case basis for each individual
working on a plant or facility. In practice there is insufficient definition in the data which
defines the durations for which people will be exposed and locations at which they will be
exposed. Calculations are therefore undertaken for representative work groups rather
than for every individual.

The process contribution to the individual risk for a specified work group is evaluated as
the time weighted average of the LSIR values determined at each of the locations at
which the work group will spend time. Risk contributions due to transport and
occupational risk are also accounted for. Where personnel remain on the plant during
their off shift risk contributions for this period are also taken into account.

iii. Potential Loss of Life (PLL)


Potential Loss of Life (PLL) is derived from the workgroup’s IR estimates. The PLL for
each workgroup is the product of the workgroup IR and the number of members of the
workgroup. Where both day and night shifts will be utilised both will contribute to PLL.
Rotations are also accounted for.

PLL can be evaluated in terms of fatalities per year, but may also be expressed in terms
of total fatalities over the design life of the facility. Where the difference in PLL between
two design options is required (for example as part of an ALARP demonstration) this is
usually evaluated over the life of the plant since this facilitates cost benefit calculations.

iv. Cumulative Frequency vs. Number of Fatalities (F-N)


Cumulative Frequency vs. Number of Fatalities (F-N), also called Societal Risk, is an F-N
plot that plots the cumulative frequency (F) of events resulting in N or more fatalities
against N. Because of the way the plot is defined the maximum value of F corresponds
to the smallest value of N and vice-versa. F therefore plots as a decreasing function of N.

The F-N curve provides information with respect to the distribution of risk between events
resulting in small numbers of fatalities and events resulting in large numbers of fatalities.

Risk Aversion - Risk Aversion is the concept that society has a greater adverse reaction to
those accident events that result in a large number of fatalities

Risk Reduction Measure - Control or mitigation aimed to reduce the level of risk
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 8 of 26

Risk Tolerability - The acceptance to live with a risk to secure certain benefits in the
confidence that the risk is being properly controlled.

The reduction of a risk such that it becomes tolerable does not rule out the requirement for
further reduction since the ALARP demonstration may be incomplete.

Risk Tolerability Criteria - Criteria that are used to express a risk level that is considered
tolerable for the activity in question.

Note: Risk Tolerability Criteria are used in relation to risk assessment and express the level of
risk which will be tolerable for the activity. It is the starting point for further risk reduction
according to the ALARP principle. It may be qualitative or quantitative.

Societal Risk - The relationship between frequency and the number of people suffering from a
specified level of harm in a given population from the realization of specified hazards.

Tolerable Risk - Risk that has been reduced to a level that can be endured by KOC in
accordance with HSEMS Procedure KOC.SA.018 for “Safety Risk Assessment” (Ref. 3).

5.0 Abbreviations
ALARP - As Low As Reasonably Practicable
CBA - Cost Benefit Analysis
HC - Hydrocarbon
HSEMS - Health, Safety & Environment Management System
ICALF - Implied Cost To Avert a Fatality
IP - Institute of Petroleum
IR - Individual Risk
IRPA - Individual Risk per Annum
KOC – Kuwait Oil Company
OGP - Oil and Gas Producers
PGS - Project Gate System
PLL - Potential Loss of Life
QRA - Quantitative Risk Assessment
RAM - Risk Assessment Matrix
RTC - Risk Tolerability Criteria
SCE - Safety Critical Equipment
UK HSE - United Kingdom Health and Safety Executive
UKOOA - United Kingdom Offshore Operators Association

6.0 The ALARP Principle

6.1 General

The ALARP principle embodies several concepts (Figure 1):

a. Process risks can be partitioned into three regions:


 Intolerable risks that cannot be justified except under extraordinary
circumstances.
 Tolerable risks that are considered acceptable if further risk reduction is
impractical, that is, the benefit does not outweigh the impact.
 Broadly acceptable, or negligible, risks that are so low as not to be of concern.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 9 of 26

b. Decreasing risk and the diminishing proportional benefit as risk is reduced are
represented by the triangle.
c. Efforts to reduce risk should be continued until the incremental sacrifice is grossly
disproportionate to the value of the incremental risk reduction achieved.
Incremental sacrifice is defined in terms of cost, time, effort, or other expenditures
of resources.

Referring to Figure 1 below, if the risk lies in the intolerable risk region, it must be reduced
below the dividing line between the intolerable and tolerable regions and moved downward
toward the dividing line between the tolerable and broadly acceptable regions to the point
where the sacrifice involved would be grossly disproportionate to the benefits of risk
reduction that would be achieved. If the risk lies in the tolerable region, the same must be
done. If the risk lies in the broadly acceptable region, nothing needs to be done.

The approach is weighted in favor of safety, because risk reduction measures must be
implemented unless a justification is provided not to do so based on grossly disproportionate
sacrifices, i.e. risk reduction measures are adopted except where they are ruled out,
because they involve grossly disproportionate sacrifices.

Additional risk reduction


Intolerable Risk measures must be pursued

10-3 10-4
Demonstration of ALARP shall be made.
ALARP Medium Risk can be tolerated if further risk
reduction is impracticable or if the cost
Region (Tolerable) Risk and effort is unreasonably disproportional
to the benefit gained
10-5 10-6
Low
(Broadly Consider cost effective risk reduction measures.
IR per Annum IR per Annum
Acceptable) No need for detailed working to demonstrate ALARP
(Workers) Risk (Public)

Figure No. 1 - The ALARP Principle and the KOC RTC

6.2 KOC Risk Tolerability Criteria (RTC) and the ALARP Principle
Application of the ALARP principle involves specifying two sets of risk tolerance criteria. The
first set of criteria is the dividing line between the unacceptable and tolerable regions, which
for KOC is given as 10-3 per Annum for own personnel, and 10-4 per Annum for Public; both
in terms of IRPA (see Figure 1 above). It refers to a level of risk that plainly must be
reduced, in accordance with HSEMS Procedure KOC.SA.018 for “Safety Risk Assessment”
(Ref. 3). In other words, it is a minimum requirement that must be met.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 10 of 26

The second set of criteria is the dividing line between the tolerable and broadly acceptable
regions, which for KOC is given as 10-5 per Annum for own personnel, and 10-6 per Annum
for Public; both in terms of IRPA (see Figure 1 above). In accordance with HSEMS
Procedure KOC.SA.018 for “Safety Risk Assessment” (Ref. 3), this is a goal that may not be
reached but toward which progress must be made until risk reduction measures involve
grossly disproportionate sacrifices. It refers to a level of risk that is too small to be of
concern, that is, a “virtually safe” level that is perceived by most people to be broadly
acceptable and does not require further action to reduce it. A range of risks is tolerable
between the two sets of criteria. The residual risk, which is the risk remaining after controls
have been implemented, should fall either in the broadly acceptable region or near the
bottom of the tolerable region.

KOC RTC criteria are set for both individual and societal risk.

In accordance with HSEMS Procedure KOC.SA.018 for “Safety Risk Assessment” (Ref. 3),
the ALARP principle can be incorporated into both qualitative and quantitative risk
assessment. Commonly, the risk matrix shown in HSEMS Procedure KOC.SA.018 for
“Safety Risk Assessment” (Ref. 3) is used in process hazards analysis to assign qualitative
risk levels to hazard scenarios. This risk matrix is partitioned into three zones that reflect the
ALARP principle (Figure 2).

Figure No. 2 - KOC Risk Evaluation Matrix

The ALARP principle is used also in setting numerical (quantitative) risk tolerance criteria for
both individual and societal risk. Note that group risk tolerance criteria also incorporate the
ALARP principle. Group risk tolerance criteria are often confusingly called societal risk tolerance
criteria, as they were first applied to the public. However, in accordance with HSEMS Procedure
KOC.SA.018 for “Safety Risk Assessment” (Ref. 3), they should also be applied to workers in a
facility.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 11 of 26

Figure 3 depicts the F–N cumulative curve for societal risk in KOC. Societal risk refers to the
frequency of multiple fatality incidents, which includes workers and the public. The F-N Curve
represents societal risk for a single facility, like a refinery or a process plant. The F-N Curve
shown in Figure 3 clearly indicates the principle that society’s tolerance for risk decreases as
fatalities increase.

Figure No. 3 - KOC Societal Risk (F-N Curve)

6.3 The Use of the Precautionary Principle and the ALARP Principle
Caution should be practiced when uncertainties exist. In this case, the precautionary
principle (see Reference 14) can be used to deal with hazards. In the context of major
hazards where there is reason to believe that harm to people might occur, key aspects of
the precautionary principle are:
a. Actions should be taken to prevent or minimize harm to people or the environment
even when the absence of scientific certainty makes it difficult to predict the
likelihood of harm occurring, or the level of harm should it occur.
b. Lack of scientific certainty should not be used as a reason for postponing measures
to control the risk.
c. The need for control measures increases with both the level of possible harm and
the degree of uncertainty.
d. Control measures should be cost-effective.

Thus, where data, model, or knowledge uncertainties exist, the precautionary principle can
be applied by making assumptions to produce a conservative risk estimate for decision
making. The greater the possible harm and the degree of uncertainty, the more conservative
are the assumptions made. Often, these assumptions entail using a credible worst case or a
worst-possible case. The assumptions can be applied to the models employed or data used.
In the case of data, they are sometimes called safety factors.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 12 of 26

6.4 The ALARP Principle and Cost-Benefit Analysis (CBA)


The key concept in using the ALARP principle is the tradeoff between the benefits and costs
of risk reduction measures. Eventually, a point of diminishing returns is reached wherein
expenditure increases markedly as risk reduction diminishes rapidly.

Cost–Benefit Analysis (CBA) assists the decision making process by expressing all relevant
costs and benefits of decision options in common terms, usually monetary values, so they
can be compared. CBA used with risk analysis entails a comparison of the sacrifice (costs)
and the risk reduction (benefits) achieved for a risk reduction measure. Benefits gained by
risk reduction are the risks avoided. Benefits gained by tolerating risk include employment
and beneficial use of products. Both benefits and costs may have intangible contributions
that are difficult to quantify.

Appendix C presents a suggested methodology that might be used to perform CBA when
QRA is involved in the decision making.

7.0 Demonstration of ALARP

7.1 General

To reduce risk to a level which is ALARP involves, for each proposed risk reduction
measure, balancing reduction in risk against time, trouble, difficulty and cost of achieving it.
This level presents the point, objectively assessed, at which the time, trouble, difficulty and
cost of further reduction measures become unreasonably disproportionate to the additional
risk reduction achieved.

ALARP is not just a demonstration that risks of the preferred or selected option are tolerable
and/or comparable to other similar developments. Demonstrating ALARP requires
consideration of fundamentally different options for further risk reduction over the lifetime of
a facility or operation. Demonstrating ALARP requires consideration of all the issues related
to a range of options and a judgmental decision at the right level in the organization with the
full knowledge of all the options, and associated risks and costs.

Demonstrating that the risks have been or will be reduced to ALARP typically consists of
addressing the following questions:

a. “What Control Measures are already Implemented?”


The answer to this question is qualitative in nature. It entails the identification of
control measures to eliminate or, if it is not practicable to eliminate, reduce the risks

b. “What more can I do to reduce the risks?"


The answer to this question is qualitative in nature. It entails looking systematically at
the risks and drawing up, in a proportionate way, a list of measures which could be
implemented to reduce those risks. Only in a minority of circumstances will there be
nothing further that can be done. However, the need to act is determined by
answering the second question.

c. "Why have I not done it?"


The answer to this question may be qualitative or quantitative in nature depending on
the predicted level of risk prior to the implementation of those identified further
measures. It entails an evaluation of the reasonable practicability of the identified
measures.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 13 of 26

Whichever way the question is answered, if the measure is technically reasonable,


based on engineering considerations, and it cannot be shown that the cost of the
measure is grossly disproportionate to the benefit to be gained, then the measure
shall be implemented.

d. “How will ALARP be Assured?”


The answer to this question is qualitative, and it entails establishing a system for
monitoring, audit and review of actions and controls to achieve ALARP.

7.2 Risk Levels and ALARP Demonstration


The concept of what is reasonably practicable includes the principle that the higher the risk,
the more time, attention, effort and cost needs to be directed towards reducing it. What
might be reasonably practicable when risks are high, may well not be reasonably practicable
if risk levels are low.

Based on Figures 1, 2 & 3 above, three different types of ALARP demonstration can be
established as follows:

Intolerable Risk
This region is defined by the dividing line between the unacceptable and tolerable regions,
which for KOC is given as 10-3/yr. own personnel, and 10-4/yr. for Public; both in terms of
IRPA (see Figure 1 above).

Clearly, if the risk falls in this region (whether for individual or societal risk) then ALARP
cannot be demonstrated and action must be taken to reduce the risk irrespective of cost.
Therefore, risks assessed to be in the Intolerable band shall be given immediate attention
(including stopping of the activity or abandoning the associated option) to minimize risk
exposure such that the risk is reduced to the “Tolerable” band. Operation in the Intolerable
region for a short duration may be considered only if there are no alternatives and people
are fully informed and in acceptance.

“Tolerable if ALARP” Risk


The dividing line between the tolerable and broadly acceptable regions defines this region,
which for KOC is given as 10-5/yr. for own personnel, and 10-6/yr. for Public; both in terms of
IRPA (see Figure 1 above).

If the risks fall in this region then a case specific ALARP demonstration is required. The
extent of the demonstration should be proportionate to the level of risk. This in fact entails
that risks assessed to be in the Tolerable band shall be analyzed and reduced to levels that
are demonstrably ALARP. Risks within the tolerable region cannot automatically be
considered to be ALARP. Demonstrations are required to justify that the risks have been
reduced to ALARP.

Broadly Acceptable Risk


This is the region defined below the dividing line between the tolerable and broadly
acceptable regions, which for KOC is given as 10-5/yr. for own personnel, and 10-6/yr. for
Public; both in terms of IRPA (see Figure 1 above).

Risks assessed to be in the Broadly Acceptable band do not require detailed working to
demonstrate ALARP. Effort to analyze and reduce the risks further shall form part of a
continuous improvement program.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 14 of 26

The risk reduction and ALARP Demonstration processes shall be applied throughout the
lifecycle of the installation, sites or activity, from design through operation to
decommissioning. This includes the application of the hierarchy of risk at the design stage
so that the emphasis is on hazards being managed by an inherently safer design that will
prevent their realization rather than just mitigating the effects. This process shall take into
account advances in technology, changes in design developments, improvements in risk
assessment methods and databases, modifications to plant and/or operating procedures
and changes in activities.

It is not an acceptable practice in KOC to transfer management of risk from one stage
of the PGS to the next one, or from the design phase of a project to the operational
phase.

7.3 The ALARP Demonstration Process


To ensure a risk has been reduced to ALARP it is first necessary to confirm that the design
meets KOC and international codes and standards, as well as Kuwait regulations. It is also
necessary to ensure that the risk to individual workers and the General Public is tolerable
(falls in the ALARP region of the RTC depicted in Figures 1, 2 & 3 above). If it is not, then
compulsory risk reduction measures must be taken until the risk is within the tolerable
(ALARP) region.

Once the risk is tolerable, it is still necessary to demonstrate that the risk is ALARP. This is
done by showing, for each activity, or facility, or project (or at each project gate), that the
following aspects have been covered:

a. Efforts have been made to identify hazards with the potential to cause harm to
people.
b. The risk derived from each hazard has been evaluated, either qualitatively or by
using QRA.
c. The existing (or proposed) measures to reduce the risks to people affected by those
hazards have been identified and assessed. These measures may prevent an
incident from occurring or, less preferably, mitigate to reduce the effects of an
incident if it occurs.
d. If the existing controls do not reduce the risk to the broadly acceptable region, further
risk reduction measures are identified.
e. The added benefit of each risk reduction measure is assessed to determine whether
it is viable or whether the benefit is grossly disproportionate to the sacrifice involved
in the measures necessary for averting the risk (whether in money, time or trouble).
f. Once all risk reduction measures have been considered and the justification for
acceptance or rejection documented, then it can be considered demonstrated that
risks to people have been reduced to the lowest level that is reasonably practicable
(ALARP).

In practice, it is necessary to demonstrate that the sacrifice involved in implementing a risk


reduction measure (or set of risk reduction measures) would be grossly disproportionate to
the benefits achieved from the proposed risk reduction measures. It follows then that
substantially more effort shall be made to reduce risks where the risk is close to the
intolerable region than for risks that are judged to be closer to being broadly acceptable.

Thus, the process, in addition to being one of balancing the costs and benefits of
measures, it is also one of adopting measures except where they are ruled out
because they involve grossly disproportionate sacrifices.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 15 of 26

As an aid to facilitate the ALARP Process, Appendix D presents a template to be used for
the process, including explanations of each entry in the template. This appendix also
includes a tool and criteria for the evaluation of risk reduction measures in terms of sacrifice
and benefits.

Appendix E presents a series of tenets, which reflect some additional criteria and rules,
which may help during the application of the ALARP Principle in KOC.

7.4 Documentation of the ALARP Demonstration Process


KOC must be able to provide evidence that demonstrates that the risks of a particular
design, facility or activity have been reduced to ALARP. This entails that KOC must be able
to document that the lowest risk option has been adopted unless the risk reduction gained is
grossly disproportionate to the cost, time or effort involved in its implementation.

The documentation can be achieved by firstly documenting the basis for the decision to do
an ALARP study and secondly to document the options considered in the ALARP
Demonstration Process. This entails that the entire ALARP Demonstration Process shall be
fully documented, starting with the ALARP Workshop results, and including all the required
evaluations and calculations.

A final report documenting the complete ALARP demonstration process shall be


issued. Each ALARP demonstration is a formal document and is a critical deliverable.

8.0 Bases for Decision Making

8.1 Framework for Risk-Based Decision Making

Understanding and defining the decision(s) that must be made is critical. This includes
definition of the decision to be made (e.g. to do or not to do something, how best to improve
a facility or operation, etc.), who needs to be involved/consulted (e.g. key stakeholders),
options available, factors and issues that influence the decision(s) and decision context (e.g.
novelty vs. well understood situation or practice, risk trade-offs, uncertainties, risk
perceptions, business and economic implications) and factors that influence stakeholders
(internal and external).

UKOOA has developed a framework, which has already been tailored to KOC (see Figure
No. 4) to promote transparent decision making and assist decision-makers choose an
appropriate basis for their decisions and demonstration of ALARP. The framework helps
decision-makers assess the relative importance of codes and standards, good practice,
engineering judgment, risk analysis, cost benefit analysis and KOC and societal values.

The framework takes the form of a spectrum of decision bases, ranging from those
decisions dominated by purely engineering concerns (technology based decisions) to those
where company and societal values are the most relevant factors (values based decisions).
Typical characteristics which indicate the decision context are given on the right hand side
of the framework. Once the decision context type has been identified, reading horizontally
across the framework shows the suggested balance of decision bases to be taken into
account (see Appendix A). The relative proportions of the horizontal band in the various
zones of the framework indicate the relative importance that should be attached to each the
decision bases (e.g. codes & standards, good practice, use of QRA/CBA, or consideration of
KOC or societal values). Some means of calibrating or checking the decision basis are
shown on the left-hand side of the framework (see Appendix B).
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 16 of 26

Significance to Decision
Consultation Making Process Context
• Nothing new or unusual
Codes & • Established practice
Expert Standards A • No major stakeholder implications

Verification
• Lifecycle implications
Peer Review • Some risk trade-offs/transfers
B • Standard or best practice
• Significant economic implications
Benchmarking

Internal Stakeholder • Very novel or challenging


• Strong stakeholder views and perceptions
KOC
Societal
C • Significant risk trade-offs or risk transfers
Values • Large uncertainties
External Stakeholder Values • Perceived lowering of safety standards

Figure No. 4 - Framework for Risk-Based Decisions (adapted from Ref. 6)

This framework can be used to provide a more transparent decision making process across
all KOC Directorates and business sectors. In this sense, technology based decisions which
only require reference to codes and standards or established practice can generally be
taken by the designer. As the risk or economic implications increase, the decision should be
elevated within the organization. Values based decisions which could have a major impact
on the business as a whole or KOC reputation should be referred to top management
(Leadership Committee).

As an example consider the following. The development of a gas transmission pipeline


across Kuwait desert would typically fall into “Type A” context; whereas developments in or
near urban areas or where some uncertainties exist would more likely be “Type B”. In some
circumstances, especially where these involve large risk implications or uncertainties such
as public risk (e.g. Jurassic Gas development in North Kuwait), internal and external
stakeholder views or expectations may need to be addressed. Clearly, this would clearly fall
in the context of a “Type C” decision.

8.2 Risk Assessment within the Framework


The framework indicates that risk assessment has a major input to Type B decisions (see
Figure 4 above). For Type A and C decisions, risk assessment is still relevant but is likely to
be much less influential in reaching the final ALARP decision. Higher elements of novelty,
uncertainty or stakeholder concern will demand more thorough risk assessment.

Further guidance on the various assessment approaches and methods including


applicability to the lifecycle stage is given in reference 3, which presents the methodologies
and criteria to be followed within KOC for risk assessment. Section 3.0 also presents a
series of other international references that may be consulted for risk assessment.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 17 of 26

The depth of the risk assessment ranges from qualitative (represented by “Q” in Figure 5
below) at the lowest risk level, through semi-quantitative (represented by “SQ” in Figure 5
below), up to quantitative (QRA) and Cost Benefit Analysis (CBA) at the highest level see
Figure 5 below). It is not necessary to use QRA or CBA to demonstrate whether risks are
ALARP for all facilities or activities, but these are likely to have some degree of input to
many decisions. QRA is particularly important for decisions involving risk trade-offs, novel
systems, deviations from standard practice or significant economic implications. The key is
choosing the right approach to provide the required information for robust decision making
without overworking the problem.

Tolerability of Risk Tiered Approach to Risk Assessment

Quantitative detailed, Objective, High


Assessment Resolution, low uncertainty,
Increasing cost,
Unacceptable Risk reduction
Grater decision flexibility
Region Regardless of cost Stop Is more information required?
Is more flexibility required?
QRA Is a more rigorous option analysis
Increasing Risk

required?
Relevant Good Practice
Semi-Quantitative
Tolerable SQ Plus
Assessment
Region Risk Reduction Measures
Plus
Is all required information available? Are
Gross Disproportion Stop the major risk drivers and controls known?
Is the uncertainty reduced?
Are the decision options clarified? Can the
Q Relevant Good safest option be identified?
Broadly Tolerable Region Simple, subjective, low
Practice Resolution, high uncertainty,
Qualitative Low cost, low decision
Assessment flexibility

Figure No. 5 - Depth of Risk Assessment

9.0 ALARP Assurance


Measures shall be implemented throughout the project and operational life cycle of any KOC
facility or activity to assure that ALARP is achieved and maintained. Assurance plans should
consist of an appropriate combination of the following:
a. Audit
b. Verification of Safety Critical Elements
c. Management Review
d. Project Reviews
e. Self-Assessment
f. Inspection
g. Testing
h. Active Performance Monitoring
i. Reactive Performance Monitoring
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 18 of 26

Appendix - A

Decision Bases

Codes and Standards


Decision basis is to follow the requirements of the relevant codes and standards.
Codes and standards embody the lessons learnt over past years, and for well
understood hazards and situations often provide an appropriate solution.
Good Practice
Decision basis is to follow what is generally accepted as current standard or
good/best practice.
Good practice embodies both the requirements of codes etc, and other good
engineering, analysis and management practices for common situations. Good
practice may include solutions that have not yet found their way into codes and
standards. What is good practice may differ from situation to situation. Care should
be taken to benchmark against the relevant good practice or emerging practice.
Engineering Judgment
Decision basis is to follow what sound engineering judgment indicates as the best
solution. This would be expected to include recognition of what is
good/best/emerging practice, and an understanding and application of sound
engineering and scientific principles and methods. It could include: engineering
analysis, consequence modelling, deterministic cases for hazard management as
well as competent judgment and interpretation of these and other information.
Risk Based Analysis (QRA, CBA etc)
Decision basis is to make use of the results of probabilistic analysis such as QRA,
reliability analysis and CBA to support the decision making process. The assessment
could be qualitative or quantitative. Uncertainties and the resolution of the analyses
vs. the needs of the decision will be key issues to address.
Company Values
Decision basis should take account of the views, concerns and perceptions of the
stakeholders directly affected by the decision/option and the values of the company
in terms of its safety commitment, image etc.
Societal Values
Decision basis should take account of the views, concerns and perceptions of all the
relevant stakeholders, including society at large etc.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 19 of 26

Appendix - B

Means of Calibrating the Decision Bases

Codes and Standards


Refer to latest codes and standards, regulations, approved codes of practice,
guidance and classification rules from e.g.: Industry bodies (UKOOA, BROA, IADC,
API etc.), International and National Standards (IMO, ISO, BSI etc), Regulatory
Authorities
Verification
Use verification process to demonstrate compliance with codes and standards,
established performance standards or good practice. Make reference to ‘verified’
arrangements and designs to demonstrate meeting good or best practice.
Peer Review
Use internal peer / expert review or consultation with external industry experts to
confirm the validity and robustness of any judgments or analyses made.
Benchmarking
Benchmark practices against others in the industry or other industries where
appropriate to show relevance and robustness of the approach and any principles
this is based on e.g. via technical committees/forums, industry contacts and experts.
Benchmark the scope, method and detail of the analysis and any assessment of
uncertainty against practices in other companies/ similar situations to show the
robustness of the approach.
Internal Stakeholder Consultation
Consult the views and perceptions of the stakeholders (such as the workforce)
directly affected by the decision/options e.g. by surveys, direct consultation,
consultation with safety representatives.
Benchmark these against the views of similar stakeholders in other companies or
business units.
Make attempts to identify and record the values of the company/project/unit or other
culture in which the decision is to be taken and the values of those which might be
affected by the decisions (e.g. downstream business/units/partners etc)
External Stakeholder Consultation
Consult the views and perceptions of the stakeholders directly and indirectly affected
by the decision/options e.g. by surveys, direct consultation.
Consider local, or International societal and industry views and perceptions.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 20 of 26

Appendix - C

Cost Benefit Criteria for Risk to Persons

Where quantified risk assessment is used with cost benefit analysis to demonstrate as low as
reasonably practicable, the following shall be undertaken:

(a) Identify possible, i.e. practicable, measures for risk reduction for each identified major
accident scenario.

(b) Quantify the financial costs and benefits of the risk reduction measure in order to
calculate the net cost of the measure (C) and estimate the risk reduction benefits
(PLL). Those costs and benefits that will be accrued in the future shall be discounted
using a basic discount rate. For each risk reduction measure calculate the Implied Cost
To Avert a Fatality (ICAF).
ICAF = C /PLL
where, C = the through life net cost of the risk reduction measure, i.e.
financial costs minus financial benefits (capital and operational), and
PLL = the potential loss of life throughout the remaining
life of the facility, and including any potential loss of life incurred
through implementation of the measure.
Risk aversion shall be taken into account within cost benefit analysis when calculating
the ICAF value.

(c) Calculate the cost per life saved criteria for each risk reduction measure. This shall be
calculated as follows:
Cost Per Life Saved Criteria = V * GDF
where, V = Base Cost Per Statistical Life Saved, and
GDF = Gross Disproportion Factor.
The Base Cost per statistical life saved shall be taken as KWD 1.0 million (January 2014
base cost).
The Gross Disproportion Factor (GDF) shall be taken as a linear variation from 1 at the
lower boundary of the as low as reasonably practicable region to 10 at the upper
boundary. This factor shall be based on the initial individual risk for the group of persons
who would most benefit, in terms of individual risk reduction, from the risk reduction
measures.

Generally speaking, a measure would not be considered worth the risk reduction
achieved if Costs/Benefits > GDF

The UK HSE (see References 12 to 14) has suggested GDF values of up to 3 for risks to
workers and 2 for low risks and 10 for high risks to members of the public. The greater
the risk, the greater should be the GDF to achieve a given benefit. Placing more weight
on benefits as the risk increases compensates to some extent for imprecision in the
comparison of costs and the benefits. As the risk increases, the imprecision has greater
impact so the use of a GDF factor errs on the side of safety.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 21 of 26

(d) For each risk reduction measure, compare ICAF against Cost per Life Saved Criteria for
that measure. If ICAF is greater than the Cost Per Life Saved Criteria for a given
measure (allowing some latitude for the accuracy of costing and risk reduction
estimates), review the potential for the combination of this measure with other measures
to evaluate whether combined measures would result in ICAF being less than the Cost
Per Life Save Criteria.

(e) For all risk reduction measures or combination of measures where ICAF is greater than
the Cost Per Life Saved, then risk reduction measures are not recommend. However,
the final decision will rest with senior management and their decision may be influenced
by external factors such as adverse publicity, loss of expertise, level of employee or
public concern, morale, etc. or by management awareness of strategic issues.

(f) For all risk reduction measures or combination of measures where ICAF is less than the
Cost Per Life Saved Criteria, then prioritize the implementation of the risk reduction
measures according to the following hierarchy,
- lowest ICAF has the highest priority, then
- highest Individual Risk Benefit has the next priority, then
- the shortest time for the implementation of the risk reduction measure
has the next highest priority.

(g) Recommendations from the Cost Benefit Analysis shall then be considered by
management in order to make the final decision on implementation.

(h) Risk Aversion is the concept that society has a greater adverse reaction to those
accident events that result in a large number of fatalities. Risk aversion shall be
addressed within QRA when setting the Societal Risk Tolerability criteria and calculating
the ICAF value in cost benefit analysis.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 22 of 26

Appendix - D

ALARP Demonstration Process

The ALARP Demonstration document shall include filling out the template shown in Table D-1
below, and it be fully referenced with any standards, procedures, studies and calculations
supporting the ALARP Demonstration. The overall template of an ALARP Demonstration is not
important, provided that the following aspects are thoroughly considered when completing the
ALARP Demonstration Process:

(a) Always refer to further supporting safety studies and calculations.


(b) A holistic approach is important in order to ensure that risk-reduction measures that are
adopted to address one hazard do not disproportionately increase risks due to other
hazards, or compromise the associated risk control measures.
(c) Where appropriate, consideration should also be given to the balance of risk between
workers and the public, and to the increased risk due to action taken during normal
operation which is intended to reduce risks during an emergency condition.
(d) A CBA may be appropriate in certain circumstances but this shall only be used if the
risk is already tolerable. It is preferred that CBA is used to compare risk reduction
options rather than discount single measures.
(e) Reference applicable performance standards and operating/construction requirements
which will be integral to the selected option.
(f) State if the inputs and outputs from a QRA are uncertain to some degree. In some
cases the uncertainties may be very large, and the conclusions of the QRA may be
sensitive to possible variations in the inputs and modelling assumptions.
(g) State the ALARP Decision for Each Risk Reduction Option: State the residual risk value
with reference to RAM or QRA as appropriate, and whether it is now intolerable,
tolerable or broadly acceptable.
(h) Summarize the practicability for each risk reduction option and whether it has been
accepted or rejected for implementation. Use criteria shown in Figure D-1 below.
(i) Provide the basis for maintenance of ALARP. To achieve this:
 List any recommendations for the subsequent phases.
 List requirements for measurement and testing and performance standards.
 Review if ALARP has been maintained after each process or operability change
(j) Ensure that supporting information is provided. Supporting information, including any
calculations shall either be appended to the ALARP Demonstration Report or published
in separate documentation and properly referenced.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 23 of 26

Heading Notes
Title Insert issue / decision title. Each hazard must be
given a unique title and ALARP Reference Number.
The Abstract must state the nature of the hazard
and define the scope of the ALARP Demonstration.
Problem Definition Identify the Project, or activity, etc. and the scope
of the area under consideration. Define the problem
for which an ALARP demonstration is required.

Safety Issues and Potential Risk Summarise the safety issues and hazards. Make
reference to any safety studies done, e.g. HAZOP,
QRA, SIL, etc. Describe the potential risk and
reference to RAM as necessary. Record whether
the risk from the hazard is intolerable, tolerable or
broadly acceptable. State the basis for this
decision (with references) and whether this
assessment is qualitative or on the basis of QRA.
If the latter, state the initial risk value and, if
known, the sensitivity and main drivers to reduce
the risk

Safety Standards and Tolerability Criteria Define the applicable safety standards (KOC, Best
Practices, API, Kuwait Legal Regulations, etc.)
and the KOC tolerability criteria as applicable.
Mention any Best International Oil Field Practices
that can be used in the absence of codes and
standards

Options Considered Summarise the options under consideration. List


all possible changes to the design or operating
mode that would reduce the frequency (likelihood)
and/or severity (consequences/outcomes) of the
event.
Basis for Selection Discuss the basis for selecting the preferred
option. Use the methodology presented in Tables
D-2 & 3 of this Appendix D for this purpose.
Present the pros and cons of each option, the
results of quantative analysis, and the reasons why
certain options are not viable. Give individual RAM
classifications if appropriate. This section may
refer to other safety studies and cost analysis
work. Define applicable performance standards
and operating/construction requirements which are
integral to the selected option.
Justification for Chosen Option Summarise the justification for a particular option.
This may include justifying why alternative options
where rejected.
Residual Risks List the residual safety risks.
Recommendations List any recommendations for the subsequent
phases of project, or activity
Requirements List requirements for measurement and testing and
performance standards (in particular performance
standards for SCE)

Table D-1. Template for ALARP Demonstration Process


KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 24 of 26

The risk reduction evaluation tool depicted in Tables D-2 & -3, is useful to assist in deciding
what risk reduction measures are warranted for the costs involved. The use of the disproportion
concept in the analysis formalizes the concept of reasonably practicable and provides
justification and transparency for decisions made.

Benefit
H M L Effort Factor

Decision
L L M H
Criteria
1 2 3

Cost M X Equals 1 to 11 12 to 17 18 to 27
2 4 6 1 2 3
Implement measure. No clear Implementation not
Benefit clearly disproportion. viable. Benefit is
favourable Consider grossly
H implementation disproportionate to
based on risk level. the sacrifice involved
4 6 9

Cost vs Benefit
Factor

Cost/Benefit Cost
Low <KD 50k
Medium KD 50k to KD 500k
High >KD 500 K
Tables D-2 & 3-Risk Reduction Evaluation Tool

The key concept in using the risk reduction evaluation tool is the tradeoff between the benefits
and costs of risk reduction measures. Eventually, a point of diminishing returns is reached
wherein expenditure increases markedly as risk reduction diminishes rapidly. The tool assists
the decision making process by allowing a comparison of the costs and the risk reduction
(benefits) achieved for a risk reduction measure.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 25 of 26

The tool helps in making judgments on whether risk reduction measures are reasonably
practicable. In this sense, a measure is adopted unless the cost is grossly disproportionate to
the risk. The cost is considered to be grossly disproportionate to the risk when the product of the
Cost/Benefit factor and the Effort Factor (see Table D-2), result in a number above 18. Tables
D-2 & -3 also demonstrate that the greater the risk, the more that should be spent in reducing it.
KOC.SA.042 Revision - 0
Guidelines for As Low As Reasonably Practicable
(ALARP) Demonstration Page 26 of 26

Appendix - E

Tenets of the ALARP Principle (derived from Reference 13)

The following tenets may help to better apply the ALARP Principle:

a. ALARP allows goals to be set rather than prescriptive requirements.


b. ALARP does not achieve zero risk. The risk arising from a hazard will be realized
sometimes, though the risk is ALARP.
c. Risk from an activity can never be eliminated entirely unless the activity is stopped.
d. Past performance is no guarantee of future success. Operation of a facility for many
years without a major incident does not prove the facility has a tolerable risk.
e. Absence of the evidence of risk is not evidence of the absence of risk.
f. Existing good practices can be used to establish what is ALARP. Good practice means
the minimum required and is not the same as best practice, which is a higher standard
(see definitions).
g. KOC should identify relevant good practices (i.e., those that are appropriate to the activity
and the associated risks, and that are up-to-date), comply with them as applicable,
determine if there are any other measures that would be effective in further reducing the
risks, and implement any such measures that are reasonably practicable.
h. For day-to-day hazards, explicit evaluations of risk rarely are needed, because relevant
good practices are likely available for controlling the risk from such hazards and the
adoption of good practices relieves KOC of the need to perform ALARP determinations.
i. Meeting good practice alone may not be sufficient. For example, in high hazard situations
where large numbers of people may be harmed in a single event, and where the
circumstances are not fully within the scope of the good practice. In such cases,
additional measures may be required to reduce risks ALARP.
j. For major hazards, often no relevant good practices are available that clearly establish
control measures required to reduce risks ALARP and ALARP determinations must be
made considering all lifecycle costs.
k. Good practices evolve from increased knowledge about hazards; technical innovations;
and changes in costs, management practices, and tolerable levels of risk. Higher
standards may become reasonably practicable.
l. When a code or standard is updated, processes/activities/facilities should be examined to
see if they can be brought up to the new standard. Such upgrades should be undertaken
if reasonably practicable.
m. Each incremental reduction in risk likely will require greater expenditure of resources.
n. More formal decision making techniques, including CBA are needed for high hazards,
complex processes, or novel situations.
o. Judgment that a risk is ALARP is not based on CBA alone. For example, societal
concerns, that is, public feelings about the risk, are also considered.
p. Determination of what is ALARP requires judgment. There is no simple formula for
calculating what is ALARP.
q. If the risk from a risk reduction measure is greater than the risk that it seeks to prevent,
the measure should not be introduced.
r. A number of risk reduction options may be available for which the costs are not grossly
disproportionate. The option, or combination of options, which achieves the lowest level
of residual risk should be implemented, provided grossly disproportionate costs are not
incurred. Less protected but significantly cheaper options should not be used.
s. A precautionary approach should be taken where the potential consequences are high by
giving more weight to the use of best engineering and operational practices than to
arguments about the probability of failure.