Process Safety Management Audits Point Up Operating Practice Deficiencies

Companies conduct process safety management (PSM) audits to gauge the effectiveness of their current programs and identify potential improvements, or to comply with relevant regulatory requirements [1,2]. Certain common issues arise in many of these audits. The first article in this series on the findings of such audits focused on safe limits and operating limits (“PSM Audits Find Confusion Common”) [3]. In this part, we concentrate on operating procedures (OPs), training, and safe work practices (SWPs), including hot work permits (HWPs).

OPs [2, 4], the associated operator training and the SWPs governing hazardous work performed in facilities provide the basis for the ongoing safe and consistent manufacture of desired products as intended by the process design, including appropriate evaluation and management of process risks. A lack of well-designed and comprehensive OPs can lead to process upsets, quality problems, productivity issues and, perhaps, significant process safety incidents, including loss of containment, injury to people and environmental harm. Inadequate training of personnel in understanding and following OP requirements also can prompt these issues. Likewise, deficiencies in SWPs or poor use and training on SWPs can result in similar situations.

A PSM audit assesses if a company has followed regulatory requirements and good industry practices in developing effective OPs/SWPs and if personnel have received, understood and adhere to training on their required job tasks.

Here, we will discuss several of the most frequent audit findings related to OPs, training and SWPs, and provide guidance on how appropriate implementation of requirements for these PSM elements can improve compliance and, ultimately, contribute to safe operations and manufacturing excellence.

Requirements/Background

OPs are developed to provide instruction on how to safely and reliably perform job tasks related to process operations, consistent with the technical documentation given in the process safety information (PSI) and the hazard and risk evaluation in the process hazard analysis (PHA). OPs typically define the specific operating tasks associated with the process, including the roles of operators, sequencing of job tasks, safety and health considerations, operating limits, and troubleshooting of potential operating problems. The relevant PSM requirements of the U.S. Occupational Safety and Health Administration (OSHA) appear in OSHA 29 CFR 1910.119 (f), (g) and (k).

A number of approaches can meet these requirements, with the choice often related to different operating needs (e.g., for batch, semi-continuous or continuous processing). Regardless, the company must (1) review OPs as often as necessary to help ensure they are up-to-date, including alterations adopted following a management-of-change (MOC) procedure, and (2) annually certify them as current and accurate.

SWPs are developed to provide instruction on recurring but nonroutine tasks, to help ensure this type of work proceeds safely following established general procedures. The relevant OSHA PSM requirements appear in OSHA 29 CFR 1910.119 (f)(4); in some cases, additional OSHA standards may apply (e.g., OSHA 1910.146 for confined space entry). Typical SWPs as listed in the OSHA PSM regulation include:

• lockout/tagout;
• confined space entry;
• line break (equipment/piping);
• control over entrance; and
• hot work.

Note the OSHA Hot Work Permit element [OSHA 29 CFR 1910(k)] has been included here due to its similarities with the listed SWPs. A company also should develop additional SWPs on a wide range of nonroutine activities needed at a facility but not listed in the OSHA PSM regulation; they should be consistent with other OSHA regulations and effective occupational safety programs (e.g., OSHA 1910.179 for crane lifting) [3].

A company must provide training on OPs and SWPs to develop personnel competency and consistency of operation. The relevant OSHA PSM requirements appear in OSHA 29 CFR 1910.119. Such instruction consists of:
• initial training to understand safe operating practices and requirements, including an overview of the process, safety and health hazards, emergency operations and shutdown, and safe work practices; and
• refresher training to help ensure employees understand and adhere to current OPs.

Different approaches can serve to meet initial training requirements. Most companies use extensive training checklists with written tests and/or field demonstrations to verify understanding and determine job qualifications. Some firms opt for outside training at community colleges or other locations to provide some of the initial training on facility hazards, emergency response and SWPs. Initial training and qualification practices often relate to job progression requirements.

The approaches used for refresher training vary from requirements to review all current revisions of the OPs with written tests, interviews and/or field demonstrations to less-extensive OP reviews or testing. Refresher training must take place at least every three years; some firms do it just before the deadline while others schedule aspects of the refreshing training monthly or quarterly with completion over the 3-year time frame. Companies must consult employees on the frequency of training to help establish effective refresher training schedules. For example, operators may believe they should get certain training annually instead of once every three years. In all cases, a company must properly document training has occurred. This must include the identity of the employee, the date of the training, and the means used to verify understanding.

Common Failings

PSM compliance audits often find issues with OPs, SWPs and training. Common ones include:

1. OPs do not explicitly address all operating phases. The OSHA regulation and good industry practice (GIP) require each covered process to have OPs that cover seven operating phases (e.g., startup, normal operations, emergency operations). Some issues related to this requirement include:

• When discussing “initial startup” procedures, auditors often are referred to “normal startup” procedures. Initial startup procedures are intended for (1) the first startup of the covered process, which likely includes additional pre-commissioning activities and steps, or (2) startup following a de-inventory of the entire process (e.g., as part of a big turnaround). Normal startup procedures typically address “startup following a turnaround, or after an emergency shutdown.” For example, batch processes routinely may get started up daily while semi-continuous or continuous processes may start up routinely following normal shutdowns or scheduled maintenance. Of course, the initial startup may have occurred many years ago and, as a result, such procedures no longer may exist or may be archived/available in some fashion.

• When “normal operations” OPs are reviewed, sometimes (1) there is a lack of clarity about what they should be, (2) the information simply is not available, or (3) it is dispersed across multiple OPs. Normal OPs typically cover activities such as (1) daily field/board operator duties, including operator rounds/readings, (2) sampling, (3) troubleshooting, and (4) routine activities (e.g., switching filters or pumps). However, these often are not clearly labeled as procedures during normal operations; this could result in unnecessary attention during a regulatory inspection.

• Some units require OPs for “temporary operations” (e.g., routine bypassing of a piece of equipment that needs cleaning or maintenance) but these OPs do not always exist. The most common source of temporary OPs for most units is associated with temporary MOC packages, and there is no reference to this in the operating manuals or the “procedure on writing and revising procedures” (if one exists).

• When reviewing the emergency shutdown procedures, it is not uncommon to find (1) the conditions under which emergency shutdown is required are not explicitly stated or are lacking, and/or (2) the assignment of shutdown responsibility to qualified operators is not documented (e.g., by explicitly defining who does what for each OP step or section and clearly stating that only qualified operators can execute the emergency shutdown).

• The differences between “emergency shutdown” and “emergency operations” procedures often are not clearly defined/understood and no references to the “corrective actions” appear in the operating/safe limits tables [3]. Typically, emergency shutdown procedures are those pertaining to immediate shutdown of a piece of equipment, process section or entire process based on loss of containment or deviations outside a safe upper/lower limit, while emergency operations procedures are those associated with loss of a utility, loss of the control system, shutdown of an upstream/downstream unit, or operation outside an operating limit.

• Often, specific procedures for “startup after an emergency shutdown” are lacking. For most units, the state of the process after an emergency shutdown will differ from the state after a normal shutdown. The subsequent startup would need to begin with placing the system in the proper configuration for startup so the normal startup procedures can be used, after appropriate checking of the process and equipment.

Guidance: Provide OPs for all required operating phases, with adequate detail to address the issues discussed above. In most cases, two best practices exist: (1) clearly named individual OPs are provided for each operating phase, and (2) all operating phases are clearly identified in each OP. If an operating phase (e.g., initial startup) is not relevant for the process, this also should be documented to avoid possible confusion or be seen as an oversight.

2. OPs do not clearly and specifically address safety and health considerations. Industry practice is to meet OSHA’s requirements by writing OPs in a way that ensures even the least experienced operator has clear instructions for safely operating the process. As such, it is important to (1) remind personnel of what chemical(s) they could be exposed to when executing each procedure, and (2) provide some combination of summary information about the associated chemical exposure hazards and clear references to the safety data sheets (SDSs) and any other pertinent safety documents for further review. However, one or both of these aspects often are lacking.

Conversely, we periodically find a large “Safety and Health” section in each procedure, which (1) is redundant, (2) develops “variances” between different OPs over time, and (3) may cause operators to skip over this section to get to the primary operating instructions. OSHA provides a clear list of items to include in the safety and health section but, in many cases, the requisite information is not organized, is hard to find during an audit, or simply is not given (e.g., quality control of raw materials).

Guidance: Ensure OPs provide all required safety and health items. If using an “umbrella” OP to document the required safety and health information, consistently refer to it in the other OPs.

3. OPs omit (or don’t reference) safety systems and their functions. OPs must include discussion of safety systems to help operators (1) understand what safety systems exist in their process, and (2) know how these systems function as well as actions they must take to activate a system when appropriate. However, even when sufficient information about the safety systems and their design appears in the PSI, OPs may lack adequate details or references, as required. Often OPs do not contain enough information to inform operators on how they should interact with each safety system (e.g., how do they activate fire protection if it does not automatically activate, or how do they respond to one or multiple toxic or combustible gas detectors alarming); determining the right level of detail requires serious thought. Also, the safety systems may not be a formal refresher training subject.

Guidance: Ensure safety systems are discussed or referenced in OPs. In some cases, one OP can be provided to document multiple safety systems applicable to a set of OPs or a process unit. OPs for safety systems also can be distributed in several OPs, as appropriate.

4. OP review and certification process has gaps. Asking how often OPs are reviewed leads to a variety of answers, including (1) “annually as part of the certification,” (2) “every three years as part of the refresher training schedule,” or (3) “whenever a MOC-approved alteration affects them.” The first response is beyond regulatory requirements because OSHA does not expect annual in-depth reviews of all the procedures [5], although this can be a GIP depending on the overall scope. The other responses suggest not all the procedures are being reviewed “as often as necessary” per the regulation. Involving all the operators in periodic procedure reviews as part of refresher training (see Issues 8 and 9) is helpful but is not a regulatory requirement. Review only by some operators and not including operations supervision or engineers may miss some actual operating practices and is a lost “employee participation” opportunity.

Even though the regulatory requirement for annual certification of OPs has been in place since 1992, we too frequently find that implementation of this has eroded over the years and gaps exist in the certification documentation, sometimes for extended periods. Also, some new processes have been introduced without including a requirement for annual certification of the OPs. In many cases, certification documentation does not explicitly confirm the current revisions of the OPs are “current and accurate” or identify the process used to determine the status of the procedures.

Guidance: Ensure OPs are reviewed on a practical timetable, to support the 3-year refresher training schedule. Ideally, operators should lead or at least be involved in the review process to help make certain the OPs reflect actual operating practices. OPs should be certified annually, providing documentation on the review process (along with use of the MOC system) used to keep them current.

5. Non-PSM OSHA requirements for SWPs are not met. Several of the SWPs referred to in the PSM regulations have their own internal audit requirements, as mentioned in the “Requirements/Background” section. Three issues with these frequently arise during compliance audits:

• Sites are not complying with the OSHA 1910.147(c)(6)(i) requirement to “conduct a periodic inspection of the energy control procedure at least annually to ensure that the procedure and the requirements of this standard are being followed.” In some cases, no evidence exists of any annual reviews. In many cases, “field” inspections or inspection of all the pertinent types of energy control procedures may be lacking. OSHA considers periodic inspections to be a “hot” topic [6]. Potential reasons include personnel changes and/or management systems that may erode over time.

• A majority of sites do periodic “permit audits” but some do not audit all the completed confined space entry (CSE) permits within at least one year of the entry, as required by OSHA 1910.146(d)(14). In other cases, they regularly review their CSE procedure and permit form but not all the completed CSE permits.

• Neither the HWP nor the associated site procedure/training discuss all the pertinent fire prevention and protection requirements in OSHA 1910.252(a). Although listing all these on the HWP form may not be practical or necessary, it is certainly reasonable to go through the requirements and sources of the requirements during training on the site’s HWP procedure. Periodic training for employees and contractors who use the HWPs and with personnel who authorize the permits should be provided.

Guidance: Ensure compliance with non-PSM OSHA requirements for SWPs, in particular the requirements for periodic review of completed permit documentation. In addition, when supplementary training and audit requirements are built into corporate or site SWPs, make certain these requirements are met consistently because they typically will be reviewed by auditors/inspectors.

6. Hot work permits do not consistently identify the object on which work is to be performed. Many sites do a good job in implementing the OSHA 1910.252(a) requirements associated with the hot work element. However, the additional PSM requirement to identify the “object” of the hot work sometimes is missed. Review of completed HWPs usually turns up some cases where this identification is lacking or vague. Typical descriptions provided often are along the lines of “C Rx 3rd Floor” (if the reactor is large, hot work hazards may differ depending on the side being worked on), “Fabricating New Water Line” (no mention of any specific location or range), or “Weld Repairs on North Stairs” (no identification of which level[s]). In some cases, this may partly result from use of HWPs that do not include a “location” box on the form.

Guidance: Ensure hot work permits and work control practices require identification of the specific location and object to be worked on. Periodically review completed hot work permits and require additional training as needed.

7. Control over entrance (and exit) for the covered process units is not adequate. Most sites have procedures/practices for control over entrance/exit of maintenance and support personnel, contractors and other visitors to covered process units. However, people often don’t strictly follow entrance procedures. Sign-in and sign-out logs typically are used with operator contact in the control room prior to entry to hazardous areas to help ensure safe performance of the required work. It is not unusual to review logs or work permits and observe that workers did not sign in or out during the task. Often, people sign in but fail to sign out, which could lead to unnecessary rescue efforts in an emergency. In some cases, a person passing through security procedures at a site’s entrance may have access to the entire facility. Visiting personnel allowed into a facility should not be able to enter hazardous process areas without following access control requirements. Auditors should carefully review the effectiveness of access restrictions.

Guidance: Develop written procedures for entry into covered process areas in addition to typical security measures for entrance into the overall facility. Periodically review sign-in and sign-out logs and update them to help ensure their correct use. Provide corrective training, as needed, for violators.

8. Inconsistencies and gaps undermine refresher training. The refresher training process and requirements often are not well defined and, as a result, may vary from unit to unit (or even shift to shift), raising compliance issues or gaps versus GIP. Some examples include:

• The site has not specified which OPs require refresher training. This can result in variability and/or gaps in which procedures are reviewed during the 3-year refresher training cycle. Note the regulatory requirement is to “assure that the employee understands and adheres to the current operating procedures of the process” but employers have latitude on how they accomplish this.

• The frequency of OP reviews and/or the “depth” of such reviews may not be specified or may be lacking. In-depth versus summary reviews can aid both OP reviews (see Issue 4) and the effectiveness of refresher training (see the next bullet point).

• Refresher training lacks clear documentation of the means used by the trainer/supervisor to verify understanding (particularly for training that does not include a test).

• Documentation of the training for all operators is not available (e.g., operators out sick or on vacation may be missed).

Guidance: Develop and implement (or upgrade) the site PSM operator training guideline to specifically address how initial and refresher training are to be performed, including the differences between them, documentation of the site’s basis for deciding which OPs require refresher training, and the depth of review necessary. For example, the decision on the depth/type of review needed may be based on (1) identifying the “critical” OPs on a qualitative basis, or (2) analyzing each OP for frequency/criticality/difficulty and requiring refresher training or more-frequent training on those with specified scores. Then, consider use of computer-based training or document review approaches to provide and record refresher training on “basic” OPs, with additional testing and/or field demonstrations on “critical” OPs to verify understanding/adherence. (See the next issue for related information.)

9. Refresher training does not ensure employees adhere to the current OPs. One of our focus issues of the last few years — the part of the regulatory requirement “to assure that the employee understands and adheres to the current operating procedures of the process” — often is not addressed. Refresher training frequently (1) relies on the same written tests (or subsets of the tests) used for initial training, (2) involves individual or group reviews of some procedures, and (3) includes “what-if” or “tabletop” drills on some training on operating/emergency scenarios. These practices can help to verify understanding of training for a group but not for individuals or on the specifics of the current revisions of the OPs. They do not suffice to establish adherence to the OPs, especially for tasks done infrequently.

Guidance: Provide a “demonstration of proficiency” component in the refresher training program in addition to written test verification of understanding, to help provide adherence to the current OPs. For example, it can be useful to (1) identify “critical” procedures (typically ones for startup, shutdown, emergency, and other serious situations) needing refresher training to verify “adherence,” and (2) require some amount of “field demonstrations” on these critical procedures (e.g., repeating some of the demonstrations used in initial training and/or showing proficiency on some procedures [“what-if” or “tabletop” group simulation, monitored execution or simulation of some procedures]). Review the quality and results of written testing procedures. A true/false question format likely is less effective in establishing understanding of OPs and emphasizing the continuing adherence to OPs. While not required, rechecking knowledge of the OPs (say, 3–6 months after training) can be useful as a GIP to evaluate the long-term retention of training and help emphasize the adherence requirements. In addition, focusing on operational discipline programs [7] to promote continued adherence to OPs and other requirements, and evaluating gaps can play a useful role in evaluating, documenting and improving overall adherence efforts.

10. A process or documentation that employees are consulted on the appropriate frequency of refresher training is lacking. A common audit finding is inadequate consultation with employees on the appropriate frequency of refresher training since refresher training cycles can be up to three years with some training repeated at shorter (e.g., annual) intervals or provided prior to each execution of a particular OP. Consulting with employees on the frequency of training on OPs or other topics allows both experienced and new personnel to provide input to the training process. In some cases, consultation on the frequency may have occurred at one point but has not been sustained by repeated consultation (e.g., annually or at the 3-year refresher training limit). Refresher training also may be required “on demand” for infrequently performed tasks when they are scheduled (e.g., a unit shutdown/startup that only occurs on a 3–5-year frequency).

Guidance: (1) Consult with employees on the frequency of refresher training at least once during each 3-year refresher training cycle, and (2) appropriately document the input received. You can get employee feedback on training frequency in a safety meeting or via questions on training checklists or tests. In addition, while not required, consultation with employees on the content and quality of refresher training materials and instruction can provide feedback to improve the refresher training program.

Enhance Operational Safety

Well-documented OPs and SWPs with associated effective training programs and practices are important foundations for safely and reliably operating potentially hazardous processes. Process safety regulations and industry best practices therefore require:

• OPs be developed for different operating phases; be kept current; and contain clear operating instructions, operating limits, safety and health considerations, and safety systems descriptions and instructions;

• SWPs be developed for recurring nonroutine tasks, such as lockout/tagout, confined space entry, line break, facility entry, and hot work;
• Initial and refresher training on OPs and other operating and safety information be provided and documented to develop personnel capability and operational consistency; and

• Periodic training be given on SWPs and other safety procedures and information.

Process safety audits continue to show poor understanding and ineffective implementation of these OP and training requirements and the requirements for SWPs.

We hope the information provided here will help you better evaluate these important parts of your PSM programs for improved regulatory compliance, continued safe operation, and support of overall manufacturing excellence.

JIM THOMPSON, CPSA, is a Louisville, Ky.-based process safety consultant with ABSG Consulting Inc. JIM KLEIN, CCPSC, CPSA, is a Minneapolis-based process safety consultant with ABSG Consulting Inc. Email them at [email protected] and [email protected].

REFERENCES
1. “Guidelines for Auditing Process Safety Management Systems,” 2nd ed., Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (2011).
2. “Guidelines for Risk Based Process Safety,” Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (2007).
3. Klein J. A. and Thompson J. R., “Process Safety Management Audits Find Confusion Common,” pp. 18–24, Chemical Processing (Oct. 2021)
4. “Guidelines for Writing Effective Operating and Maintenance Procedures,” Center for Chemical Process Safety/John Wiley & Sons, Hoboken, N.J. (1996).
5. “Standards Interpretations Letter,” U.S. Occupational Safety and Health Admin., Washington, D.C. (March 9,1994).
6. “Lockout-Tagout – Hot Topics – Energy Control Program – Periodic Inspections,” U.S. Occupational Safety and Health Admin., Washington, D.C.
7. Klein, J.A., and Vaughen, B.K., “Process Safety: Key Concepts and Practical Approaches,” CRC Press, Boca Raton, Fla. (2017).