Ops Knowledge This document on

Portal (OKP) OKP

SHE Practice
Incident Investigation and Analysis

DSM CSHE&M Heerlen. December 2003

Version 3
DSM

Incident Investigation and Analysis

This publication is issued as a SHE practice for fulfilling the DSM SHE Requirements on
“Incident Investigation” (req. 11.9 and 11.10).

This document is prepared under responsibility of DSM CSHE&M Heerlen and is issued for the guidance of DSM
companies and they may wish to consider using it in their operations. Other interested parties may receive a copy
of this document for their information. DSM CSHE&M is not aware of any inaccuracy or omission from these
guidelines and no responsibility is accepted by DSM CSHE&M or by any person or company concerned with
furnishing information or data used in these guidelines for the accuracy of any information advice given in the
guidelines or for any omission from the guidelines or for any consequences whatsoever resulting directly or
indirectly from compliance with or adoption of guidance contained in the guideline even if caused by a failure to
exercise reasonable care.

The copyright of this document is vested in DSM Heerlen, The Netherlands.

All rights reserved.

2
CONTENTS

Page

1. INTRODUCTION 5
1.1 Objectives 6
1.2 Structure of the SHE Practice 6
1.3 Link with other documents 6
1.4 Written Policy and Procedures 6

2. IMMEDIATE ACTION AND NOTIFICATION 9

2.1 Immediate action 9
2.2 Notification from the Incident location 9
2.3 Notification for Group Service Companies Authorities 9

3. THE INVESTIGATION PROCESS 10

3.1 Determination of level of investigation 10
3.1.1 General 10
3.1.2 Incident classification 10
3.2 Appointment of investigators 10
3.2.1 General 10
3.2.2 Line responsibility for investigation 11
3.2.3 Contractor incidents 11
3.2.4 Investigation by local or national authorities 11
3.3 The investigation 12
3.3.1 Scope and aims 12
3.3.2 Timing 12
3.3.3 Background information 12
3.3.4 The investigation method 12
3.3.4.1 Fact finding 13
3.3.4.2 Inspecting the location 14
3.3.4.3 Reserving physical evidence 14
3.3.4.4 Conducting interviews 15
3.3.4.5 Records and procedures 15
3.3.4.6 Conducting special studies 15
3.3.4.7 Conflicting evidence 15
3.3.4.8 Identifying missing information 15
3.3.4.9 Underlying causes and human factors 16
3.4 Establishing the sequence of events 16
3.5 Analysis of findings 16
3.6 Identification of recommendations 17
3.7 Investigation report 17
3.7.1 Compilation 17
3.7.2 Legal assistance 17
3.7.3 Management review and endorsement 17
3.8 Data recording 17

3
4. FOLLOW-UP 18
4.1 Communication of investigation findings 18
4.2 Implementation of recommendations 18
4.3 Monitoring of implementation and Check on effectiveness 18
4.4 Statistical analysis 18

APPENDICES

1. THE TRIPOD METHODOLOGY APPLIED TO INCIDENT ANALYSIS 19

2. ROOT CAUSE ANALYSIS APPLIED TO THE INCIDENT ANALYSIS 25

3. INCIDENT INVESTIGATION REPORTS 26

4
1. INTRODUCTION

This document provides guidelines on procedures for effective incident investigation and
analysis of serious incidents. The definition of (serious) incidents is given in the DSM SHE
requirements.
Within DSM two Incident investigation methods are introduced, Root Cause Analysis (RCA)
and Tripod.
- RCA is introduced as part of the Operational Excellence project and can be used for
finding the root cause of all kind of problems and incidents, including non SHE
incidents.
- Tripod is introduced as a mandatory investigation method for serious incidents but may
also be used for other incidents.

Examples of both methods are given in appendices 1 (Tripod) and 2 (RCA)

This SHE Practice will be focusing on how to do an extensive incident investigation on

a(n) (serious) incident and the use of the Tripod method.

The primary purpose of incident investigation is to prevent recurrence of similar incidents by

identifying deficiencies and recommending remedial actions. Follow-up should ensure that
those actions are implemented. Statistical analysis of the results of incident reports can
enhance the learning effect of each individual case by deriving trends. These can be used to
identify and correct Safety, Health and Environmental (SHE) management weaknesses, as
well as activity and hardware deficiencies in DSM’s operations.
Studies have shown that incidents can have many causal factors and that underlying causes
often exist away from the site of the incident. Proper identification of such causes requires
timely and methodical investigation, going beyond the immediate evidence and looking for
underlying conditions, which may cause future incidents. Incident investigation should
therefore be seen as a means to identify not only immediate causes, but also failures in the
management of the operation.
Management must support and be involved in investigations and be prepared to act on
resulting recommendations. Commitment is best demonstrated when a thorough and
objective investigation is carried out by competent investigators and prompt action is taken to
correct deficiencies.
Lessons learned from incidents that are believed to be of benefit to others should be
communicated throughout DSM and within the Business Group. Consideration should be
given to communicating such lessons to other interested parties as appropriate.
Special attention should be given to the actions to be brought in practice and a check on
effectiveness of the implemented actions.

1.1 Objectives

The objectives of this SHE Practice are:

· to provide line managers, SHE advisors and contractor managers with a consistent
approach to incident investigation in order to achieve a high quality of reporting and
analysis,
· to explain the incident investigation process and the relationship between the available
techniques and methodologies for analysis and recording,
· to provide a SHE Practice to comply with DSM SHE Requirements.

5
1.2 Structure of the SHE Practice

The main text of the SHE Practice describes all the steps to be taken after a Serious Incident
has occurred. These are summarized in Figure 1 and 2.
Further details of the investigation process, techniques, methodologies and reports, as
relevant for the investigator or investigation team are presented in Appendices 2-4. A list of
definitions is given in Appendix 1.

1.3 Link with other documents

This document describes incident investigation and analysis. For definitions of incident types
and reporting requirements reference is made to the DSM Requirements.

1.4 Written Policy and Procedures

An essential prerequisite for management of SHE is to have a written policy and procedures
for incident investigation. These should require reporting, recording and investigation of
incidents.

6
 Notification Investigation & Analysis Follow-up

Incident The investigation

• Establish scope and Communicate
aims learning
• Mobilize swiftly points
Make site Provide • Obtain background
safe medical/ information
aid

The investigation Use Tripod

method analysis Implement
• Inspect location recommend-
• Preserve site • Take photos (make ations
conditions sketches)
• Make • Preserve physical
preliminary evidence
• Conduct interviews Monitor
assessment implement-
• Review documents
• Conduct specialist ations
Notify relevant • Determine Appoint studies • Analyze Identify • Compile
parties level of investigators • Resolve conflicting findings recommendations report
investigation evidence • Identify • Review with
• Classify • Identify missing causes management Check
incident information effectiveness
• Record underlying
causes and human
factors
Construct Perform
Record incident in incident statistical
Complete
Company system investigation analysis
data recording
e.g. Establish event tree, RCA
sequence

Figure 1. Incident Investigation and Analysis

7
Figure 2. Incident Investigation Process

Incident Investigation Process

Investigation
Place of Incident Mgt Data
team

Incident

Immediate actions
2.1 &
Incident
classification 3.1
Appointment of
investigators
3.2
Notifications
2.2, 2.3

Investigation
process
3.3, 3.4, 3.5,
3.6 ,

Data recording
3.8
Compilation of
report
3.7.1, 3.7.2

Review report &

endorsement
3.7.3

Communication
4.1

Implementation &
monitoring
recommendations Statistical analysis
4.2 & 4.3 4.4

End End

8
2. IMMEDIATE ACTION AND NOTIFICATION

2.1 Immediate action

When an incident occurs the first action to be taken is to prevent further injury and arrange
for any necessary medical treatment as well as taking measures to prevent the situation from
escalating and causing further damage. Where possible, the site should be left unchanged
until the investigation team has inspected it. Where this is not possible, photographs should
be taken or sketches are made of the scene.
A preliminary assessment of the incident should be made to identify the extent of injury or
damage, and any potential for escalation.

2.2 Notification from the Incident location

After arranging any necessary first aid and medical treatment and taking measures to
prevent consequential losses and injuries, notification from the location of an incident is made
in order to:
· advise operations control (so that adjustment can be made to the plan of operations)
· facilitate notification of other parties as required
· initiate the investigation process.

Notification should be made via the senior person at the location or plant. Notification should
be routed to the line function and to other departments from which assistance is sought and
also to the SHE organization.
The notification should contain details of:
· time, place and nature of the Incident
· persons injured/equipment damaged
· nature of injury/damage and estimate of severity
· immediate corrective action being taken
· assistance required
· operation in progress at the time.

The notification report should be factual and avoid hearsay, assumptions and preliminary
conclusions. If the notification is made verbally, it should be followed up by a written, faxed or
e-mailed confirmation. The notification is brought to an organizational level depending on
seriousness (SHE requirements) and BG/BU regulations.

2.3 Notification for Authorities

In addition, there may be a requirement for local or national authorities (e.g. in the
Netherlands the “Arbeidsinspectie”) to be notified of all incidents in certain categories (e.g.
fatalities, occupational illnesses, accidents including those involving lifting appliances,
pressure vessels or vehicles).

9
3. THE INVESTIGATION PROCESS

3.1 Determination of level in investigation

3.1.1 General

The notification of an incident triggers the start of the investigation process, which comprises
the consecutive stages as indicated in Figure 1.

3.1.2 Incident classification

An incident may result in serious injuries, illness, damage, and environmental impact or
alternatively have only minor consequences. Lessons to avoid re-occurrence can be gained
from all incidents. For incidents with minor consequences the potential severity can still be
very high. Investigation of those cases may reveal as much about the deficiencies in SHE
management as cases in which major injury resulted. In isolation, incidents with minor
consequences and minor potential severity may provide little learning, but the collection and
analysis of data from many such incidents show trends which may be used to identify
measures for improvement in the overall SHE performance.
For classification of the incident use the SHE Requirements.

3.2 Appointment of investigators

3.2.1 General

The size and composition of an investigation team (figure 2) will depend on one or all of the
following factors:
· extent of injury or damage to assets, the environment and / or reputation.
· potential for injury or damage to assets, the environment and / or reputation
· potential for repetition
· departments involved
· requirements for specialist knowledge
· legal requirements.

For many ‘not serious’ incidents and not having the potential to be serious incidents, the
investigative skill and effort required might be within the capability of one person, who could
be the line supervisor.

10
3.2.2 Line responsibility for investigation

Following the concept of line responsibility, the line function should take the lead in incident
investigation. A rapid response from the appropriate level of line management assists in
obtaining an accurate investigation and demonstrates management commitment.
First-line supervisors bring their technical skills and familiarity to the task, the process and the
operation, together with their knowledge of the individuals involved. In some investigations
however, the immediate supervisor may have more value as a witness than as a member of
the investigating team. Senior line supervisors and line managers provide their experience
and view events from a perspective based on an overview of a broad area of activity. They
are in a better position to detect weaknesses in management systems and can assist in
expediting the investigation process.
SHE personnel can also make a valuable contribution to an investigation. Beside their
contribution of SHE know-how and skills in investigating and analyzing incidents, they can
provide comparison with similar situations in other departments and companies. In addition
their independent viewpoint can be useful when examining established work practices. It may
also be valuable to include other technical specialists and SHE representatives on the team.

3.2.3 Contractor incidents

The responsibility for investigating contractor incidents lies with the relevant Contractor. It is
recommended that:
· Contractor’s arrangements for carrying out incident investigation should be established at
the pro-qualification stage
· DSM should monitor such investigations and follow-up
· findings and recommendations from the investigation should be discussed between the
management of DSM and Contractors
· an investigation should be conducted by the DSM, either separately from or jointly with
the Contractor, when a Contractor incident occurs on DSM premises or involves DSM
property or interests.

3.2.4 Investigation by local or national authorities

In the event that local authorities take over responsibility for the investigation, DSM should
nominate a focal point to liaise with the authorities and to assist them in assembling the
information they require.
Notwithstanding the involvement of the authorities and other bodies, DSM should carry out
their own investigation into the incident. In order to have a clear understanding of the
incident, DSM should endeavor to obtain relevant evidence from the authorities.
It is most likely that (local) authorities investigating the incident will require to be provided with
a copy of the report of the investigation carried out by DSM. However, it must be borne in
mind that investigation reports will in most cases not be classified as privileged or otherwise
confidential documents, and may serve as a basis for, or even as evidence in, civil or criminal
proceedings possibly brought against DSM, its directors or employees in respect of the
incident.

11
3.3 The investigation

3.3.1 Scope and aims

The scope of the investigation should be such as to achieve the following primary aims:
· to identify the immediate and root causes of the incident such that actions can be taken to
prevent recurrence of future incidents
· to review the application of management practices and their impact on SHE
· to establish the facts surrounding the incident for use in relation to potential insurance
claims or litigation
· to meet relevant statutory and DSM requirements on incident reporting.

3.3.2 Timing

An investigation should be carried out as soon as possible after an incident. The quality of
evidence can deteriorate rapidly with time, and delayed investigations are usually not as
conclusive as those performed promptly. A prompt investigation is also a good demonstration
of management commitment.

3.3.3 Background information

Appropriate background information should be obtained before visiting the incident location.
Such information could include:
· procedures for the type of operation involved
· records of instructions/briefings given on the particular job being investigated
· location plans
· command structure and persons involved
· messages, directions etc., given from base/head office concerning the work.

3.3.4 The investigation method

The method of conducting an investigation consists of the following activities:

· fact finding
· inspecting the location
· gathering or recording physical evidence
· interviewing witnesses
· reviewing documents, procedures and records
· conducting specialist studies (as required)
· resolving conflicts in evidence
· identifying missing information
· recording additional factors and possible underlying causes including human factors.

During the initial stages of every investigation, investigators should aim to gather and record
all the facts, which may be of interest in determining causes.
Investigators should be aware of the danger of reaching conclusions too early, thereby failing
to keep an open mind and considering the full range of possibilities.
Checklists can be very useful in the early stages to keep the full range of inquiry in mind, but
they cannot cover all possible aspects of an investigation, neither can they follow all individual
leads back to basic causal factors. When checklists are used, their limitations should be
clearly understood.

12
3.3.4.1 Fact-finding

The objective of this stage of the investigation is to collect as many facts as possible, which
may help understanding of the incident and the events surrounding it. Figure 1 provides an
overview of the investigation and analysis process.
The scope of an investigation can be divided into five areas:
· people
· environment
· equipment
· procedures
· organization.

Conditions, actions or omissions for each of these may be identified, which could be factors
contributing to the incident or to subsequent injury, damage or loss.
A factor to consider during an investigation is recent change. In many cases it has been
found that some change occurred prior to an incident which, combining with other causal
factors already present, served to initiate the incident. Changes in personnel, organization,
procedures, processes and equipment should be investigated, particularly the hand-over of
control and instructions, and the communication of information about the change to those
who needed to know.
The effect of work cycles and work related stress could have an impact on individuals’
performance prior to an incident.
The impact of social and domestic pressures related to individuals’ behavior should not be
overlooked.
The initial stages of an investigation normally focus on conditions and activities close to the
incident and only immediate causes are usually identified at this stage. However, the
conditions underlying these causes may also need investigating.
Information should be verified wherever possible. Statements made by different witnesses
may conflict and supporting evidence may be needed.
To ensure that all the facts are uncovered, the broad questions of “who?, what?, when?,
where?, why? and how?” should be asked.
After fact-finding and analysis it should be possible to:
· give a precise description of the incident, its background, timing, and the events leading
to it
· describe the weather conditions
· describe the operations
· identify the equipment in use, its capabilities and any failures
· describe the locations of key personnel and their actions immediately before the incident
· describe all pertinent instructions
· identify energy flows that were not controlled
· identify operational deviations, other defects or inappropriate use of resources and
equipment
· identify changes of staff, procedures, equipment or processes that could have contributed
to the accident
· evaluate relevant personnel skill levels and their application
· identify whether alcohol or drugs were contributory
· identify what barriers were in place to prevent the incident and why they were not
adequate to prevent it
· review the relevance and input that was or should have been made by safety programs
· identify underlying causes
· comment on response to an accident (first aid, rescue, shut-down, fire-fighting, etc.)

13
· identify damage control and medical treatment actions taken to prevent worsening of the
situation and the condition of injured parties, particularly if disabling injuries or death
ensued
· make an inventory of all the consequences of the incident (injury, damage and loss).

3.3.4.2 Inspecting the location

Important evidence can be gained from observations made at the scene of the incident,
particularly if equipment remains as it was at the time of the incident. Similarly, witnesses’
statements can usually be better understood and verified if discussed at site. Witnesses
should be readily available to the investigation team. It is not possible to set rules on
“immobilizing” equipment at a location, but as far as possible the site should be kept “as is”
until at least a preliminary investigation has taken place. However, rescue operations or the
presence of residual hazards and/or congestion may justify moving some of the equipment.
Local legislation may prescribe that for certain classes of incident, e.g. fatality or motor
vehicle accident, nothing may be moved without prior permission from the relevant
authorities.
Photographs and/or video film will assist the investigation. However, local authorities may
restrict site access or impound equipment and in such circumstances it may not always be
possible to obtain photographic records. In these situations sketches should be made.
The investigators should be looking for any conditions in the immediate environment, which
could have contributed to the incident. Items to check include:
· position of all equipment in relation to other equipment/facilities
· the position of valves, spades, set points, recorders, override switches, etc.
· electronic recorded process data
· the condition of the load-bearing surface
· accessibility/evidence of congestion
· illumination/visibility and audibility at the location/site
· state of house-keeping
· the condition of all equipment/facilities
· effects of weather
· presence of witnesses
· evidence of spills ore release
· odors, discoloration
· presence of unauthorized people
· evidence of excessive forces
· presence/absence of warning signs/notices
· results of statutory and other inspections.

3.3.4.3 Preserving physical evidence

In many incidents components or equipment may be damaged, or have failed. In these

cases, it is best to lodge this equipment in a secure place pending more detailed analysis.

14
3.3.4.4 Conducting interviews

People should be interviewed singly and be asked to go step-by-step through the events
surrounding the incident, describing both their own actions and the actions of others.
The value of a witness’s statement can be greatly influenced by the style of the interviewer,
whose main task is to listen to the witness’s story and not to influence him/her by making
comments or asking leading questions. This requires patience and understanding. If the
investigation is a team effort, great care should be taken not to make a witness feel
intimidated by too many interviewers and if appropriate, the witness could be accompanied
by an independent “friend”.
It should be remembered that an investigation team is often seen in a prosecuting role, and
there may be a reluctance to talk freely if people think they may incriminate themselves or
their colleagues. An investigator is not in a position to give immunity in return for evidence,
but must try to convince interviewees of the purpose of the investigation and the need for
frankness.
At the end of an interview the discussion should be summarized to make sure that no
misunderstandings exist. A written record should be made of the interview and this should be
discussed with the witness to clarify any anomalies. Any anomalies in the statement or
conflicts with other evidence should be clarified.

3.3.4.5 Records and procedures

Documentation such as “as-built” drawings, inspection records, instrument and tachograph

records, printouts, log sheets/books, maintenance records, work permits and load/time
sheets may provide information relevant to the investigation.
Written instructions and procedures provide evidence of pre-planning and individual
responsibilities. The investigation should try to establish the extent to which these procedures
and instructions were understood and acted upon, as these can indicate the effectiveness of
training and supervision. The relevance and extent of application of procedures should be
assessed during the investigation.

3.3.4.6 Conducting special studies

Incidents of an involved or complex nature often require the analysis of specialists to

determine causes of failure. Aircraft crashes, crane failures and explosions are examples of
such incidents, where specialist advice may be required. This should be rapidly identified and
the specialists are involved early in the site assessment.

3.3.4.7 Conflicting evidence

It is not unusual for different witnesses to give different accounts of an incident. Human
memory can be unreliable and, even if not motivated by self-protection or other subjective
arguments, one person’s recollection of an incident can differ from another’s in quite
important details. Investigators should note any significant differences in accounts of an
event. Faced with conflicting witnesses’ statements, investigators should look for the
similarities between the statements and commonality with other evidence. The objective is to
use the evidence to understand the incident and not to prove the accuracy of individual
statements, nor to apportion blame.

3.3.4.8 Identifying missing information

As the investigation progresses, the investigator(s) should begin to identify the sequence of
events and concentrate efforts on increasing their knowledge of areas of uncertainty.

15
 3.3.4.9 Underlying causes and human factors

As the extent of physical factors involved in an incident becomes clear, the investigator(s)
should shift the emphasis of their investigation and questioning to the underlying causes and
to the reasons for peoples’ actions. This will allow for ease of assessment when analyzing the
incident.

3.4 Establishing the sequence of events

In the fact-finding stage of an incident investigation, it is crucial to obtain all facts essential to
the understanding of the incident. This implies back tracking from the initial facts found, to
discover the reasons behind them. Without a structure for identifying and following leads, it is
difficult to ensure that the full scope of the investigation has been covered.
Gaps that are left in the event sequence should be reviewed to identify alternative scenarios
to complete the sequence. In doing this it may be helpful to consider the human factors
sequence.

3.5 Analysis of findings with Tripod

The purpose of analysis is to establish the critical events and the underlying causes of the
incident such that corrective measures can be taken to prevent future incidents. This requires
investigators to have a clear understanding of the cause and sequence of activities and why
one event or situation progressed to the next.

Incident causation studies, particularly the Tripod analysis, clearly identify that a chain of
events causes an incident. These can be identified at differing stages in the incident
causation sequence.
The incident investigation should not be restricted to the unsafe acts or active failures, as this
will only conclude that human failures (driver, operator, and maintenance crew) caused the
incident (“human error”). The Tripod theory has shown that unsafe acts do not occur in
isolation but are influenced by existing preconditions, which may originate from failures in the
organization. These so-called latent failures may lie dormant within the system for a long
time, and their adverse consequences may only become evident when they combine with
other factors to breach the system defenses. Detailed case studies reveal that latent rather
than active failures are the precursors of incidents. Tripod classifies these latent failures into
Basic Risk Factors (BRF’s).
Identifying and correcting these latent failures rather than merely only correcting the active
failures induced by them (symptoms), is more effective in meeting the ultimate objective of
the investigation, namely to improve the overall SHE performance.
Identification of underlying causes and latent failures need not necessarily involve application
of the full Tripod methodology, but should apply the causation theory as proposed by Tripod
(See Fig. 3), involving a brief consideration of the BRF’s.
See Appendix 2 for a summary of the Tripod methodology.

Latent Failure Preconditions Active failure Accident: Event and

Consequences

Lat.Failure HW HW HW Precondition Active Failure

Failed Defence
16
Figure 3. Tripod Incident Causation Sequence

3.6 Identification of recommendations

The investigation process should identify actions to prevent recurrence. This can best be
achieved by addressing the unsafe acts and unsafe conditions, and by identifying and
correcting the latent failures. Not all causes can be completely eliminated, and some may be
eliminated only at prohibitive cost. Some recommendations will therefore be aimed at
reducing the risk to a tolerable level, while others will be aimed at improving protective
systems to limit the consequences.
All recommendations should be in the form of measurable action items with clearly defined
action parties and a time scale for implementation.

3.7 Investigation report

3.7.1 Compilation

The investigation report is a presentation of the findings and recommendations of the

investigation team. The report may be in a standard form or free format. Appendix 3 provides
an outline of an investigation report.

3.7.2 Legal assistance

When incident reports are being compiled, that may be required by authorities outside DSM,
it is strongly recommended that legal advice from ‘Corporate Legal Affairs’ (CLA) be sought
in the preparation of the report. Legal advice from LCA should also be considered if third
parties, including other authorities than those directly competent in respect of the incident,
request to be provided with copies of the report. Each such request should be considered on
a case-by-case basis taking into consideration the potential risks and exposures for DSM and
employees for possible criminal or civil liability.

3.7.3 Management review and endorsement

Before completion, the investigation report should be reviewed at the appropriate

management level as a check on the completeness and quality of the investigation and to
obtain endorsement of the recommended actions.

3.8 Data recording

Key data from all incidents should be registered in a database to facilitate (figure 2)
· preparation of performance reporting requirements to Business Group or Corporate
Department and/or local authorities
· statistical analysis of incident data
· causal/trend analysis.

17
4. FOLLOW-UP

4.1 Communication of investigation findings

To maximize the lessons learnt, relevant findings and conclusions of incident investigations
should be given as wide a distribution as practicable.
Discussions at, and feedback from, SHE meetings and team briefings should be used to
maximize the benefits from the learning points of the incident investigation and help achieve
the objective of preventing of similar incidents.
Learning points, which may have a wider industry value, may be exchanged with industry
contacts, safety institutes, etc.

4.2 Implementation of recommendations

Recommendations should be discussed on a formal basis with action parties for agreement
on the action required and the time-schedule for implementation. For serious incidents, this
might be reviewed and endorsed by the Business Group.

4.3 Monitoring of implementation and Check on effectiveness

Much of the value of incident investigation will be lost if the implementation of agreed
recommendations is not achieved. Where recommendations cannot be fully implemented
immediately, a formal follow-up monitoring system should be in place to ensure that agreed
actions are implemented and/or non-conformances are known to management and formally
endorsed.
Hardware related items are normally easy to identify as having been completed, e.g. when
the modification has been effected or when the new equipment has been received or
installed. This is not always the case with items such as training, changes to procedures or
supervision and particularly when action is described as “ongoing”. A precise description of
the action item is essential if it is to be effective.
It is suggested that a procedural action point is considered to have been completed when:
· written instructions have been issued and circulated to all staff concerned
· changes in procedures have been monitored and found to be effective.
It will be necessary to set a deadline to ensure implementation of recommendations. The
schedule for implementation should take both the above points into account.
Items involving training or changes in supervision should be handled in a way similar to
procedures. The changes must be planned, circulated as necessary, and monitored until they
are seen to have taken effect.
Finally, a (field) check on the effectiveness of the implementation can give valuable
information on whether the lessons learned from the incident really did result in effective,
preventative changes in the situations where incidents happen.

4.4 Statistical analysis

Statistical analysis allows for better identification of the lessons learnt from individual
incidents and improves the ability to identify and correct weaknesses in SHE management. In
addition, the Business Group incident registration system can facilitate performance
monitoring of individual units, contractors, etc.
Statistical analysis of incidents is only able to reflect what has happened and is therefore a
reflection of past policies and their implementation. For statistical analysis to be meaningful a
significant number of entries in required in order to be able to detect trends. As a company’s
safety performance improves, complete recording and analysis of all incidents becomes
increasingly more important.

18
 Appendix 1

THE TRIPOD METHODOLOGY APPLIED TO INCIDENT ANALYSIS

1. Introduction

This appendix provides a general overview of the practical application of the Tripod theory, as
applied to incident analysis of serious incidents.
The key benefit in using the Tripod analysis instead of the Incident Investigation Tree is that
the structure identifies, in a more directed manner, the types of latent failures in the
organization. This allows the incident analysis to link the aspects of DSM’s operations and
policies that need to be modified, to produce a safer working climate.
In addition, the structured method identifies those event sequences that have not been fully
analyzed and where further information is required to complete the chain of events. This can
assist investigators to identify the more generic system deficiencies. Identification of latent
failures related to incidents allows comparison with assessments of the level of
implementation of safety management; especially in companies that use the failure state
profiling technique.
Tripod is a diagnostic method of understanding how incidents happen and provides a means
of exposing latent failure mechanisms when performing incident analysis. The purpose of the
analysis is to derive a greater understanding of the underlying causes. The causal chain
which comes out of an analysis is no longer a simple sequence over time but is now
established in accordance with the following:

· incident
· breached defenses
· unsafe acts
· preconditions
· latent failures

Figure 4 illustrates this incident causation sequence, which can be traced back to the latent
failures in an organization.

2. Drowning accident (Example)

Summary

Four men, working on construction of a drilling location, were returning to their base camp for
lunch. To save time, they attempted to swim across a creek, and all men got into difficulties.
Three managed to reach the opposite bank, but the fourth failed and drowned. His body was
recovered 24 hours later.

Background

Four men had been assigned to clear a track for a water line between a new drilling location
and a nearby creek. The new location was across the creek from the engineering base camp.
to get to the worksite from base, crews could either cross the creek by canoe or walk around
via an upstream bridge, which would take them about an hour and a half.
On the day of the accident, the four men had been able to get a local canoe to ferry them
across in the morning. At about 11.30, being hungry, they decided to return to the camp for
lunch. They waited a short while for a canoe to pass, bunt none came. Their supervisor was
not there, and they did not want to lose time by waiting, so they decided to swim across the

19
creek. The water was flowing quite fast, but the creek was only six meters wide and they all
had life jackets.
Due to the current, they all experienced difficulty in swimming. Three men managed to make
it to the other bank, exhausted, but they could not locate their companion (Mr. X). The creek
was muddy and full of debris.
Villagers recovered Mr. X’s body some 24 hours later. It was found at the bottom of the
creek, some 50 meters downstream of the crossing point. His life jacket was still attached.

Result of the investigation

- The civil engineering contract specified that the Contractor was responsible for
accommodation, feeding and transport of field crews.
- The labor subcontractor was given a daily allowance to cover transport. He did not
provide a canoe on stand-by, but there were usually enough local canoes passing for his
crews to obtain lifts across the creek.
- Life jackets of local manufacture had been issued for use when working by water. Due to
recent rains, rivers and creeks were high. Instructions had been given to wear life jackets
“at all times”.
- Life jackets had been in use for about three months, but many were in poor condition,
with securing tapes broken or missing and polystyrene floatation blocks
broken/compressed.
- Neither the Company nor the Contractors had prepared a river crossing procedure.
- There was no rule forbidding swimming; contractor management considered that some
swimming was unavoidable.
- It was the understanding that all men could swim, but no swimming tests had been held,
so individual competence had not been verified.
- The subcontractor’s labor was paid on a piecework basis.
- Construction crews were split up into groups of 3 to 4 men, one supervisor looking after 5
of 6 groups.

3. Use of the Tripod method for the Drowning Incident

A complete Tripod Analysis Diagram for the Drowning accident is given in figure 5. The
diagram is set up with the use of the Tripod software (corporate license in possession of
DSM).

The Hazard- Event- Target Diagram (HET)

The Tripod method uses as a core the Hazard- Event- Target (HET) diagram as the basis to
systematically show and describe the 5 factors mentioned above. The HET describes what
happened. The further analysis shows how and why it happened.
The HET in Figure 5:
Hazard: Strong current in creek
Event: Crew swims in strong current/ Consequence: Mr. X drowns
Target: Swimming crew.

The Hazard: The threat to a defined target. Check: The Hazard transforms the Target into an
unwanted (damaged situation).

20
The Event: The Event is the accident that is the reason for the investigation. Also other
preceding or subsequent events are possible. HET diagrams can be chained. Always
describe the Event and the Consequences of the event. This is relevant for the determination
of Controls and Defenses (see later).
The Target: The target is the subject that is affected by the Hazard. It can be a person, a
building, the environment etc.

Controls and Defenses

An accident (here the Event) can only happen when one or more safety provisions designed
into the system did fail. The general Tripod name for this provision is Barriers. The Tripod
Analysis is further completely directed to the analysis of how and why the barriers failed. Two
types of barriers are distinguished:
1. Controls
Controls do control the Hazard and are placed in the HET diagram in the line between the
Hazard and the Event. In the case of a failing control a hole is shown in the Control.
Check: If the Control would not have failed, the event would have been prevented.
Controls in figure 5:
- River crossing Procedure
- Transport to other site of the creek
2. Defenses
Defenses do prevent the consequences of an event, and are therefore placed in the line
between the Target and the Event. Note that this is the reason to show the event itself
and the consequences of the event in the Event box. Check: If the Defense would not
have failed, the consequences would have been prevented.
Defenses in figure 5:
- Use of lifejacket
- Swimming skill

Analysis of the Failing Controls and Defenses

The Failed Controls and Defenses and the direct causes for the failure are the tangible, well-
understood aspects of the incidents, which emerge relatively easily from the fact-finding and
are confined to the immediate time period and surroundings of the incident. The direct
causes (mostly unsafe acts) are called active failures.
The Tripod theory has shown that these active failures do not occur in isolation but are
encouraged by existing preconditions, which are again caused by latent failures in the
organization of a company. See also Figure 4.

Active failures:
These types of failures are the direct reason that a Control or a Defense was not effective.
Active failures are failures which are the closest to the field an included unsafe acts (human
error) and failing equipment. The Tripod theory states that it is the organization and its
procedures/ management etc. that allowed the active failures to occur.
The Tripod Analyst therefore starts here the search for Preconditions and Latent Failures in
the system and organization. Only one Active Failure per failing Control or Defense should be
given.
Active failures in figure 5:
- Insufficient swimming skill
- Failing lifejacket
- No adequate river crossing procedure
- Inadequate frequency of transport

21
Preconditions

Preconditions are conditions that do encourage the occurrence of Active Failures. To

understand the nature of a Precondition: it can also be seen as the context that enabled the
Active Failure to occur. It should be noticed that there is no direct causal relationship.
The preconditions should be identified in an exhaustive way. They are the indications for
Latent Failures in the organization.

In figure 5, 2-3 Preconditions are mentioned for each Active failure. Examples:
- No inspection/ testing of life jacket (precondition for a poor life jacket)
- Swimming training inadequate (precondition for insufficient swimming skill)
- Swimming seen as unavoidable by management (precondition of inadequate river
crossing procedure)
- Local canoes frequently unavailable (precondition for low frequency transport)

Latent Failures

Latent Failures are deep rooted, longer existing problems in an organization that will be
recognized by employees if mentioned. To check whether it is really a Latent Failure that is
identified: it can also be phrased as ‘this is the way we work here’. For example: ‘we are not
good in maintenance, we know it for years, more incidents did occur because of that: ‘that is
the way we work here’.
Latent failures always address a specific organizational unit. This unit should be mentioned in
the Latent Failure. In figure 5, all three Latent Failures address the Company itself. They will
differ for the Contractor and the subcontractor.
The Latent Failures identified for the drowning incident have to do with a bad control and
supervision of Contractors. The company also never requires insight in the Safety
Management and specific job safety plans of Contractors.

In figure 5, 3 Latent Failures are mentioned:

- Company does not require a Safety Plan from Contractors
- Safety Provisions not seen as important by the Company
- No supervision of Contractor company.
The final step in the Tripod Analysis is the Categorization of the Latent Failures into Basic
Risk Factors.

Basic Risk Factors

The concept of Basic Risk Factors (BRF) is developed and validated within Tripod. A number
of 11 BRF’s are identified which characterize an organization. The BRF’s are:
· Hardware (HW)
· Design (DE)
· Maintenance Management (MM)
· Procedures (PR)
· Error Enforcing Conditions (EC)
· Housekeeping (HK)
· Incompatible Goals (IG)
· Communication (CO)
· Organization (OR)
· Training (TR)

22
· Defenses (DF)

This BRF list, order and phraseology have been standardized for use throughout the DSM.
By categorizing the Latent Failures identified from incidents, the company starts to build a
BRF profile. It is believed that the accumulation of 20 incident investigations will lead to a
reliable BRF profile of a company. The profile shows the relative strengths and weaknesses
of the company with respect to the different Basic Risk Factors. This than is a good basis for
improving the effectiveness of the Safety management System.
As mentioned above: the BRF classified Latent Failures should all refer to the same
company.
For the drowning incident, the BRF’s have been classified as Organization (OR) and
Defenses (DF). The Tripod software allows identifying three BRF’s per Latent Failures (see
the small boxes connected to the Latent failures).

Figure 4 Incident causation sequence

Human
involvement
Top level Line managers
decision makers designers, planners, etc.

Line management
Latent
Operators maintainers
failures
truck drivers etc.
Pre-conditions

Active failures
(incl. Unsafe
acts) Controls &
System
Causal defences
sequence

Local triggers
Technical Faults ACCIDENT
Atypical conditions
Environmental conditions
etc. Limited windows
of Accident opportunity

23
 Dependency on
infrequent local canoes

Company does not

require a Safety Plan Precondition
from Contractors
Subcontractor did not
Frequency transport
Lat.Failure OR OR OR arrange (daily allowance
insufficient
saving)

Precondition Active Failure

Transport need: labor

paid on piece work basis
(time is money)

Precondition

Food not provided at Strong current in creek

construction site by
subcontractor
Safety Provisions not Creek crossing transport to other side
seen as important by Precondition procedure creek
Company
Swimming was seen as
Lat.Failure DF DF DF No adequate procedure
unavoidable by
with swim prohibit
contractor management

Precondition Active Failure Crew swims in strong

current/ Mr X drowns
Risk of swimming not
appreciated

Precondition

Swimming crew
No supervision of
Contractors by
Company Use of Lifejacket Swimming skill
Jacket in poor condition
Lat.Failure OR OR OR
Precondition

No inspection/ testing
procedure for lifejacket Fails to keep him afloat
by contractor

Precondition Active Failure

No approval of life jacket

design by contractor

Precondition

Swimming training
inadequate

Precondition insufficient swimming

skill Figure 5 Tripod diagram of drowning accident
Swimming skill test
procedure inadequate
24 Active Failure

Precondition
Figure 6 Drowning Incident Root Cause Analysis Appendix 2
Description Preconditions Active cause – consequence Broken barriers Possible solutions
chain

Where: Bush Object Deviation/Condition

Object Deviation/Condition Object Deviation/Condition

When: ???
One man in problem
and drowns Lifejacket inadequate
Severity: Better inspection
One fatality support
4 men problems with
swimming
Evidence & Swimming tests not held
Creek high/fast Introduction swimming
remarks tests
Creek muddy, lots of trash
4 men swimming Forbid swimming
Bridge 1 ½ hour walking men saving time
and creek and is only 6 meter
men paid on piece work
People want to go to base- Other contract
basis
camp Supervisor not present
Canoe not available Substitute deputy
Contractor no audits on
Audit Contractors
subcontractor
Men are hungry
Canoe no standby canoe
Canoe not in the
neighborhood Subcontractor depended on
canoes in
Creek higher and fast Take lunch to the drilling
neighborhood
location.
???? (money?)

25
 Appendix 3

INCIDENT INVESTIGATION REPORTS

This appendix contains a brief description of the key elements of a written investigation
report.

Advised is the following content for a serious incident investigation report

· information about the injured person(s);
· basic information about the injury, including classification of the injury as a first-aid, a
medical treatment, a restricted work case, a lost work day case or a fatality;
· the groups concerned, stating job and employment status (e.g. contractor personnel);
· a detailed description of the incident
· a list of witnesses to the incident;
· a list of all existing unsafe conditions and the reasons for the incident;
· a description of the unsafe action that led to this incident;
· the causes of injury, including the underlying causes;
· how management and/or the employee could have prevented this incident;
· the corrective action to prevent the incident's recurrence;
· any recommendations resulting from the investigation;
· the signature of the investigating supervisor or of the manager, the title, the date, and, if
appropriate, the supervisor of the investigating manager and the names of the
investigation team members.
When liable issues could play a role, the report should be classified as 'draft' until after a
check by the legal counsel.
General recommendations to consider in preparing the report are:
· the report should be factual, concise and conclusive
· interpretations of findings should be based on the facts as identified in the investigation
· unsubstantiated speculation should be avoided at all times
· assessment of underlying causes should be made, based on an analysis of the findings
· where events or conditions are listed, that are not critical for the incident to have
occurred, this should be clearly indicated
· the report should be readable as a stand alone document, references to other documents
not open to inspection by others i.e. the public, should be avoided
· The issue date should be mentioned and previous drafts of the report should be
destroyed
· a paper trail of the documents relevant to the incident and the report should be
established.

26
Specification of an incident investigation report (format)

Summary

A brief summary of the report, giving the background of the Incident, a description of the
Incident, description of injuries, damage and loss, and outlining the main facts, principal
causes identified, and remedial measures taken.

Time, place and date of incident

Details of persons injured, including as appropriate

· status, i.e. DSM employee, contractor employee, or third party (specified)

· name, age, whether employee or contractor, position held, time in that position
· length of service (DSM and area)
· nationality and family status
· details of injuries, in a form understandable to non-medical readers (medical reports can
be attached as appendices).

Details of damage

· description of the extent of direct damage

· estimate of loss value
· estimate of consequential losses.

Events leading up to the Incident

A short narrative that sets the scene of the Incident:

· description of the operation in progress
· preparations made for the work (work procedures, instructions, permits, supervision)
· personnel and equipment involved
· environmental conditions
· activities taking place at the scene of the incident
· activities of key persons prior to the day of the incident that could have affected their
actions.

Description of the Incident

A statement of the facts immediately surrounding the incident, covering the period from the
initiating events until the situation was under control and identifying, where possible, the
sequence of events. In this context photographs, maps or drawings should be used as
illustrations to support the narrative.

Results of the investigation of the Incident

This section should demonstrate that the investigation was carried out in sufficient depth to
support the conclusions that follow. It should include, where relevant, references to:
· environmental conditions
· condition of equipment and facilities, known deficiencies, positioning, operating mode,
etc.
· procedures relating to the operation
· pertinent information concerning the principal operators and supervisors (e.g. training,
experience, hours into shift and days into tour)

27
· work instructions and communications
· records and documentation
· information derived from the nature of the damage
· list of witnesses and witnesses’ statements
· medical information (state of health)
· factors affecting alertness or judgment (e.g. fatigue, social pressures, alcohol, medication
or drugs)
· working conditions
· survival aspects
· results of special investigations and tests
· rescue and damage containment activities
· emergency response and recovery activities

Conclusions

This section should include the results of the analysis of the findings, identifying the
immediate and underlying causes and commenting on the effectiveness of rescue and
damage containment activities where appropriate.
Conclusions based on circumstantial evidence should be highlighted as such.

Recommendations to avoid recurrence

Recommendations should identify corrective measures for as many of the listed causes as
possible and may be related to:
· eliminating the causes
· minimizing possible consequences
· improving rescue or damage containment measures
· emphasizing that all causes identified should be eliminated.
Action parties and time schedules for implementation should be identified.
Note that recommendations based on a Tripod Analysis can be given at three different levels:
- Active Failures
- Preconditions
- Latent Failures

Signature

The signature of the investigating supervisor or of the manager, the title, the date, and, if
appropriate, the supervisor of the investigating manager and a list of investigation team
members.

Appendices

Any other pertinent information considered necessary for the understanding of the report.
This should include photographs, maps and drawings to supplement and clarify the written
report.

28