Assessing Well-Integrity Risk: A Qualitative
Model
J.C. Dethlefs, SPE, ConocoPhillips, and B. Chastain, Arktis
Summary
For successful delivery of well integrity (WI), there needs to be
an understanding of the risks that can cause undesirable events
such as safety hazards or loss of containment. Performing a risk
assessment (RA) on a well, or type of well, will help determine
and rank the potential risks and provide information that allows
limited resources to be applied in the most effective manner. The
main objectives of performing a risk assessment include (a) fol-
lowing a formal process to assess risk consistently and to enable
comparison between well-barrier failure-mode scenarios; (b) qual-
itatively assessing well-barrier failure risk for every segment of a
well; (c) documenting suggestions that are offered by the risk-
assessment team for mitigating well-barrier failure risk; and (d)
providing a report of the methodology, failure-mode scenarios,
risk ranking, and potential mitigation actions for use as a refer-
ence tool for managing WI on a routine basis.
Our WI/RA model follows a common qualitative risk-assess-
ment process—a team-based, structured brainstorming format,
using the “What-If Methodology” to identify potential hazards
associated with well-barrier failure modes. In addition, the model
has the following attributes:
 It incorporates a unique method to segment well barriers into
discrete sections, successively “failing” each section for evaluation.
The list of analyzed well-barrier failure modes, along with their risk
ranking, becomes the risk register for the well or type of well.
 It is adaptable for assessing well-barrier failure modes on a
single well, or a group of wells, having the same general design
parameters. An entire well portfolio can be assessed quickly by
analyzing types of wells rather than individual wells.
 It can be used to assess well-barrier failure risk for any type
of well.
 The model can easily be modified to conform to any com-
pany’s risk model.
The WI/RA model has been proven to
 Successfully assess well-barrier failure risk for thousands of
wells
 Focus specifically on well-barrier failure modes, and as a
result be an effective tool that should be incorporated into a “best-
in-class” WI program
 Be used as a management tool to provide guidance for how
limited resources can be used effectively to continuously deliver
WI.
Introduction
One definition of WI is “the application of technical, operational,
and organizational solutions to reduce the risk of an uncontrolled
release and/or unintended movement of well fluids throughout the
life-cycle of a well” (NORSOK 2004). Using this definition, for
successful delivery of WI there must be an understanding of
potential problems or situations of elevated risk that may cause an
uncontrolled release from, or unintended fluid movement in, a
well. Performing an RA on a well, or type of well, will increase
the understanding of the potential negative impacts, or consequen-
ces, that may result from specific problems a well may have or
Copyright V
C 2012 Society of Petroleum Engineers
This paper (SPE 142854) was accepted for presentation at the SPE/ICoTA Coiled Tubing
and Well Intervention Conference and Exhibition, The Woodlands, Texas, USA, 5–6 April
2011, and revised for publication. Original manuscript received for review 30 September
2011. Revised manuscript received for review 16 February 2012. Paper peer approved 21
February 2012.
294
may develop. The asset operator can use this information to
reduce risk from well operations and minimize potential WI prob-
lems. This may include updating or modifying processes, proce-
dures, and practices used during the construction and operation of
the wells.
The scope of work for an RA is to assess the various barriers
available in the well that prohibit unintended fluid movement.
This is done by analyzing a variety of barrier-failure modes to
determine the likelihood of the barriers failing and the severity of
the consequences should the barriers in place fail. This serves to
define the risk because the mathematical definition of risk is the
combination of the likelihood of a failure event happening and the
consequences of that event should it occur.
This paper is intended to provide a general description of an
RA process that has been developed and implemented to assess
well structures as they relate to WI issues. The basis for the pro-
cess is a qualitative risk assessment that is optimized to evaluate
the types of problems that wells may encounter throughout their
life cycle. Performing an RA on a well portfolio is a best-practice
approach for understanding likely WI problems and their potential
consequences, so that diagnostic and mitigation efforts can be
focused to provide the most benefit.
The RA process described is suitable for evaluating an individ-
ual well, groups of similar wells, or an entire well portfolio.
Rather than evaluating specific wells, this model allows for a set
of wells with similar design parameters to be assessed. The more
well types that are required to be assessed, the more time and
effort will be required to perform the RA. If several well types are
to be assessed, then the RA will be a multiday effort; past experi-
ence shows that it takes approximately one-half day per well type
to complete the evaluation. Whether assessing one well or many,
the process should follow the basic RA steps detailed in this pa-
per. Proper scoping and an understanding of the needs and desired
deliverables should dictate the level of effort required for per-
forming the RA.
Qualitative Model
The WI/RA model is a qualitative tool that can be used for evalu-
ating the risk of well-barrier failures; it is not intended to be a
quantitative risk assessment (QRA) that will provide a numerical
value of risk level. A qualitative approach for assessing WI risk is
an appropriate assessment tool that is used because of the general
lack of comprehensive industry data for these types of failures,
particularly for onshore operations. Operating companies typi-
cally do not record or maintain accurate records of the number
and types of actual failures that have occurred over time, and
sharing of such data within the industry is generally lacking.
However, employing a qualitative approach relies heavily on the
experiences and knowledge of the RA participants and, therefore,
is subjective in nature. To deliver a thorough and consistent quali-
tative assessment, it is imperative to have participation from expe-
rienced and knowledgeable RA team members from a variety of
disciplines and backgrounds.
The RA uses a risk matrix in the evaluation process, which
provides a numerical value for risk based on the likelihood and
consequences of an event taking place. Typically, there is a com-
mon model used throughout a company’s operating areas, which
is important for defining the organization’s risk tolerance, main-
taining consistency for risk determination, and comparing risk
results from one area with those of another. For assessing WI risk,
June 2012 SPE Drilling & Completion
 TABLE 1—CONSEQUENCE-SEVERITY DESCRIPTION (MOST SEVERE TO LEAST SEVERE)

Envir. Impact Asset Business Negative Public Public

Category Safety (Remediation)* Damage* Interruption* Image Exposure Notification

5 Fatality, public > $10 MM** > $10 MM > $10 MM National Complete area
hospitalization, or coverage evacuation
severe health
effects
4 Permanent disabil- $1 MM to $10 MM $1 MM to $10 MM $1 MM to $10 MM Regional Selected areas
ity, multiple hospital- coverage of evacuation
izations, or major notification
health effects
3 One or more lost $100 M to $1 MM $100 M to $1 MM $100 M to $1 MM State Shelter-in-place
time workday cases coverage notification
or significant health
effects
2 Medical treatment $10 M to $100 M $10 M to $100 M $10 M to $100 M Local Local (selected
with restricted duty coverage phone/leaflet
or medium health notice)
effects
1 Medical treatment, $ 0 to $10 M $ 0 to $10 M $ 0 to $10 M No outside No communica-
minor health effects, coverage tion to public
first aid case, or less
*Severity values for may need to adjusted as applicable for costs in the local area.
**All monetary amounts are given in USD.

the most common consequence categories to be considered as
“consequences of concern” are safety and environmental impact.
Other consequence categories that may be included in the assess-
ment, but are not limited to it, are asset damage, business interrup-
tion, public image, and public notification. The severity of the risk
is determined by the product of the likelihood ranking and conse-
quence level of an event if it occurs. See Tables 1 through 4 for
an example risk matrix and supporting tables.
Objectives
The main objectives for performing an RA include
 Following a formal process to assess risk consistently and to
enable comparison between the individual risk levels associated
identify potential hazards associated with well-barrier failure
modes. General steps of the RA process are
 Determine a WI single point of contact (SPOC) to plan and
organize the RA. The SPOC is typically the person(s) responsible
for delivery of WI for the asset.
 The SPOC, with management support, should establish the
specific objectives to be gained, such as the number and types of
wells to be evaluated, and specific deliverables required from the
RA process.
 The SPOC should coordinate the RA-team member selec-
tion, including a facilitator and scribe, as well as schedule the
time and location for the meeting.
 The WI SPOC and facilitator should work together to
* Confirm the methodology to be used and determine the data

with the various well-barrier failure modes. requirements for the assessment.
 Qualitatively assessing well-barrier failure risk for every * Enlist an asset technical expert to provide a description for

segment of a well and providing a risk ranking of all of the well- each of the well types to be evaluated.
barrier failure modes for each type of well to be evaluated. * Define and list the well-barrier failure modes to be evaluated

 Providing suggestions and/or recommendations for mitigat-
ing annular communication and/or well-barrier failure mode sce-
narios that have unacceptable or highly elevated risk levels.
 Providing a report of the methodology, failure-mode scenar-
ios, risk ranking, and potential mitigating actions for use as a ref-
erence tool for managing well operations on a routine basis.
Methodology
The RA is performed using a qualitative, team-based, structured
brainstorming format, following the What-If Methodology to
for each well type.
 Following the established process, the facilitator will lead
the RA team in qualitatively assessing each well-barrier failure
mode scenario and determining the likelihood and consequences
of each of the scenarios being considered.
 During the meeting, the scribe records the meeting discus-
sions and populates the risk-register table that lists and describes
each failure mode, the likelihood and consequence levels, and
the final risk-ranking determination. Throughout the process, the
scribe also records suggestions and/or recommendations from the
RA team members for mitigating the risks.

TABLE 2—LIKELIHOOD CATEGORIES

Category Frequency Quantitative Range /Yr* Description

–1
5 Frequent > 10 Likely to occur several times a year
4 Probable 10–3–10–1 Expected to occur at least once in 10 years
3 Rare 10–4–10–3 Occurrence considered rare
2 Remote 10–6–10–4 Not expected nor anticipated to occur
1 Improbable < 10–6 Virtually improbable and unrealistic
*The values in the quantitative range should be used as guidance in selecting the appropriate likelihood category. These
values should not be used in the risk calculation.

June 2012 SPE Drilling & Completion 295

 TABLE 3—RISK MATRIX

5 II II III IV IV

5 10 15 20 25
4 I II III III IV

LIkelihood 4 8 12 16 20
3 I II II III III

3 6 9 12 15
2 I I II II II

2 4 6 8 10
1 I I I I II

1 2 3 4 5
1 2 3 4 5
Consequence
Risk: Likelihood X Consequence

 The RA team computes the risk ranking for each scenario,
which is the product of the likelihood and consequence rankings.
 Each well-barrier failure mode is evaluated completely
before moving on to the next failure mode. The process repeats
until all of the scenarios for that well type are evaluated.
 The team will repeat the assessment process for each type of
well in the portfolio to be evaluated. After all well types have
been reviewed, the work of the RA team is completed.
 The risk-register table, risk rankings, and mitigation sugges-
tions can be compiled into a final document for use as a reference
to prioritize mitigation efforts and assist with management of WI
issues on a routine basis.
 Once the evaluation is complete, the asset management
should consider the results of the RA as they relate to the com-
pany’s overall risk level criteria to determine where assigned risk
levels exceed the company threshold tolerances. The asset man-
agement can use the results to develop a risk-reduction plan to
manage WI levels to as low as reasonably practicable (ALARP)
and to decide which recommendations made and suggested miti-
gative actions by the RA team, if any, should be implemented to
reduce overall WI risks to an acceptable level.
Team Selection
When performing a qualitative RA, having the right team mem-
bers is imperative for completing an effective evaluation. Unlike
a quantitative RA, where actual failure-rate data are used to gen-
erate risk rankings, a qualitative RA relies on the knowledge and
experience of the team members. The suggested team makeup
and a listing of the various team-member titles, positions, and dis-
ciplines for conducting an effective WI RA are described in the
following subsections.
Technical Resource. The asset sponsoring the RA should have a
technical resource or SPOC for coordination of the RA process,
including team-member selection, venue logistics, data prepara-
tion, and all other aspects of sponsoring a large group meeting.
The SPOC, or their designee, will play a key role during the RA
meeting to explain each well-type design and service characteris-
tics and will provide other pertinent information about the well
being evaluated. The technical resource is typically a WI engineer
or the equivalent functional position responsible for delivery of
WI for the asset. In most cases, this person will follow up on any
post-assessment action items.
Technical Experts. The quality and success of the RA depend
on the experience and knowledge of the participants in the discus-
sion. Having numerous experienced members with a variety of
viewpoints will result in a more-thorough examination of the
potential well-barrier failure modes and possible outcomes than if
fewer or less-experienced members take part in the meeting. In
addition, team members from outside of the asset should be con-
sidered to provide insight from other assets’ experiences.
Advanced planning for the RA is important so that arrangements

TABLE 4—RISK CATEGORIES

IV High High Risk. Manage risk utilizing prevention and/or mitigation with
17–25 highest priority. Promote issue to appropriate management level with
commensurate risk assessment detail.
III Significant Significant Risk. Manage risk utilizing prevention and/or mitigation with
12–16 priority. Promote issue to appropriate management level with
commensurate risk assessment detail.
II Medium Medium Risk With Controls Verified. No mitigation required where
5–10 controls can be verified as functional. ALARP should be evaluated,
as necessary.
I Low Low Risk. No mitigation required.
1–4

296 June 2012 SPE Drilling & Completion

can be made for the desired members to be available throughout
the entire exercise.
Team members that have proven to be effective contributors
during previous assessments include, but are not limited to, the
following:
 Operations engineer
 WI engineer
 Well-operations coordinator
 Completions engineer
 Operations supervisor
 Operations superintendent
 Production engineer
 Well-services coordinator
 Drilling engineer
 HSE advisor
 Public relations
 Safety specialist
Team selection and planning should also address the appropri-
ate number of participants for the review. To achieve adequate
viewpoints of the issues, a minimum of five to as many as 10 partic-
ipants should be considered for the role of technical experts.
Assessments with as many as 20 participants have proven to be
manageable and successful; however, the effectiveness of the
review is generally dictated by the manageability of the group of
participants. It has been noted that a common team-member state-
ment at the conclusion of previous assessments is, “I learned a lot.”
Therefore, the RA process also can be considered to be a valuable
training tool as well if managed properly. If more individuals par-
ticipate, even as observers, then more people in the organization
will become familiar with WI issues. These benefits come with a
cost; generally, the more participants that are involved, the longer
the assessment will take, with potentially less-robust results.
Facilitator. To perform an RA, the team is required to stay
focused on the discussion for long periods of time. Because of the
nature of the process, it is easy for the team to become distracted
by off-topic issues, or to get bogged down attempting to fix prob-
lems. To keep a large group on task and productive, the use of a
facilitator is essential. A trained facilitator provides support and
reinforcement for the RA process, without which some of the dis-
cipline inherent in the process would be lost. The facilitator guides
the discussion so that all relevant questions are answered and time
is used productively. The most value can be obtained from the RA
process when the facilitator is familiar with wells and WI issues. A
third-party facilitator who is knowledgeable in the application of
the RA process and in the subject material may be required.
Scribe. The scribe provides an important service to the RA pro-
cess. As the designated person to capture the thoughts and record
the meeting ideas of the participants, a scribe can keep focused on
the discussion and will not miss recording important information.
Accurately capturing the issues, risk-ranking levels, and mitiga-
tion suggestions is the basis for maintaining the discussion focus
and for preparation of the final report. The facilitator or a member
of the study team cannot perform this role along with his/her other
functions; a dedicated person is required to record the process
efficiently and thoroughly.
Data Preparation
Thorough planning and preparation for an RA will ensure that the
process will work as intended. Typically coordinated by the WI
SPOC, advance preparations should be completed so that the par-
ticipants, once assembled, can immediately go to work and their
time will be used efficiently. Preparation includes, but is not lim-
ited to, the following items.
Inventory of Well Types for Evaluation. Wells in similar serv-
ice and similar design may be grouped together for evaluation so
that a large number of wells can be evaluated as a single type. To
determine the well-type groupings, consideration should be given
June 2012 SPE Drilling & Completion
to influences that could affect both the severity and consequence
ratings. These may include well construction, well process fluids,
well location, production rates, environmental sensitivities, artifi-
cial-lift methods, and outside influences. Some example well
types include free-flowing producers; gas lifted producers; ESP
producers; gas injectors; water injectors; onshore, offshore and
subsea wells; sour service; and remote or urban locations. The
types may also be categorized by design, with consideration given
to whether they have one, two, or more casing strings. The goal is
to define the well types so that all the asset’s wells, or a large ma-
jority of the wells, are captured in one of the well-type categories
to be evaluated. Each well type will be fully evaluated in the RA
process; the better the categorization of the well types, the better
the RA results.
Define a “Typical Well” for Each Well-Type Category. A
complete definition is required for each type of well, including
casing, tubing, and completion design and service parameters
(flow rates, pressures, annular pressures, and temperatures). Infor-
mation should also be gathered for alarm set points, SCADA
monitoring, and other process information that may provide input
for the evaluation.
The “typical-well” definition may not encompass all wells that
could potentially fall into the category because of various tubular
specifications, flow rates, and the like. A conservative model will
work best for the RA, representing the worst-case scenario for
that well type. Individual wells can later be compared to the typi-
cal-well description to see if the failure-mode risks are similar or
need adjustment. It is important that the written description of
each “typical” well type be entered on the risk-register spread-
sheet. This forms the basis from which the risk rankings are
made, and should be readily available for reference at a later date.
See Appendix B (Fig. B-1) for an example description of a typical
well type.
Well Diagrams. A diagram for each well type is a key visual aid
for use during the RA discussion. Potential failure modes can be
illustrated, which helps the team members visualize potential out-
comes. Complex diagrams should be simplified to the greatest
extent possible for ease in viewing and understanding. The well
diagrams should be printed in a large format to be used as wall
hangings and/or projected on a large screen for ease of viewing.
See Figs. 1 and 2 for examples of simplified well diagrams.
Identify the Well-Barrier Failure Modes. Depending on the
design and type of service for the well, a comprehensive list of
failure modes is determined. The list can be used in advance to
populate the tables to be used by the scribe for documenting the
process. See the next section for a description of failure modes.
Operating Policies and Procedures. Documentation related to
well operations should be available to address questions that may
arise in the RA discussion. These may include, but are not limited
to, safety-valve testing, tree maintenance, diagnostics, interven-
tion, corrosion/erosion, well testing, production optimization, and
heavy lifting and logistics management.
Regulatory Requirements. Documentation related to regula-
tions that apply to well operations should be available for the dis-
cussion. Requirements for safety valve testing, mechanical-
integrity tests (MITs), pressure management, variances, reporting
anomalies, and other associated issues should be available.
List of Definitions, Terms, and Acronyms. Introductory
remarks before starting the RA should include an explanation of
the definitions of well barriers, barrier elements, and other terms
to be used so that team members start the process with the same
level of understanding. Providing printed handouts of definitions
for reference is also recommended. See Appendix A for a glossary
of common terms used in the RA process.
297
 Christmas Tree

HANGER
PACKOFF
LEAKS
Hanger Seals

24 or 30-in. Drive ±400–500 ft

Pipe/Conductor
Sub-Surface Safety Valve
CONNECTION
LEAKS

185 8 or 20-in. Surface Casing ±1,400–1,700 ft

TUBING CASING SHOE
LEAKS LEAKS
Cement
(Cement Tape Vary)
CASING
LEAKS

10¾ or 133 8 -in. ±4,500–5,500 ft

Intermediate Casing
POOR PRIMARY
CEMENT JOB
Gas Lift Mandrels
3½, 4½ or 5½-in.
Production Tubing GAS LIFT
VALVE LEAK
STINGER
Profile Nipples
SEAL LEAK
Packer Bore Receptacle (PBR)
Production Packer
PACKER
SEAL LEAK

Perforations

7 5 8 or 9 5 8 -in. Production Casing >7,500 ft

Fig. 1—Potential failure-mode pathways in a well.

Failure Modes
During the RA discussion, each well type will be evaluated against
A the list of potential well-barrier failure modes, one at a time. As the
G name implies, a failure mode is a description for a specific barrier
failure in the mechanical structure of the well. The RA model is
B
based on one failure being present at a time; multiple failures are not
H considered because of the large number of permutations that would
be required for the evaluation. However, this limitation can be over-
K
come by grouping similar first-level failures into a well type for anal-
ysis. Given that the first failure is present (base case), the well type
C L can be evaluated for a second set of well-barrier failures. It is not
necessary to evaluate each tubular or completion item; an entire seg-
I ment can be evaluated, because the consequences will be the same
no matter which component failed in a singular well section. See
Fig. 2 for an example well that has been sectioned into units to be
evaluated. Descriptions of each well section (A through L) follow.
D J The facilitator will lead the discussion and ask the team “What
if this barrier (or barrier element) fails?”, which leads to an evalu-
E
ation and discussion regarding the consequences and likelihood of
the event taking place. Most failure modes for “typical” wells can
F
be predetermined and are largely universal for all wells, with
minor exceptions. However, the consequences and likelihoods
(and therefore the risk levels) may be considerably different for
the various well types within an asset, or for the same well type in
different operating areas.
Using Fig. 2 as an example, sections of the well to be eval-
Fig. 2—Sections of well for evaluation. uated are designated with a capital letter and arrow. The

298 June 2012 SPE Drilling & Completion

corresponding failure modes for those sections are listed next, and
a representative selection of the list is presented in the Failure
Mode column of the example risk register in Appendix B (Fig. B-1).
Failure modes for the example well include the following:
A. External leak above lower master valve (MV); leak will
stop with closed MV.
B. External leak below lower MV; leak will not stop with
closed MV.
C. Tubing or packoff leak above subsurface safety valve
(SSSV); tubing  A Annulus communication.
D. Tubing leak below SSSV; tubing  A Annulus
communication.
E. Packer or seal leak; tubing  A Annulus communication.
F. Production-casing (PC) leak below packer; tubing 
formation communication.
G. A-Annular-valve external leak; will not shut off with closed
valve.
H. PC packoff leak; A  B Annulus communication.
I. PC leak above surface-casing (SC) shoe; A  B Annulus
communication.
J. PC leak below SC shoe; A Annulus  formation
communication.
K. B-annular-valve external leak; will not shut off with closed
valve.
L. SC leak; B Annulus  formation communication.
Specific well-barrier failure modes depend on the design and
service of each well type. Each section of each tubular present in
the well should have an assigned failure mode. A comprehensive
list of barrier failure modes is assembled for each well type once
the “typical design” has been determined.
Assessment Process
Once the well-barrier failure modes have been identified, the risk
matrix is used to determine the risk posed by each of the identified
hazards. This is done by completing the following steps in order:
1. Describe and record the most likely reason for the failure
mode, in detail.
2. Describe and record the remaining well barriers, conditional
barriers, and/or administrative controls in place.
3. Determine and record the consequences of the single barrier
failure, considering that all other listed barriers are still in place
and effective.
4. Determine and record the severity for each consequence cat-
egory being assessed (i.e., health and safety, environmental
impact, business interruption).
5. Determine and record the likelihood ranking of the failure
actually occurring.
6. Determine and record the risk ranking of the failure mode
for each category assessed, using the risk matrix, on the basis of
the product of the likelihood and consequence of the failure being
considered.
Describe the Failure Mode in Detail. Describe the failure mode
in sufficient detail that a reader will understand the most likely
reason that this failure may occur. For example, if the failure
mode is “tubing leak,” the description may read: “The most com-
mon failure is a leak in the tubing caused by CO2 internal corro-
sion, since there have been many similar failures of this type on
record.” If the failure modes are not already well understood, then
a failure mode and effects analysis (FMEA) may be required to
determine them. An FMEA is a procedure for analysis of potential
failure modes within a system for classification by the severity
and likelihood of the failures. A successful FMEA activity helps a
team to identify potential failure modes on the basis of past expe-
rience with similar well conditions.
Describe the Barriers, Conditional Barriers, and/or
Administrative Controls in Place. Referring to the well dia-
gram, determine which, if any, barriers remain in place to prevent
a release in relation to the failure mode. For example, for a
June 2012 SPE Drilling & Completion
“tubing leak,” the remaining barriers available to prevent a release
might be the PC envelope and SC envelope. For an external leak at
the MV, there are no barriers available. Also, determine the avail-
able conditional barriers and/or administrative controls that are in
place (see the glossary in Appendix A), because these may affect
the actual consequence determination. Document the remaining
barriers in the appropriate column of the risk-registry table.
Determine the Consequence of the Failure Mode. Describe the
consequence (outcome) for the individual well-barrier failure
mode, assuming all other existing well barriers remain effective.
The consequence will not always be the worst case possible; rather,
the consequence should be realistic, plausible, and credible. Bar-
riers, conditional barriers, and/or administrative controls in place
should be considered when determining the consequence. However,
active controls and safeguards should not be considered when deter-
mining the ultimate consequences (i.e., safety devices intended to
prevent the failure are assumed not to be present or are disabled).
For example, a gas-detection device that will cause an ESD shut-
down of a well will be considered deactivated or not working.
A written description of the consequence is entered in the table
and should include sufficient text to describe the most likely out-
come. For example, if the failure mode is “tubing leak,” the conse-
quence description may read: “Release of production fluids and
pressure from the tubing into A Annulus. PC should be able to con-
tain fluids at the expected maximum pressure (SITP). PC should
not degrade for 3-4 months owing to corrosion from the leaked flu-
ids.” The consequence description can be further detailed by how
the failure impacts each of the consequence categories considered,
such as the Safety, Environment, Asset Damage, Business Inter-
ruption, Public Image, and Public Notification categories. These
descriptions will assist to determine the consequence-severity
rankings for each individual consequence category. See the exam-
ple risk-register table in Appendix B (Fig. B-1).
Determine the Consequence Severity for Each Category.
Determine the severity of the consequence for each category
assessed (Safety, Environment, Asset Damage, Business Interrup-
tion, Public Image, and Public Notification) from the risk matrix.
The appropriate severity number [1 (lowest) through 5 (highest)]
is from the consequence severity description table (Table 1) and
is entered in the appropriate column on the risk-register table for
the failure mode being considered.
Determine the Likelihood of the Failure. Determine the likeli-
hood level for the well-barrier failure from the likelihood-cate-
gory-table description (Table 2). To determine the likelihood of
the failure event occurring, existence of all active and passive bar-
riers should be considered (i.e., safety devices intended to prevent
the failure from occurring are assumed to be functioning). For
example, a gas-detection device that will cause an ESD shutdown
of a well should be considered to be working properly.
Use previous experience and engineering judgment to assist in
the determination of how likely it is that the failure event will
happen. For barriers to be considered in reducing the likelihood of
an event, there must be assurance that the barriers will prevent or
mitigate risks in the scenario. The likelihood level should be
reduced as the number and quality of barriers increases. When
assigning a likelihood level to the event, consideration should be
given to the fact that a conditional barrier may provide some pro-
tection but must be discounted from the protection that a full bar-
rier would provide.
The likelihood component is divided into five descriptive cate-
gories from the risk matrix: Level 1: Improbable; 2: Remote; 3:
Rare; 4: Probable; and 5: Frequent (Table 2). The determined
likelihood number is entered in the risk-register table for the ap-
plicable failure mode.
Determine the Risk Rank. Determine the risk-rank value by
using the consequence-severity and likelihood numbers to
299
reference a box on the risk-matrix diagram (Table 3). The X-axis
location is the consequence severity number; the Y-axis location
is the likelihood number. The level of risk is the product of the
consequence and likelihood numbers and is determined by the for-
mula: Risk Rank ¼ Consequence  Likelihood. Each box in the
matrix has a risk-rank number designation, and there are four
associated risk-rank categories: High (17–25), Significant
(12–16), Medium (5–11), and Low (1–4) (Table 4). Note that this
is only one of many risk-matrix tables available, and individual
companies will probably have their own set of RA tools based on
individual corporate risk-tolerance thresholds. Most other corpo-
rate risk matrices may be substituted, when implementing this
methodology, for the risk-matrix example presented here.
Risk-Register Tables
The scribe has the responsibility of capturing important elements
of the discussion as they occur throughout the process. Risk-regis-
ter tables are prepared for this purpose; one set of tables is con-
structed for each well type considered. The tables contain a
description and supporting information for the “typical well” in
that category. Columns in the table include cells for recording the
failure mode being considered, available barriers, conditional bar-
riers, consequence categories and rank, likelihood rank, overall
risk rank, and notes for supporting comments, such as potential
mitigation options. See Appendix B (Fig. B-1) for an example
risk-register table.
As the RA progresses, the scribe will use the tables to record
key elements of the discussion and log information into the vari-
ous cells. It is strongly recommended for the scribe to perform
his/her function while projecting the data onto a screen so that all
participants can see and verify that the information being recorded
is accurate according to the discussion taking place. Discrepancies
can be quickly located and corrected so that consistency is
ensured throughout the process. The tables provide the final log of
all of the discussions and determinations that occurred in the RA
process.
Recommendations, Suggestions, and Notes
The far-right column of the risk-register table (Appendix B, Fig.
B-1) is intended for capturing recommendations, suggestions, and
notes offered by the team during the RA process. Recommenda-
tions may be included for preventing or mitigating well-barrier-
element failures, as well as suggestions, notes, or comments more
general in nature. Any pertinent information may be added to this
area to provide mitigation ideas, clarification of the issue, or gen-
eral information that is not included elsewhere and should not be
forgotten. The scribe will document these items as the RA pro-
gresses so they can be compiled and included in the final report.
Deliverables
The completed risk-register tables form the basis of the RA final
report. The tables are organized in a format that can be easily ref-
erenced should actual well-barrier failure events occur. The risk
from a specific situation of a well can quickly be determined by
referring to the tables, providing that the actual event is the same
as, or close to, one of the failure modes assessed.
The final text report should include a description of the method-
ology, definitions, and processes used throughout the assessment.
The report should also include the suggestions for preventing or mit-
igating potential WI issues identified during the RA discussions, as
well as the names of the team members; the time, date, and location
of the RA; and an explanation of the risk-register tables and results.
Post-Assessment Implementation
The purpose of performing a WI RA is to provide the asset with
information that can be leveraged to reduce the risk from well
operations and potential WI problems to ALARP levels. Because
the RA team comprises people knowledgeable about wells, the
RA results should accurately reflect the qualitative set of risks
300
associated with barrier failures on the wells in that operating area.
Therefore, the final report and risk-register tables provide a tool
that highlights areas of elevated risk and where mitigation efforts
can be focused for risk reduction. It is up to the asset to consider
the RA rankings and provide the resources to implement mitiga-
tion efforts and recommendations by the RA team.
When more than one well type is assessed, the risk-register
tables can be combined and sorted by consequence category
(Safety, Environment, Asset Damage, Business Interruption, Pub-
lic Image, and Public Notification). This will provide a sortable
list of all of the risk rankings within each category, regardless of
the well type. Risk-rank levels should be compared only on a con-
sequence-category basis and not between categories. For example,
compare the rankings within the Safety category only. From a
management standpoint, the list is helpful to determine where the
areas of highest risk reside throughout the entire well portfolio.
Conclusion
This paper has described a WI/RA model that has proven to be
successful for indentifying and ranking well-barrier failure risk in
a well, a group of similar wells, or an entire well portfolio. The
results from the assessment allow the risks to be ranked so that
areas of highest risk are identified and can be monitored and/or
mitigated properly with limited resources. The asset can use the
RA results as a reference for a WI program in order to reduce risk
from well operations and potential WI problems on a routine basis.
Acknowledgments
The authors wish to thank ConocoPhillips for permission to pub-
lish this paper, Doyon Emerald for help in the development of the
initial RA process and methodology, and the many participants
who have used and proven this methodology for assessing WI risk.
References
NORSOK D-010: Well integrity in drilling and well operations, third edi-
tion. 2004. Stavanger: Norwegian Oil Industry Association (OLF)/Fed-
eration of Norwegian Manufacturing Industries (TBL).
Appendix A—Glossary
Administrative Controls. A policy, procedure, or program in
place to detect, prevent, mitigate, or control consequences. Exam-
ples include, but are not limited to, daily monitoring and record-
ing of pressures, computer-automated scans, compliance tests,
well-operating guidelines, and WI programs.
ALARP. As low as reasonably practicable.
Barrier. Envelope of one or several dependent well-barrier ele-
ments preventing fluids or gases from flowing unintentionally
from the formation into another formation or to surface (NORSOK
2004). Examples of barriers include tubing, packer, and casing
below packer; tubing, packer, and casing above packer (A annu-
lus); and PC, SC, and casing shoe (B annulus).
Barrier Element. A barrier element is a single component of a
barrier envelope. It is an object that alone cannot prevent flow
from one side to the other side of itself (NORSOK 2004). Avail-
able barrier elements include, but are not limited to, tubing or cas-
ing string, production packer, tubing/casing hanger packoff,
annulus and tree valves, tubing plug installed above the upper-
most perforation, closed and tested SSSV, and static fluid of suffi-
cient weight to hold the highest bottomhole pressure.
Conditional Barrier. A term not commonly used in the industry
but helpful for the purposes of an RA, it is a combination of bar-
rier elements that constitutes a containment envelope where one
or more barrier elements cannot be tested or have not been tested
to envelope pressure rating, and/or one or more barrier elements
June 2012 SPE Drilling & Completion
was positively tested where a leak does exist and is less than the
pressure-test detection threshold.
Consequence. Impact on site personnel, on-site or off-site prop-
erty, off-site communities, and the environment. In general, these
are realistic, plausible, and credible outcomes of a failure event.
Consequences are analyzed independently of the event’s probabil-
ity or frequency of occurrence and do not take into account active
safeguards.
Consequence Severity. A measurement of the negative impact
level of the consequence represented by a Level 1 through Level
5 value from the Consequence Severity Table.
Failure Mode. A failure of a well barrier or barrier element that
compromises the integrity of the barrier envelope and results in
the loss of that barrier as a layer of protection.
Hazard. Chemical or physical characteristic of a material, sys-
tem, plant, or process that has the potential for causing damage to
people, property, or the environment.
Hazard Scenario. A risk-management term that describes poten-
tial ways that a layer of protection (barrier) can be compromised.
For WI risk assessments, the term “failure modes” will be used.
Layer of Protection. A risk-management term used to describe a
group of elements that, when combined, form an envelope that is
intended to prevent the occurrence of, or to mitigate the effect of,
hazardous events. For the purposes of this paper. the term
“barrier” will be used.
Fig. B1—Example risk register table.
June 2012 SPE Drilling & Completion
Likelihood. A generic term that relates to either a probability or
frequency of an event occurring.
Qualitative Risk Assessment. A method of evaluation and
assessment of risk based on experience and/or the application of
good engineering judgment.
Quantitative Risk Assessment (QRA). A method of risk assess-
ment based on numerical-probability data and mathematical anal-
ysis. QRA involves a higher level of analysis than risk ranking
through a qualitative assessment.
Risk. A combination of the likelihood of an unfavorable evnt
occurring and the consequence severity should an unfavorable
event happen. The relationship is this formula: Risk ¼
Likelihood  Consequence Severity.
Risk Assessment. A procedure to estimate risk on the basis of
combining estimates of event consequences and likelihood.
Risk Matrix. A matrix to quantify risks; consequences are in
rows and likelihood is in columns. Risk is plotted on the matrix
according to this formula: Risk ¼ Consequence  Likelihood.
Risk Ranking. A numerical value assigned to the measure of the
potential human injury, property damage, environmental damage,
or economic loss in terms of both the event likelihood and the se-
verity of potential injury, damage, or loss.
Safeguards. An active or passive component of a protective
system.
301
What-If Methodology. A qualitative-risk-assessment methodol-
ogy that contemplates the answers to the question “what if?” in
regard to a potential failure mode taking place and the consequen-
ces thereof. The outcomes are highly dependent upon the experi-
ence and knowledge of the participants.
Jerry Dethlefs is the Well Integrity Director for ConocoPhillips in
Alaska. He has 32 years of experience with well operations,
intervention, production operations, and drilling. For the last 14
years, his focus has been on WI issues including policy, diag-
nostics, best practices, program management, and regula-
tory compliance. Dethlefs holds a BS degree in general
engineering, an MS degree in civil engineering (environmen-
302
tal), and an MBA, all from Oregon State University. He was an
SPE Distinguished Lecturer during the 2010–11 tour season and
serves as a reviewer for SPE.
Bettina Chastain works as a principal consultant through her
private consulting company, Arktis LLC. Chastain spent the pre-
vious 15 years as President and CEO of Alaska’s premier process
safety and risk-management firm, Emerald Consulting (Doyon
Emerald), which she founded in 1996. She has more than 23
years of experience in the oil and gas industry, working as a pro-
cess engineer with OSHA’s Process Safety Management Pro-
gram and in the risk-management field. Chastain holds a BS
degree in chemical engineering from the University of Arizona.
June 2012 SPE Drilling & Completion