Guideline on the Principles for

discharging “Duty of Care” in

insecure environments
Report No. 473R
October 2012

CONFIDENTIAL – OGP MEMBERS ONLY

International Association of Oil & Gas Producers
P ublications

Global experience

The International Association of Oil & Gas Producers (formerly the E&P Forum) has access to a wealth of techni-
cal knowledge and experience with its members operating around the world in many different terrains. We collate
and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines

Our overall aim is to ensure a consistent approach to training, management and best practice throughout the
world.
The oil and gas exploration and production industry recognises the need to develop consistent databases and
records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their
operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information

Many of our guidelines have been recognised and used by international authorities and safety and environmental
bodies. Requests come from governments and non-government organisations around the world as well as from
non-member companies.

Disclaimer

Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither
the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their
negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded.
Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to
the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms.

This document may provide guidance supplemental to the requirements of local legislation. Nothing herein,
however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any
conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice

The contents of these pages are © The International Association of Oil & Gas Producers. Permission is given
to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are
acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP.

These Terms and Conditions shall be governed by and construed in accordance with the laws of England and
Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

Guideline on the Principles for discharging

“Duty of Care” in insecure environments

Report № 473R
October 2012

Revision history
Version Date Amendments
1 October 2012 First issued

©2012 OGP iii

International Association of Oil & Gas Producers

Acknowledgments

This report was produced by the OGP Security Committee.

iv ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

Contents

1 Introduction 1
2  Individual responsibility 1
3  Employers and the State 2
4  Oil and Gas operations in insecure environments 2
5  Changing Situations 4
6  Risk Assessment 4
7  Operators and Contractors 5
8  Expatriates and National Staff 7
9  Families and Dependents 8
10  Security Personnel and Host Government Security Forces 8
11 Communities 10
12  Joint Ventures and Partnerships 11
13 Conclusion 11

©2012 OGP v
International Association of Oil & Gas Producers

vi ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

1 Introduction
This paper builds upon the background commentary on the origin and nature of a
‘Duty of Care’ provided to the Security Committee of the International Association
of Oil and Gas Producers (OGP) by the Centre for Defence Studies of Kings College
London. In an increasingly litigious world, companies operating in areas that are,
or may become, insecure can find themselves exposed to unwelcome and often
unjustified attacks on their probity and reputation as a result of violent incidents or
confrontations. In addition, all reputable organisations involved in the oil and gas
industry share a desire to operate safely and ethically. A company’s recognition of its
Duty of Care and demonstration that it takes its responsibilities seriously and with
due consideration can go a long way towards mitigating subsequent risks, and towards
ensuring the safety, security and well-being of its people.

In order to minimise legal and reputational risk and promote a culture of safety and
security, the following principles and guidelines are proposed to help OGP members
meet their Duty of Care towards employees, contractors, security personnel and
communities when operating in insecure environments. This paper sets out some
principles and guidelines, based on accepted best practice, for security practitioners in
the oil and gas industry. For the purposes of this paper, ‘Duty of Care’ is deemed to be
a duty of an employer to take reasonable steps to ensure the security, safety and well-
being of individuals who are within the employer’s control or area of responsibility.

2 Individual responsibility
An overriding principle in respect of ‘Duty of Care’ in a security context is that each
individual bears a degree of responsibility for their own security. An employer must
provide a reasonable framework of security, commensurate with security risks, but an
individual employee is responsible for following security procedures and instructions,
and for taking appropriate care of themselves and their belongings.

As with safety, an employer must take reasonable steps, but if an employee deliberately
or negligently disregards or overrides measures designed to keep them from harm it
does not mean that the employer has failed in their ‘Duty of Care’.

©2012 OGP 1
International Association of Oil & Gas Producers

3 Employers and the State

A primary duty of any State is the security and protection of its citizens.

An employer operating in the oil and gas sector should not attempt to assume the
responsibilities of the host nation in this respect, but should recognise that it, like an
individual, should take due and appropriate care of its assets and personnel.

Matters such as crime or violence affecting employees are properly matters for the
host government’s law enforcement agencies. If no effective law enforcement exists
at any given time the employer may have to take greater responsibility for protecting
their personnel and assets, but at no time can they assume the rights of the State.

4 Oil and Gas operations in insecure environments

Global reliance on hydrocarbons as a primary source of energy is likely to persist for
the foreseeable future, and the oil and gas industry will therefore need to continue
to explore for, extract and produce fossil fuels to meet world demand, wherever
those fuels might be found. The industry has been doing this successfully for over
a century, and many international operators have maintained long-term, profitable
and safe production in once-peaceful places that have become increasingly unstable
and insecure. The cycle of exploration, production, decline and closure of oil and gas
fields is a lengthy one, and one which has different political, business and economic
drivers at different stages. Thus practices that are appropriate and desirable during
exploration may not be so during production. This is particularly true in relation to
security, and the exercise of ‘Duty of Care’.

It is essential, therefore, to establish a security concept or policy that is based on a

company’s particular ethos, and from that baseline build procedures, organisations and
partnerships that are in keeping with the company’s objectives at any given time, and
which are predicated on clearly defined and well understood risks.

This principle is equally applicable to service providers, exploration companies, and

international and national oil and gas producers. Sound, risk-based security planning
is an integral part of a company’s overall ‘Duty of Care’ to people in its charge. While
this is particularly so in higher-risk or insecure environments, it is true anywhere.

2 ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

For example, an international oil company (IOC) exploring offshore blocks may
require a representative office in a country that owns the blocks for the period of
exploratory drilling. The security policy should be to provide a secure environment
for the small number of expatriate and national employees needed for the project. The
strategic planning to meet that aim may include:
• conducting an appropriate risk assessment;
• determining whether or not families will accompany expatriates;
• provision of secure office and residential accommodation;
• ensuring reliable communications and logistical support;
• engagement of a reliable local security service provider;
• development of emergency plans, including evacuation and availability of
medical treatment; and
• developing appropriate relationships with host government security and
other agencies.

In formulating this type of approach companies will have demonstrated an early

commitment to meeting their duty of care from a security perspective, and integrating
security into other planning only serves to underline an overall commitment.

Having established a strategic security plan that meets the business requirement,
tactical security plans will explain to those responsible for service delivery how to
ensure that a secure environment is arrived at, and set out what a company will do to
fulfil its ‘Duty of Care’.

©2012 OGP 3
International Association of Oil & Gas Producers

5 Changing Situations
As mentioned above, the time scales involved and in oil and gas projects can be very
long. Initial discussions with host governments to completion of test drilling can take
several years, with production and decommissioning & abandonment coming still
more years after that, if at all. It is always possible, and often likely, that the political
or security situation in a country could change radically during the project cycle.

There are many opportunities to review investment decisions, significant changes in

security risks that may impact the project should inform such decisions.

The guiding principle here is that security risk assessment reviews and other planning
mechanisms should be built into the project planning and decision review cycle to enable
business leaders to give due and proper consideration to their ‘Duty of Care’ at the
appropriate time.

In addition to this, management may wish to explore a range of potential scenarios

that could impact their operations, both positively and negatively. These scenarios
could involve regime change in country, significant changes in overall security and
the host nation’s ability to deal with them, a business need to withdraw from the
country at short notice, and so on. The scenarios should be described, and signposts
towards each one identified. Importantly, the potential impact on the business needs
to be defined, as do the steps needed to mitigate negative effects.

Scenarios and risk assessments should be reviewed periodically, and particularly

when there is any major change in the status of the business or the security situation.

The process of risk identification and planning mitigation strategies is a significant

demonstration of a company’s commitment to exercising its ‘Duty of Care’.

6 Risk Assessment
There are a large number of risk assessment methodologies in use in the oil and gas
industry. The most common, and most easily recognised, are those relating to safety
issues. By definition, these are generally quantitative (i.e. they rely on statistical
data to determine the probability of an incident occurring and its impact) and they
determine appropriate mitigation measures to reduce the likelihood or severity of
such incidents. These risk assessments, and the safety culture that is prevalent among
responsible companies working in the industry, are a good demonstration of the way
in which ‘Duty of Care’ is discharged.

4 ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

The one element that differs in security risk assessments is the intention of an
individual or group determined to carry out an act deliberately to harm a person
or the interests of a company or industry. Assessing security risks using purely
quantitative assessment tools is therefore less effective than the qualitative approach,
i.e. assessing the capabilities and intentions of a potential adversary using subjective
as well as statistical data.

The goal in deciding which risk assessment method to use should be two-fold: firstly,
the assessment should produce a realistic appreciation of the risks that are specific to
the company or industry concerned in a given location; and secondly the assessment
should be recognised and accepted by the business as a tool in which they have enough
confidence on which to base decisions.

The guiding principle therefore should be to adopt a recognised risk assessment tool that
can be applied to the specific company or operation, taking into account individual factors
that can increase or lower security risks.

Generic security risk assessments provided by commercial providers may be of use,

but should not be relied on as the sole method of risk assessment unless specifically
adapted for the company or operation in question. Always, it is essential to include
non-security personnel in the risk assessment process in order to establish the factors
most critical to the operation that need most protection. Apart from adding value
to the risk assessment, inclusion of business people facilitates acceptance of the
assessment findings and mitigation measures, and it minimises waste of resources on
extraneous mitigations that do not address properly identified risks.

7 Operators and Contractors

There are two specific issues in relation to ‘Duty of Care’ in respect of an operating
company and its contractor companies. These are:
• agreement and compatibility of risk assessment and subsequent security
management systems, policies and procedures; and
• the issue of an operator’s responsibility for the well-being of contractor personnel.

In addressing these it is important to clarify expectations from the outset if an

employer’s duty of care is to be met. Significant discrepancies between assessments of

©2012 OGP 5
International Association of Oil & Gas Producers

security risks, either by an operator or a contractor, can lead to unnecessary exposure

and present unwanted vulnerabilities. Similarly, uneven measures can be dangerous
and costly.

A guiding principle therefore should be that both operators and contractors should
share information pertinent to security risks and risk assessment at an early stage in the
engagement, and ensure that consensus is reached to satisfy both parties that their
concerns are being addressed.

There will often be occasions where there is little, if any, overlap between an operator
and a contractor, for example where a seismic contractor is working alone prior to the
arrival of an operator. In this situation the onus is on the contractor to ensure that
risks are properly assessed and appropriate mitigation measures are employed. The
operator may still wish to be consulted to ensure that there is a consistent approach
and attitude towards security, and that the respective security management systems
are aligned and transitional bridging documentation is in place.

The second issue, an operator’s responsibility towards contractor personnel, is very

much related to the first in terms of managing security risks and implementing
security plans. It is arguable that a person’s direct employer will bear the ‘Duty of
Care’ towards that individual, but nevertheless there may still be a degree of control
(and therefore an assumption of at least some of the duty of care) exercised by the
operator. This would be the case in a remote closed camp where the operator provides
all life support and security for all staff on site. This would also apply to a situation
where the operator assumes a degree of control over the contractor’s working practices
by stipulating security measures to be taken. Examples of this are to be found in
places like the Niger Delta where operators have extensive security operations that
encompass contractors as well as their own employees.

The principle here is that security policy and provision, and therefore the ‘Duty of Care’, is
dependent on the minimisation of vulnerabilities, which may include using an operator’s
greater availability of resources and facilities to ensure the appropriate protection of a
contractor’s personnel where it is not practical for the contractor to do it alone.

6 ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

8 Expatriates and National Staff

As a general rule, ‘Duty of Care’ is owed to all employees, whether they are locally
employed or expatriate. The extent of the duty will vary, depending on how
much responsibility the employer assumes for the well-being of the employee, for
example where the employer assumes responsibility for providing food, shelter
or transportation to an employee. An expatriate employee may have a greater
dependency on the employer than a locally engaged employee, especially in areas
such as presence or residency in the country, and the employer may have a greater
contractual responsibility for the employee.

In terms of security, a locally engaged employee has the same expectation that an
employer will exercise a ‘Duty of Care’ as would his expatriate colleague. However,
the security risks for one group of employees may be significantly different from those
affecting another group. For example, a senior expatriate employee might be seen as
a more attractive target for robbery or kidnap than a more junior employee engaged
locally.

The one area where there are differences in expectation is the rare event of evacuation
due to security issues. In this case a locally engaged employee would not normally be
removed from his home country to another by an employer, whereas an expatriate
employee (and their dependents) might be. However, both locally engaged employees
and expatriates could be removed from a place of danger to a safer place within
the same country until the emergency has passed. The reasons for the difference in
treatment of locally engaged and expatriate staff in cases of evacuation are complex,
and include issues of nationality, immigration and refugee status, family ties, and so
on. For an expatriate, the employer’s responsibility is to return the employee (and
dependent family) to their home country.

The guiding principle is that all employees can expect a ‘Duty of Care’ to be exercised in
respect of their own security, commensurate with the security risks they face. In addition
to this, there may be additional obligations on the employer in respect of expatriate
employees due to the extension of responsibility that the employer assumes.

©2012 OGP 7
International Association of Oil & Gas Producers

9 Families and Dependents

As with expatriate and locally engaged employees, there is no difference in the ‘Duty
of Care’ owed to families and dependents of expatriate or locally engaged employees
where the employer has assumed a degree of responsibility for them. For example,
an employer who provides a medical facility to employees and dependents, and the
facility is protected by the employer’s security arrangements, everyone at the facility
is subject to the security arrangements. The same would apply where the employer
provides secured housing for locally engaged and expatriate staff.

However, when locally engaged employees are responsible for their own affairs, the
employer’s ‘Duty of Care’ does not extend into the employees private life.

Particular care should be taken in this regard in instances where a locally engaged
employee is the victim of kidnap for ransom. Involvement by an employer in
responding to the crime may have adverse consequences for the victim or their family.

10 Security Personnel and Host Government

Security Forces
It is generally accepted that people employed in an emergency response function, such
as fire fighters, security personnel, etc, are willing to accept a higher level of risk than
other employees. Similarly, members of the armed forces traditionally acknowledge
that they may have to face extreme risks in the course of their duties. In the case
of security personnel, be they employees or contract staff, a company still has a
duty of care towards them. The company should ensure that security personnel are
properly trained and equipped, as they would for fire fighters, to meet potentially
hazardous challenges associated with their duties. Such training should include
matters such as conflict management, appropriate use of force, and the Voluntary
Principles on Security and Human Rights (http://www.voluntaryprinciples.org/).
Equipment should include appropriate protective clothing and defensive equipment,
communications, and so on. In addition, it is important that security personnel have
clear instructions and good leadership.

The principle in respect of security personnel is that the discharge of the ‘Duty of Care’ is
demonstrated through provision of the appropriate level of training and equipment, and
instructions and leadership, to enable them to meet expectations as to the situations they
should deal with and how to conduct themselves. A company’s expectations of its security
personnel in these respects should be realistic and clearly understood by all parties.

8 ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

A company’s duty of care towards government security forces and military personnel
is less clear. In summary, a company should have no role in the command and control
of military or police personnel.

However, they have a right to attempt to influence their conduct by making them aware
of the Voluntary Principles on Security and Human Rights, and explaining clearly the
company’s desires and expectations.

Deployment of military or police is a decision taken by the host government in

defence of the host government’s interests, even if those deployed are exclusively
protecting a company’s personnel or assets. It is acceptable for a company to provide a
reasonable level of accommodation, food and water, and non-aggressive equipment to
government security forces deployed in its operations. A company should not provide
weapons, ammunition, any items with potentially offensive uses, or military training.
The nature and purpose of transportation afforded to military or police personnel
should be carefully considered by company management before it is provided.

A guiding principle here is that a company has no responsibility for the safety and well-
being of police or military personnel deployed by and under the command of a host
government, but humanitarian gestures are appropriate.

A company’s reputation may be affected by the actions of military or police action

associated with its operations, and therefore the company may use its influence
to explain its expectations and desires in respect of such actions. A company may
be challenged in courts outside the host country in respect of the actions of host
government security forces, and it should be mindful of this possibility in its
engagements with them.

©2012 OGP 9
International Association of Oil & Gas Producers

11 Communities
The modern oil and gas industry operates in partnership with host governments and
host communities. The traditional view of multi-national corporations bestowing
gifts of schools and hospitals on inhabitants close to their operations is outdated,
and there is much more focus now on creating sustainable benefits for communities.
Most companies in the industry will now go to great lengths to avoid any suggestion
that they are taking on any of the responsibilities of local or national government in
respect of their community neighbours. Instead, they prefer to identify themselves as
employers and neighbours, and this is where the ‘Duty of Care’ should reside.

Community members who are employees or contractors have a defined relationship

with a company. Other community members have a less clearly defined one. The duty
towards these has two aspects: keeping the community safe from harm, for example
by having suitable perimeters to prevent access to operations; and preventing adverse
contacts between security personnel (company or government) and community
members.

A guiding principle in respect of the first matter is that companies should ensure that
there is adequate perimeter demarcation, and access control, fencing or barriers where
appropriate, to prevent unauthorised access to areas of potential danger.

A company also has the right to protect its own property, and appropriate fencing or
barriers may also help in this.

The risk to communities from security personnel working on behalf of companies

may be more difficult to mitigate, especially where there is animosity or conflict
between the host government and the community in question. A company can direct
its own security personnel, and thus reduce risk of confrontation and harm, but it
cannot direct government security forces.

A guiding principle here is that a company must develop and adhere to a plan of
community engagement that clearly separates the company from any dispute between a
host government and the community.

This principle is in addition to those outlined in respect of government security forces

above.

10 ©2012 OGP
 Guideline on the Principles for discharging “Duty of Care” in insecure environments

12 Joint Ventures and Partnerships

Oil and Gas exploration and production ventures in current times almost always
entail joint ventures and partnerships between both National and International Oil
and Gas Companies, and including both local and international service companies
and contractors. Many of these will be members of the OGP, but some will not.
The industry is already making allowances and seeking accommodations to meet
the differing cultural and commercial needs of all parties in joint ventures and
partnerships. However, responsible participants in the industry do not compromise
on safety or care for the environment.

It is an increasingly important principle that a similar, uncompromising attitude

towards security and the Duty of Care is also embedded in joint venture and partnership
agreements, and that all reasonable influence is exerted to ensure that compatible values,
polices and processes are adopted by all parties.

13 Conclusion
The framework of principles set out will help participants in our industry, whether
they are producers, service providers, operators, partners or contractors, to identify
the extent and scope their own Duty of Care. It should also enable them to develop
policies and processes that are compatible with, and complementary to, those of
other companies engaged in the same ventures. A failure by any component part of
a venture in respect of its attitude towards care for its people, and others associated
with it, will inevitably be seen as a failure of the collective whole. The consequences
of such failures can be far-reaching, and apart from causing harm to people can also
destroy a company’s reputation and business.

As such, the Security Committee of the OGP strongly urges all members to adhere
to the principles set out here, and to strive to ensure that their own Duty of Care is
discharged fully in the best interests of the company and the industry.

©2012 OGP 11
International Association of Oil & Gas Producers

12 ©2012 OGP
For further information and publications,
please visit our website at

www.ogp.org.uk
209-215 Blackfriars Road
London SE1 8NL
United Kingdom
Telephone: +44 (0)20 7633 0272
Fax: +44 (0)20 7633 2350

165 Bd du Souverain
4th Floor
B-1160 Brussels, Belgium
Telephone: +32 (0)2 556 9150
Fax: +32 (0)2 556 9159

Internet site: www.ogp.org.uk

e-mail: reception@ogp.org.uk