LFI JKPDF

Learning from incidents, accidents and events
LEARNING FROM INCIDENTS, ACCIDENTS AND EVENTS
1st edition
August 2016
Published by
ENERGY INSTITUTE, LONDON
The Energy Institute is a professional membership body incorporated by Royal Charter 2003
Registered charity number 1097899
The Energy Institute (EI) is the chartered professional membership body for the energy industry, supporting over 23 000 individuals
working in or studying energy and 250 energy companies worldwide. The EI provides learning and networking opportunities to support
professional development, as well as professional recognition and technical and scientific knowledge resources on energy in all its forms
and applications.
The EI’s purpose is to develop and disseminate knowledge, skills and good practice towards a safe, secure and sustainable energy system.
In fulfilling this mission, the EI addresses the depth and breadth of the energy sector, from fuels and fuels distribution to health and safety,
sustainability and the environment. It also informs policy by providing a platform for debate and scientifically-sound information on energy
issues.
The EI is licensed by:

−− the Engineering Council to award Chartered, Incorporated and Engineering Technician status;
−− the Science Council to award Chartered Scientist status, and
−− the Society for the Environment to award Chartered Environmentalist status.
It also offers its own Chartered Energy Engineer, Chartered Petroleum Engineer and Chartered Energy Manager titles.
A registered charity, the EI serves society with independence, professionalism and a wealth of expertise in all energy matters.
This publication has been produced as a result of work carried out within the Technical Team of the EI, funded by the EI’s Technical Partners.
The EI’s Technical Work Programme provides industry with cost-effective, value-adding knowledge on key current and future issues
affecting those operating in the energy sector, both in the UK and internationally.
For further information, please visit http://www.energyinst.org
The EI gratefully acknowledges the financial contributions towards the scientific and technical programme
from the following companies
BP Exploration Operating Co Ltd RWE npower

BP Oil UK Ltd Saudi Aramco
Centrica Scottish Power
Chevron SGS
CLH Shell UK Oil Products Limited
ConocoPhillips Ltd Shell U.K. Exploration and Production Ltd
DCC Energy SSE
DONG Energy Statkraft
EDF Energy Statoil
ENGIE Talisman Sinopec Energy (UK) Ltd
ENI Tesoro
E. ON UK Total E&P UK Limited
ExxonMobil International Ltd Total UK Limited
Kuwait Petroleum International Ltd Tullow Oil
Maersk Oil North Sea UK Limited Valero
Nexen Vattenfall
Phillips 66 Vitol
Qatar Petroleum World Fuel Services

However, it should be noted that the above organisations have not all been directly involved in the development of this publication, nor
do they necessarily endorse its content.
Copyright © 2016 by the Energy Institute, London.

The Energy Institute is a professional membership body incorporated by Royal Charter 2003.
Registered charity number 1097899, England
All rights reserved
No part of this book may be reproduced by any means, or transmitted or translated into a machine language without the written
permission of the publisher.
ISBN 978 0 85293 923 9
Published by the Energy Institute
The information contained in this publication is provided for general information purposes only. Whilst the Energy Institute and the
contributors have applied reasonable care in developing this publication, no representations or warranties, express or implied, are made
by the Energy Institute or any of the contributors concerning the applicability, suitability, accuracy or completeness of the information
contained herein and the Energy Institute and the contributors accept no responsibility whatsoever for the use of this information. Neither
the Energy Institute nor any of the contributors shall be liable in any way for any liability, loss, cost or damage incurred as a result of the
receipt or use of the information contained herein.
Hard copy and electronic access to EI and IP publications is available via our website, https://publishing.energyinst.org.
Documents can be purchased online as downloadable pdfs or on an annual subscription for single users and companies.
For more information, contact the EI Publications Team.
e: pubs@energyinst.org
CONTENTS
Page
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
I Executive summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
I.1 Overview of LFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.2 What is LFI? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
1.3 The benefits of LFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.4 Objectives and scope of guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.4.1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.4.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.5 Basis for guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
1.6 Potential users of this publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2Overview of incident causation and LFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.2 Incident causation model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.2.1 Barriers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.2.2 Immediate causes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.2.3 Performance influencing factors (PIFs) . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.2.4 Underlying causes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.2.5 Differences in terminology and models . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.2.6 Drilling down . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.3 LFI process model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.3.1 Feedback loops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.4 Individual and organisational learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4.1 Individual learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4.2 Organisational learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.5 Management systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.6 Safety culture and organisational cultural maturity . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.7 Overview of legal issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3Reporting and prioritisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.2 Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.2.1 What incidents should be reported? . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.2.2 How should incidents be reported? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.3 Triage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.3.1 Initial response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.3.2 Prioritisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.4 Defining the level of investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.5 Encouraging reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.6 Case studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.6.1 Chiltern Railways’ 'Close Call' campaign. How to build a
strong reporting culture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3
Contents continued
Page
3.6.2 Q8Oils near misses promotional campaign 2013/2014 . . . . . . . . . . . . . . 41
3.7 Blockers and potential enablers for reporting of incidents . . . . . . . . . . . . . . . . . . . . 41
4Investigation: Fact finding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.2 Investigation initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.3 Investigation resources and competences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.4 Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.5 Information gathering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.6 Interviewing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.7 Early learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.7.1 Urgent actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.7.2 Communication of initial findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4.7.3 Returning to production/service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4.7.4 Including frontline staff in investigations . . . . . . . . . . . . . . . . . . . . . . . . . 52
5Investigation: Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.2 Approaches to incident causal analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.2.1 What happened . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.2.2 Why it happened . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
5.3 Investigation reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.4 Case study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.4.1 Overview of incident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
5.4.2 Summary of investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.4.3 Immediate causes and recommended actions . . . . . . . . . . . . . . . . . . . . . 64
5.5 Blockers and potential enablers for investigation of incidents . . . . . . . . . . . . . . . . . 65
6 Recommendations and actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

6.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
6.2 Developing appropriate recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.2.1 Who should be involved . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.2.2 Rationale for recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.2.3 Prioritisation and review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
6.2.4 Standards for recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
6.3 Derivation and allocation of actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
6.4 Action implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
6.4.1 Implementation and close out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
6.4.2 Follow up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
6.5 Blockers and potential enablers for effective recommendations and actions . . . . . . 73
7 Broader learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.2 Identifying lessons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
7.3 Identifying stakeholders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
7.4 Methods for communicating lessons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
7.4.1 Internal communications methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
7.4.2 External communications methods (including to other industries) . . . . . . 79
4
Contents continued
Page
7.5 Receiving and making sense of communicated information
('reflecting', 'contextualising' or 'sense-making') . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
7.6 Embedding and sustaining learning in an organisation . . . . . . . . . . . . . . . . . . . . . . 84
7.6.1 Management system improvements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
7.6.2 Organisational arrangements for learning . . . . . . . . . . . . . . . . . . . . . . . . 86
7.7 Case studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
7.7.1 Hearts and Minds Learning from incidents tool . . . . . . . . . . . . . . . . . . . . 86
8 LFI evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
8.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
8.2 Determining whether effective learning has occurred following an incident . . . . . . 88
8.3 Collection and analysis of data on multiple incidents . . . . . . . . . . . . . . . . . . . . . . . 90
8.4 Evaluating the effectiveness of LFI processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
8.5 Blockers and potential enablers for broader learning and LFI evaluation . . . . . . . . . 97
Annexes
Annex A References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Annex B Glossary of terms, abbreviations and acronyms . . . . . . . . . . . . . . . . . . . . . . . 102

B.1 Abbreviations and acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
B.2 Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Annex C Performance influencing factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
5
FOREWORD
A number of industry commentators have noted that the energy and allied industries still need to
improve in learning lessons from incidents. This view is prompted by the reoccurrence of similar
events, and by evidence of the difficulty of achieving long-term changes in behaviour and working
processes following incidents. Ideally, learning from incidents (LFI) should be a critical part of ensuring
continuous business and operational improvement.
In 2008 the Energy Institute (EI) published Guidance on investigating and analysing human and
organisational factors aspects of incidents and accidents (first edition). This provided guidance on
ensuring human and organisational factors (HOF) are considered in addition to technical causes when
investigating incidents, and was produced because of the recognition that these factors were often
given insufficient attention.
In addition to insufficiently probing HOF within the investigation, research has indicated additional
challenges at several stages in the LFI process, including: reluctance to report incidents due to fear
of disciplinary action; lack of time and resources dedicated to helping people understand and make
sense of lessons; overload of investigation recommendations and failure to agree actions with all
the involved parties, and failure to check that implemented changes have actually addressed the
underlying causes and have reduced risk.
In recognition of these and other challenges, the EI’s Human and Organisational Factors Committee
(HOFCOM) was tasked by the EI’s Technical Partner Companies (comprising many of the major energy
companies), together with the Stichting Tripod Foundation (STF), to update and broaden the original
2008 guidance document.
Learning from incidents, accidents and events (first edition) supercedes the 2008 publication and
now covers the whole LFI process, from reporting and finding out about incidents through to
implementation of effective learning resulting in changing practices.
The main objectives of this publication are to:

−− act as the initial 'go to' resource for LFI, but pointing to other more detailed resources
as necessary;
−− inform on current good practice for all key phases of the LFI life cycle; and
−− focus not just on accident/incident investigation but also learning.
In addition, the central objective of the 2008 publication has been retained, i.e. to guide the reader
in understanding the HOF causes of an incident through appropriate investigation approaches.
This publication has been produced with the help of three industry stakeholder workshops organised
by the EI and held in September, October and November 2014. The workshops focused on reporting,
investigation and broader learning respectively. Workshop attendees included representatives from
major energy companies, regulators, infrastructure providers, consultancies and academic institutions
(over 20 organisations in total).
Little progress with LFI is possible without strong management commitment. Section I Executive
summary is intended to inform managers of the essential features of LFI and explain concisely why
it is needed.
6
The information contained in this publication is provided for general information purposes only.
Whilst the EI and the contributors have applied reasonable care in developing this publication, no
representations or warranties, express or implied, are made by the EI or any of the contributors
concerning the applicability, suitability, accuracy or completeness of the information contained herein
and the EI and the contributors accept no responsibility whatsoever for the use of this information.
Neither the EI nor any of the contributors shall be liable in any way for any liability, loss, cost or
damage incurred as a result of the receipt or use of the information contained herein.
Suggested revisions are invited and should be submitted through the Technical Department, Energy
Institute, 61 New Cavendish Street, London, W1G 7AR. e: technical@energyinst.org
7
ACKNOWLEDGEMENTS
Learning from incidents, accidents and events (first edition) was developed by Dr Ed Smith and Richard
Roels (DNV-GL), and produced by the EI Human and Organisational Factors Committee (HOFCOM)
and the Stichting Tripod Foundation (STF). During this work, HOFCOM members included:
Tony Atkinson ABB

Ed Corbett HSL
Alix Davies EDF Energy
Bill Gall Kingsley Management Ltd.
Stuart King (Secretary) EI
Peter Jefferies (Vice-Chair) Philips 66
Eryl Marsh HSE
Richard Marshall Essar Oil UK
Simon Monnington BP Plc
Rob Miles (Chair) Hu-tech Risk Management Services Ltd
Helen Rycraft IAEA
Jonathan Ryder ExxonMobil
Rob Saunders Shell International
Gillian Vaughan EDF Energy
Mark Wilson ConocoPhillips
Razif Yusoff Shell International
During this work, STF members included:
Sally Martin (Chair) Shell International

Tony Gower-Jones (Secretary) Centrica
Dr Robin Bryden Shell International
Razif Yusoff Shell International
Prof Jop Groeneweg Leiden University
Dr Desmond Hartford BC Hydro
The EI also thanks the following individuals for their contributions to this project, either for attending
the 2014 stakeholder workshops and/or contributing to the review of draft versions of this publication:
Martin Ball Independent consultant

Ian Baulch-Jones E.ON
John Briggs Q8
John Burnett RWE
Dr Linda Drupsteen TNO
Dr Rupert England Cranfield University / INCOSE
Khary Fermin Centrica
Zoila Harvie Dana Petroleum
Lisbeth Holberg Independent consultant
Steve Hutchinson Network Rail
Jan Hinrichs Advisafe
Uche Igbokwe Shell Nigeria
Ed Janssen Independent consultant
Paul Kaufman BP plc
Ian Kidger Exxonmobil
8
Chris Langer CIRAS

Dr Matthew Lawrie Independent consultant
Prof Allison Littlejohn Glasgow Caledonian University
Ken Maddox Independent consultant
Anoush Margaryan Glasgow Caledonian University
Paul McMulloch E.ON
Allen Ormond ABB
John Pond Independent consultant
Graham Reeves BP plc
Simon Robinson BP plc
John Sherban Independent consultant
Edwin Scholten Advisafe
Judica van Deeden AdviSafe
Jakko van Kampen TNO
Kirsty Walker Schlumberger / IOGP
Peter Wielaard Independent consultant
Affiliations are correct at the time of contribution.
Project management and technical editing were carried out by Stuart King (EI).
9
I EXECUTIVE SUMMARY
I.1 OVERVIEW OF LFI
Developing an effective process for LFI will provide an organisation with a critical tool for
managing its risks. Inadequate LFI processes have been cited as contributory factors in major
accidents such as the space shuttle accidents, Piper Alpha, Macondo and many others. An
effective LFI process will use multiple opportunities for learning to make optimising changes
that lead to a lower risk, more stable, business environment.
LFI is a process whereby employees and organisations seek to understand any negative events
that have taken place and then take actions in order to prevent similar future events (Lukic,
2013). However, many aspects of the LFI process can also be applied to learning from positive
events to help feed an organisation’s continuous improvement loop.
The LFI process should lead to changes in equipment, behaviours, processes and management
systems, such that risk is reduced in an effective and sustainable manner. Achieving this is not
just about generating and disseminating information about incidents from which learning
might take place. Rather it should involve giving people the time and resources to reflect
on and make sense of the information communicated, enabling them to make the changes
necessary to reduce risk. It also involves the organisation embedding and monitoring changes
so that, even if people leave the organisation, sustained measures to prevent incident re-
occurrence stay in place.
The main LFI phases necessary to deliver the required changes (see Figure I.1) are:
−− Reporting incidents and prioritising for investigation: as well as formal reporting, it
is recognised that incidents can also come to light through informal discussions. This
is covered in more detail in section 3.
−− Investigation: this includes initial fact finding and information gathering, and the
subsequent analysis of the information to determine what happened and why (see
sections 4 and 5).
−− Recommendations and actions: the recommendations from an investigation
should be translated into actions which are tracked, implemented and verified (see
section 6).
−− Broader learning: the implementation of actions arising from an incident
investigation will typically lead to localised changes. In order to ensure that the
changes will be broader geographically and sustained for the long term, broader
learning should be achieved. This is described in section 7. Broader learning
includes learning from the incidents of other sites and organisations and sharing
information with them. However, importantly, following communication of
incidents, people should be given time and resource to ‘reflect’ on incidents and
incorporate lessons into their own work. The result should be systematic changes
to equipment, management systems, behaviours and processes, driven through by
the relevant teams, to ensure learning and sustainable change.
−− Evaluation: this final phase is regarded as two-fold; evaluating whether effective
learning has taken place following an incident, and whether the LFI process itself can
be improved (see section 8).
Following incidents, these phases serve as building blocks to ensure effective and sustainable
change that reduces the risk of incidents occurring in the future.
10
Identification of potential improvements in each LFI step
Recommendations Broader
Reporting Investigation Change Evaluation
and actions learning
Actions leading to
effective change
motivate improved If change has not been effective, additional actions required
reporting
Figure I.1: LFI process model
Whilst the phases are presented as discrete, feedback loops between the phases help
determine whether the LFI process thrives or withers. For example, an active reporting
culture will generate the raw material for LFI. If actions leading to effective change are taken,
that will encourage additional reporting. If change is not effective and, in the worst case,
individuals are simply blamed, reporting is likely to decline and formal LFI will cease. At the
evaluation phase, feedback loops identify if additional actions are required in response to an
incident and help an organisation ‘learn how to learn’ by identifying potential improvements
in the LFI processes. The importance of the latter evaluation loop has been highlighted by
research ‎(Drupsteen, Groeneweg and Zwetsloot, 2013) that reveals that, across the industry,
significant learning potential is being lost in every phase.
There are a number of blockers to learning discussed in this guidance document. These can
lead to a situation where an organisation neglects the potential lessons from lesser severity
incidents (accident precursors) and only learns when a major accident actually happens. This
is inherently an unstable approach likely to lead to states of higher overall risk.
The LFI blockers for each phase are highlighted in table I.1. Guidance on how to overcome
these blockers is provided in the relevant sections of this publication. A coordinated approach
to making improvements in each LFI phase should be taken to avoid exposing weaknesses
elsewhere. For example, any improvements made to investigation practices should take place
before trying to secure an increase in reporting, to ensure that maximum value is obtained
from the LFI process.
11
Table I.1 Blockers to learning
LFI phase Blockers

Reporting −− Fear of being blamed or embarrassed
−− Belief that nothing will be done in response
to a report
−− Concern from contractors that their
contract may be jeopardised
−− Apathy
−− People do not understanding what to
report
−− Complex reporting systems
−− Insufficient weight given to potentially high
learning events
−− How to classify and prioritise reported
incidents. Are theones selected for
investigation those with the most potential
for learning?
Investigation −− Insufficient management commitment
−− Lack of personnel trained/competent in
investigation
−− Reluctance of personnel to provide
full story; worry of being blamed or
incriminating others
−− Lack of comprehensive identification of
underlying causes and 'single (root) cause
seduction'
−− Difficulty of establishing why people did
something: they themselves might not
know
−− Lack of early learning: the time to produce
a final report can be lengthy and the
temptation can be to postpone wider
learning until all the facts are known
definitively
Recommendations and actions −− Recommendations are not accepted by
line management
−− Recommendations are not accepted by
frontline personnel
−− Insufficient weight given to underlying
causes in developing recommendations
−− Insufficient checks that recommendations
will effectively reduce risk
−− Too many, or loosely worded,
recommendations
−− Recommendations do not address the
main risk issues or all relevant causal
levels
−− Backlog of actions build up
12
Table I.1 Blockers to learning (continued)
LFI phase Blockers

Broader learning and evaluation −− Difficulty in identifying who should be
learning
−− Common methods of sharing lessons are
often passive and provide over-simplified
summaries lacking in context
−− The investigation report is difficult to
understand
−− Insufficient opportunity to reflect and make
sense of communicated information
−− Actions not taken to embed learning
−− Legal constraints on sharing incident
information widely
−− Difficulties in relating to other
organisations’ incidents, especially when
they are in a different industry
−− Embedding change for the long term can
be difficult given normal corporate memory
loss
−− Difficulty in evaluating if effective learning
and change has occurred
A key message that emerges from the examples and case studies in this publication is that
leadership and management commitment at all phases of the process are important for
making LFI effective, whether this involves setting up comprehensive reporting systems or
implementing the necessary actions from incident data analysis. Linking senior managers to
LFI also reduces the risk that LFI is seen as the narrow responsibility of incident investigators
or the safety, health, environment and quality (SHEQ) department.
13
1 INTRODUCTION
1.1 BACKGROUND
A number of industry commentators have noted that the energy and allied industries still need
to improve in learning lessons from incidents. This view is prompted by the reoccurrence of
similar events and by evidence of the difficulty of achieving long-term changes in behaviour
and working processes following incidents. Ideally, LFI should be a critical part of ensuring
continuous business and operational improvement.
In 2008 the EI published Guidance on investigating and analysing human and organisational
factors aspects of incidents and accidents (first edition). This provides guidance on ensuring
HOFs are considered in addition to technical causes when investigating incidents, and
was produced because of the recognition that these factors were often given insufficient
attention. A recent publication from the Society of Petroleum Engineers (SPE) states that this
is still the case (The human factor: process safety and culture):
‘Researchers, human factors professionals and others [. . .] believe that real learning from
incidents has been hindered by a tendency to ‘blame the human’, or to treat ‘human error’
as an acceptable final explanation of why an incident occurred.
Despite the best efforts of many companies [. . .] going ‘beyond human error’ is still relatively
uncommon in many industries, including the oil and gas industry.
The key is to pursue a deeper understanding of why ‘human error’ occurred, and especially
the organizational/cultural factors that ‘set up’ the human for failure.’
In addition to insufficiently probing HOF within the investigation, research has indicated
additional challenges at several phases in the LFI process, including:
−− reluctance to report incidents due to fear of disciplinary action or the perception that
reporting does not lead to any change;
−− lack of time and resources dedicated to helping people understand and make sense
of lessons;
−− overload of investigation recommendations and failure to agree actions with all the
involved parties, and
−− failure to check that implemented changes have actually addressed the underlying
causes and reduced risk.
In recognition of these and other challenges, the EI’s HOFCOM was tasked by the EI’s
Technical Partner Companies (comprising many of the major energy companies), together
with the STF, to update and broaden the original 2008 guidance document. Learning from
incidents, accidents and events (first edition) updates and supersedes the previous 2008
publication, and now covers the whole LFI process, from reporting and finding out about
incidents through to implementation of effective learning resulting in changing practices.
1.2 WHAT IS LFI
In this publication, LFI is understood to be a process whereby employees and organisations

seek to understand any negative events that have taken place and take action to prevent
similar future events (Lukic, 2013). Such events include near misses, which enable successful
interventions to be analysed and learnt from, as well as learning from what has gone wrong.
14
While LFI is often discussed in the context of safety, it includes any failure of control with the
potential to impact a business. These impacts could be, but are not limited to, environmental,
health, production, system availability, damage, quality, etc. Thus, LFI should be understood
to be relevant to all these aspects throughout this publication.
Following a significant incident, organisations produce a range of responses, suggesting that

the phrase 'we have learnt from this incident' can mean different things to different people.
For example, it could mean any of the following:
a) That the team of investigators has investigated an incident, and understand how and
why it occurred.
b) That several people in an organisation now know how to prevent it happening again.
c) That an organisation has implemented a set of changes (for example in equipment
and personnel behaviours) which will prevent this event happening again.
d) That an organisation has implemented a set of changes which will prevent this
event, and similar events, happening again and even learnt about its processes and
practices for LFI.
Bullets a - d could be seen as representing a range of learning potential. It would be expected

that bullet 'd' would lead to a significantly larger and sustained risk reduction than if bullet 'a'
alone were achieved. In this publication, the ideal LFI process is regarded as one which leads
to changes in equipment, processes or behaviours such that risk is reduced in an effective
and sustainable manner.
LFI is therefore not just about investigation or generating and disseminating information
about incidents from which learning might take place, but it will also involve people having
opportunity to reflect and make sense of that information, and actually taking action to
reduce risk. It involves the organisation embedding changes so that even if people leave,
measures to prevent incident reoccurrence stay in place. A key point about LFI is that it should
occur within individuals, teams, an organisation, and between organisations. All of these are
covered within this publication.
For convenience, the phrase LFI is used in this document to cover learning from accidents,
incidents and events. An accident is considered to be an event that results in injury or
damage or general loss, whereas an incident has the potential for injury, damage or loss
and hence includes near misses. For further definitions see Annex B. The term 'incident' is
predominantly used in this publication and refers to both accidents and incidents unless
otherwise specified.
It should be noted that there are other methods as well as LFI for learning from operational
experience, such as task observation, inspections and audits. Lessons from these techniques
are also necessary for risk management, but they are not the subject of this publication.
1.3 THE BENEFITS OF LFI
There can be various 'blockers' to learning (discussed in this publication) that can lead
organisations to neglect the potential lessons from lesser severity incidents (e.g. near
misses, precursors, barrier failures) which could have escalated into major accidents (MAs),
and only learn when a MA actually happens. This is an inherently unstable approach
likely to lead to states of higher overall risk as illustrated in Figure 1. If the only changes
an organisation makes are in response to learning from major accidents (LFMA) rather
15
than the broad range of potential incidents, as represented in the accident pyramid in
Figure 1, this will typically lead to large disruptive changes following such MA events in
which risk will be reduced by large expenditure in new safety related equipment, with
high associated capital expenditure (CAPEX) costs and reduced plant availability. Over
the longer term however, the memory of these low frequency events may weaken and
risk could increase unnoticed as the warning signs (or 'weak signals') offered by smaller
incidents are not being effectively processed.
LFMA Major accident

'Normal' operational life factors
competing with periodic safety
initiatives
Major Accidents Risk Major changes in
equipment and
behaviours
Accidents
LFI Time
Incidents
Accident
Multiple opportunities for learning and

Risk changing, stability, business efficiency
Precursors
Incidents, near misses
Time
Figure 1: Benefits of LFI
An effective LFI process should make use of multiple opportunities for learning leading
to a lower risk, more stable business environment as the organisation makes smaller,
optimising adjustments in response to LFI. As an illustrative example, following the 1988
Piper Alpha disaster, the hydrocarbon release (HCR) system was developed to learn from
higher frequency loss of containment incidents as opposed to learning only from major fires
and explosions.
Many public inquiry reports have noted how weak signals of problems or incident precursors
have been repeatedly missed. The LFI processes set out in this guidance document should
help to detect those signals and reduce the risk of major losses.
Although a well-working LFI process should ultimately represent a cost-effective approach,

the phrase 'near-misses offer free lessons' (which is sometimes heard amongst safety
professionals), referring to the aftermath of events that do not cause injury or damage, is
potentially misleading. It is not possible to learn effectively from incidents without dedicating
resources to this process. In particular, time and effort should be invested to help personnel
make sense of the information produced by investigations. This topic has been the subject of
research funded by the EI (Lukic, Littlejohn and Margaryan, 2012) and the practical outputs
of that research are discussed in 7.4 and 7.7.
16
1.4 OBJECTIVES AND SCOPE OF GUIDANCE
1.4.1 Objectives
The main objectives of this publication are to:

−− act as the initial 'go to' resource for LFI, but pointing to other more detailed resources
as necessary;
−− inform on current good practice for all key phases of the LFI life cycle; and
−− focus not just on accident/incident investigation but also learning.
In addition, the central objective of the 2008 publication has been retained, i.e. to guide the
reader in understanding the HOF causes of an incident through appropriate investigation
approaches.
1.4.2 Scope
For clarity, this publication is focused on LFI rather than learning from other types of
operational experience, such as task observation, safety walkarounds, inspections and audits.
However, the process and techniques in this publication are in many cases also applicable to
learning from these others types of operational experience.
Incidents could be related to safety (personal and process safety), health, environment,
property or equipment damage, loss of production, quality, security, business interruption or
organisational reputation.
All phases of an incident are relevant for LFI. This includes incident causation but also later
phases of an incident including emergency response. However, prevention is often more
valuable and reliable than mitigation and emergency response.
1.5 BASIS FOR GUIDANCE
The guidance in this publication has been produced with the help of three industry stakeholder
workshops organised by the EI and held in September, October and November 2014, which
focused on reporting, investigation and broader learning respectively. Workshop attendees
included representatives from major energy companies, regulators, infrastructure providers,
consultancies and academic institutions (over 20 organisations in total). The outputs from
the workshops have helped augment the guidance and literature that are already available
(see references in Annex A) and ensured that the guidance is based on existing good practice.
1.6 POTENTIAL USERS OF THIS PUBLICATION
It is in the nature of LFI that there will be a broad range of potential users, including:
−− incident investigators in operating companies, authorities or consultants;
−− LFI coordinators in the operating companies and their contractor organisations;
−− those who commission an investigation;
−− persons who use the recommendations from the investigation to decide what
changes are needed (line managers, designers, consultants);
−− those involved in helping individuals learn (including training professionals);
17
−− those involved in long-term knowledge management (e.g. designers of incident

databases), and
−− researchers in incident investigation and safety who may obtain insights from this
good practices overview.
It is recognised that little progress with LFI is possible without strong management commitment.
Thus section I Executive summary is intended to inform managers of the essential features
of LFI and explain concisely why it is needed. Mature LFI processes will ensure that managers
are better informed and able to determine appropriate actions for managing risk effectively.
18
2 OVERVIEW OF INCIDENT CAUSATION AND LFI
2.1 OVERVIEW
This section provides the background required to understand the subsequent sections in this
publication. Two main models are presented in this section, namely the following:
−− An incident causation model: by illustrating the multiple causal levels of a typical
incident, ending ultimately with management system, leadership and cultural issues,
the model highlights the main factors that an incident investigation should be trying
to uncover.
−− An LFI model: this is based on the main building blocks of LFI identified in existing
studies. In each building block there are potential challenges or blockers to learning.
The guidance in subsequent sections provides practices to help overcome these
learning blockers.
In this section, some of the main concepts which underpin LFI (namely organisational and
individual learning, management systems, culture, and legal considerations) are also briefly
introduced. Cross-references to more detailed explanations are provided.
2.2 INCIDENT CAUSATION MODEL
The incident causation model used in this publication is structured around a generic model of
failures and is illustrated in Figure 2. It consists of the following:
−− A barrier model, also known as a 'Swiss cheese' model. Barrier models are widely
used and represent an organisation’s defences between a source of harm (e.g. a fuel
source) and an undesirable outcome (e.g. injury due to a fire) as a series of barriers or
layers, represented as Swiss cheese (with holes to indicate breaches in barriers). These
barriers are often structured in the form of preventive and mitigation measures.
−− Links between each barrier and sets of progressively deeper causal factors (a
'causation path'). These are represented in Figure 2 as:
−− immediate causes, also known as direct causes;
−− performance influencing factors (PIFs), also known as performance shaping
factors (PSF) or preconditions, and
−− underlying causes, also known as root causes, latent failures/causes or systemic
causes.
19
Preventative barriers
Hazard
Mitigation barriers
Event
Performance Escalation
influencing
factors (e.g. level Immediate causes (e.g.
of supervision) human action/inaction)
Underlying
causes (e.g.
management
systems,
leadership and Barriers fail due
culture)
People are to immediate
influenced by their causes
Environment is
created by the environment
organisation
Figure 2: Incident causation model
2.2.1 Barriers
Barriers may be physical barriers (fences, guards, bunds, protective clothing, safety devices)
or 'administrative' barriers (checking procedures, permits-to-work, supervision). For example,
a pipe is depressurised and drained prior to removing a pump; a drip tray is placed under
the pipe in case of leaks; also, the permit-to-work requires a second fitter to ensure that
the pipe is isolated and drained and to sign the permit-to-work when he has completed the
check. From the example in this section, it is clear that there are two types of barriers: those
designed to prevent incidents and those designed to counteract or reduce the consequences
of an incident.
It should be noted that a person’s understanding of what constitutes a barrier may depend
on what analysis or risk assessment methodologies they are familiar with. For example, some
would describe a general measure as a barrier (e.g. a procedure), whereas others would only
consider a specific measure to be a barrier (e.g. the specific action the procedure requires the
operator to perform and how that will prevent an incident).
If the barrier is ineffective, then an incident ensues.
2.2.2 Immediate causes
As illustrated in Figure 2, barriers are considered to fail (or be ineffective) due to immediate
causes. These are events where an action (or inaction), or decision, by a person reduces the
level of control over a task; such 'operational disturbances' or 'unsafe conditions' could result
in an incident. For example, a small pump was being lifted by a sling attached to an eyebolt
20
on the pump. This was a 'blind lift' and the load snagged causing the eyebolt to fail and the
pump to drop several feet. The decision to use the eyebolt to lift the pump and the decision
to conduct a blind lift were both 'substandards acts', leading to the operational disturbance
of lifting the load in this manner. Immediate causes are often unsafe/substandard acts –
these are the human behaviours that lead to barrier failures. Often, an immediate cause is
the human action that directly led to a barrier failure (opened the wrong valve, pressed the
wrong button, did not respond to an alarm, etc.), or the human decision/action that created
an operation disturbance or unsafe condition (failure to address corrosion, leading to failure
of a component, installation of a faulty fuse that only created a problem several months in
the future, etc.). Immediate causes may also be less proximal actions or decisions made by
managers or designers weeks, months, or years before an incident (see 2.2.5). For example,
the immediate cause of an alarm failure may be with the design of the alarm.
It should be recognised that there is a variety of 'human failure types' (commonly called
human error) that lead to unsafe actions. These are commonly split into errors (slips, lapses,
mistakes) and non-compliances/violations (of which there are several). In general, errors of
these types result in either:
−− an error of omission: something is not done that needs to be done, or
−− an error of commission: something is done but is done incorrectly.
(In addition, it should be noted that an error of commission such as operating the wrong
device would also involve an error of omission because the device that should have been
operated is not operated.)
The type of human failure is often only known once the PIFs are known.
2.2.3 Performance influencing factors (PIFs)
Having identified immediate causes, including relevant human action or inaction, it is then
possible to identify factors which are likely to have influenced performance.
PIFs are sometimes referred to as psychological precursors (the state of mind of the person
which influenced the type of unsafe/substandard act carried out) and situational precursors
(the working conditions that led to the state of mind). It is not possible to know a person’s
state of mind at any given time but certain factors could affect a person’s state of mind more
than others: time pressure, lack of competence, etc.
Examples of PIFs include the following, grouped by whether the PIF is something to do with
the task at hand, the person, or the organisation (taken from EI, Guidance on using Tripod
Beta in the investigation and analysis of incidents, accidents and business losses):
−− Task:
−− Inadequate or incorrect tools or equipment (can lead to slips of action).
−− Procedures that are unclear, incorrect, ambiguous, or do not align with usual
working practices (can lead to rule-based mistakes or violations).
−− Working environment conditions that are noisy, dark, hot, untidy, etc. cause
sensory errors (which in turn can lead to lapses or knowledge-based mistakes).
−− Personal:
−− Insufficient knowledge or insight to undertake a task (can lead to knowledge-
based mistakes).
−− Reduced attention from being preoccupied (can lead to slips and lapses).
−− Over-energetic attention to task; macho behaviour; 'can-do' attitude, over
confidence, complacency, stubbornness (can lead to violations).
21
−− Organisation:
−− Poor motivation by supervisor failing to promote a positive attitude (can lead to
violations).
−− Failure to adequately train personnel (can lead to knowledge-based and rule-
based mistakes)
−− Production goals, superiors, work schedules, inadequate resources creating
undue time pressures (can lead to violations by short cuts being taken).
'The relationship between [PIF] and immediate cause is not direct causal but probabilistic.
That is, it is not certain that the influence created by the [PIF] caused the sub-standard act
[the immediate cause] but only that it increased the likelihood for it to happen' (EI, Guidance
on using Tripod Beta in the investigation and analysis of incidents, accidents and business
losses). Immediate causes can be the result of multiple PIFs.
2.2.4 Underlying causes
Finally, underlying causes that created the environmental conditions and gave rise to the
PIFs should be identified and understood. Underlying causes are often faulty organisational
decisions, leadership or culture. Within this model, decisions made within the organisation
about how to manage all the tasks carried out are the ultimate root cause of incidents and
accidents. These can create the conditions from which errors later emerge. Such conditions
include: poorly defined systems for selection or design of plant and equipment; inadequate
processes for training of personnel; ineffective supervisory practices or resource provision;
inaccurate communications methods used; poor team structuring etc. Underlying causes
often stem directly from inadequacies with the safety management system, such as lack of
policy or requirements to manage certain aspects of the operation, and so are likely to relate
to deficiencies in the management system itself (e.g. procurement or human resources),
leadership or organisational cultural. Deeper underlying causes may be the factors that affect
those management decisions (such as the regulatory environment), but this is a level of
complexity that is not often reached in investigation, as such factors are often beyond the
control of organisations.
2.2.5 Differences in terminology and models
As LFI is a complex topic, there are understandably differences in the terminology and models
different practitioners use. For example, some only consider human actions that immediately
precede the incident to be immediate causes, and instead consider human actions that
were made weeks or months prior, such as installing a faulty fuse, to be underlying causes
(i.e. the causes of the incident are categorised in terms of chronological proximity to the
incident). Others still consider such ‘distant’ human actions to be immediate causes, reserving
underlying causes for organisational aspects that, in turn, can cause many different types
of incidents (i.e. the causes of the incident are categorised in terms of logical proximity to
the incident). This publication uses the latter definition, but it is important to ensure the
organisation uses consistent terminology so that people share the same understanding.
2.2.6 Drilling down
Investigating the progressive causal layers can be seen as a process of repeatedly asking
'Why?'. For example, for an incident involving the accidental release of product, these layers
could be:
−− Barrier: valve prevents release of product.
22
−− Immediate cause: operator opens wrong valve.

−− PIF: Operator is fatigued, makes wrong decision.
−− Underlying cause: organisation does not have a system for assessing the impact of
changes to shift patterns; supervisors not trained to consider fatigue when setting
shift patterns.
This process of drilling down to underlying causes can enable an investigation to go well
beyond simply attributing an incident to 'human error', and it becomes clear that investigations
that do not get further than identifying the human error have only investigated as far as
the immediate causes. It should be noted that it is possible to conduct an investigation
without focusing on HOF; however, such an investigation will likely only serve as a technical
investigation (i.e. to understand the component and technological failures of an incident,
common with initial aircraft accident investigations) and will not be able to identify the
immediate or underlying causes of the incident (at least as the terms are understood in this
publication) without knowledge of HOF.
If an organisation addresses the underlying causes of the failures identified, this is likely
to have a longer term impact on reducing the likelihood of not just this event reoccurring
but other potential events linked to the inadequate management system element. On the
other hand, addressing such organisational causes can take significant time. Thus it has been
argued (Peuscher and Groeneweg, 2012) that a balanced approach is required that addresses
barrier failure as well as the underlying organisational causes.
Major accident hazard (MAH) organisations’ management systems are generally 'barrier
based' as they rely on defence in depth. If there has been a significant event then usually
multiple barriers will have failed or been absent. This model is therefore well suited to
illustrating and visualising the multiple causes present in most significant events. Even if a
barrier model is not included explicitly in a formal incident investigation technique, 'barriers'
in a general sense will still receive consideration in an investigation; hence the model in
Figure 2 is of general applicability.
2.3 LFI PROCESS MODEL
Organisations will likely have a number of processes in place for LFI. Based on various research
studies, Figure 3 presents a generic LFI process model in order to illustrate the various steps
required for effective LFI. The main LFI building blocks considered in this guidance are the
following:
−− Reporting incidents and prioritising for investigation: as well as formal reporting, it
is recognised that incidents can also come to light through informal discussions. This
is covered in more detail in section 3.
−− Investigation: this includes the initial fact finding and information gathering, and
the subsequent analysis of the information to determine what happened and why
(see sections 4 and 5).
−− Recommendations and actions: the recommendations from an investigation
should be translated into actions which are tracked, implemented and verified (see
section 6).
−− Broader learning: the implementation of actions arising from an incident
investigation will typically lead to localised changes. In order to ensure that the
changes will be broader geographically and sustained for the long term, broader
learning should take place. This is described in section 7. Broader learning
includes learning from the incidents of other sites and organisations and sharing
23
information with them. Following broader communication, systematic actions

should be driven through by the relevant organisations to ensure learning and
effective change.
−− Evaluation: this final phase is regarded as two-fold; evaluating whether effective
learning has taken place following an incident, and whether other LFI processes can
be improved (see section 8).
Following incidents, these phases serve as building blocks to ensure effective and sustainable
change that reduces the risk of incidents occurring in the future. Each phase of the LFI
process is expanded upon in the relevant chapters. The LFI process model can be used
to identify opportunities for learning throughout the incident life cycle. Organisations can
use the model to ensure LFI initiatives are integrated in ways that support overall effective
learning.
Actions leading to
effective change
motivate improved If change has not been effective, additional actions required
reporting
Figure 3: LFI process model
2.3.1 Feedback loops
The feedback loops in Figure 3 are of key importance in determining whether the LFI process
thrives or withers. An active reporting culture will generate the raw material for LFI. If lessons
are learnt within an organisation, that will encourage additional reporting. If lessons are not
learnt and, in the worst case, individuals simply blamed, reporting is likely to decline and
formal LFI will cease.
The evaluation feedback loops are two-fold. Evaluation after an incident should determine
whether the change has been effective, i.e. whether learning has really taken place. If not,
additional actions should be planned and implemented. Additionally, higher level evaluation
helps an organisation ‘learn how to learn’, by identifying potential improvements in the LFI
processes. The importance of this evaluation loop has been highlighted by research that
reveals that, across industries, significant learning potential is being lost in every phase
(Drupsteen, Groeneweg and Zwetsloot, 2013). This is somewhat surprising given that good
practice guidance has been available on traditional features of LFI such as investigation
techniques for some time. However, it is clearly important to address all the LFI phases in this
publication and expand traditionally under-represented topics related to broader learning
and evaluation.
Despite the linear representation of steps in the LFI model, it should be noted that
opportunities for early learning do arise even before an investigation report has been finalised
and published. Examples of this are presented in this publication.
24
2.4 INDIVIDUAL AND ORGANISATIONAL LEARNING
Whilst organisations are made up of individuals, individual learning and organisational

learning are distinguishable.
2.4.1 Individual learning
It is generally accepted that adults learn best in the workplace through participation and
'doing', with plenty of social interaction. In addition, learning that encourages reflection
(particularly self-reflection on the relevance of lessons learnt on an employee’s own practice)
is more likely to result in deeper learning and improved practice.
Research within relevant industries (e.g. Lukic, Littlejohn and Margaryan, 2011) has revealed
that, in order to learn, individuals:
−− Need to understand the context of incidents, and time should be allocated for
reflection on lessons and sense-making.
−− Need encouragement from the organisation to challenge the status quo and reflect
on whether current practices could be made safer.
−− Benefit from more active engagement, for example, turning incidents into scenario-
based group training sessions.
−− Will be affected by who delivers the learning information. The quality and credibility
of the individuals delivering the information are critical. For example, learning from
a peer who has been involved in an incident might be more effective than hearing
something second-hand from a supervisor or manager.
Much of the discussion about individual learning is in the context of frontline staff. However,
LFI is at least as relevant for managers and technical personnel, and this should be catered for.
The user experience of LFI should be considered. Figure 4 shows two extreme paths for
individuals through the LFI process, for illustration only. Clearly the green path is likely to
encourage a more effective LFI process than the red path. No organisation will set out to
design an LFI experience as negative as the red one; however, in an organisation where
mutual trust is low, and where little LFI evaluation is occurring, it could be possible for a
system to exhibit many of these characteristics.
25
‐ Supervisor ‐ Reporter informed of

thanks ‐ Fair interviews, ‐ Personnel given time and
progress of investigation.
reporter. with emphasis opportunities to consider
on learning, ‐ Group interviews/discussions investigation outputs and reflect.
‐ Safety used to identify early
not blaming.
meetings ‐ Reporter and personnel included
learning.
create positive ‐ Option to in follow‐ups (e.g. one year later)
atmosphere include union ‐ Personnel involved in to determine what has changed.
for raising representative. identifying potential risk
‐ Overall positive experience leads
safety reduction measures that
to more reports.
concerns. could be recommended.
‐ Supervisor’s ‐ Reporting ‐ Focus of investigation is on

‐ Summary of report is missing
first reaction is operator is who did what wrong.
context.
to criticise or made to feel ‐ Causal analysis never gets
‐ ‘Lessons learnt’ centre on
blame the like a guilty beyond the most immediate
individuals’ errors and importance
reporter for party during causes.
of following existing procedures.
causing the subsequent
‐ Impenetrable final
incident. interviews. ‐ Reporting dries up.
investigation report.
Figure 4: Examples of the user experience of LFI
2.4.2 Organisational learning
Organisational learning involves embedding the lessons from incidents in the organisation
itself, not only in the individuals who make up that organisation. Hence one would expect
learning to result in changes to plant and equipment and to policies and procedures, training,
competence assurance, supervision, resourcing priorities, and other management systems
(and the reasons for the changes recorded). In this ideal, learning will become permanently
embedded in the organisation and be sustained long after those involved in the incident have
left the company.
Figure 5 illustrates how LFI should work in relation to increasing organisational knowledge.
The figure represents a 'before LFI' and 'after LFI' scenario. In both scenarios it is considered
that knowledge relevant to an incident could be known or unknown to the organisation
and known or unknown to an individual within that organisation. This leads to four possible
states which are characterised as shown in Figure 5. Over time, as information from incidents
is effectively learnt from, the amount of corporate information known to the organisation
and to individuals will grow, partly due to the better capture of 'private' information known
only to certain individuals. The effective sharing of this corporate information will reduce the
number of employees who have significant 'blind spots' (that which the organisation knows
but individuals do not) and shrink the information gaps that exist both in the organisation
and individuals.
26
Before After
Individual employee Individual employee
Known Unknown Known Unknown
Corporate Employee’s
Unknown Known
Unknown Known
Organisation
Organisation
Corporate
information blind spot Employee’s
information
blind spot
LFI
Private
Unknown
information Private
information Unknown
Figure 5: Increasing the pool of organisational knowledge through LFI
In the context of LFI, key aims for an organisation should be to ensure the following:
−− Having increased organisational knowledge, sustainable actions are then taken to
reduce risk.
−− The right culture is in place such that the user experience is a positive one (see Figure 4).
−− The investigation is deep enough that relevant causes, including management system
inadequacies, are identified and understood so that effective change can be planned.
−− Stakeholders have been identified and their learning needs understood. Who should
be involved in LFI extends beyond picking an investigation team. Understanding
which stakeholders can influence and shape the learning process has been shown to
be critical (Lukic, Littlejohn, and Margaryan, 2012).
−− Sufficient resources are dedicated to support individuals in the active learning that is
noted as most effective in this section. In particular, for a message to be successfully
communicated, it should be both transmitted and received. The reception and
implementation end of the learning cycle is often under-resourced or even ignored
entirely.
−− Openness, transparency and sharing of information, rather than unclear requirements
and the hoarding of knowledge.
2.5 MANAGEMENT SYSTEMS
LFI has a two-way connection to management systems. As noted in 2.2, problems with
management systems can result in underlying causes of incidents. LFI should therefore be
a key contributor to a successful operating management system. Figure 6 shows a typical
operating management system (OMS) framework from IOGP (IOGP Report 210, Guidelines
for the development and application of health, safety and environmental management
systems). Incident reporting and investigation have traditionally fitted within the ‘monitoring’
element contributing to the continuous improvement loop. However, the broader view of LFI
set out in this guidance document can be seen to link more widely to the following:
−− Plans and procedures: some of the actions arising from incident investigations can
be readily implemented (e.g. procedural updates) but others could relate to deeper,
underlying causes that may take some time and effort to resolve. Such actions would
typically be included in a SHEQ or business unit plan.
−− Organisation, resources and capability: some of the recommended action from an
investigation may require significant changes to the organisation or resources. In
addition, LFI will involve awareness sessions and training related to lessons learnt
from incidents. It will also be an input into knowledge and learning management
related documents and databases.
27
Overview of OMS Framework
The Framework comprises two interdependent components:

• Four Fundamentals focus attention on management principles that are
arguably the most important for an effective OMS—Leadership, Risk
Management, Continuous Improvement
LEARNING FROM and Implementation.
INCIDENTS, ACCIDENTS AND EVENTS
These principles are not sequential and they apply equally to every Element
of the OMS to drive its success. Constant focus on each Fundamental will
−− Risk
sustain assessment
the OMS, and control:
strengthening performance information about
and effectiveness. incidents can be fed into risk
assessments and risk assessments can help
• Ten Elements establish a structure to organise the various components of an structure incident investigations (e.g.
OMS.providing
Each of the teninsights intoanrelevant
Elements includes barriers).
overview, a purpose statement
−− and a Assurance,
set of Expectations that define the
review andsystem’s intended outcomes. the evaluation phase of LFI contributes
improvement:
to requires
Every Element continuous improvement
the establishment and maintenance through reviewing whether learning and effective
of appropriate
documentation and records.
change has taken place after each individual incident, and assists in the wider
review of OMS systems illustrated in Figure 6. LFI should be a critical part of making
the feedback loop real, rather than an abstract management system concept.
Eleme
nts
10. 1.
Assurance, Commitment
review and and accountability
improvement
9. 2.
Monitoring, Policies,
reporting and standards and
learning objectives
Implementation
Leadership
8. The 3.
Execution of Fundamentals Organisation,
activities resources and
Continuous
capability
Improvement
Risk
Management
7. 4.
Plans and Stakeholders
procedures and customers
6. 5.
Asset design Risk assessment
and integrity and control
Figure 1: The OMS Framework—Four
Fundamentals underpin ten Elements
Figure 6: A model for an operating management system, from IOGP Report No. 510
A key message that emerges from the examples and case studies in this publication is that
leadership
4 and management commitment at all phases of the process are important for
making LFI effective, whether this involves setting up comprehensive reporting systems or
implementing the necessary actions from incident data analysis. Linking senior managers to
LFI also reduces the risk that LFI is seen as the narrow responsibility of incident investigators
or the SHEQ department.
Practical management activities should be done to set up LFI in an organisation. These will
include the following:
−− Establishing a written policy concerning reporting, investigation and learning lessons.
−− Defining the roles, responsibilities and specific activities to be carried out by personnel
involved in LFI.
−− Building an atmosphere of trust and respect (to encourage reporting and active
participation).
−− Developing procedures and guidelines for LFI with input from an organisation’s
relevant LFI personnel, i.e. investigators, trainers, and knowledge management
experts.
−− Providing the resources necessary for training and organising LFI.
28
−− Establishing performance indicators of effective LFI and measuring these against this
(see 8.4).
−− Periodically reviewing and evaluating LFI.
2.6 SAFETY CULTURE AND ORGANISATIONAL CULTURAL MATURITY
A short, and therefore well remembered, definition of safety culture is 'The way we do safety
around here' (CBI, Developing a safety culture). It has also been described as 'How people
behave when no one is looking'. Detailed information about safety culture can be found in
IOGP Report No. 435, A guide to selecting appropriate tools to improve HSE culture.
LFI initiatives should be appropriate to the cultural maturity of the organisation. For example,
the attitude to confidential reporting will vary in different cultures. In a low maturity setting,
confidential reporting may be seen as a first step in trying to kick-start reporting; an increasing
number of confidential reports will be seen as positive, demonstrating greater engagement.
In a high maturity organisation, confidential reporting might not often be used, as the
internal reporting systems are well trusted and used, but it may be retained as an option;
an increasing number of confidential reports in this context could be a sign that trust has
diminished in a part of the organisation.
Creating the right culture for LFI involves leaders in an organisation promoting an environment
that will create the positive user experience illustrated in Figure 4. This will involve leadership
commitment to LFI and leadership behaviours such as providing positive responses to 'bad
news', openness and demonstration of trust.
Developing an appropriate approach towards reported incidents is particularly relevant

(GAIN, A roadmap to just culture: enhancing the safety environment). A company should
establish a distinction between acceptable (non-culpable) and unacceptable (culpable)
behaviour so that appropriate action can be taken to prevent a recurrence. Based on an
understanding of HOF, unintentional unsafe acts (i.e. honest errors, routine and situational
violations) are seen as opportunities for organisational learning. Conversely, deliberate,
intentional unsafe acts (i.e. reckless non-compliance, criminal behaviour, substance abuse
and sabotage) are dealt with accordingly, with the required level of sanction.
The link between LFI and cultural maturity means that it is difficult to be definitive with
respect to what a specific organisation should implement. Thus, in some of the subsequent
sections, a number of LFI approaches which have been found useful are outlined, and it is
expected that an organisation will select measures appropriate to its situation. If LFI initiatives
are introduced at the right time and in the right way they can provide a major boost to the
culture of an organisation and improve risk management, as demonstrated in many of the
examples in later sections.
2.7 OVERVIEW OF LEGAL ISSUES
Legal advice can act as a blocker to sharing and learning the lessons from accident and
incident investigations. There are potentially very significant benefits associated with sharing
information as noted in 1.3. However, there are also risks, as illustrated in Figure 7 (adapted
from Hazards Forum Newsletter, Issue No. 84), in terms of potential legal liabilities and
prosecution. This can sometimes make it difficult for organisations to learn if information is
being deliberately suppressed or kept confidential (or limited in some other way) in order to
protect against prosecution.
29
Risks of not Risks of

sharing information sharing information
• Failure of organisation/ • Loss of control of

industry to prevent re- information – could be
occurrence used out of context or by
• Negative impact on unintended audiences
reputation if shown to be • Incident reports used in
acting in this manner civil injury claims or
• Perception of a cover-up criminal prosecutions
• Increased liabilities if • Reports might contain

company is shown not to be misplaced admissions of
acting on lessons liability
Figure 7: Balancing the risks and benefits of sharing incident information
Thus an organisation should weigh up the pros and cons of sharing information and
decide what is in the best interests of the business. Practical approaches to addressing legal
constraints include the following:
1. Establish a productive relationship with the legal department

The legal team should be engaged at an early stage when setting up LFI processes so that they
can understand what are the aims of LFI and what the overall organisation is attempting to
achieve in terms of sharing incident information. Advice about the legal risks can be provided
at this early stage. Then there is time to devise a process (e.g. using agreed report templates,
avoiding problematic terminology (cause, failure, etc.)) that is the optimum compromise of
sometimes competing concerns. This will help avoid last minute frustrations and wasted
efforts. One commentator stated that engaging the legal team in this way greatly helped,
and the legal team actually felt better placed to defend the organisation against legal action
if the need arose because of their better understanding of the incident and its causes.
2. Use alternatives to releasing full causal information about an incident

Release purely factual information about what happened (this can raise awareness that an
event has happened and of basic facts, although this will not lead to all possible lessons
being shared).
Be clear on what information is needed to learn. A recipient may have enough to learn the
lesson from just a description of the hazard, how it can be realised and what precautions are
necessary. Many hazards will be common to the industry. It may not be necessary to describe
exact details such as locations, incident chains, consequences, etc.
Turning lessons learnt quickly into good practice guidance which can help others learn
shouldn’t carry the same liability risks.
Share information about near misses and precursors where there are generally fewer legal
complications than in accidents.
30
3. Write as if the information will be made public

Be mindful of how reports are written. Avoid emotional or judgemental language and
adjectives. Think how words could be misinterpreted if used in another context outside of
the organisation.
4. Make learning a priority when legal privilege is applied

In some countries legal/ litigation privilege may allow an organisation to control the flow of
information2. Privileged documents are immune from ordinary disclosure requirements. They
do not have to be disclosed as part of either civil or criminal investigations and proceedings.
There will usually be legal tests to determine what can be deemed legally privileged (including
the investigation report itself).
Where there is a genuine risk of prosecution/civil litigation, a company may decide that
legal privilege is necessary. When managed appropriately this may not impede learning and
may even allow for deeper investigation, but it can restrict the speed and availability of
information. Work with the organisation’s legal team to ensure learning is made available in
a timely fashion.
5. Establish an incident response protocol

To help an organisation manage the risk balancing described in Figure 7, an organisation
should have in place a documented, tried and tested incident response protocol incorporating
legal privilege over internal investigations when appropriate, and access to required legal
advice in the event of an incident that is likely to give rise to criminal proceedings.
6. Be prepared to challenge legal advice

There could be a bigger picture associated with sharing incident information of which legal
advisors are not aware. A healthy debate concerning the pros and cons for the business can
help to optimise the final decision.
2
The laws associated with legal privilege vary between countries.
31
3 REPORTING AND PRIORITISATION
3.1 OVERVIEW
This section focuses on maximising the potential for learning by generating the necessary
learning 'raw material' and prioritising it for effective use in the next LFI phases.
Figure 8 shows a schematic for a reporting and prioritisation process. Incidents are likely
to come to light via formal reports and by informal means such as safety concerns raised
at safety meetings. All these reports should be recorded. If the reporting system is mature,
there should be sufficient recorded incidents such that they need to be classified and
prioritised. The prioritisation process can be used to determine the investigation level and
the resources allocated to the investigation. Positive feedback from later LFI stages, i.e.
evidence that actions have been implemented to prevent reoccurrence, may encourage
further reporting.
Report Triage Investigation Level
Formal High
reports Record
Medium
Classify Investigation
Prioritise Low
Safety
concerns
Negligible
Encourage
reporting Feedback from downstream LFI stages
Figure 8: Incident reporting and prioritisation
3.2 REPORT
3.2.1 What incidents should be reported?
When an event is detected, it should be formally reported and recorded. However, deciding
what events should be reported can be a challenge. There are often different perceptions
within an organisation about what constitutes a reportable event. Therefore an organisation
should:
−− Define clearly what needs to be reported, ensuring that the definition includes near
misses and precursors which will provide valuable learning, but does not become so
wide that it becomes unwieldy.
−− Train personnel in what needs to be reported using a wide range of illustrative
examples.
32
Accident and external reporting requirements, for example in the UK the Reporting of
Injuries, Diseases and Dangerous Occurrences regulations 2013 (RIDDOR), are generally well
understood (HSE INDG453, Reporting accidents and incidents at work). External reporting
may include stakeholder as well as regulatory reporting requirements. Even if the regulations
are not known in detail by everyone in an organisation there will usually be a general
awareness that such events need to be reported.
Differences in the understanding of what needs to be reported usually arise at the level of
‘near misses’ and lesser severity events. To develop a common understanding of the term,
a company should develop a list of examples it believes to be reportable near misses (CCPS,
Guidelines for investigating chemical process incidents). Examples of process-related incidents
−− excursions of process parameters beyond pre-established critical control limits;
−− releases of less-than-threshold quantities of materials;
−− activation of protection such as relief valves, interlocks, rupture disks, blowdown
systems, vapour release alarms, and fixed water spray systems, and
−− activation of emergency shutdowns.
Examples of personal safety near misses include:

−− trip hazards not leading to injury;
−− unsecured ladders or faulty scaffolding, and
−− absence of PPE.
In determining what should be reported, an organisation should try to find an appropriate

balance. Making requirements too broad may dilute the power of learning from actual events
and overwhelm the reporting and analysis system, but being too narrow may mean that
important learning opportunities are missed. Research has indicated that at least 20 events
per actual accident need to be reported to drive organisational learning (Bridges, 2000); thus
having all the workforce understand what events should be reported is clearly an important
step in ensuring effective LFI.
EI Guidance on meeting expectations of EI Process safety management framework Element

19: Incident reporting and investigation provides additional examples of incidents an
organisation should report.
Some organisations also attempt to make personnel aware of what barriers site management
rely on to control risk, and hence the events that frontline staff are expected to report.
This involves creating a dialogue between management and frontline staff and creating a
common awareness of barrier management. The reporting of failed barriers represents a
relatively sophisticated approach to developing reporting criteria.
3.2.2 How should incidents be reported?
Organisations should consider a variety of mechanisms to ensure that all can participate in
reporting, i.e. via a paper form, using an online system or reporting verbally. Alternatively,
direct voice communication can allow rapid tuning of information and the use of
semi-structured discussion can lead to high quality, richer data. Typically such systems are
phone-based, with dedicated trained operators, or web initiated with call-back.
33
Example of a reporting system
The railways system CIRAS (Confidential Reporting for Safety) is a well-established

example of a direct reporting system.
http://www.ciras.org.uk/
A report can be submitted by phone, text, online or hard copy form and then a
member of the CIRAS team will get in touch and discuss the reported health and
safety concerns. A written report will be prepared on behalf of the reporter. CIRAS will
make sure the report does not contain any information that can identify the reporter.
They then send the report to the relevant rail company for a response.
Once CIRAS receive the company response they will then provide the reporter with a
copy. Events with high learning potential are published in the CIRAS newsletter.
Whatever system is used, reporting should be easy and rewarding (or at least not painful),
there should not be negative feedback and the user should not have any anxieties that they
will end up with lots of extra work.
Reporting should be rapid to ensure that an investigation is started as soon as possible after
the incident. People have a tendency to forget events, 'reinvent' history or unduly influence
each other by discussing an incident before it can be properly investigated.
All employees should be familiar with the procedure for incident reporting; training should
be provided to ensure this is the case.
There should be a culture of mutual trust between workforce and management. The system
should be perceived to be fair (see 2.6). Confidential reporting may be considered where the
culture of trust and fairness is not yet established or to support other reporting mechanisms
(see Table 1).
Table 1: Cultural maturity and attitudes to confidential reporting (adapted from

CIRAS newsletter, Issue 51, May/June 2014)
Level of maturity Typical attitudes to confidential reporting

Low Confidential reporting might be distrusted by managers.
Alternatively it could be encouraged by management as
a first step in engaging with frontline staff and trying to
increase the number of reports.
Medium Confidential reporting is generally regarded as a valuable
way of engaging staff in safety, demonstrating that they can
report safety concerns and near misses securely.
High Confidential reporting may be rarely used as internal systems
are well trusted. However, the system is retained and valued
as it is recognised that not all people may feel comfortable
using internal systems. Confidential reporting could also help
identify departments where internal systems are not working
as expected.
34
To assist in reporting to external bodies, the format and timing of all external notifications
should be identified and incorporated as part of a company’s normal incident response
procedures. Proper notifications can then be made quickly and accurately when an incident
occurs.
The typical contents of an initial report (example template) are shown in EI Guidance on
meeting expectations of EI Process safety management framework Element 19: Incident
reporting and investigation. Some organisations also identify which barriers have failed in
the initial report, but this implies a relatively high level of training in, and awareness of, risk
management.
As noted, not all incidents will be formally reported immediately. Information may come to
light in different ways, such as via safety meetings, mess room conversations, and toolbox
talks, etc. In order to ensure that these are also used to learn, they should be recorded and
integrated with the formal reports.
3.3 TRIAGE
3.3.1 Initial response
For more serious incidents there can be an overlap at the initial notification stage with the
emergency response system. An organisation should develop procedures or checklists for the
following:
−− For those earliest at the scene of an incident to ensure their own safety and the safety
of others.
−− To preserve and protect information, especially of a perishable nature, for example,
take photographs of the site/equipment, names of witnesses, instrument readings,
etc. (see 4.5 for more on information gathering).
There should also be procedures in place covering response times for investigators; for
example, following a fatal accident, investigators will be on site within 24 hours.
Initial response actions effectively form the beginning of the investigation, for example,
recording what has happened and when.
In the case of certain types of incidents (for example, fatal incidents or public transport
incidents), there will be a legal framework that needs to be applied. This tends to restrict
the right of organisations to interview, may restrict access to the site of the incident and
normally defines the concept of primacy (who is in charge) of one particular organisation
for that incident. In some cases, there is a requirement to enable interested parties to access
information identified by a lead investigator. The result of this is that separate protocols may
be needed for these types of incident.
3.3.2 Prioritisation
It is not possible to conduct in-depth investigations (deep dives) into all reported incidents.
An organisation should make best use of constrained investigative and learning resources. To
achieve this, organisations adopt classification schemes designed to achieve a 'triage' type
process. The classification level will often link to investigation levels (capability and number of
investigators) and sometimes to the rigour of the investigation techniques employed. These
levels may also determine how the incident is used subsequently in terms of broader learning.
35
There is no perfect one-size-fits-all system of classification. Traditionally, classification systems

fit an incident into severity (actual or potential) categories. However, alternative approaches
−− Take into account the probability of reoccurrence and hence use a risk-based
approach (see the following examples).
−− Assign investigators based on the nature and complexity of the incident, rather than
its severity. Complexity may be judged against a number of parameters: organisational
interfaces, type of process systems, etc.
−− Determine how much additional learning could come about through a deeper
investigation.
−− Take account of how many barriers should have been in place and which ones have
failed. This is a relatively sophisticated and potentially demanding approach.
In practice, there will be grey areas in every classification scheme, i.e. lack of clarity into which
level an incident should be classified. During an investigation new information or reanalysis
may lead the team to change the initial classification.
Example of a proportionate response classification scheme

Rail Safety and Standards Board (RSSB, Investigation guidance - Part 2: Development of
policy and management arrangements) lays out a proportionate response model which
is used in the rail industry and employs a three-stage filtering process:
1. Determine the credible worst outcome. Examples are provided to guide the user
to ratings from negligible to high.
2. Evaluate the effectiveness of the safety barriers (again from negligible to high).
Stages 1 and 2 are combined in a matrix, similar to the classification matrix in the
following example, to determine an initial level of investigation (low, medium or
high) or, if an incident is considered of negligible risk, whether it should be just
recorded and not investigated.
3. More senior managers then consider wider factors (such as similar previous
events, how to gain the maximum safety benefit for the organisation) to
determine the final level of investigation.
Thus this is a risk-based, proportionate approach, but one which allows additional
flexibility for taking account of broader learning opportunities.
36
Example of a risk-based classification scheme (EI Guidance on meeting expectations

of EI Process safety management framework Element 19: Incident reporting and
investigation)
A suggested matrix for classifying incidents is shown here for health and safety events. This
divides incidents into three levels, incidents (I), serious incidents (SI) and very serious incidents
(VSI). EI Guidance on meeting expectations of EI Process safety management framework
Element 19: Incident reporting and investigation notes that this matrix should be calibrated to
meet the needs of an organisation.
Similar matrices cover incidents with consequences for the environment or a company’s
reputation and for business interruption and financial costs.
Example Consequences
E1 E2 E3 E4 E5
Fatalities, major fire-explosion, gas leak E 10 14 21 23 25
D1 D2 D3 D4
VSI
D5
Permanent disability, fire, minor gas leak D 9 13 18 22 24
C1 C2 C3
SI C4 C5
Lost time injury, RIDDOR reportable C 4 7 17 19 20
I
B1 B2 B3 B4 B5
Medical treatment injury, minor fire B 2 5 8 15 16
A1 A2 A3 A4 A5
First aid treatment, limited plant damage A 1 3 6 11 12
1 2 3 4 5
Very Unlikely Possible Likely Very
unlikely likely
Figure 9: Risk matrix
An alternative risk-based scheme is shown in HSE HSG245 (Investigating accidents and incidents).
Some schemes classify only on the consequence axis of this matrix, i.e. the actual or potential
severity of outcomes, not the likelihood.
While a risk-based classification scheme will generally represent a proportionate treatment of

incidents, some organisations have also followed different, or complementary, approaches:
−− One organisation chose to investigate every tenth reported incident regardless of
the classification level. Partly this was to act as quality assurance on the prioritisation
process and partly to train enough personnel in incident investigation.
−− Similar to this approach, an organisation could choose to conduct deep dives on a
random basis to determine if the formal prioritisation process is identifying those
incidents from which significant learning can be extracted.
−− Some organisations have considered classifying incidents in an alternative manner
more specific to the incident type, for example classifying dropped objects by
estimates of kinetic energy.
Given the uncertainty and subjectivity that will inevitably exist around classification, it
is important to provide training and plenty of examples so that the classification scheme
selected can be consistently followed.
37
3.4 DEFINING THE LEVEL OF INVESTIGATION
The classification levels developed in 3.3.2 are generally linked directly to levels of investigation.
Alternative rule sets recommended by the HSE, EI and RSSB are shown in Table 2.
Applying rule sets in an overly prescriptive manner can lead to inappropriate decisions.
For example, risk matrices can be difficult to apply consistently as individual incidents can
be reasonably placed in several cells of a matrix. Thus, decision makers should be allowed
flexibility to apply different investigation levels if they think it is warranted. This open-
minded attitude should be carried over into an investigation, for example, if an incident is
more complex than first thought the investigation level may change, as could the required
resources and methods used to analyse it.
Table 2: Example rule sets for determining investigation levels
HSE, HSG 245 EI, Guidance on meeting RSSB, Investigation

expectations of EI Process guidance - Part 2:
safety management Development of policy
framework Element 19: and management
Incident reporting and arrangements
investigation
Minimal – the relevant – Negligible – supervisor
supervisor will look at the records event.
event and try to learn lessons
to prevent reoccurrence.
Low level – short investigation Incident – investigated by Line manager level.
by the relevant supervisor local supervisor.
or line manager into the
circumstances and causes.
Medium level – a more Serious incident – Line manager level
detailed investigation by the investigated by independent potentially with support.
relevant supervisor or line investigator.
manager, the health and
safety advisor and employee
representatives.
High level – team-based Very serious incident – Experienced investigator and
investigation involving investigated by independent team of experts.
supervisor or line managers, senior manager.
health and safety advisors and
employee representatives.
It will be carried out under
the supervision of senior
management or directors.
38
3.5 ENCOURAGING REPORTING
Encouraging and sustaining increased reporting are likely to require multiple approaches.
These will include:
−− demonstrating that valuable use is made of the reports;
−− making the user experience positive;
−− creating a trusting atmosphere, and
−− targeted use of rewards.
The best demonstration that valuable use is being made of reports is when personnel can see
effective changes being made to prevent the reoccurrence of incidents (as illustrated in the
LFI feedback loop in Figure 3). If personnel see reports being used to help reduce risk they are
likely to report more. By contrast if something has been reported several times personnel will
learn to live with it and that becomes an accepted norm.
The importance of making incident reporting a positive experience has been emphasised
already in Figure 4. The initial reaction of the supervisor is crucial: it should be 'thank
you', but often it is not. The organisation should strive to create the type of environment
that encourages such reaction. However the event is reported (e.g. verbally or online), an
organisation should provide timely feedback and keep the reporter updated on progress and
when something changes. If practical, an organisation should involve the person reporting
the incident in developing the solution, on the basis that they will be more likely to implement
it and report again in the future.
Another important factor in determining whether reporting will be fit for purpose to drive LFI
will be whether the majority of employees perceive there to be a fair process in place.
Example of incentivising reporting

Within a train operating company (Basacik and Gibson, in press) no action was
taken if a driver released the doors on the wrong side at a station if they reported it.
Action was only taken if this happened and it was not reported but was subsequently
discovered. This effectively incentivises reporting and dis-incentivises non-reporting. In
the case of non-reporting, an organisation should try and discover the reason; it may
have a systematic cause that needs to be addressed.
The use of financial rewards or prizes should be carefully considered within an overall package
of measures to encourage reporting. They can drive inappropriate behaviours but if used
carefully they can be an effective incentive, as demonstrated in 3.6.2.
3.6 CASE STUDIES
3.6.1 Chiltern Railways’ 'Close Call' campaign. How to build a strong reporting culture
3.6.1.1 Understand the blockers to reporting

The Health, Safety, Quality and Environment Executive in Chiltern Railways used informal
discussions with frontline staff (e.g. chatting in the mess room) to promote openness with
reporting, make the staff aware that Chiltern Railways had a genuine concern for the safety
of its employees, and to find out why frontline staff did not always report near misses. Three
main issues were discovered. Staff felt there was:
39
−− Too much paperwork. Completing the correct forms was time-consuming and
sometimes impractical for operational roles that are not based at computers.
−− Peer pressure not to report, and some feared being seen to 'shop their friends' (get
their friends into trouble).
−− Some confusion or misunderstanding about what constitutes a 'near miss'.
Additionally, there was a lack of understanding about why it is important to report a
near miss when 'nothing actually happened'.
3.6.1.2 Implement change

The Close Call campaign was launched across Chiltern Railways in September 2013. The
campaign’s aim was to improve near miss reporting across the company. The campaign was
underpinned by several tactics to improve near miss reporting:
−− 'Near misses' were rebranded as 'close calls'. There was some misunderstanding
about what constituted a near miss so it was reconceptualised as a close call. A close
call is defined as an event that had the potential to cause injury, loss or damage.
Under different circumstances this event could have ended with more serious
consequences.
−− The reporting process was made easier, more straightforward and less time-
consuming for the staff. Staff are no longer required to fill in forms to report a close
call and a special confidential telephone service was set up for the staff to use.
−− Timely feedback was given to staff. Using the
intranet, a log was made accessible to all staff
so that they could see the reported close calls
and follow-up actions.
−− All staff were informed about the messages
of the campaign. Line managers received
various training materials and safety briefing
procedures. Mugs and flasks with examples of
close calls were given to all staff (Figure 10).
−− It was made clear to all staff that the safety
department would listen to reports from staff
at every level and that their input was vital for
the success of the campaign.
−− Reporting was made into a positive experience
Figure 10: Close call mug
for the reporter.
−− The company began to actively reward and praise
its staff for reporting close calls.
Close call reporting was emphasised to be a way of protecting colleagues from future harm
and injury. This message was communicated through casual discussions, and staff began to
think 'I’m looking after my guys – I’m reporting this', rather than fearing they were getting
colleagues, or themselves, into trouble.
3.6.1.3 Result
Over the five months during the build-up and the launch of the campaign, near miss reporting
increased by a factor of 17. When the campaign was officially launched in September 2013
there was a further increase in near miss reporting and Chiltern Railways are now averaging
approximately 70 near miss reports per month, compared to 13 near misses reported in the
previous 12 months (a near 70x increase).
To sustain the frequency of close call reporting and maintain a healthy reporting culture,
the campaign will be relaunched annually to remind staff about the benefits of close call
40
reporting. These campaign relaunches will provide a good opportunity for managers to give
feedback to all staff about how their close call reporting has helped to reduce risk across the
company in the past year. This feedback should include statistics that show how effective
close call reporting has been at improving company-wide safety, and personal examples of
close call resolutions.
3.6.2 Q8Oils near misses promotional campaign 2013/2014
3.6.2.1 Overview of campaign

The goal of the campaign was to increase awareness of the importance of near miss reporting
and increase reporting through use of targeted communications, coaching and rewards.
Communications included: the production of posters in different languages located widely

outdoors and indoors, including non-HQ offices and operative sites (e.g. sales offices); near
miss report forms made available in hard copy in dispensers; and a campaign video played on
both local Q8Oils televisions/screens and on the intranet.
Safety, health and environment (SHE) focal points met with different teams to provide
appropriate coaching concerning the campaign and the processes for near miss reporting.
3.6.2.2 Use of rewards

Prizes were allocated, not based on frequency of reports but on the basis of which reports
had led to the biggest safety or business improvement for the organisation. This evaluation
was made by SHE and management team representatives.
3.6.2.3 Result
Following this campaign near miss reporting increased globally by 32 % compared to the
previous year.
3.7 BLOCKERS AND POTENTIAL ENABLERS FOR REPORTING OF INCIDENTS
Table 3 summarises what are judged to be the most significant blockers to effective reporting,
along with potential enablers.
41
Table 3: Blockers to effective reporting and potential enablers
Blockers to effective reporting Enablers for reporting

Fear of being blamed or professionally −− Long-term engagement and commitment
embarrassed; peer group pressure to a fair reporting system (see 2.6).
−− Making the user experience a positive one.
In an ideal world the initial reaction of the
supervisor to a report should be 'thank you'
but often it is not.
−− If culture is immature, consider confidential
reporting.
Belief that nothing will be done in response to −− However the event is reported (e.g. verbally
report or online), provide timely feedback and
keep the reporter updated on progress and
when something changes.
−− If practical, try and involve reporters in
developing the solution, on the basis that
they will be more likely to implement it and
report again in the future.
−− Provide feedback at end of LFI process to
demonstrate that reports lead to effective
changes.
Concern from contractors that their contract −− Ensure contractors are protected from
may be jeopardised contractual penalties for reporting and are
encouraged to participate in LFI processes
(see 7.3.1).
Not understanding what should be reported −− Develop a list of examples that illustrate
(lack of awareness about what is important) high-learning-value incidents, particularly
near misses.
−− Train personnel on the examples.
−− Use safety meetings to capture and
communicate near misses that were not
previously identified.
−− Try and develop common understanding of
important incident barriers and important
safety performance indicators.
−− Avoid tendency to focus efforts on high
frequency personal risks at the cost of low
frequency major hazards.
42
Table 3: Blockers to effective reporting and potential enablers (continued)
Blockers to effective reporting Enablers for reporting

How to classify and prioritise reported −− Ensure there is an effective risk-based
incidents. Are the selected ones those with approach to prioritise incidents that also
the most potential for learning? takes account of learning potential.
−− All classification schemes (whether
based on actual severity of outcome,
potential severity, risk of reoccurrence,
learning potential, etc.) have strengths
and weaknesses. Do not become too
constrained by definitions and boundaries
(e.g. concerning near miss, incident,
accident, dangerous occurrence etc.).
−− Random deep dives can act as a quality
control check on the classification
scheme. They can also be used to train
up investigators and test the overall LFI
process.
Apathy – not understanding the value of −− Ensure that the reporting process is
reporting, instead seeing reporting and straightforward and that extra follow-
investigations as taking unnecessary time and up workload is not allocated to those
effort which should be avoided reporting.
−− Make the case for reporting, i.e. it is about
'looking after colleagues'.
−− Provide incentives for reporting, e.g. prizes
for reports that lead to the largest safety/
business improvements.
−− Provide disincentives for non-reporting, e.g.
no disciplinary action is taken if an event is
reported, but action is taken if an event is
not reported but subsequently discovered.
Complex reporting systems −− Make sure the reporting system does not
require too much from the reporter.
−− Avoid multiple systems that confuse the
reporter and that require repeated data
entry.
−− Review the system from user’s perspective –
is reporting a positive experience?
43
4 INVESTIGATION: FACT FINDING
4.1 OVERVIEW
The main steps of incident investigation are shown in Figure 11. The first step is to gather facts
concerning the incident. This step is also known as information or evidence gathering. The
next steps are to analyse the gathered information and determine what has happened and
why. This involves making hypotheses which are either discarded when information comes
to light which contradicts the hypotheses or retained for further consideration. Although
fact finding, analysis and validation of hypotheses are shown as discrete activities, in practice
they are part of an iterative, overlapping process and they could be combined. Finally, the
investigation should be clearly reported to feed effectively into the subsequent stages of LFI.
For clarity, this section discusses planning and initiation of the investigation phase, and fact
finding. The steps of analysis through to reporting are covered in section 5. The overall
investigation process as set out in Figure 11 applies to investigations at all levels (as covered
in section 3); however, some of the specific details would not be required for a simple
investigation.
Investigation
Incident Validation of Investigation Recommendations

Fact finding Analysis
reporting hypothesis Yes reporting Actions
No
More facts needed
Figure 11: Investigation
The topics in sections 4 and 5 are well covered in the following references, among others:
−− HSE HSG 245, Investigating accidents and incidents
−− RSSB Investigation guidance - Part 2: Development of policy and management
arrangements
−− RSSB Investigation guidance - Part 3: Practical support for accident investigators
−− CCPS Guidelines for investigating chemical process incidents
−− EI, Guidance on meeting expectations of EI Process safety management framework
Element 19: Incident reporting and investigation
Hence these sections make use of cross references where appropriate.
4.2 INVESTIGATION INITIATION
Establishing a terms of reference (TOR), also termed remit, helps to define the scope and
depth of the investigation. Investigator involvement in the development of the TOR can be
beneficial. Typical TOR require the investigation to cover the following (RSSB, Investigation
guidance - Part 2: Development of policy and management arrangements):
44
−− level of investigation;
−− determination of events leading up to the incident;
−− immediate and underlying causes;
−− documentation of analysis;
−− recommended system improvements;
−− reporting of urgent safety problems requiring early remedial action;
−− completion timescale, and
−− a well-structured and accessible report covering these.
Developing templates for TORs should ensure consistent application of good practices. Clear
TORs are particularly important for small organisations which need external investigation
resources (e.g. stating whether assistance is required with close-out of actions). The typical
TOR requirements cited should be extended to cover LFI, for example, considering what went
right (successes) as well as what went wrong, converting the report into incident summaries
for safety meetings or developing training scenarios based on the event.
At this stage the affected organisation should establish an incident owner with the
accountability to ensure that it is investigated according to the TOR.
4.3 INVESTIGATION RESOURCES AND COMPETENCES
The organisation should ensure that appropriate training is provided to develop the
competence of the nominated investigators. The training should address all aspects of
incident investigation and issues of leadership and team skills. An organisation can make
use of CCPS, Guidelines for investigating chemical process incidents to help it define the
investigation, leadership and team skills that investigators will require.
For more complex investigations, an organisation should ensure that sufficient numbers of
suitable personnel are identified and nominated to take on the role of incident investigators.
Persons chosen to be investigators should have sufficient experience of the operation, good
analytical skills and interpersonal skills, and have an inquisitive nature. A register of available
trained investigators, who can be called upon to carry out independent investigation of
serious and very serious incidents should be maintained. It may be advantageous to establish
a rota whereby specified individuals are the nominated- or duty- investigator for a defined
period; this can be a practical solution to resource constraints, although it should be ensured
that investigation skills are sufficiently practised to maintain competence.
Other investigations may be carried out by the local supervisor/line manager or their delegates.
Consider independent investigation leads if the actions of the supervisor or line manager may
have been contributory factors.
A common learning constraint identified in section 1 is lack of depth with respect to HOF
analysis. All investigation teams should have at least a basic level of competence in HOF. This
should be sufficient to recognise where additional help is required on human factors issues.
This is difficult on the basis that 'you don’t know what you don’t know', but this publication
should help investigation teams to determine if they have sufficient knowledge of human
factors to make this decision. RSSB, Investigation guidance – Part 2: Development of policy
and management arrangements provides an illustrative HOF syllabus.
As well as training courses other means of ensuring investigators’ competence include:

−− investigating enough events (including near misses) to ensure skills are maintained;
−− including them in independent reviews of other incident investigations;
45
−− involvement in table top exercises and assessing them during these exercises;
−− providing refresher training to suit the levels of investigation;
−− competence testing, and
−− obtaining qualifications linked to incident investigation courses.
Normally a lead investigator chosen for more serious or more complex incident investigations
will be independent from the operation or facility where the incident occurred. Appointment
of supporting staff will be dependent on the nature of the event and company resources.
The selected lead investigator may require support, especially if they are a line manager with
limited experience in investigations and they are under pressure of time. Technical expertise
may also be required from inside or outside the organisation, for example, fire/explosion
experts or materials experts.
Whether an organisation consistently allocates sufficient resources for investigation is a

significant indicator of its priorities. Releasing investigators sufficiently from their day-job
responsibilities involves a cost, but one that should be recouped in the long term from
reduced losses due to reoccurring events.
Some organisations may have minimum requirements for the size of an investigation team
based on the incident classification, e.g. a fatal event will be investigated by a team of four,
a lost time injury (LTI) by a team of typically two, a reportable injury by a local manager and
a first aid injury by a local supervisor. It should be noted, however, that as an investigation
proceeds, new lines of enquiry or increasing complexity may require the investigation team
to grow in size, or to seek input from specialists.
Example – RSSB’s Human factors training modules for investigators (RSSB,

Investigation guidance – Part 2: Development of policy and management
arrangements)
The RSSB’s human factors awareness course has been developed for incident investigators and
those with an incident investigation role. The course is run over two days and focuses on the
analysis of incidents and accidents from a human factors perspective. It clarifies the process of
identifying underlying causes using practical examples and case studies from a range of safety
critical industries. It provides an introduction to human factors analysis techniques and the
application of these to the incident investigation process.
The course content covers:
Section 1: Introduction to human factors.
Section 2: Understanding human performance (observe; understand; decide; act).
Section 3: Human error and violations (types of error; types of violation).
Section 4: The individual (distraction; fatigue; physical and mental well-being; work-related
attitudes; experience).
Section 5: The job and workplace (equipment; workload; communication and teamwork;
practices, process and information; work environment).
Section 6: The organisation (culture; supervision and management; knowledge and skills;
change).
Section 7: Putting it into practice (investigative techniques; developing recommendations).
46
In the case of a very simple incident, the basic investigation steps remain the same but they
are generally scaled back.
For anything other than a very low-level incident, a person will find it a challenge to conduct
an investigation alone. An individual does not have the benefit of developing hypotheses
through brainstorming possible chains of events or causes. A single person should also guard
against individual biases. For example, an individual’s specialism could cause them to focus
on certain lines of enquiry. Alternatively, recent investigations may skew an investigator’s
approach. In some cases a single-person-investigation may be necessary but the investigator
should be aware of potential problems, and it should be ensured that there is adequate peer
review of the investigation report.
As noted in this section, sometimes outside assistance from third parties will be required to
provide resources, experience and an independent view. This is often the case for smaller
companies, serious or complex incidents, or when stakeholder management is critical. Having
clear TORs may assist in obtaining the right resources.
4.4 PLANNING
It is difficult to provide definitive guidance concerning planning and scheduling, because

incidents vary so much in terms of scale and complexity. Some simple low complexity/low
severity events may need little formal planning and may require only a few hours to complete.
Major incident investigations on the other hand can extend for weeks and months.
Assuming an event is not of very low complexity/low severity, a planning checklist can be
helpful, such as the one adapted from CCPS, Guidelines for investigating chemical process
incidents:
−− defining priorities and the scope of the investigation;
−− identifying support and supplies;
−− developing information-handling procedures;
−− establishing communication channels both within the company and with outside
groups;
−− establishing interfaces, e.g. with other parties and other investigations (contractors,
legal, insurance, etc.), precedence and authority in multi-party investigations;
−− plan for conducting witness interviews;
−− plan for documentation, and
−− summarising findings and recommendations in a report.
In some cases the investigation methodology itself will have such checklists built in (see
section 5) which assist in the planning process.
In the case of an investigation team, as opposed to a single investigator, an organisation

should clearly establish who has responsibility for which activities in the plan. It should make
sure that tasks are allocated appropriately, i.e. matching tasks to the skills and strengths of
the team members.
Research among a range of companies (Drupsteen and Hasle, 2014) indicated that one
cause of dissatisfaction with investigations is a perception that they can be rushed to fit
artificial deadlines, rather than establishing the full causal picture and, hence, appropriate
recommendations. Thus, investigation schedules should be realistic and allow for all the steps
in Figure 11 to be carried out thoroughly and to a high quality.
47
An orientation visit can be useful to firm up the plan and establish the physical boundaries of
the investigation. A site visit at some stage in the investigation is critical for understanding3.
It is also important to establish an investigation room for serious incidents. There will be
lots of information to handle, collate, process and visualise on charts, so sufficient space is
needed.
For further information on planning and team resourcing it is recommended to consult CCPS
guidance (Guidelines for investigating chemical process incidents), chapters 2 and 7.
4.5 INFORMATION4 GATHERING
During the information gathering the investigator is looking to establish in broad terms (HSE,
Investigating accidents and incidents):
−− what happened;
−− who or what was affected and to what extent;
−− what were the conditions like;
−− what was the chain of events (what happened just before the event and just before
that);
−− what was going on at the time, and
−− was there anything unusual/different in the working conditions etc.?
Good practice guidelines for information gathering and preservation are set out in HSE,
Investigating accidents and incidents, CCPS, Guidelines for investigating chemical process
incidents and RSSB Investigation guidance Part 3: Practical support for accident investigators
e.g. how to make effective use of photography and video.
There is also merit in identifying whether there have been previous incidents at the site, and
if so, obtaining the associated investigation report to provide useful insights.
The CCPS guidelines identify five types of information:

1. People: examples include discussions with, or written statements from, witnesses,
participants, or victims.
2. Physical: examples include mechanical parts, equipment, stains, chemicals, raw
materials, finished products, results of analysis of parts, and chemical samples.
3. Electronic: all electronic format data are included in this category. Examples include
operating data recorded by a control system (both current and historical), controller
set points, and email. Email may provide a record of what and how people were
thinking when decisions relating to the incident were made. This can be an important
and powerful source of information.
4. Position: this is the depiction of locations of people and physical data such as valve
positions, tank levels, and explosion fragments and debris. Position data are related
to both people data and physical data.
5. Paper: examples include operating logs, policies, procedures, alarm logs, test records,
and training records.
The different types of information have strengths and limitations with respect to the
investigation aims. Some examples of these are shown in Table 4. By combining the five
3
An organisation may not always have the control to ensure a site visit, e.g. where regulatory investigations take
precedence.
4
‘Information’ has been used rather than the commonly used alternative ‘evidence’. Evidence can be regarded by
some people as linking to finding blame or establishing a basis for prosecution.
48
different sources, the limitations in any one source can be effectively compensated for (see
CCPS, Guidelines for investigating chemical process incidents for a fuller list of strengths and
limitations).
Table 4: Example strengths and limitations of information sources
Information source Example strength Example limitation

People Good at noticing the unusual Imperfect recollection
Physical Equipment likely to have May be severely damaged in
records that describe its the event
original condition
Electronic In a modern system there Can only record what it was
might be a huge amount of designed to do
electronic data available
Position Can allow reconstructions Positions might be moved as
and simulations part of rescue and recovery
Paper Paper relating to events a Records may be incomplete
long time prior to the incident
might be valuable
The five sources also have different characteristics in terms of fragility (e.g. people forgetting)
and likelihood of degrading with time. The investigator should identify time-sensitive data
as a priority (e.g. software data, metallurgical items prone to oxidation) and take steps to
collect or preserve this information (e.g. taking photographs, conducting interviews in a
timely manner).
In terms of the control of collected information:

−− information should be logged and catalogued carefully and systematically;
−− a simple spreadsheet to record details can be useful, and
−− information reference numbers can be used on storyboards to provide an audit trail
and highlight where there are information gaps.
For serious incidents it may be necessary to establish formal chains of custody (i.e. who has
been in charge and what protective measures taken) to show that information has been
preserved.
For further information on gathering information it is recommended to consult the CCPS

guidance, Guidelines for investigating chemical process incidents, chapter 8. For special
requirements for testing failed equipment cross-refer to CCPS, chapter 8.4 including physical
tests.
4.6 INTERVIEWING
When drawing up a list of bystanders/witnesses and those to be interviewed, investigators

should look more widely than the immediate participants in the incident and determine, for
example, how other shifts conduct the task of interest and whether they have experienced
problems.
49
Good practice guidance concerning setting the right tone for the interview, types of questions
to ask, and style of questioning are covered extensively in CCPS, Guidelines for investigating
chemical process incidents and RSSB, Investigation guidance Part 3 Practical support for
accident investigators.
The following points should be noted:

−− A witness’s memory may degrade over time, so interviews should be conducted in a
timely fashion.
−− Accurate records of interviews should be kept, although verbatim accounts may
not be necessary. Such records will help to avoid the influence of memory loss and
contamination through conversations with others. Recordings can be used but this
can lead to witnesses becoming unwilling to share, and are time-consuming to
transcribe.
−− By introducing the interview as an opportunity to prevent reoccurrence this is a
motivation to personnel to prevent others suffering injuries or loss.
−− Discourage asking 'why did you do it?' – the motivation is not that helpful. People
often may not know why they did a certain action. Ask more neutral questions such
as 'take me through what happened'.
−− Conducting an interview while walking around the location can be more productive
than 'behind closed doors'.
−− There are easy to use structured interview techniques (cognitive interviewing) that
help witnesses to recall information accurately.
−− With traumatic incidents witnesses may find it difficult to give their account. It is
important to be supportive and refer them to further help if they want it.
−− Be careful in the use of language, repeatedly stress it is about 'learning'.
−− Naming interviewees: consider whether you need to name anyone when you are
investigating. It will help with disclosure if no-one is named in reports and some
legislation specifically prohibits the use of witnesses names.
−− Be mindful of things unsaid. Personal problems and impending redundancy have
been given as examples which were not mentioned in initial interviews but which
emerged subsequently as causal factors. Give space for such things to emerge in the
interview and provide contact details so that interviewees can come back afterwards
with this type of follow-up information.
While it is common to interview personnel singly to try and develop a clear picture of what has
happened, consideration should also be given to using group-based interviews at some stage
in the investigation. This approach can be useful in helping to develop recommendations to
deal with identified causal factors and in promoting learning from the event at an earlier
stage than traditionally occurs.
4.7 EARLY LEARNING
As some investigations can become quite lengthy, it is good practice to look for opportunities
for early learning within an organisation. An extreme example of early learning was during
the emergency at the Fukushima Daiichi nuclear reactors following the devastating tsunami
of 2011. Operators in one control room controlling two of the nuclear reactors were learning
lessons in real time based on events in another control room responsible for two of the other
units on the site which had suffered a hydrogen explosion. Three teams from each of the
control centres were located in the same emergency response room. Such early learning
was very dependent on the relatively long duration of the incident and the co-location of
multiple control centres. However, it flags up the potential for early learning which other
organisations could be looking to exploit.
50
4.7.1 Urgent actions
During the initial part of the investigation it may become apparent that actions need to be
taken before detailed causes are known. If an identical or a similar system is being operated
at another site, for example, a safety alert (flash alert) may need to be issued. Even if longer-
term measures are planned, an organisation should consider informing other parts of its
business of the basic facts to allow them to assess and mitigate in the short term.
An organisation should also be able to respond to such safety alerts coming from other sites
or other organisations. This is discussed further under external methods for communicating
lessons in section 7.
Figure 12: Example flash report/incident alert
51
4.7.2 Communication of initial findings
In some investigations there can be a need or an opportunity for issuing interim reports with
initial findings. With reference to Figure 2, potential solutions for fixing the barriers may
be proposed in such interim reports. Potentially this could provide an opportunity for early
learning. Identifying and fixing the underlying causes might take further analysis and involve
longer-term learning.
In some cases, issuing alerts with basic facts can allow people to make their own assessment
as to the relevance of the findings to their situation.
The aviation industry is generally good at issuing timely interim reports and bulletins that
enable the industry to begin risk reduction in advance of the final report.
Example illustrating early communications from Air Accident Investigation Branch

(AAIB) special bulletins
AAIB special bulletin S1/2014 on the crash of an AS332 L2 Super Puma on 23 August 2013
into the North Sea was published on 23 January 2014 prior to a final investigation report. It
contained a safety action concerning the emergency breathing systems (EBS), namely:
Safety action
The AAIB has approached the main helicopter operators flying in support of the UK oil and gas
industry, whose passengers are equipped with a hybrid EBS. Whilst operation of the hybrid EBS
should be covered in initial and recurrent training, it is not explicitly described in the pre-flight
safety briefing.
The operators have undertaken to amend their pre-flight briefing material to include
information that the hybrid system contains its own air supply which is discharged
automatically, making the system usable even if the wearer has not taken a breath before
becoming submerged.
http://www.aaib.gov.uk/cms_resources.cfm?file=/S1-2014%20G-WNSB.pdf
4.7.3 Returning to production/service
Another form of early learning concerns the decision to return to production or service.
Although the actual decision to restart depends on equipment availability, repairs being
completed, and line management, the investigation team may also have identified
requirements or criteria that need to be met before resuming operations. These requirements
may be informed by the information gathering and initial analysis. For example, early
identification of the immediate causes of barrier failure may enable restart with certain
short-term operational constraints or limitations.
4.7.4 Including frontline staff in investigations
HSG245 notes that accident rates in organisations that include front-line staff in investigations
are about half that of those that do not. As well as helping to incorporate front-line expertise
into the investigation, this approach is another route for spreading early learning out into the
wider organisation.
52
5 INVESTIGATION: ANALYSIS
5.1 OVERVIEW
In this section the remaining steps from Figure 11 are covered, i.e. analysis, hypothesis
validation and investigation reporting. Different approaches to investigation analysis are
described but they all have the common goal to understand causal factors in sufficient
breadth and depth that effective recommendations for change can be identified.
Investigation analysis techniques can help to structure known facts and findings and identify
unknown information that will require further collection and analysis. This can help to
increase transparency and make it clear how investigation results were obtained. However,
ultimately analysis techniques are 'servants' and not the 'masters'; the skill and experience of
the analyst is more important than the technique selected.
In a recent literature review of papers relating to identifying incident causes (Drupsteen and
Guldenmund, 2014) it was shown that underlying causes, including organisational and
managerial factors, are often not addressed in investigations. This is a critical weakness in the
LFI process making effective learning much more difficult.
Guidance is provided in this section on broad approaches to analysing what happened and
why (5.2). By combining techniques into an overall framework and applying the good practice
set out in this publication the aim is to generate outputs that:
−− are systematic and defensible;
−− are consistent across different investigations;
−− are understandable and engaging;
−− have clear timelines/sequences of what happened;
−− present multiple causes logically and identify immediate and underlying causes,
including HOF causes, and
−− are traceable and auditable.
In this way an organisation maximises the chances of developing a good understanding of an

incident and what can be learnt for the future.
The broad approaches presented in 5.2 can be supported by specialist techniques (e.g. HOF
incident and analysis tools, as well as technical methods such as metallurgical analysis) to
form an effective toolkit to address the range of incidents that may be encountered.
This section also addresses the validation of hypotheses (5.2.2.6) and the reporting of the
investigation (5.3). A case study is presented in 5.4 to illustrate typical investigation processes.
Blockers and enablers relevant to all steps in investigation are summarised in 5.5.
5.2 APPROACHES TO INCIDENT CAUSAL ANALYSIS
5.2.1 What happened
In determining what happened the use of a storyboard-based technique (e.g. sequentially

timed events plotting (STEP)) is commonly used to build up the sequence of events and a
timeline (see). Such techniques help provide a visual picture of what happened and act as
53
a point of focus for an investigator or an investigation team. Sticky notes can be created as
information is gathered (e.g. following an interview) and used to fill in the storyboard. This
will also help show the areas where information is currently missing.
CCPS (Guidelines for investigating chemical process incidents), BSI (Root cause analysis) and
EI (Guidance on investigating and analysing human and organisational factors aspects of
incidents and accidents first edition (superseded), Annexes A and B, available as a web link)
provide descriptions of storyboard and sequencing techniques.
5.2.2 Why it happened
There are a very large number of analysis techniques that are used to help determine why
an incident occurred. EI (Guidance on investigating and analysing human and organisational
factors aspects of incidents and accidents first edition (superseded), Annexes A and B,
available as a web link) provides an initial introduction to many of these. A survey by IOGP
(Walker et al, 2012) indicated a number of techniques which are most commonly used by
some energy companies, including TapRoot, Tripod Beta, Topset, SCAT, Apollo and others.
Many companies use multiple techniques either for different levels of incident consequence or
different incident types (CCPS, Guidelines for investigating chemical process incidents and Walker
et al, 2012). It should be noted that not all techniques are comparable in scope, i.e. some are more
focused on the investigation (the information gathering) and others on the analysis (the causes),
and techniques can therefore be complementary. Combining techniques into a framework or
toolkit has advantages in terms of ensuring appropriate investigation for the full range of incidents.
Each of the broad approaches described in this section provides a structure for analysis of
collected facts and helps identify where there are gaps in the collected information. All
of them can be used to analyse HOF. Whether the use of a technique during a specific
investigation achieves the desired goals is often a function of the skill of the analyst.
Whilst it is possible to group the various types of techniques in a number of ways, the
categorisation following is based on CCPS, Guidelines for investigating chemical process
incidents, EI Guidance on investigating and analysing human and organisational factors
aspects of incidents and accidents first edition (superseded, Annexes A and B available as
a web link) and the EI stakeholder workshops, and can help the reader understand the
distinguishing features of different techniques.
5.2.2.1 Logic-based trees/charts

A number of techniques build logic trees or charts to identify causes of an incident. Typically
the final incident is shown as an event at the top or on one side of the page and a tree of
causes is constructed (deduced) based on collected information and logic. The tree is based
on a ‘why-because’ process of questioning, and helps to define relationships between causes
and effects. Often there are logic gates that set rules on how different causes interact (AND
gates and OR gates). This process can effectively show progressive layers of causes similar to
the diagram shown in Figure 2. Figure 14 and Figure 15 show an example chart and tree.
It should be noted that while fault tree analysis was not designed for incident analysis it is
commonly used in investigations.
54
Driver
Driver taken
Driver gets Driver falls evacuated to
Driver Driver over- to hospital
into asleep at first aid post
corrects
vehicle the wheel
Vehicle Vehicle hits

departs windrow at Vehicle rolls Vehicle and
Vehicle from Prod the edge of over driver found
centre the road
Missing
vehicle
reported to
duty manager
ER duty manager
55
ER duty
S&R team Search
Vehicle due manager
Search and search along extended off
to return mobilises
rescue party planned route planned route
S&R team
8:00 12:30 15:30 16:30 18:30
Figure 13: Illustrative timeline and storyboard (Guidance on using Tripod Beta in the investigation and analysis of incidents, accidents
and business losses)
Pressure on
dispatcher to
deliver goods
immediately
Dispatcher
Tired driver
combines goods
wheel ofbehind
with following day’s
vehmoving
delivery
i l
Vehicl e hits
wind row >
Driver maintains alert
overreaction of
and steers correctly
tired driver
Tired driver
available for
delivery
Driver reacts Vehicle rolls over
appropriately on
hitting windrow
Dispatcher delays
delivery until rested Vehicle (moving on Driver injures back
driver becomes the road) as a result of
available
vehicle rollover
56
Vehicle stability
Driver
Figure 14: Example Tripod Beta ‘core diagram’ (logic tree plus barriers, but causation paths removed for Seat belt restrains
clarity)
driver
Tank over-filled
during tanker
unloading
Full And
Insufficient space High level

in tank to receive protection system
delivery fails
Full Or Prot And
Operator fails to
Level indicator High level alarm Trip fails to stop
check enough
failed fails to stop pump pump
space in tank
LI OP1 Alarm Or Trip Or
Operator fails to Trip solenoid fails

Level alarm fails Level switch fails Level switch fails
respond to alarm to stop pump
LA OP2 LSH LSH SOLN
Figure 15: Fault tree of tank over-filling
Trees and charts can allow an analyst to work through to the underlying causes of an
incident. They are often combined with checklists (see in this section) to prompt the analyst
to consider a suitably comprehensive range of possible causal factors. When combined with
timelines and storyboards they provide visual representations that aid creative analysis and
aid communications internally within the team and with external parties. A more detailed list
of the main strengths and limitations of tree- or chart-based techniques is given in Table 5.
Table 5: Strengths and limitations of logic tree-based techniques
Typical strengths
−− Flexibility: trees can generally be split into segments allowing detailed analysis of the
most interesting parts specific to that incident.
−− Visual representation can be helpful in promoting group involvement and
communicating to others.
−− Trees clearly show the multi-causal nature of significant incidents and may help the
team understand how these causes have interacted.
−− The process of developing the trees encourages the exploration of deeper levels of
causal factors.
−− Trees can show multiple hypotheses and help investigation teams see other ways that
an incident could have occurred. This could be especially important for subsequent
learning, helping to prevent occurrence of similar events as well as reoccurrence of
the identical event.
−− The reasoning behind such trees should be checkable using formal logic.
57
Table 5: Strengths and limitations of logic tree-based techniques (continued)
Potential limitations
−− Barriers, immediate causes, PIFs, or underlying causes may not be specifically
identified, making targeting actions difficult.
−− Generally most effective in the hands of trained and experienced users.
−− Because of their rigour, may be reserved for the more serious incidents.
−− Some specialist training may be required, e.g. on rule sets to be applied.
−− These techniques are expansive and they can result in finding a lot of potential causes
because there is no direct linkage to control failure. This in turn can result in many
recommendations, not all of which are significant in terms of causation.
−− Because they do not depend on a checklist, may be more difficult to categorise and
trend findings across multiple incidents.
5.2.2.2 Barrier-based techniques

Many organisations use barrier-based analysis techniques to represent the various safeguards
protecting against serious incidents. As noted in 2.2, barrier models are well matched to
MAH industries which rely on defence in depth (see Figure 2).
Barriers can be physical (e.g. over-pressurisation protection), actions (e.g. valve closure) and
procedures/systems of work (e.g. permit to work). The rules for what can constitute a barrier
vary between organisations; rules should be harmonised and applied consistently within an
organisation. During investigation, available risk assessments within safety cases and safety
reports can be used to identify what barriers should have been in place. Once these have
been identified the analyst determines whether the barriers were effective, failed, were
inadequate or missing entirely (and can even identify new barriers, making the analysis a
business improvement opportunity). Thus, successes will be highlighted as well as failures.
Having categorised barriers in this manner, the causes of failures or inadequacies will be
sought. Checklists can complement the barrier approach in determining causes.
As with logic-based trees, barrier models provide a useful visual aid to analysts and can be
readily linked to wider control of risk through the management of barriers. Table 6 summarises
more details of their main strengths and limitations.
58
Table 6: Strengths and limitations of barrier-based techniques
Typical strengths
−− Engaging visual representation.
−− Barrier diagrams show the multi-causal nature of significant incidents.
−− Can help establish the breadth of the incident before the team go too deep with any
single component.
−− Help identify what went right (successes) as well as what went wrong (failures).
−− Links each underlying cause to a barrier failure rather than a general link to the
incident.
−− Generally, the organisation will have used barrier thinking in their risk assessments;
hence there should be material in safety cases/reports which can be readily applied in
the investigation.
−− Barriers can be combined with logic trees (e.g. a tree can be applied to one or
multiple barriers) and checklists.
−− Barrier analysis can help identify corrective actions that may be relatively quick to
implement.
−− Such techniques require training and if an organisation is not familiar with barrier-
based approaches to risk, e.g. bow tie analysis, this is a large step in thinking.
−− Different analysts could construct different sets of barriers for the same system/
incident; because they do not depend on a checklist, may be more difficult to
categorise and trend findings.
−− Because of their rigour, may be reserved for the more serious incidents.
5.2.2.3 Checklist-based techniques

A large number of organisations use checklists or structured prompts in some form within
incident investigations. This category includes the use of pre-defined trees. Checklists are
generally based on extensive collective experience, e.g. drawn up by groups of experienced
personnel or based on analyses of incident databases. As such they will represent events that
are beyond what a single analyst is likely to encounter even in a whole career and hence can
be a valuable resource.
An example of a checklist is the table of potential PIFs from HSE Core Topic 3: Identifying
human failures, reproduced in Annex C. This checklist helps an analyst consider what factors
relating to the job (signage, task, working environment, etc.), person (fatigue, competence
workload, etc.) and organisation (communications, manning, culture, etc.) could have
influenced the chain of events identified in 5.2.1.
Table 7 summarises the main strengths and limitations of checklists.
59
Table 7: Strengths and limitations of checklist-based techniques
Typical strengths
−− Can transfer good practice and learning from previous incident investigations. Some
checklists are based on many years of incident experience across MAH industries.
−− Can provide helpful support to a team, which can be particularly valuable for less
experienced analysts (provides ready-made questions/ prompts).
−− Aids consistency within investigations and this, in turn, allows for better trend
analysis (e.g. frequency of incidents involving defined factors).
−− Incident investigation checklists can help planning, acting as an aide-mémoire,
ensuring that relevant items are considered.
−− Checklists can be broken down into convenient categories, e.g. technical, hardware/
software, procedural, HOF, etc. which can help check for completeness and are useful
for communications with others.
−− Typically easier and faster to use than logic trees or barrier-based techniques.
−− Checklists can readily be combined with other tools (e.g. HOF checklists supporting
logic trees or barrier-based models) and can be used to facilitate group-based
sessions.
−− Comprehensiveness of checklists can vary greatly.
−− They can have a constraining effect and prevent wider (lateral) thinking.
−− They may cause an investigator to lead a witness down a defined route.
−− Should not use the checklists related to ‘why’ too early; make sure the ‘what’ is fully
understood first.
−− Some checklist language can appear to imply blame which is clearly against the
culture necessary for LFI.
−− They can be biased, e.g. towards technical causes or towards blaming the individual
within HOF checklists.
−− Checklists may highlight many other problems and shortcomings that did not directly
cause or contribute to an incident. This in itself may not be a limitation in terms of
wider learning but it may distract effort away from the short-term goal of preventing
reoccurrence.
−− Checklists may be easier for inexperienced users, but are not a substitute for analyst
skill.
A number of techniques combine the three broad approaches above, e.g. Kelvin Top-Set®
and TapRooT® combine trees and checklists, B-SCAT combines barriers and checklists, and
Tripod Beta combines aspects from all three.
5.2.2.4 System theory techniques

These types of technique are not in widespread usage within industry, but are the subject
of academic research. Examples of these types of techniques include functional resonance
analysis method (FRAM), AcciMap, and systems theoretic accident modelling and processes
model (STAMP). System theory approaches look at the linkages between different actors
within an incident. Actors may be individuals, but may also be aspects of the organisation at
various levels (e.g. processes, staff level, management level), the regulator and government
policy. Because these techniques have been largely confined to research, little can be said of
their effectiveness and advantages over other techniques for learning from incident, although
they may be helpful for revealing findings that other techniques are unlikely to uncover, such
as government policy.
60
5.2.2.5 HOF causal analysis

When conducting a HOF analysis of an incident, consider the following:
−− Do not try to prove exactly why people did what they did. It is more productive
to focus on the influencing factors (PIFs) that made the event more likely. When
considering PIFs, the analysis will often deal with the balance of probability rather
than absolute, clear causation.
−− Look at HOF successes as well as failures (see 4.2 to build this into the TOR) in order
to expand learning potential.
−− HOF issues should be addressed in simple language and not academic terminology.
−− Link HOF issues to a hierarchy of controls for improvement actions (see 6.2.2). Within
this hierarchy of controls include consideration of non-technical skills (NTS) that
could be improved (see IOGP, Crew resource management for well operations teams
on additional guidance for NTS).
−− For lower level events, some organisations make use of checklists with a range of
pre-determined potential underlying causes to make cause identification easier and
more consistent (e.g. at supervisory level). However, it is important to review whether
such methods actually generate information of sufficient quality to be useful for
learning as this is often not the case.
5.2.2.6 Hypothesis validation

It is to be expected that some information may not be readily available or necessarily clear-cut
and may be incomplete, inconsistent, contradictory, ambiguous, misleading or false.
It is important not to rule out causes just because evidence is initially weak. If in doubt, weak
signals should be explored further. This is especially relevant to process safety hazards. It is
also important to determine the extent of a causal factor through sampling.
A useful rule of thumb is to accept information leading to a conclusive finding if it is supported

from at least two independent sources. This is not always possible and the analyst may have
to decide whether to use a single source as conclusive proof. Single findings can be tested by
asking those involved in the incident if they agree or disagree with it.
Listing the source of each finding will facilitate conflict identification and resolution. In general,
where any assumptions are made, these should be explicitly stated in the investigation report.
One approach to helping to clarify or resolve alternative hypotheses is to construct a finding/

hypothesis table (see CCPS, Guidelines for investigating chemical process incidents for more details).
Table 8: Mapping known findings against hypotheses (adapted from CCPS,

Guidelines for investigating chemical process incidents)
Hypothesis Findings or Conditions

A B C D E F
1 ? + ? + + -
2 ? ? + + + ?
3 NA ? ? + + -
Legend: (+) the finding supports the hypothesis; (-) the finding refutes the hypothesis; (NA)
not applicable - the finding is not related to this hypothesis; (?) not enough information is
available to decide on this finding.
61
5.3 INVESTIGATION REPORTING
It is good practice to develop a template for investigation reports and to have this checked
by the legal department. The template should take account of good practice guidelines
for report structure (see RSSB, Investigation guidance Part 3: Practical support for accident
investigators and the template in EI Guidance on meeting expectations of EI Process safety
management framework Element 19: Incident reporting and investigation). The report does
not need to be an exhaustive description of the investigation itself. This can become excessive
and distracting. Separate report templates for different investigation levels can help make
sure authors include relevant information that will be more recognisable to readers.
To accompany the template an organisation should define good practices that help make a
report a good tool for learning, for example:
−− Consider who the readers are and what they need from the report.
−− Use visual aids to make the report accessible, e.g. use diagrams to show where
people were, photographs of area/equipment.
−− Use short sentences and keep technical language and explanations in an appendix.
−− Include a list of similar incidents to lend weight to the findings of an investigation
report and put it in a broader learning context.
−− Consider other formats to complement a written report, e.g. presentations, slides,
videos; how can the information be best communicated?
Details from the report should also be captured as key words and fields for use in databases
to allow trending and pattern recognition (see section 8).
5.4 CASE STUDY
5.4.1 Overview of incident
At about 0115 hours on a Thursday morning in the spring of 2007, a fire occurred at an
atmospheric pipe still (crude distillation) (APS) unit at a refinery. There were three fatalities
and one person was injured as a result of the fire.
These four individuals were contractors who had been carrying out de-blinding work at the
APS unit in which five blinds, previously installed for the conduct of maintenance work, were
being removed after completion of the maintenance work.
Schematics showing the relevant equipment and blind locations are provided in figures 16
and 17
The incident occurred when the contractor crew was working on the last of five blinds to be
removed (blind E on the schematic). It is estimated that more than 760 litres of condensed
hydrocarbon and water were released from the flange at blind E, which subsequently ignited
from an unknown source below the work area.
Emergency response was immediate, with APS shutdown commencing at 0116 hours. The
fire was extinguished by 0224 hours.
62
Figure 16: Heat Exchanger Structure
Figure 17: Schematic Layout of E138A/B and E139
5.4.2 Summary of investigation
Suitably qualified and independent investigators were assigned to report back to management
with recommendations to prevent a reocurrence. The investigative techniques used reflected
the following key principles:
63
−− Establish the sequence of events with significant times and conditions defined (see
Figure 18 for illustrative charts).
−− Find out as far as reasonably practicable the reasons 'why' actions were taken
or omitted (techniques include interview, documentation reviews, radio traffic
recordings, expert witnesses/local subject matter experts, why-based techniques).
−− Identify 'causal factors' (CF5) – those acts or omissions that if completed would have
prevented the incident occurring.
−− Determine influences and underlying causes relating to each causal factor, which in
turn enable effective corrective actions to be developed.
−− Make recommendations that allow line management to develop SMART actions to prevent
a recurrence. Assign action owners and links to the global safety management systems.
Figure 18: Charting sequence of events, associated conditions/status and causal

factors
5.4.3 Immediate causes and recommended actions
Table 9 lists the identified immediate causes together with a sample of the underlying causes
and recommended actions.
5
Referred to as immediate causes in rest of this case study
64
Table 9: Summary Analysis
Immediate causes Influences/underlying Sample of actions7

causes6
CF1 – No spill containment In the past, procedures Provide hazard awareness
CF2 – No gas test had not been followed for contractors at refineries
and no incident had worldwide covering
CF3 – Disjointing practices occurred. disjointing tasks among
not followed
Lack of hazard others.
CF4 – Work permit
awareness of contractors Revise guidance for
conditions not followed
around disjointing task. providing assurance that
CF5 – Process/work global equipment disjointing
Lack of assurance that
conditions were not practices are being followed.
global equipment
adequately evaluated prior
disjointing practices are Enhance process operator
to breaking the flange
being followed. work permit control in order
CF6 – Work continued to provide necessary checks
after liquids were released Lack of controls around
contractor compliance prior to work commencing.
with permit conditions. Make process operator
presence a prerequisite for
work to proceed.
5.5 BLOCKERS AND POTENTIAL ENABLERS FOR INVESTIGATION OF INCIDENTS
Table 10 summarises what are judged to be the most significant blockers to effective
investigation, with potential enablers.
Table 10: Blockers to effective investigation, and potential enablers
Blockers to effective Enablers for investigation

investigation
Insufficient −− Release staff from normal duties so that they can carry out
management investigations to sufficient standard.
commitment −− Encourage investigators to identify underlying causes even when
these point to organisational and management system issues.
−− Encourage board / corporate level interest in LFI.
6
Some assumptions arise due to inability to confirm with the personnel involved.

7
Note these have been simplified and hence do not necessarily follow a SMART format (see 6.3).
65
Table 10: Blockers to effective investigation, and potential enablers (continued)
Blockers to effective Enablers for investigation

investigation
Lack of personnel −− Develop investigator capability through selection, training and
trained/ competent assessment (see 4.3).
in investigation (e.g. −− Obtain assistance from another part of organisation or outside body.
lack of competence −− Set up easy to use templates/ checklists that enable a non-
in structured analysis specialist to determine underlying causes for non-complex
techniques or incidents. However, be realistic about what less-resourced
understanding HOF) investigations can achieve; prevent non-specialists providing low
quality data on underlying causes that bias the investigation and
prevent robust trend analysis.
−− Provide HOF training for investigators. A basic HOF competence
should help supervisors in day-to-day operations as well as incident
investigation.
−− Use review panels to check investigation findings, including
recommendations.
Reluctance of −− Establish the right atmosphere in interviews; it’s about learning,
personnel to provide not blame.
full story; worry of −− Use approaches that make the interviews less intimidating, e.g.
being blamed or walk around the site with the personnel during initial discussions
incriminating others and consider the pros and cons of interviewing groups of
personnel together (this can have powerful learning potential).
Lack of comprehensive −− Establish systematic and objective processes for gathering
identification of information so that the findings will be well founded and can be
underlying causes and linked to the collected information.
'single (root) cause −− Aim to understand correctly what happened through the
seduction' sequence of cascading loss of control events, how it happened
through the various barrier systems which were not effective, and
why the barrier systems were not effective because of human and
organisational behaviours and influences.
−− See training/ competence issues detailed in this table.
Difficulty of −− Recognise that the investigation is not about proving categorically
establishing why why something happened; it is about learning. Focus on what
people did something: made this event more likely to happen (e.g. were fatigue factors a
they themselves might potential influence?).
not know −− Discourage asking 'why did you do it?': the motivation is not
that helpful, and vulnerable to hindsight or reinterpretation. Ask
more neutral and open questions such as 'Take me through what
happened'.
Lack of early learning: −− Send out incident alerts or interim reports.
the time to produce −− Possibly run sharing learning sessions (see 7.4) in parallel to formal
a final report can investigation.
be lengthy and the −− Include frontline personnel in investigation teams.
temptation can be to
postpone wider learning
until all the facts are
known definitively
66
6 RECOMMENDATIONS AND ACTIONS
6.1 OVERVIEW
This LFI phase translates the investigation findings into effective actions that will prevent
the reoccurrence of similar incidents. Figure 19 shows the main steps in this phase.
Recommendations are developed (6.2) and line managers should convert these into
actions which are SMART (see 6.3) and which reduce risk to a level which is as low as is
reasonably practicable (ALARP). Other operational feedback mechanisms (such as audits,
task observations, staff surveys) may have also indicated issues that require corrective actions.
These actions should be implemented and closed out (6.4). The results from this stage will
feed forward into broader learning and change. Feedback from the broader learning and
evaluation phases may lead to the identification of further actions. Blockers and enablers
relevant to this phase are summarised in 6.5.
Recommendations and actions
Develop Implement Close out

Investigation Derive actions Broader learning
recommendations actions actions
Broader learning and evaluation

Other indicate if further actions are
operational required
feedback
Figure 19: Recommendations and actions
It is recognised that addressing recommendations following an incident can be a major area

of weakness. There may be long lists of unclosed-out actions existing sometime after an
investigation report is finalised, or a tick box approach to implementing ineffective measures
(e.g. rebriefing a team on a procedure).
To address these potential weaknesses line managers should be involved in the development
or review of recommendations so that they buy-in to them. Equally front-line personnel
should be involved in discussing potential risk reducing measures so that their expertise is fed
into recommendation development.
Prioritising recommendations can prevent an organisation becoming overloaded with

resultant actions (especially when actions are also being generated through reviews, audits,
safety tours, etc.). Investigation recommendations should be translated into SMART actions
to make them easier to address and close-out. Periodic reviews of actions should be used to
check that actions are closed out in a timely and robust manner.
67
6.2 DEVELOPING APPROPRIATE RECOMMENDATIONS
6.2.1 Who should be involved
Line managers have an important role during the development of recommendations. As a

minimum they should be consulted with to ensure that they understand the rationale for
the recommendations and have a chance to comment on issues such as practicality and
priorities. This consultation should be aimed at improving acceptance of recommendations
and preventing misunderstandings when the draft investigation report is issued.
An organisation should consider whether the investigator or investigation team are the best
people to be developing recommendations. The necessary expertise for this is more likely to
lie with the line managers who understand the business and, ultimately, who will implement
the actions. In The Netherlands it has become the practice for national investigation bodies
to stop their report at the findings stage and hand over to the responsible line managers of
the involved organisations to develop recommendations and actions to address the findings.
Putting the onus on the line managers in this way has led to a higher rate of actions being
closed out appropriately.
In developing recommendations it is good practice to also involve local personnel, who have
frontline experience and also subject matter experts, who would typically have a deeper
understanding of the issue at hand. As well as developing better risk reducing measures, this
should also help establish buy-in of the resulting actions. Discussing options with appropriate
stakeholders will lead to more credible recommendations and greater understanding of what
needs to be done.
In developing recommendations it is very helpful to know if issues associated with the incident
have been experienced and addressed before. To this end, some industries have made use
of panels of retired experts who were willing to review incidents on the basis of 'giving
something back' into the industry. Tapping into such large accumulations of knowledge
can lead to rapid recognition of issues, appropriate recommendations and cross-references
to incident reports that are not easily tracked through more formal means. These expert
panels should be supported by knowledge management systems (e.g. incident databases as
described in section 8).
6.2.2 Rationale for recommendations
6.2.2.1 Linkages to findings and barriers

It is usual to link recommendations to findings so that the rationale is clear. There
should be at least one recommendation for each of the failed or ineffective barriers and
underlying causes. If a barrier has failed, rather than automatically trying to develop a
new barrier, the reasons why the existing barrier did not succeed should be understood
and corrected. Suitable actions should be taken to fix failed barriers before production
is restarted.
In the case of HOF causes of barrier failure, understanding the human failure types in the
event can identify what measures are likely to be effective. Table 11 indicates what classes of
recommended measures are likely to be effective for different HOF failure types. Improving
training, for example, is unlikely to have a big impact on reducing slips and lapses, whereas
it could potentially have an impact on mistakes. In contrast, reducing distractions through a
less cluttered workplace or removal of extraneous activities could have a significant effect on
slips and lapses, but is unlikely to be so relevant to violations.
68
Table 11: Mapping effective recommendations against human failure classification

(adapted from Shorrock and Hughes, 2001)
Recommendations – Slips Lapses Mistakes Violations8

improvements in:
Control/ display design    
Equipment/ tool design  
Memory aids 
Training 
Work design   
Procedures    
Supervision    
Reducing distractions   
Environment    
Communications    
Decision aids 
Behavioural safety  
6.2.2.2 Applying a hierarchy of control

The rationale for recommendations can also be improved by applying logical hierarchies for
reducing the risk of reoccurrence. The following hierarchy of additional risk controls has been
proposed in HSE Core Topic 3: Identifying human failures and could be applied to incident
investigation recommendations:
−− Can the hazard be removed?
−− Can the human contribution be removed, e.g. by a more reliable automated system?
−− Can the consequences of the human failure be prevented [or mitigated], e.g. by
additional barriers in the system?
−− Can human performance be assured by mechanical or electrical means? For example,
the correct order of valve operation can be assured through physical key interlock
systems or the sequential operation of switches on a control panel can be assured
through programmable logic controllers. Actions of individuals should not be relied
upon to control a major hazard.
−− Can the Performance Influencing Factors be made more optimal, (e.g. improve access
to equipment, increase lighting, provide more time available for the task, improve
supervision, revise procedures or address training needs)?
Such a hierarchy relating to plant process changes, equipment improvements, enhanced

operational environment, revised procedures, better supervision and training, etc. can help
organisations apply changes that are likely to be effective in the long term.
6.2.3 Prioritisation and review
It is helpful to be able to understand the relative priority of each recommendation or

action and how these stand relative to other issues that need to be addressed. Ideally each
recommendation or action generated by an incident investigation should be prioritised,
providing an assessment of the level of risk which is mitigated by the implementation
of each recommendation, and consequently, the level of risk which will remain if the
69
recommendation is not implemented, see EI Guidance on meeting expectations of EI Process

safety management framework Element 19: Incident reporting and investigation.
Risk matrices of the type discussed in 3.3 can be useful in demonstrating how risk levels could
be changed by implementing different recommendations. A qualitative approach to looking
at the potential benefits of implementing recommendations and issues of practicability can be
found in the EI Guidance on human factors safety critical task analysis (SCTA). In a minority of
cases, when a recommendation will entail large costs but could lead to large safety benefits,
a quantified cost benefit assessment (CBA) may be necessary to decide whether or not to
implement a proposed safety measure. Such assessments can be useful to help demonstrate
that the risk of a repeat occurrence is ALARP.
Investigation recommendations should be reviewed by professional leaders (discipline leads)

and technical authorities before the draft report is issued. Careful reviews of recommendations
can help to check that they really would eliminate the causes of the incident while being
reasonably practicable, cost effective and within the control of the organisation. As noted in
2.7, and where appropriate, a legal review should also be carried out.
As part of feasibility assessment, some organisations have established review panels for
recommendations to ensure that they will be beneficial and that they are practical. These
panels are given the authority to accept or reject recommendations. Documentation should
be produced explaining why a recommendation was rejected or modified.
It is good practice to consider whether workstreams set up after previous incidents are
already addressing findings from the latest investigation. Thus, rather than producing new
recommendations, the investigation may want to check whether these other workstreams
are sufficient and produce a linking recommendation (e.g. 'review schedule of workstream
X to ensure timely completion'). Additionally it may be possible to group recommendations
from multiple incidents to help rationalise the flow of resulting actions.
6.2.4 Standards for recommendations
Organisations should have standards or procedures for developing recommendations to

ensure consistency between investigations and effective resulting actions. The following
guidance should be covered:
−− Word the recommendation as a single stand-alone item that includes an explanation
of why it is made (i.e. linkage to a finding).
−− Wording should be free of emotive or judgemental language.
−− Avoid wording that is vague and open to interpretation (see Table 12)9.
−− Ensure that recommendations are not only directed at immediate causes but that
underlying causes and management systems are also addressed (see Table 12).
−− Be clear on who is responsible for a recommendation and which part of the
organisation it applies to.
−− Make the intent clear in the recommendation. It may be best to specify the desired
outcome (e.g. the performance standard for a barrier) and leave it to the organisation
to determine the best actions to achieve that outcome.
−− Avoid wording that can sound authoritarian or overly prescriptive. While a SMART
format is suitable for actions (see 6.3), for other recommendations more latitude can
be allowed so that appropriate actions are developed.
−− Emphasise if there could be broader learning for the organisation/industry from a
recommendation.
8
Extra guidance on handling violations is provided in the Hearts and Minds guidance (Managing rule breaking, The
toolkit)
9
Standards on wording are also applicable for investigation reporting.
70
Table 12: Example recommendation improvements
Findings Poorly directed Better worded Additional

and worded recommendation recommendation
recommendation
Several steps in Rewrite the Conduct a step- Review the
the procedures operating by-step review management system
seem to be procedures. of the reactor for writing and
missing, e.g. charging operating reviewing procedures,
purging, blocking procedures with a ensuring that
in reactant A and multi-disciplinary personnel with the
disconnection. team and update required competence
the procedures as are involved and that
necessary. procedure review
cycles are specified.
Having established organisation-wide standards for recommendations, recipients of

recommendations should enforce these standards and be prepared to send recommendations
back should they not fulfil the standard. Periodic verification of the appropriateness of
recommendations should also be conducted.
One particular problem for organisations can be handling recommendations that are likely
to take a long time to close out. If something is likely to take more than 6-12 months to
implement, the investigation team should consider this carefully and highlight this before it is
entered into a tracking system. Additional guidance identifying how to determine whether the
recommendation is closed-out could be helpful for these long-term issues. An example of this
could be when the investigation has been unable to cover a topic and wants to recommend,
for example, a wider review of task execution competence. Such a recommendation should
be carefully worded so that close-out is possible.
6.3 DERIVATION AND ALLOCATION OF ACTIONS
As noted in 6.2, there should be a formal process for line managers to translate investigation
recommendations into actions to be implemented. This will involve the following:
−− Line management review of the recommendations to ensure that they are understood.
Depending on the level of involvement of line managers in an investigation,
clarifications with the investigation team may be required. Feasibility studies and
safety or HOF analysis may also be needed as described in this section.
−− Translating the recommendations into actions. One recommendation may lead to
multiple actions (e.g. a short-term and a longer-term response). Actions should
be SMART, i.e. (RSSB, Investigation guidance part 3: Practical support for accident
investigators).
−− Specific – a clear description of what is required and who is responsible. Each
action should address one recommendation or issue.10
−− Measurable – so that the level of implementation can be tracked.
−− Attainable – non-attainable recommendations should not be accepted but
challenged.
10
Even if the recommendation is non-specific and addressed at the desired outcome the actions should be clear and
follow the format above.
71
−− Relevant – the action should address the intent of the recommendation, relate
to the circumstances of the incident and be targeted to prevent reoccurrence.
−− Time-bound – timescales for stages and completion will allow monitoring to
closure.
−− Ensuring ownership and agreeing responsibilities and timescales with action owners.
−− Obtaining commitment to allocate the required resources and funding for
implementation of the agreed actions.
In determining the feasibility of recommendations that involve significant changes, it may be

necessary to carry out a safety analysis to check that additional risks are not being introduced
or risks simply transferred elsewhere. This is likely to be covered by an organisation’s
management of change system. In addition, HOF analysis of proposed recommendations
may be required to determine if people may react or adapt to recommended changes in an
unpredicted (and unsafe) manner.
Following an incident, as well as addressing the recommendations for modified or additional

controls, personnel and organisations may also need to unlearn old practices and break past
habits. This may require the development of additional actions or be part of the broader
learning described in section 7.
It should be checked that the derived actions do not duplicate actions that are already in the
system, or that the system is becoming overloaded with unachievable or unnecessary actions.
6.4 ACTION IMPLEMENTATION
6.4.1 Implementation and close out
The tracking of actions is a vital part of the investigation output, as the failure to address
recommendations from previous investigations has been seen as a precursor to many major
accidents. Senior managers should provide oversight of action implementation to ensure that
appropriate resources are made available to match the risks involved. It should be clear when
an action is complete. Specific criteria may be set and information provided to demonstrate
that the criteria have been met. Further criteria and measures should be set to demonstrate
that actions have been effective (see 6.4.2 and section 8).
A number of challenges to closing-out actions appear widespread, as demonstrated in the

following examples:
−− The original recommendation was developed by a person remote from the action
party and the action party does not understand the context. Therefore they do not
'buy in' to the change. This could lead to repeat deferrals of actions or changing
interpretations of actions.
−− The fact that staff may have to do something differently following an incident is not
usually a positive experience. People need to be prepared to accept that what they
believed was 'good practice' may not now be the case. This challenge to people’s
perceptions should be recognised as an issue when planning implementation. It may
require extensive communications before everyone is convinced and implementation
can start.
−− There are likely to be practical problems in implementing changes, e.g. if human
machine interface (HMI) weaknesses have been revealed there will be a need to procure
new equipment, develop new standards, review other sites’ HMIs, etc. all of which
could involve long timescales. Widespread or longer-term actions may be better rolled
up into higher level plans so that they can be appropriately monitored and resourced.
72
−− There can be the belief that closing out investigation actions is the responsibility
of the SHEQ department. Ownership should be established early and the owners
consistently held to account.
Many organisations track overdue items at management meetings; however, this tends
to focus attention on the items that have already gone overdue. Some organisations set
targets of no more than a predefined number of overdue items. A good practice is to provide
management information on items before they go overdue and track close-out in a more
proactive manner.
6.4.2 Follow up
Actions can be framed to be easily closed-out, rather than leading to effective change. Thus,
in order to ensure that implemented actions are effectively addressing the investigation
recommendation, additional controls should be in place:
−− Verification should be required to determine whether the actions continue to be
followed, even when actions have been closed-out in an action tracking system.
−− Periodic reviews should take place to check the effectiveness of the actions. This
can be difficult to achieve in practice. One method could be the use of interviews to
determine how the learning from incidents has been incorporated into practice (also
see method in 8.2).
−− Performance indicators should be set up to monitor the effectiveness of actions and
how well recommendations have been addressed. This is covered in 8.4.
Examples of rationalising the number of recommendations and actions

An oil and gas company reanalysed about 20 serious accidents that had occurred over a
period of three to four years using a barrier based approach. The investigations had collectively
produced hundreds of recommendations. The structured review identified five common
underlying causes and all the recommendations were consolidated into five workstreams.
In another example a steel smelting organisation managed to rationalise a large and
ineffective action register down to just five corrective actions; for each of the five actions,
the organisation developed realistic plans for implementation and closure. In addition, the
organisation asked its investigators when developing future recommendations to determine
ways to measure if the interventions had been successful. The process of thinking about
'how to measure success and failure' is seen as an important part of generating effective
recommendations.
6.5 BLOCKERS AND POTENTIAL ENABLERS FOR EFFECTIVE RECOMMENDATIONS AND

ACTIONS
Table 13 summarises what are judged to be the most significant blockers to effective
recommendations and actions, with potential enablers.
73
Table 13: Blockers to effective recommendations and actions, and potential enablers
Blockers to effective Enablers for recommendations and actions

recommendations and
actions
Recommendations are −− Involve line management in the review of the recommendations
not accepted by line so they understand the context and have the opportunity
management to question the investigation team on the value of the
recommendations.
−− Ask line management to define the recommendations, with
investigators approving them (line managers may be more
motivated to implement resulting actions; but on the downside,
they may be tempted to make recommendations that are easy
to action rather than leading to long-term improvements).
Recommendations are −− Involve frontline personnel in discussing potential risk reducing
not accepted by frontline measures and developing recommendations.
personnel; there can be −− Hold briefing sessions with frontline personnel at which draft
a perception that actions recommendations are presented and discussed.
that come down from
management/investigators
following an investigation
are divorced from
understanding of what is
happening day-to-day
Too many, and −− Prioritise recommendations based on risk assessment.
loosely worded, −− Review the process for creating recommendations to check
recommendations they eliminate the causes of the event while being reasonably
practicable and within the control of the organisation.
−− Give guidance on recommendation wording (ideally provide
examples of good and bad wording).
−− Convert recommendations into SMART actions.
Insufficient weight −− Check that there are recommendations that link to the different
given to underlying causation levels in the failure model.
causes in developing −− Ensure that recommendations are appropriate to the
recommendations relevant human failure type (e.g. if failure was due to a
slip, extra training would probably not be an appropriate
recommendation).
Insufficient checks that −− Check that recommendations are risk proportionate and that
recommendations will they will not inadvertently increase risk (linked to management
effectively reduce risk of change process).
−− Apply logical hierarchies of risk reduction to recommendations.
−− Use review boards and subject matter experts to assess
recommendations.
Backlog of actions build −− Reduce the numbers of recommendations by combining into
up (not just from incident workstreams.
investigations but also −− Proactive management of action close-out, and control of
from audits, safety deferral of actions.
tours, etc.) −− Leadership should allocate sufficient resources to closing-out
actions (particularly priority actions).
−− Audits and follow ups of investigation recommendations.
74
7 BROADER LEARNING
7.1 OVERVIEW
The processes described in the previous sections will lead to changes that reduce the risk of
an incident reoccurring, but those changes will generally be constrained in some way, for
example, being localised within the company or perhaps effective only in the short term. To
ensure sustained effective change, broader learning is necessary.
A phrase that is often used in the context of broader learning is ‘dissemination of lessons’.
However, it should be emphasised that broader learning is not just lesson dissemination;
dissemination is necessary but is not sufficient. Broader learning involves people having
time to reflect, put the information into the context of their own work environment and
make sense of the information disseminated. As a result they are more likely to change their
behaviour and reduce the risk of a similar incident happening. Broader learning (or learning
in general) should result in a measurable change to equipment, behaviours, processes and
management systems, that will prevent repeat, similar or even different incidents.
Broader learning involves:

−− Reaching more people in the organisation who may be affected by the same problems
and risks revealed in the investigation (i.e. a wider geographic or functional reach
within the organisation).
−− Affecting people in the longer term, perhaps long after the memory of the incident
has dissipated.
−− Applying the learning to a broader range of incidents (similar and dissimilar).
−− Learning about the LFI processes themselves as well as incident causation and
prevention.
−− Reaching and influencing people outside the organisation.
The broadening effect of these aspects on LFI is illustrated in Figure 20.
LFI processes enhanced to share information with outside organisations

and learn from their incidents
Organisation applies learnings about LFI processes

(learning to learn)
Organisation applies learnings more widely to

dissimilar events
Organisation embeds changes for

wider workforce and longer term
Those immediately
affected change
effectively in short
term to prevent
reoccurrence
Figure 20: Representation of broader learning
75
To deliver this broader learning the organisation should ensure the steps in Figure 21 are
conducted. Following on from the steps in section 6, organisations affected by an incident
should identify what broader lessons need to be drawn (7.2). These should be effectively
communicated to relevant stakeholders (7.4). But whilst communication is an important
first step, real learning takes place as a result of later steps. Those stakeholders should
receive this information and make sense of it, including putting it into the context of their
own work situation (reflection) (7.5). The affected organisations should then identify and
implement appropriate actions such that changes become embedded and sustained for
the long term (7.6) i.e. a change to equipment, behaviour, processes and management
systems. Part of this broader learning involves reviewing multiple incidents to understand
common underlying causes that are impacting across the business activities; this is further
addressed in section 8 together with blockers and enablers applicable to broader learning.
Broader Learning
Recommendations Receive and Embed and

Identify lessons Communicate Change
and actions make sense sustain
Identify Additional
stakeholders actions
Figure 21: Steps in broader learning
There is a key role for the leadership of an organisation in this stage of LFI. Senior managers
should state and demonstrate that LFI is important, highlight the benefits and make the
necessary resources available to ensure that additional actions are implemented. They should
embed the expectation that the organisation and the personnel have only learnt from an
incident if they are doing something differently.
7.2 IDENTIFYING LESSONS
Following an investigation, two broad strategies to identifying lessons should be used:

1. Top down or expert identification: for example, leadership reviews of investigations
and quarterly reviews of high potential (HiPo) incidents using a cross-disciplinary
team or a learning committee.
2. Participative identification typically involving:
−− Encouraging people to identify for themselves what the lessons are. This involves
reflecting on the event and finding information that is relevant.
−− Coaching activities such as facilitating sessions at which key questions are
discussed: how can something like this happen to us, what is our equivalent to
this?
−− Sessions in which a scenario based on an incident is presented and the team
works through the example. This tests people’s knowledge of their systems.
In identifying lessons, an organisation should be looking at technical issues and behaviours.

Similar behaviours could be relevant in a completely different type of facility or even a different
industry. A hierarchy, such as that described in 6.2.2.2, can assist in the identification of
relevant lessons and potential risk-reducing measures.
76
7.3 IDENTIFYING STAKEHOLDERS
A range of practices can be helpful in identifying stakeholders and determining how best
to communicate with them. In listing potential stakeholders it is important to consider both
those inside, and those external, to the organisation (see examples in Table 14). Once a
comprehensive list of stakeholders has been generated the SHEQ leads for LFI should
document the likely interests of the stakeholders in an incident, potential communication
mechanisms that could be effective and key messages, i.e. what people will take away. This
can be captured in matrices such as Table 14.
Table 14: Illustrative stakeholder identification matrix
Stakeholders Their potential Potential Key messages

Internal = I interests in communications
External = E incident mechanisms
Active = A
Passive =P
Technical Novel ignition Briefing note (P) Review existing
specialists (I) source identified risk assessments
in light of novel
information
Operators (I) Actions and Facilitated session Importance of
decision making involved scenario NTS
of control room building and
operators reflection (A)
Regulators (E) New or emerging Workshop for the Sector (including
risk industry to which regulators) need to
regulators are address this new
invited (A) issue
7.4 METHODS FOR COMMUNICATING LESSONS
7.4.1 Internal communications methods
A wide variety of techniques is currently used to communicate incident lessons within

organisations. In the toolbox illustrated in Figure 22, some can be used in a personal (face-
to-face) situation, others will typically be used to reach personnel remotely and others can
be multi-use. Alongside such routine mechanisms, the use of special events can help provide
regular boosts to the profile of LFI.
The following practices can enhance use of these techniques:

−− Use older incidents to encourage discussions. They do not usually have the
associated political or emotional problems that recent incidents have and may have
enduring lessons that have stood the test of time. The use of older low frequency/
high consequence events can help make use of experience that has led to sustained
changes to companies.
−− Develop a standard template for sharing lessons and communicating with other
operating units. A summary format with space for a picture and text covering
77
causes, corrective actions and lessons learnt can assist the communication process
and creates the expectation that information will be shared. It should be noted that
the use of templates can lead to the LFI process becoming too formulaic, but overall
the advantages usually outweigh this problem.
−− Organise a communication session about a type of hazard and how it could turn into
an incident. This can be valuable and less contentious than focusing on a historic
example.
Personal:
Remote: Toolbox talks
Safety alerts Safety meetings
Monthly bulletins Safety moment
Intranet resources Testimonials
TV screens on site
Blogs
Events:
Seminars
Multi-use: Safety stand-downs
Videos/dramatisation of events
Discussion forums
Figure 22: Toolbox of communication techniques for LFI

−− Consider more innovative methods of presentation. One organisation converted their
monthly bulletin of incidents into a comic that was sent to all the organisation’s sites
around the country. This format was much more attractive for readers. In the UK rail
industry the RSSB produces the magazine Right Track which adopts a story telling,
novelistic style to incident descriptions, which is more engaging than typical safety alerts.
−− Use testimonials with care. The experience of some energy organisations has been
that personal testimonials from those directly involved in an incident have only a
limited short-term impact. However, others have found that they can raise awareness
and be a valuable part of an overall package of improved incident communication. A
two-way dialogue between the audience and personnel involved in an incident will
be more effective than a monologue alone.
As well as the formal techniques discussed above, information about incidents will be
communicated informally between personnel. Such informal learning, especially if between
peers, has the advantage of potentially being more open with less concern about being
blamed. The main limitation of informal learning is that information is often not shared
across a site or between multiple locations. In addition, it does not become embedded into
the relevant management systems.
It can be a challenge to communicate learning at the time when it is most needed, and
to communicate incident information with contractors. Good practices concerning these
challenges are set out as follows:
78
Examples of delivering the learning at the right time

Supervisors have a key role in ensuring that personnel are aware of learnings from past
incidents. They can make use of, and be supported by, the following mechanisms:
1. Tool box talks (TBT) that are specific to the task at hand.
2. Key wording of safety alerts and linking these to the permit to work (PTW) system so that
they are attached to relevant permits that are issued. This is especially useful for infrequent
tasks (reminders about previous incidents are less effective for day-to-day tasks.)
3. Central library system of incidents that can be easily accessed.
Examples of sharing lessons with contractors

The following approaches have been found to be productive in communicating incident
information to contractors:
1. Appoint a buddy manager, accountable for contractor performance, who reviews safety
processes, attends meetings, visits worksites and shares information.
2. Ensure that incident information is passed to contractors. This apparently simple task is not
always done, e.g. due to IT access issues, lack of relevant terminals etc.
3. Provide an intranet site specific to the contracting community.
4. During quarterly performance reviews, include a ‘sharing session’ covering incidents.
5. Specify requirements for incident reporting, investigation and LFI in the contract.
6. Integrate relevant management systems or ensure that contractor systems are of an
equivalent standard.
The approach may vary according to the size of the contractor (e.g. a small contractor may not
be able to invest in substantial new systems).
With all these techniques, it is important not to assume that providing access to information
means that personnel will be actively learning. See 7.4 and 7.5.
7.4.2 External communications methods (including to other industries)
7.4.2.1 Obtaining and using information from external sources

Appropriate contact should be maintained with groups that may provide information on
relevant incidents that have occurred in other parts within the organisation, and those that
have occurred in other organisations. Typically these groups will be organisation committees
and industry associations, together with journalists from trade and safety journals (EI,
Guidance on meeting expectations of EI Process safety management framework Element 19:
Incident reporting and investigation).
In some energy-related industries there are already well established networks and initiatives
for sharing such information:
−− An example of an effective global initiative using operating experience in the nuclear
industry is run by the World Association of Nuclear Operators (WANO). Incident
data are collected and analysed and results communicated in various formats for
operators’ use:
−− Reports covering the principal contributors to significant events and providing
recommendations that members are expected to implement to prevent similar
events at their plants. WANO peer review teams evaluate the effectiveness of
stations’ actions to implement these recommendations.
−− Training presentations to help members communicate the content of incident
reports to their plant staff.
79
−− Specially formatted briefing sheets for use in pre-job briefings to prepare

personnel for specific tasks. The reports highlight relevant industry operating
experience, key lessons learnt and questions to encourage a detailed discussion
of the planned task to ensure thorough work preparation.
−− CEO updates describing important events and trends that utility CEOs are
encouraged to discuss with their nuclear executives and oversight organisation.
−− An example of a national-level initiative is the United Kingdom Petroleum Industry
Association’s (UKPIA), Assuring Safety initiative. A key part of this initiative is sharing
information and learning from this in a collaborative manner. As well as sharing
and learning within the petroleum industry, UKPIA has learnt some very important
lessons from information shared by other sectors. For example, UKPIA has used input
from both the rail and nuclear industries in a study to strengthen human factors
performance (Hazards Forum Newsletter, Issue No. 84).
−− An example of a committee is the G9 Offshore Wind Health and Safety Association,
which is comprised of members of European offshore wind operators. This group
facilitates the sharing of incident data, safety alerts and lessons learned among its
member companies, and produces good practice guidance, via the EI, to common
issues.
For those sectors where such initiatives have not yet begun, additional research may be
required to obtain a useful flow of external events. Fortunately there are many excellent
sources of incident information such as the IChemE’s Loss Prevention Bulletin, the US
Chemical Safety Board (CSB) which has excellent animations and visualisations of incidents,
the CCPS’s Process Safety Beacon, and Step Change in Safety incidents. The G9 Offshore
Wind Health and Safety Association publishes incident information (via the EI) as does Energi
Norge. A register of external bodies and websites should be maintained which has such
valuable incident information. By searching through these sources LFI personnel can identify
what is new and interesting and feed this into the learning process in their organisations.
It is good practice for an organisation to format relevant external incidents in the same
style as their internal incidents. Effectively this can increase the potential for learning by
treating external events as seriously as internal events (Guidance on meeting expectations of
EI Process safety management framework Element 19: Incident reporting and investigation).
7.4.2.2 Sharing information externally

The external channels described in 7.4.2.1 can be used by an organisation to communicate
information about its incidents to the outside world. However, other methods have also been
found to have a significant positive impact as described in the following examples:
80
Examples of other methods of external communications
Industry briefing workshop

There was a fatal accident in the Gulf of Mexico on a rig, operated by contractors, maintained
by other contractors, under the project manager of another contractor. The work permit system
failed and the maintainers were welding onto a supposedly safe line, but this ignited and
caused a connected tank to explode, leading to four fatalities.
Following the investigation the rig owner held a public meeting and invited all in the industry,
especially contractors, to come and learn from this incident. An important lesson for the
welding contractor was the need to revamp its procedures to no longer assume that other
contractors had verified isolations – they needed to verify isolations themselves.
Sharing with regulators

Another potentially effective mechanism for sharing information across an industry is through
discussions with regulators. In December 2012 there was a failure on a jack-up rig while
berthed at a shipyard in Singapore, causing the main hull of the rig to list to one side. This
led to minor worker injuries and a detailed accident investigation. The rig owner carried out
detailed technical briefings to the regulators of three European states to explain to them the
details of the accident (a complex software caused event).
7.5 RECEIVING AND MAKING SENSE OF COMMUNICATED INFORMATION

('REFLECTING', 'CONTEXTUALISING' OR 'SENSE-MAKING')
Although many organisations disseminate large amounts of incident information, less

attention is given to ensuring that this information is received and translated into the desired
changes. Research (Lukic, Littlejohn and Margaryan, 2012) indicates that for change to occur
the opportunity should be provided for individuals to reflect on the incident details, make
sense of what has happened and put it into the context of their own work situation. This
reflection opportunity should ideally incorporate more active forms of learning than, for
example, computer-based training, and whilst reflection can be thought of as a separate
phase in the LFI process, in reality there may be opportunity to conduct reflection (or at least
consider the ways to provide reflecting opportunities) at various points in the LFI process.
A number of relevant principles have been published in a toolkit by the EI (Hearts and Minds
Learning from Incidents):
1. Learning is demonstrated by a change in practice. Therefore we cannot say an
individual has learnt unless we have information that things are being done differently.
2. To change practice employees have to relate knowledge about an incident to their
own work situation (e.g. job role, practices and workplace).
3. People learn by actively engaging with information. Even though an individual has
received incident information, he/she might not have learnt.
4. Some knowledge is written, but much only exists as 'culture'.
5. Some knowledge is difficult to write down and is best learnt on the job through
regular interactions with persons who are respected and trusted.
6. Learning should be two-way. Information should flow from the organisation to the
individual and group knowledge should inform the organisation.
81
These principles of learning can be considered at each stage of the LFI process in order to
help identify where broader learning is possible. For example, section 7 provides guidance
on creating recommendations; clearly it is important to consider a number of the principles
when doing so; for example, how will it be measured that change has taken place and what
type of knowledge are we trying to change (procedures, or cultural knowledge)?
Employees, including managers, should be encouraged to critically examine the learning

points contained in the LFI information, offer input and feedback and consider the relevance
of the learning points and recommendations to their own work.
This phase can sometimes be constrained by the format of the information disseminated.
In order to encourage people to read incident information it can be simplified and the
context removed (e.g. there may not be enough space in a summary report to include all
the important factors that may have influenced how a task was executed). This can then
make it more difficult for people receiving this information to understand why an event has
occurred and draw valid lessons for their own work situation. This reinforces the importance
highlighted in 7.3 of identifying stakeholders as well as lessons early in the process so that
the most appropriate method and format for communicating incident information is chosen.
It may be that one incident is converted into multiple forms of communication (e.g. a short
safety alert to raise awareness, a discussion item for a toolbox talk to cover detail, a technical
note for technical authorities, etc.).
Another consideration is that, by providing a lot of detail about an incident this can
inadvertently make it easy to rationalise the event away as something that does not apply, e.g.
if a plant does not use a catalyst a lesson around confined space entry might be dismissed.
Low information scenarios and broad questions (e.g. 'what hazards are in this confined
space') can be more engaging than ones where all the answers are given.
Active and engaging forms of communication do not necessarily need to be resource

intensive. The following example of how to share learning is from an international oil and
gas company and should not require excessive resources. However, lesson sharing should be
planned for in terms of budget allocation and personal goals, and KPIs used to encourage
appropriate use of active learning sessions.
To further enable active learning it is important that supervisors and others who will be asked
to lead such sessions receive appropriate facilitation skills training. The second example given
here illustrates how one international oil and gas company has developed online training to
give supervisors and managers the skills to facilitate a reflective learning session with their
team.
82
Example of how to share learning (from an international oil and gas company)
The following guidance is given to people (e.g. supervisors, managers) to help them plan and
conduct a learning session.
Planning to share learning

−− What do you want people to learn? Keep key learning points in mind as you design
your learning, and make sure they are relevant to your audience.
−− Ask before telling. Use open questions to prompt thinking and encourage learning.
Encourage people to share their own relevant experience and contributions.
−− Use what/when/where/who/how questions. Beware of ‘why’ questions, which can
lead people to apportion blame to those involved at the expense of focusing on
learning. Instead ask ‘what could have caused those involved to do this’ to reveal
factors which may have influenced the behaviour.
−− Provide enough information for the person leading the conversation to emphasise
the learning points.
−− When documenting, use straightforward, clear language and simple diagrams
where possible.
−− When sharing skills, think about how people can practise to embed what’s been
learnt into their role.
−− Think about how supervisors and line-managers can reinforce and encourage the
application of learning.
−− Structure the conversation as described in Table 15.
Table 15: Structure of conversation
Step Contents Possible questions for the end of

this step
What was Describe the scenario −− What would you do next?
happening? before the incident or event −− What standards apply here?
happened, preferably up to −− How do we manage this?
an important decision point −− What would happen next at our
in the event site?
What happened Describe how the incident or −− Do you have similar examples or
next? event unfolded stories?
−− What should have happened here?
−− Who has had an experience like
this?
Why did this Explain the findings of the −− What are the standards?
happen? investigation −− How do we help people to meet
the standards?
−− What else does this make you think
of?
−− How might we know if this was
about to happen?
83
Table 15: Structure of conversation (continued)
Step Contents Possible questions for the end of

this step
What can we do to Describe one or two ideas −− What else could we do?
follow up? −− What do we need to follow up?
−− What would help us?
−− Who here is going to do something
different?
−− How can we get confidence in our
approach?
−− How are you going to use this?
−− How do we make sure we don’t
forget this?
Summary Summarise the key learning −− How will you talk about this to
points that you established other people?
Example of reflective learning facilitator training

One international oil and gas company has created a 50-minute online training module called
Reflective LFI engagements (made available via the EI). The course aims to provide basic
facilitation skills and instructions on how to run a reflecting session (e.g. during a meeting or
toolbox talk), complete with videos of good and bad examples, information on when and how
to run a session, the types of questions to ask during the session to get the team engaged
(e.g. 'How can something like this happen here?'), and how to conclude the session. It also
contains a short quiz and resources to help someone plan a session. The company plans for
all supervisors, and in time, contractor supervisors, to undergo this training. The intent is that
supervisors will make use of learning alerts and conduct short reflecting sessions, such as
before starting a new or unfamiliar task.
http://heartsandminds.energyinst.org/toolkit/learning-from-incidents2
7.6 EMBEDDING AND SUSTAINING LEARNING IN AN ORGANISATION
7.6.1 Management system improvements
In an ideal world the changes that take place following an incident become embedded in an
organisation so that, even if the personnel most closely associated with the incident leave
the company, the improved practices are sustained. Achieving this ideal is clearly a major
challenge. It is often difficult to detect the influence of incidents on a company after several
years have elapsed.
Applying a risk control hierarchy that addresses plant process, equipment and workplace
environment changes, as well as procedural, supervision and training changes (see 6.2.2) is one
part of achieving long-term changes. In addition, embedding changes into an organisation’s
management systems is an important part of achieving sustained improvements and guarding
against the tendency for loss of corporate memory. Table 16 provides a number of examples
of long-term changes to management systems that could be expected following an incident
and its investigation.
84
Table 16: Using LFI to improve management systems
Management Example changes to embed and sustain improvements

system elements following incidents
Training −− Incorporate lessons from incidents into training, including site
induction.
−− Awareness training for contractors introduced into organisation-
wide programmes (see case study in section 5).
−− Training on NTS (IOGP, Report No. 501).
Risk assessment −− Review and update risk assessments following an incident.
−− Improve the links between LFI and risk assessment, e.g.:
−− During the early stages of an investigation find out if a
relevant risk assessment has been conducted and, if it has,
see if it can throw light on the sequence of events, the way
the system has or has not operated and see whether any
risk-reducing measures proposed by the risk assessment had
been implemented.
−− Ensure that risk assessments take account of past accidents/
incidents that have happened internally to the organisation
(and externally if feasible).
−− Development of hypotheses during investigations should
take account of risk assessment scenarios with similar
characteristics and can use consequence modelling
techniques (e.g. fire and explosion modelling) to inform
hypotheses.
−− Risk assessment methods can be used to evaluate and
prioritise the recommended measures from an investigation.
−− Sharing and exchanging personnel between investigation
and risk assessment teams is beneficial both in terms of
exchange of ideas on use of methodologies as well as
making efficient use of time and resources.
Operating −− Update relevant procedures across the organisation.
procedures −− Record the rationale behind changes to procedures/
instructions (e.g. within the document itself) so that changes
arising from incidents are maintained through heightening
awareness at a direct level.
Safety −− Link LFI to continuous improvement sections of safety reports
documentation and safety cases.
and knowledge −− Develop a database of recommendations and actions following
management incidents and a record of what changes were made, and why,
following incidents.
−− Put in place systematic processes to allow people to ‘pull’
information prior to starting operations, but also for the
company to 'push' relevant information towards relevant
people (e.g. SKYbrary from the aviation industry,
http://www.skybrary.aero).
The examples in Table 16 are relatively specific. In practice, an incident, and the subsequent
LFI process, can reveal potential improvements across many management systems, e.g.
management of change, procurement, human resources, etc. The evaluation phase of LFI
can also reveal potential improvements in the learning process itself (see section 8).
85
7.6.2 Organisational arrangements for learning
Organisational learning in a large company will occur at different levels, for example:
−− A local representative is likely to be responsible for feeding back lessons from an
incident to affected personnel, contractors and other facilities on the site.
−− A corporate/group/regional manager may be responsible for sharing lessons between
different operating units and shaping corporate LFI policies.
Learning from incidents is no different from any other change process that companies go
through, and should be viewed as the same. Too often it is considered the role of the SHEQ
department to develop a separate LFI process. Organisations should take a more holistic view
and look at current information-sharing networks to communicate LFI. A good example is the
Engineering Network in the global airline industry. Engineers working on a particular aircraft
type are in contact with each other, and learning is rapid and effective because it is delivered
by peers, not by a separate SHEQ department.
Typical organisational mechanisms for encouraging learning from incidents include

appointing learning 'leads' and setting up learning forums or networks. Networks and
conferences play an important role as the sharing of information and agreement for actions
can happen in a decentralised way. In addition, organisations should integrate incident/
LFI-related information into a knowledge-management system and look at the potential
benefits of integrating or linking safety management, knowledge management and learning
management systems.
Another good practice in terms of organisational learning is using more experienced

employees, who have experienced LFI, to help revise and extend key procedures, manuals
etc. prior to their release or retirement. Some organisations also make use of retired staff to
assist in reviews of incidents (see 6.2.1).
7.7 CASE STUDIES
7.7.1 Hearts and Minds Learning from incidents tool
The EI has developed a practical toolkit to help organisations conduct broader learning. The
tool is based upon an initial PhD research project (Lukic, Littlejohn and Margaryan, 2012)
conducted at Glasgow Caledonian University, which was followed by a further study and
piloting of the tool at a number of organisations working in the energy and healthcare
sectors.
The tool, which is itself a booklet, contains information about the LFI process, as well as
instructions for running workshop exercises exploring the LFI process as a whole, as well
as exploring individual parts of the process, including conducting workshop sessions to
encourage 'reflection'. The tool also includes a questionnaire and 'hints and tips' – guidance
on how to improve each phase of the LFI process.
Workshop 1: the LFI process
This workshop, which lasts four hours or longer, is meant to be run occasionally (e.g. once
per year) and will involve managers and others responsible for, or heavily involved in, LFI. The
workshop tasks a group of people with identifying and reviewing the organisation’s LFI activities
and mapping these against each phase of the LFI process. The group then conducts a gap
86
analysis to determine where the weaknesses are, such as phases where there are no activities, or
where linkages between activities have been missed. A questionnaire can be distributed within
the organisation to determine how well ‘learning’ occurs at each phase of the process, with the
data used as input into the workshop. Lastly, the group prioritises a number of the problems/
gaps identified and brainstorms solutions and actions to help tackle those problems. The intent
is that the workshop is used as a starting point from which to improve the LFI processes in the
organisation.
Workshop 2, 3 and 4: Engagement exercises
Whereas workshop 1 is aimed more at managerial level, the remaining three workshop
exercises have a more operational focus. Each workshop engages a group of people (for
example frontline workers) with an incident, and focuses on a specific phase of the LFI
process: workshop 2 focuses on creating 'incident alerts', workshop 3 on communication, and
workshop 4 on 'reflection' (which broadly aligns with the identify lessons, communication,
and receive and make sense (and additional actions) steps in Figure 21, respectively).
Workshop 2 tasks a group of participants (perhaps those who were close to an incident) with
reviewing an incident report, understanding what happened and why, and creating a short
'incident alert', along with recommendations, that can then be distributed to relevant people
in the organisation.
Workshop 3 tasks a group of participants with selecting an incident alert (perhaps one
created in workshop 2), reviewing its quality (and in the process getting an understanding of
the incident), and then brainstorming who the alert will be relevant to and what are the best
ways to communicate the incident (i.e. not just through email but other formal and informal
communications mechanisms).
Workshop 4 tasks a group of participants (likely a team and their supervisor) with reviewing
an incident alert that has been communicated in the usual way (perhaps before beginning a
new project). The facilitator (e.g. the supervisor) describes the incident, what happened and
how. The team then discuss how the findings can be applied to their own work, how similar
problems can happen, what barriers are in place (and how effective they are and how they can
fail), what additional protections they will put in place, what processes they will do differently,
and what actions they will take to ensure a similar incident doesn’t happen to them.
87
8 LFI EVALUATION
8.1 OVERVIEW
In this section LFI evaluation is considered at two levels:

−− whether effective learning has occurred following an incident (or group of incidents),
and
−− whether the LFI processes are adequate.
Both types of evaluation require collection and analysis of data (see Figure 23). If effective
learning is deemed not to have taken place following analysis of data, additional actions
should be identified and implemented to further reduce risk. Examples of such evaluation
are provided in 8.2 (following a single incident) and in 8.3. (following multiple incidents).
Collected data can also be used to feed KPIs relating to the LFI processes; this can help identify
potential improvements in the LFI phases described in previous sections (see 8.4). Blockers and
enablers applicable to evaluation are summarised in 8.5.
Evaluation could be seen as a continuous process running through the whole of LFI. For
simplicity it has been shown as one phase; however, the need for evaluation after each of
the steps of LFI should be addressed.
Evaluation
Collect and Monitoring of Evaluate LFI

Change
analyse data safety/learning KPIs performance
Has effective
learning/change
taken place? Yes
No
Additional actions
Figure 23: Evaluation Steps
8.2 DETERMINING WHETHER EFFECTIVE LEARNING HAS OCCURED FOLLOWING AN

INCIDENT
The following activities should be used to help evaluate whether effective learning has
occurred following an incident:
−− Active reviews of whether the investigation has identified underlying causes at
sufficient depth; whether the investigation tells a convincing story and whether the
recommendations are being addressed in a meaningful manner (i.e. not just a 'tick-
box' exercise).
88
−− Information should be sought that an organisation has in fact gone beyond simply
communicating lessons, but has identified and made organisational changes or
technological changes (e.g. fitting sub-sea isolation valves after Piper Alpha). The
issue of whether resource allocation has changed is a particularly salient example.
−− Active measurement of whether learning has occurred via evaluation sessions such
as described in the following example:
Example of how to evaluate organisational learning
Background
Following a serious maritime incident the affected shipping company initiated an investigation
and put in place actions that addressed immediate and system causes (Lardner and Robertson,
2011). Following this, however, the organisation wanted to know how well broader lessons
had been learnt and whether ‘something like this could happen again?’. This need to test
organisational learning led to the development of a scenario-based evaluation technique.
Description of method
The aim was to evaluate how well 20-30 onshore managers in the company had learnt lessons
from the incident. A realistic scenario was devised which contained all the key decision-making
elements of the incident but was disguised by referring to different equipment, operations and
geographic location.
Embedded within the scenario were 12 key decisions and actions which were considered critical
in the original incident’s causation. The scenario was analysed via a series of ‘organisational
capability’ workshops.
Outputs
The table below shows the results from the evaluation. The shaded cells represent incorrect answers
and effectively identify gaps in the organisation’s learning. The results showed that there were still
important gaps despite the traditional means of learning lessons that the company had used.
Table 17: Group scenario responses – shaded cells indicative of gaps in organisational
learning (Lardner and Robertson, 2011)
Persons Critical decisions

1 2 3 4 ... 12
1
2
3
4
...
23
Total correct 18 22 5 0 ... 18
As well as helping to evaluate the organisation’s learning, this method also provided an active
form of learning for the participants.
89
8.3 COLLECTION AND ANALYSIS OF DATA ON MULTIPLE INCIDENTS
Even at the simplest level, collecting information on multiple events can provide powerful
insights into whether learning has taken place. Senior personnel should be able to build up
an accurate overview of events through, for example, quarterly formal reviews of incidents
at one or more sites. Such simple approaches rely on having the right people involved in
the review at the right frequency, rather than access to sophisticated databases. Grouping
incidents with common issues can reveal that a detailed analysis ('deep dive') is required even
though individual events may have been deemed of insufficient severity or risk to prompt an
investigation.
Many organisations and industry bodies have put efforts into developing incident databases.
Some energy stakeholders have raised the caution that there are many 'data graveyards',
where significant effort has gone into developing classification schemes and taxonomies but
without a well-used end product. A comprehensive user-needs-analysis should be carried out
for database design, taking account of all the relevant stakeholders. If an incident database is
primarily designed around the person entering the data this can lead to frustrations for those
wanting to extract information, and if it is mainly designed to produce monthly reports for
managers this does not necessarily promote learning.
Some classification schemes to promote consistent coding of important incident descriptors

and causal factors do appear to be well-used. An example of those factors used by the IOGP
is given in Table 18.
The IOGP database allows causal analysis of subsets of accidents, e.g. one can look at the
dominant causal factors behind land transport accidents. This can help identify patterns of
events and factors that assist identification of additional risk-reducing measures, sometimes
at an industry level.
There are, however, typically limitations to data entry and coding of events. For example, a
review of incidents in the European Commission’s Major Accident Reporting System (MARS,
first established by the EU’s Seveso Directive 82/501/EEC in 1982), illustrated that the
relationships between incident causes and managerial weaknesses are often not registered
in the database (Drupsteen and Guldenmund, 2014). This could either be because these
underlying factors were not identified in the incident investigation, they did not fit into
the designated classification scheme, or they were omitted when the database entries
were made. Where such categorisations are used it is good practice to use clear linkages
to controls and systems that prevent incidents, rather than abstract sounding categories.
90
Table 18: IOGP list of causal factors (SPE/APPEA, Walker and Fraser, 2012)
People (acts) Process (conditions) classifications

The 'people (acts)' causal factors involve Process (conditions) causal factors usually
either the actions of a person or actions involve some type of physical hazard or
which were required but not carried out or organisational aspect outside the control
were incorrectly performed. There are four of the individual. There are four major
main categories, with an additional level classification categories, with an additional
of detail under each. level of detail under each of the major
categories.
Following procedures: Protective systems:
−− Violation intentional (by individual or −− Inadequate/defective guards or
group) protective barriers
−− Violation unintentional (by individual −− Inadequate/defective personal
or group) protective equipment
−− Improper position (in the line of fire) −− Inadequate/defective warning
−− Overexertion or improper position/ systems/safety devices
posture for task −− Inadequate security provisions or
−− Work or motion at improper speed systems
−− Improper lifting or loading Tools, equipment, materials, products:
Use of tools, equipment, materials and −− Inadequate design/specification/
products: management of change
−− Improper use/position of tools/ −− Inadequate/defective tools/
equipment/ materials/products equipment/materials/products
−− Servicing of energised equipment/ −− Inadequate maintenance/inspection/
inadequate energy isolation testing
Use of protective methods: Work place hazards:
−− Failure to warn of hazard −− Congestion, clutter or restricted
motion
−− Inadequate use of safety systems
−− Inadequate surfaces, floors,
−− Personal protective equipment not
walkways or roads
used or used improperly
−− Hazardous atmosphere (explosive/
−− Equipment or materials not secured
toxic/asphyxiant)
−− Disabled or removed guards,
−− Storms or acts of nature
warning systems or safety devices
Organisational:
Inattention/lack of awareness:
−− Inadequate training/competence
−− Improper decision making or lack of
judgement −− Inadequate work standards/
procedures
−− Lack of attention/distracted by other
concerns/stress −− Inadequate hazard identification or
risk assessment
−− Acts of violence
−− Inadequate communication
−− Use of drugs or alcohol
−− Inadequate supervision
−− Fatigue
−− Poor leadership/organisational
culture
−− Failure to report/learn from events
91
As an alternative to trying to code events according to pre-defined taxonomies, free text

describing incidents and associated factors can be entered and then analysed using suitable
tools. This type of analysis appears to be becoming more popular and can reveal useful
insights as illustrated by the following example:
Example of analysis of multiple occupational injury records
A national infrastructure company analysed its extensive database of incidents to determine trends
and patterns. A commercial software for generating 'word clouds' was used as one tool to analyse
free text fields in batches of up to thousands of records. The software counts the occurrence of
words and displays those with a high frequency as larger in the pictorial output. The example
below focussed on manual handling injuries. It helped highlight the relative contribution of back
injuries caused by lifting equipment into and out of vans.
Figure 24: Example of use of word counting analysis
In addition to the example in figure 24 there are other visual ways of presenting information on
multiple events. Categorising and analysing incident data by barriers enable an organisation to
understand the relative strengths of their safeguards (see Figure 25). By drilling down into the
weaker barriers and understanding common causal factors between multiple incidents, analysts
are able to identify and propose additional measures. In addition, by studying barrier successes the
analyst can learn how to sustain their strengths.
92
Preventive Barriers Mitigation Barriers
25
20
15
Failures
Successes
10
Figure 25: Relative strength of barriers
To actually reduce risk, this will involve combining the sorts of data analyses described in this
section with an implementation plan of actions. The example given here illustrates how data
analysis of a large number of accidents helped to identify risk-reducing measures which were
then implemented with impressive life-saving benefits.
93
Example of data analysis to derive life-saving rules

An international oil and gas company analysed several hundred fatal accidents between 1995
and 2006 for causes and measures that could have prevented the fatality. 12 'life-saving' rules
were identified which it was estimated could have prevented up to 75% of historical events
if they had been fully implemented. A global campaign was launched to make all operating
companies and contractors aware of these rules, involving 500 000 people in total. Non-
compliance was taken very seriously and led to thorough incident investigation. The company
tried to learn from all non-compliances so that initiatives were put in place to remove the
causes of the violations, rather than simply focusing on the violation itself. There was strong
commitment from the top of the organisation, and consistent application of the rules. Data
analysis is not the solution on its own; efforts across the whole organisation were required.
These led to a statistically significant reduction in injuries and fatalities with at least 30 lives
saved, from an average of 37 fatal accidents per year between 2000 and 2008 down to six in
2011 (SPE/APPEA, Peuscher and Groeneweg, 2012), with sustained and continually improving
performance over subsequent years.
Figure 26: Shell/IOGP life-saving rules
By analysing trends in multiple incident data, additional insights can be gained into the
effectiveness of post-incident actions. However, care should be taken that statistical significance is
properly accounted for.
Additional good practices related to multiple data analysis include the following:
−− Use information from incident databases to inform incident investigations and add
weight to investigation findings. Such data can show that an incident is not a one-
off. It can also indicate that an organisation has not effectively learnt lessons before.
−− If there is a small amount of data and large numbers of incident categories there
could be few events in each sub-category, and then no discernable pattern. For small
amounts of data, use broader categories to help ensure a statistically significant result.
−− In many cases an organisation may have limited data and statistical confidence will
be low. In such circumstances the best an organisation may be able to do is to
conclude that 'the data suggest that. . .'. However, possible weak signals should not
be dismissed and it may be possible to combine such data with expert judgements
and other evidence.
94
−− When analysing data, apply quality control checks, e.g. have they been collected in
a consistent manner? Reporting levels may change over time or between different
business units. Care should be taken if the data have been collected over an extended
period as the relevant operations or equipment may have changed considerably.
−− Tie in incident data analysis to complementary systems, e.g. staff surveys, to look for
patterns.
−− Apply appropriate language when presenting incident data analyses. Many people,
whether on the front line or on the management board, do not engage with heavily
mathematical language. There is little point presenting all this information if the
decision makers do not understand it.
−− Link such data analyses to risk assessment models (for example bow-tie models) to
help integrate LFI with forward looking risk analysis.
8.4 EVALUATING THE EFFECTIVENESS OF LFI PROCESSES
Similar to how organisations are developing KPIs to measure the effectiveness of overall risk
controls, some organisations are beginning to use measures relating to the quality of LFI
processes.
Table 18 provides illustrative examples (some taken from EI Guidance on meeting expectations
of EI Process safety management framework Element 19: Incident reporting and investigation).
Many of these relate to the effectiveness of LFI processes, for example, the percentage of
actions arising from investigations which are overdue. Others are related to the degree of
learning that has occurred and others to the impact on risk-based measures such as incident
rates or KPIs.
95
Table 18: Example LFI indicators
LFI phase LFI performance indicators

Reporting Reporting rates of near misses (categorised by severity).
Number of field observation reports, e.g. tests of whether personnel are
aware of reporting arrangements.
Number of observed non–compliances with incident reporting
arrangements.
Number of confidentially reported incidents.
Investigation % of incident investigations which have specialist investigators on
teams.
% of incidents which identify immediate causes, PIFs and underlying
causal factors relating to organisational and managerial (O&M) factors.
Incident investigation reports overdue.
Observed non–compliances with incident investigation arrangements.
% of incident investigations which have been peer reviewed.
Recommendations/ % of open incident investigation recommendations or actions overdue.
actions Number of recommendations per incident for a defined severity level
(both excessive or too few recommendations could indicate a problem).
% of recommendations relating to underlying O&M factors.
Broader learning % of active scenario-based training sessions versus plan.
% of incidents which have been converted into safety alerts or training
case studies.
Evaluation % of incidents followed-up after one year.
% of actions checked for effectiveness after one year.
% of incidents where LFI teams performed self-evaluations.
Scores from organisational learning evaluation exercises such as
described in 8.2.
Overall Repeat incidents would be an important indicator of failing to learn
lessons.
Incident rates categorised by severity.
KPIs versus targets (general measures of safety management system
rather than LFI in particular).
As with any evaluation or measurement programme there is the potential for unintended
consequences from the act of making measurements. In the case of LFI, for example,
measuring could lead to the extra reporting of relatively trivial incidents which may overload
the system. Overall reviews of the LFI process should be used to ensure that such problems
are detected and corrected.
As well as evaluating LFI via the performance indicators in Table 18, it is also valuable to
periodically step back and consider whether the overall goal of reducing risk is being delivered
by the LFI system. This may require significant adaptations to the overall LFI framework rather
than minor alterations to one phase.
96
8.5 BLOCKERS AND POTENTIAL ENABLERS FOR BROADER LEARNING AND LFI
EVALUATION
Table 19 summarises what are judged to be the most significant blockers to effective broader
learning and LFI evaluation, along with potential enablers.
Table 19: Blockers to effective broader learning and evaluation and potential enablers
Blockers to effective Enablers for broader learning and evaluation

broader learning and
evaluation
Difficulty in identifying −− Leadership and technical review of investigations to identify
lessons and relevant lessons for wider communication.
stakeholders −− Stakeholder identification: knowing the audience helps identify
what parts of investigation/lessons will be most relevant, and
also provides ideas for modes of communication.
Common methods of −− Make use of interactive sessions: use an incident to develop
sharing lessons are often locally relevant scenarios that can be run as team sessions to
passive and provide over- identify causes and risk-reducing measures.
simplified summaries −− Train supervisors in facilitation skills to run such sessions.
lacking in context −− Do not confuse providing access to incident information with
'learning'.
Investigation report is −− Include a summary that can be readily used and shared.
difficult to understand; it −− Define principles/good practices that help make a report a tool
is a detailed account of for learning, e.g. use of diagrams to show where people were,
the investigation rather photographs of area/equipment, short sentences, keeping
than a concise report on detailed technical language/explanations in an appendix, etc.
what needs to be learnt
Insufficient time or −− Leaders should clearly demonstrate the value placed on LFI and
opportunities to be prepared to allocate sufficient resources.
reflect and make −− Build active learning sessions into schedules of safety meetings
sense of material from and toolbox talks.
investigations
Legal constraints −− Legal team should be engaged early so that they can
on sharing incident understand what is trying to be achieved with LFI and they
information widely can advise on the legal risks. There is then the opportunity to
devise a process that is the best compromise of the competing
concerns.
−− An organisation should have in place a documented and tried
and tested incident response protocol incorporating legal
privilege for internal investigations when appropriate, and
access to legal advice in the event of an incident that is likely to
give rise to criminal proceedings.
−− Focus on hazards rather than specific incidents in the case of
communicating contentious events.
−− Turn lessons learnt quickly into good practice guidance, which
can help others learn but without carrying the same liability
risks.
97
Table 19: Blockers to effective broader learning and evaluation and potential enablers
(continued)
Blockers to effective Enablers for broader learning and evaluation

broader learning and
evaluation
Difficulties in relating −− Make use of these in safety meetings and encourage personnel
to other organisations’ to relate them to their workplace, possibly using the interactive
incidents, especially when session/scenario approach outlined in 7.4.
they are in a different −− Convert external incident alerts into the same format as used
industry for internal events.
Embedding change for the −− Trend incident data over a longer term.
long term can be difficult −− Use LFI-experienced employees prior to their release or
given normal corporate retirement to help revise and extend key procedures, manuals,
memory loss etc.
−− Ensure that the dissemination and communication activities
within broader learning are developed by the organisation into
embedded changes (changed plant, practices, procedures,
capabilities, etc.) that effectively prevent incidents reoccurrence.
−− Ensure that LFI is embedded into change processes in the
management system and that the rationale for the change is
documented and widely understood.
−− Provide links between a past incident and changes, e.g. provide
a reference to that incident in the rewritten procedure.
−− Provide a database of recommendations/actions from incidents
and what changes have occurred.
−− Improve integration and interfaces between safety
management systems and the broader organisational or
industry-wide knowledge management systems.
−− Provide training in past accidents/incidents.
−− Improve the link between risk assessment and LFI (e.g. ensure
that risk assessments take account of past accidents/incidents
that have happened internally and externally).
Difficulty of assessing −− Use active review and evaluation sessions such as described in
whether an organisation 8.2.
has learnt from an −− Develop techniques for analysing multiple incidents so that
incident or a set of patterns and common causal factors can be identified and used
incidents to generate effective risk-reducing measures and to trend risk
over the longer term.
−− Support evaluation sessions and trend analysis with
performance indicators relating to the LFI process and risk
levels.
98
ANNEX A
REFERENCES
American Institute of Chemical Engineers (AIChE) – http://www.aiche.org/

Bridges, W. G. (2000), Get near misses reported, in Process industry incidents: Investigation
protocols, case histories, lessons learned, American Institute of Chemical Engineers, pp
379-400
British Standards Institution (BSi) – http://www.bsigroup.com/

Root cause analysis, Draft BS EN 62740
Center for Chemical Process Safety (CCPS) – http://www.aiche.org/ccps

Guidelines for investigating chemical process incidents, second edition
Confederation of British Industry (CBI) – http://news.cbi.org.uk/

Developing a safety culture, London, U.K.
Process safety beacon, http://www.aiche.org/ccps/resources/process-safety-beacon
(accessed 25 February 2015)
CIRAS Confidential reporting system – http://www.ciras.org.uk/

CIRAS newsletter, Issue 51, May/ June 2014,
http://www.ciras.org.uk/media/144769/pdf.pdf (accessed 25 February 2015)
Energy Institute – http://www.energyinst.org

Guidance on investigating and analysing human and organisational factors aspects of
incidents and accidents (first edition, superseded), Annexes A and B available as a web
link, https://www.energyinst.org/technical/human-and-organisational-factors/human-and-
organisational-factors-incident-accident--invest-analy
Guidance on human factors safety critical task analysis, first edition
Guidance on meeting expectations of EI Process safety management framework Element
19: Incident reporting and investigation, first edition
Guidance on using Tripod Beta in the investigation and analysis of incidents, accidents and
business losses, version 5.01
Hearts and Minds, Learning from incidents, http://www.energyinst.org/heartsandminds
Hearts and Minds, Managing rule breaking, The toolkit,
http://www.energyinst.org/heartsandminds
Global Aviation Network (GAIN)

A roadmap to just culture: enhancing the safety environment,
http://flightsafety.org/files/just_culture.pdf
Hazards Forum – http://hazardsforum.org.uk/

Hazards Forum Newsletter, Issue No. 84, Autumn 2014
99
Health and Safety Executive – http://www.hse.gov.uk/

HSE Core Topic 3: Identifying human failures,
http://www.hse.gov.uk/humanfactors/topics/core3.pdf
HSG245, Investigating accidents and incidents
INDG453, Reporting accidents and incidents at work
International Association of Chemical Engineers (IChemE) –

http://www.icheme.org/
Lardner, R. and Robertson, I., (2011), Towards a deeper level of learning from incidents: Use
of scenarios, IChemE, Hazards XXII, 588-592
Loss prevention bulletin, http://www.icheme.org/lpb (accessed 25 February 2015)
Lukic, D., Littlejohn, A. and Margaryan, A. (2011), Key factors in effective approaches to
learning from safety incidents in the workplace, Hazards XXII, IChemE, Symposium Series
No. 156
International Association of Oil and Gas Producers (IOGP) – http://www.iogp.org/

Report 210, Guidelines for the development and application of health, safety and
environmental management systems
Report No. 435, A guide to selecting appropriate tools to improve HSE culture
Report No. 501, Crew resource management for well operations teams
Report No. 510, Operating management system framework
Rail Safety and Standards Board (RSSB) – http://www.rssb.co.uk

Investigation guidance - Part 2: Development of policy and management arrangements
Investigation guidance part 3: Practical support for accident investigators
Society of Petroleum Engineers (SPE) – http://www.spe.org/

Peuscher, W. and Groeneweg, J. (2012), A big oil company’s approach to significantly
reduce fatal incidents, SPE/APPEA international conference on HSE in oil and gas
exploration and production, Perth Australia, 11-13 September 2012
The human factor: Process safety and culture, SPE Technical Report March 2014
Walker, K., Poore, W. and Fraser, S. (2012), Improving the opportunity for learning from
industry safety data, SPE/APPEA international conference on HSE in oil and gas exploration
and production, Perth Australia, 11-13 September 2012
Step Change in Safety – https://www.stepchangeinsafety.net/

Step Change in Safety website,
https://www.stepchangeinsafety.net/safer-conversations/safety-alerts (accessed 25 February
2015)
United Kingdom Petroleum Industry Association (UKPIA) – http://www.ukpia.com/

home.aspx
Assuring safety initiative,
http://www.ukpia.com/process-safety.aspx (accessed 25 February 2015)
100
US Chemical Safety Board (CBS) – http://www.csb.gov/

CSB website, http://www.csb.gov/ (accessed 25 February 2015)
World Association of Nuclear Operators (WANO) – http://www.wano.info/en-gb

WANO website: http://www.wano.info/en-gb/programmes/operatingexperience (accessed
25 February 2015)
Various
Basacik, D. and Gibson, H. (in press), Where is the platform? Wrong side door release
at stations, In Sharples, S., Shorrock, S. and Waterson, P. Contemporary ergonomics and
human factors 2015, Proceedings of the international conference on ergonomics and
human factors 2015, Daventry, Northamptonshire, UK, 13-16 April 2015, London: Taylor
and Francis
Drupsteen, L. and Guldenmund, F.W. (2014), What is learning? A review of safety literature
on learning from incidents, Journal of Contingencies and Crisis Management, 22 (2), pp
81-96
Drupsteen, L. and Hasle, P. (2014), Why do organizations not learn from incidents?
Bottlenecks, causes and conditions for a failure to effectively learn, Accident analysis and
prevention 72 (2014) 351-358
Drupsteen, L., Groeneweg, J., Zwetsloot, G. (2013), Critical steps in learning from incidents:
Using learning potential in the process from reporting an incident to accident prevention,
International journal of occupational safety and ergonomics (JOSE) 2013, Vol. 19, No. 1,
63–77
Lukic, D. (2013), Learning from incidents: A social approach to reducing incidents in the
workplace, Doctoral dissertation, Glasgow Caledonian University, UK
Lukic, D., Littlejohn, A. and Margaryan, A. (2012), A framework for learning from incidents
in the workplace, Safety Science 50 (2012) pp 950-957
Shorrock, S.T. and Hughes, G. (2001), Let’s get real: How to assess human error in practice,
IBC Human Error Techniques Seminar
101
ANNEX B
GLOSSARY OF TERMS, ABBREVIATIONS AND ACRONYMS
B.1 ABBREVIATIONS AND ACRONYMS
AAIB Aircraft Accident Investigation Board

ALARP as low as is reasonably practicable
APS atmospheric pipe still
BSI British Standards Institution
CAPEX capital expenditure
CBA cost benefit analysis
CCPS Center for Chemical Process Safety
CEO chief executive officer
CF causal factor
CIRAS Confidential Reporting for Safety
CSB (US) Chemical Safety Board
EBS emergency breathing system
EI Energy Institute
EU European Union
FAI first aid injury
FRAM functional resonance analysis method
HAZOP hazard and operability study
HCR hydrocarbon release (database)
HiPo high potential (incident)
HMI human machine interface
H(O)F human (and organisational) factors
HOFCOM EI Human and Organisational Factors Committee
HQ headquarters
HSE UK Health and Safety Executive
I incidents
ICAO International Civil Aviation Organization
IChemE Institute of Chemical Engineers
IOGP International Association of Oil and Gas Producers
IT information technology
KPI key performance indicator
LFI learning from incidents
LFMA learning from major accidents
LOC loss of containment
LTI lost time injury
MA(H) major accident (hazard)
MARS major accident reporting system
MTI medical treatment injury
NA not applicable
NTS non-technical skills
O&M organisational and managerial (factors)
OMS operating management system
PIF performance influencing factor
PPE personal protective equipment
PSF performance shaping factor
102
PSM process safety management

PTW permit to work
QA quality assurance
RIDDOR Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
RSSB Rail Safety and Standards Board
RWI restricted work injury
SCAT systematic cause analysis technique (superseded by barrier (B) - SCAT)
SHE(Q) safety, health, environment (quality)
SI serious incident
SMART specific, measurable, attainable, relevant, time-bound
SOP standard operating procedure
SPE Society of Petroleum Engineers
SSIV subsea isolation valve
STAMP systems theoretic accident modelling and processes model
STEP sequentially timed events plotting
STF Stichting Tripod Foundation
TBT tool box talk
TOR terms of reference
UKPIA UK Petroleum Industry Association
VSI very serious incident
WANO World Association of Nuclear Operators
B.2 TERMS
accident Any unplanned event that actually results in some unwanted

effect to people, the environment, assets, reputation or other
business objective.
barrier Any risk management measure which reduces the probability
of a hazard being realised or reduces its consequences. Also
known as control or defence.
event An unplanned and unwanted happening involving the
potential for harm or damage.
hazard Anything with the potential for human injury or adverse
health, damage to assets or environmental impact. See risk
and risk assessment.
human error System failures attributable to people but not including
violations.
human failure A term used to collectively refer to both errors and violations.
human-machine system A system in which technology and human beings have
specific functions but work together towards common goals.
immediate cause (of an An action or omission by a person, or group of people, that
incident) causes a barrier to fail. An immediate cause occurs close to
the failed barrier in time, space or causal relationship and
negates the barrier.
incident An event, or chain of events, which cause, or could have
caused injury, illness and or damage (loss), e.g. to people,
assets, the environment, a business or third parties.
103
lapse When a person forgets to do something due to a failure of

attention/concentration or memory.
legal privilege Relates to protection that may be applied to the disclosure
of communications between a professional legal adviser (a
solicitor, barrister or attorney) and their clients.
major accident hazard Hazards with the potential for major accident consequences,
e.g. ship collisions, dropped objects, helicopter crashes
as well as process safety hazards. Major accidents are
potentially catastrophic and can result in multiple injuries
and fatalities, as well as substantial economic, property, and
environmental damage.
mistake (synonymous with When a person does what they meant to do, but should
cognitive error) have done something else. This is not necessarily a violation
but part of the action taken could involve rule-breaking or
similar non-compliances.
near miss An event, or chain of events, which could have caused
injury, illness and or damage (loss), e.g. to people, assets, the
environment, a business or third parties.
non-compliance See violation. Also called non-conformance.
performance influencing factor The detrimental influences on people, and their resulting
(PIF) state of mind, that increase their likelihood of inadequate
performance. Also termed performance shaping factor (PSF)
or precondition.
risk The level of risk is determined from a combination of the
likelihood of a specific undesirable event occurring and
the severity of the consequences (i.e. how often is it likely
to happen, how many people could be affected and how
bad would the likely injuries or ill health effects be?). The
likelihood of human injury or adverse health, damage to
assets or environmental impact from a specified hazard. Note
that other risk definitions include a reference to the severity
of the consequences – injury, damage etc. See hazard and
risk assessment.
risk assessment The process of assessing the risk of exposure to a particular
hazard in a specified activity. See hazard and risk.
safety critical system Any part of an installation whose failure could contribute
substantially to a major accident or whose purpose is to
prevent or limit the effects of such accidents.
slip When a person does something but not what they meant to
do.
underlying cause (of an The organisational deficiency or anomaly creating the PIF
incident) that caused or influenced the commission of an immediate
cause.
104
violation (synonymous with A type of human failure when a person decided to act
circumvention) without complying with a known rule, procedure or good
practice. The word may have connotations of wrongdoing
and alternatives such as non-compliance or circumvention
are also used.
Note: organisations differ widely in their use of some of these terms, for example, the words
'incident' and 'accident' are often used to mean the same type of event. In this publication (for
brevity), where the word 'incident' is used on its own, unless otherwise stated, it should be taken
to refer to an incident or an accident.
105
ANNEX C
PERFORMANCE INFLUENCING FACTORS
Table C.1: Performance influencing factors (adapted from HSE Core Topic 3:
Identifying human failures)
Job factors
−− Clarity of signs, signals, instructions and other information
−− System/equipment interface (labelling, alarms, error avoidance/ tolerance)
−− Difficulty/complexity of task
−− Routine or unusual task
−− Divided attention
−− Procedures inadequate or inappropriate or unavailable
−− Preparation for task (e.g. permits, risk assessments, checking)
−− Time available/required
−− Tools appropriate for task
−− Communication, with colleagues, supervision, contractor, other
−− Working environment (noise, heat, space, lighting, ventilation)
Person factors
−− Physical capability and condition
−− Fatigue (acute from temporary situation, or chronic)
−− Stress/morale
−− Work overload/ underload
−− Competence to deal with circumstances
−− Motivation vs. other priorities
Organisation factors
−− Work pressures e.g. production vs. safety
−− Level and nature of supervision / leadership
−− Communication
−− Staffing levels
−− Peer pressure
−− Clarity of roles and responsibilities
−− Consequences of failure to follow rules/procedures
−− Effectiveness of organisational learning (learning from experiences)
−− Organisational or safety culture, e.g. 'everyone breaks the rules'
−− Change management
106
This publication has been produced as a result of
work carried out within the Technical Team of the
Energy Institute (EI), funded by the EI’s Technical
Partners and other stakeholders. The EI’s Technical
Work Programme provides industry with cost
effective, value adding knowledge on key current
and future issues affecting those operating in the
Energy Institute energy sector, both in the UK and beyond.
61 New Cavendish Street
London W1G 7AR, UK
t: +44 (0) 20 7467 7100
f: +44 (0) 20 7255 1472
e: pubs@energyinst.org
www.energyinst.org
9780852939239
ISBN 978 0 85293 923 9

Registered Charity Number: 1097899

LFI JKPDF

Uploaded by

Copyright:

Available Formats

LFI JKPDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LFI JKPDF

Uploaded by

Copyright:

Available Formats

Learning from incidents, accidents and events

LEARNING FROM INCIDENTS, ACCIDENTS AND EVENTS

The EI is licensed by:

For further information, please visit http://www.energyinst.org

BP Exploration Operating Co Ltd RWE npower

Copyright © 2016 by the Energy Institute, London.

ISBN 978 0 85293 923 9

Published by the Energy Institute

2Overview of incident causation and LFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3Reporting and prioritisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4Investigation: Fact finding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

6 Recommendations and actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Annex B Glossary of terms, abbreviations and acronyms . . . . . . . . . . . . . . . . . . . . . . . 102

Annex C Performance influencing factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

The main objectives of this publication are to:

Tony Atkinson ABB

During this work, STF members included:

Sally Martin (Chair) Shell International

Martin Ball Independent consultant

Chris Langer CIRAS

Affiliations are correct at the time of contribution.

I.1 OVERVIEW OF LFI

Identification of potential improvements in each LFI step

Figure I.1: LFI process model

Table I.1 Blockers to learning

LFI phase Blockers

Table I.1 Blockers to learning (continued)

LFI phase Blockers

1.2 WHAT IS LFI

In this publication, LFI is understood to be a process whereby employees and organisations

Following a significant incident, organisations produce a range of responses, suggesting that

Bullets a - d could be seen as representing a range of learning potential. It would be expected

1.3 THE BENEFITS OF LFI

LFMA Major accident

Multiple opportunities for learning and

Figure 1: Benefits of LFI

Although a well-working LFI process should ultimately represent a cost-effective approach,

1.4 OBJECTIVES AND SCOPE OF GUIDANCE

The main objectives of this publication are to:

1.5 BASIS FOR GUIDANCE

1.6 POTENTIAL USERS OF THIS PUBLICATION

−− those involved in long-term knowledge management (e.g. designers of incident

2 OVERVIEW OF INCIDENT CAUSATION AND LFI

2.2 INCIDENT CAUSATION MODEL

Figure 2: Incident causation model

If the barrier is ineffective, then an incident ensues.

2.2.2 Immediate causes

2.2.3 Performance influencing factors (PIFs)

2.2.4 Underlying causes

2.2.5 Differences in terminology and models

2.2.6 Drilling down

−− Immediate cause: operator opens wrong valve.

2.3 LFI PROCESS MODEL

information with them. Following broader communication, systematic actions

Figure 3: LFI process model

2.3.1 Feedback loops

2.4 INDIVIDUAL AND ORGANISATIONAL LEARNING

Whilst organisations are made up of individuals, individual learning and organisational

2.4.1 Individual learning