Latest / Safe As Podcast / E36: How audits fail prior to major accidents

Transcript

E36: How audits fail prior to major accidents · Safe As Podcast

• 0:06
  Are your audits more machinery of comfort seeking than problem
• 0:09
  sensing? We trust them to find problems.
• 0:13
  But what if our audits are fueling a false sense of safety,
• 0:16
  reinforcing a dangerous, all is well assumption?
• 0:20
  Good day everyone. I'm Ben Hutchinson and This is
• 0:22
  Safe as a podcast dedicated to the thrifty analysis of safety,
• 0:27
  risk and performance research. Visit safetyinsights.org for
• 0:31
  more research. So shameless self promotion
• 0:35
  alert. But this is another one of my
• 0:36
  studies Co authored with Drew Ray and Sydney Decker titled How
• 0:41
  audits fail according to accident investigations account
• 0:45
  of factual logic analysis 2024 in process safety progress.
• 0:51
  The study addresses what we saw as a critical gap in
• 0:54
  understanding the performance of safety auditing, particularly
• 0:57
  after major accidents where investigations often cite a lack
• 1:02
  of audit quality. We sought to clarify what even
• 1:05
  constitutes a good quality audit versus a poor quality one, in
• 1:08
  hindsight, of course. So the research was driven by
• 1:12
  three core questions. What do major investigators
• 1:15
  expect from effective audits? What contributing role have
• 1:19
  audits played in failing to adequately warn organisations of
• 1:23
  emerging danger before that accident?
• 1:25
  And what role does counterfactual reasoning play in
• 1:27
  the construction of investigation reports?
• 1:30
  We systematically identified and evaluated major accident reports
• 1:35
  that were available online and they needed to have mentioned
• 1:39
  auditing or had some sort of link to auditing. 44 major
• 1:42
  accident reports met the inclusion criteria.
• 1:46
  What do we mean by these counterfactual logics?
• 1:48
  Well, these are statements within investigation reports
• 1:51
  about alternate realities that did not occur.
• 1:54
  For instance, when they use language like could have, should
• 1:57
  have, then they're referring to counterfactuals, things that
• 2:01
  didn't happen but in their views should have happened.
• 2:04
  By examining counterfactuals, we tried to reveal sort of the
• 2:07
  idolised model of how the investigators believe audits
• 2:10
  should function, what we term the counterfactual audit.
• 2:15
  So what did we find? The study revealed 9 distinct
• 2:18
  types of counterfactual auditing failures, which was
• 2:21
  systematically grouped into 4 overarching categories.
• 2:25
  The first one audits involved fairly to understand.
• 2:29
  So what we mean is audits seem to have lacked the necessary
• 2:32
  personnel with skills and knowledge or expertise that
• 2:35
  might have helped uncover this type of hazard exposure.
• 2:39
  Investigators expected audits to involve these skilled personnel.
• 2:43
  For instance, 1 audit prior to the Husky Superior refinery
• 2:46
  accident noted internal audits lack of subject matter expert,
• 2:50
  which investigators believe led to a critical gap in the
• 2:53
  shutdown procedures being missed.
• 2:56
  The Poker Alpha inquiry also highlighted that inspectors
• 2:59
  sometimes lacked the expertise to thoroughly audit specialised
• 3:03
  systems like the Permit to Work system.
• 3:06
  Another counterfactual was that audits identified a hazard or
• 3:09
  issue, but its relevance or severity was misinterpreted.
• 3:13
  Again, always in hindsight, the expectation here is that audits
• 3:16
  accurately interpret hazards. In the Imperial sugar dust
• 3:20
  explosion, an audit identified sugar dust accumulation but
• 3:24
  interpreted it as purely a food quality issue rather than a
• 3:27
  combustible hazard. Before the West Pharmaceutical
• 3:30
  Services dust explosion, an insurance audit noted dust on
• 3:34
  fire sprinkler heads, but also didn't assess its
• 3:37
  combustibility. Another counterfactual was
• 3:40
  audits involved a fairly to act, so some issues that were relayed
• 3:44
  by audits weren't properly acted on or managed.
• 3:48
  So audits were expected to ensure issues that were
• 3:51
  identified were also addressed into the follow up period.
• 3:55
  For instance, an audit prior to the Prudeo Bay oil spill
• 3:58
  reaffirmed concerns about pipeline corrosion, but this
• 4:02
  didn't result in a revamp of the control systems at Macondo.
• 4:06
  Some issues relating to the blowout preventer that were
• 4:09
  marked down as being resolved were later found to have re
• 4:13
  deteriorated. Another subcategory was
• 4:17
  inadequate action taken on improvement opportunities when
• 4:20
  in hindsight a different response should have been taken.
• 4:24
  This means that audits were expected to result in clear
• 4:28
  actionable responses. At the AL DuPont facility, a non
• 4:32
  compliant hose was designated simply as an observation, a
• 4:36
  suggestion to improve rather than requiring mandatory
• 4:39
  remedial action, meaning ultimately no action plan was
• 4:44
  needed. Another counterfactual category
• 4:47
  was that audits involved a failure to manage.
• 4:50
  This included a misuse or lack of clarity on the purpose and
• 4:55
  scope of audits. Audits were envisioned to have
• 4:58
  clear purposes and functions, but Texas City, an over emphasis
• 5:02
  on audits as the primary driver of continuous improvement
• 5:05
  hindered the development of a broader reduction system.
• 5:09
  What they mean is instead of the overarching logics and practises
• 5:15
  and systems trying to drive down risk, the organisation relied on
• 5:19
  the external audits to do that task, which the audits couldn't
• 5:22
  do. Another subcategory was a
• 5:24
  general failure to establish an effective auditing programme.
• 5:29
  This one's pretty straightforward, it's what you
• 5:31
  would expect. There was an expectation that
• 5:33
  organisations would have a very specific targeted or systematic
• 5:38
  audit programme in place, but it wasn't.
• 5:41
  So let's move on. And another key counterfactual
• 5:44
  category involved audits that failed to focus.
• 5:48
  What we mean is audits like focus on critical components.
• 5:52
  This was the largest category of failure types that we found in
• 5:56
  this study, suggesting that the ideal audit should pay more
• 5:59
  acute attention to major hazards and operational practises.
• 6:04
  So some specific hazards like lockout tag out procedures at
• 6:07
  the Tosco refinery or issues with PVC resin processing at the
• 6:11
  Formosa Plastics facility were reportedly missed by audits.
• 6:16
  In some cases, audits focused too strictly on meeting
• 6:20
  regulatory compliance, thereby missing opportunities to reduce
• 6:23
  risk beyond the basic levels required by the regulations.
• 6:28
  Another subtype was that audits focused on service compliance.
• 6:32
  This meant audits appraised safety issues very
• 6:34
  superficially, often fixating on documents rather than
• 6:39
  operational functioning of those systems.
• 6:41
  For instance, audits before the Bunsfield Depot fire were
• 6:45
  criticised for prioritising documented artefacts, you know,
• 6:49
  like registers and things and the presence of systems, you
• 6:52
  know, they, they're physically present over their actual
• 6:55
  operational effectiveness. So they looked to check that the
• 6:58
  system was there, it was documented somewhere, but not so
• 7:01
  much how they actually functioned.
• 7:04
  Similarly, audits at the Texas City facility were criticised
• 7:08
  for insufficiently addressing actual worker practises like
• 7:12
  startup procedures. Another subtype was that audits
• 7:16
  failed to identify deficiencies but reinforced a positive view.
• 7:20
  They failed silently. This, in my view, is the most
• 7:23
  interesting and novel finding of this study is that the idealised
• 7:27
  model suggests that audits should fail loudly.
• 7:31
  They should provide clear cues that they're not effective or
• 7:34
  have missed critical hazards or whatnot.
• 7:37
  However, at the Longford gas plant, a prior audit praised the
• 7:41
  plant's safety management system as being the highest level,
• 7:44
  failing to convey bad news, even though the system was later
• 7:48
  after the fact, of course criticises needlessly intricate
• 7:52
  and divorce from operations. What this means is that whereas
• 7:56
  there was some real significant issues with the applied safety
• 7:59
  management system, the auditors gave them glowing praise.
• 8:04
  So this problem of failing silently leads to an all is well
• 8:07
  assumption like a Piper Alpha, which had an absence of critical
• 8:11
  feedback like with their perimeter work system.
• 8:15
  Audits and inspections of the perimeter work system existed,
• 8:18
  but they just weren't configured to find particular problems with
• 8:21
  them, which turned out to be really relevant after the fact.
• 8:25
  And this sort of relates to this idea of where audit programmes
• 8:28
  being entirely absent or incomplete or unable to identify
• 8:33
  particular issues. They're what we can call fantasy
• 8:36
  plans, which was named by the sociologist Lee Clark.
• 8:39
  These fantasy plans provide unrealistic assumptions that
• 8:42
  foster false assurance. They make us feel safe because
• 8:45
  we've put a very authoritative, systematic looking process, but
• 8:50
  they're not coupled to actually managing those issues very well
• 8:53
  in reality. So what are some implications?
• 8:56
  These findings lead to several important insights around how
• 8:59
  audits can inadvertently conceal or even normalise major risks.
• 9:04
  Our findings point out that audits often over prioritise the
• 9:07
  collection of documents, and the mere presence of those documents
• 9:11
  comes at the expense of probing actual system functionality.
• 9:16
  We confuse the process existing with the process actually
• 9:19
  working. This creates a gap between
• 9:22
  workers imagined, which is how work is assumed to be done or
• 9:25
  work is prescribed how the system says work should be done
• 9:29
  versus importantly work is done. This is how work actually
• 9:33
  unfolds every day with real world constraints.
• 9:37
  When orders confuse document management with issue
• 9:39
  management, they can act as a symbolic masquerade activity
• 9:44
  where serious issues go unaddressed despite an
• 9:46
  appearance of being effective. Furthermore, audits can
• 9:50
  reinforce a positive view because they fail slightly.
• 9:53
  Instead of alerting organisations to risks or an
• 9:56
  ineffective auditing programme, some audits provide minimal
• 10:00
  indication that they are not effective or they have a real
• 10:03
  pathological effect and give glowing praise for things that
• 10:07
  aren't functioning as expected. This can lead to what Drew Ray
• 10:10
  is called probative blindness, where subjective confidence in
• 10:13
  our risk control systems become disconnected from operational
• 10:17
  risk and practises. We feel safer than we really
• 10:20
  tangibly are. So this idea in combination with
• 10:25
  the idea of fantasy plans generate an unrealistic
• 10:28
  assumption about effective audit programmes.
• 10:30
  They foster a false assurance that critical hazards are
• 10:33
  identified and controlled because we have a real sexy,
• 10:37
  systematic scientific looking process, even when that
• 10:40
  programme or process is absent or ineffective.
• 10:43
  Finally, our findings suggest that audits can inadvertently
• 10:47
  reconceptualize hazardous conditions into less concerning
• 10:50
  ones. This happened in Imperial Sugar,
• 10:53
  where combustible dust was downgraded to be more of a food
• 10:56
  quality issue, not a combustible safety hazard.
• 11:00
  This illustrates an interpretive failure where audits can
• 11:03
  perpetuate a perception of adequate or reasonable systems,
• 11:07
  even when substantial risks remain.
• 11:10
  In essence, audits can promote unwarranted confidence in our
• 11:13
  risk approaches, where safety documents and artefacts are
• 11:17
  symbolically powerful yet functionally weak, bolstering
• 11:21
  belief in safety in our control systems without providing a
• 11:24
  strong link to hazardous operations.
• 11:28
  So, limitations. The main one is, of course it's
• 11:31
  all based on hindsight and outcome knowledge, and it's far
• 11:35
  easier once we know what happened to trace backwards to
• 11:37
  create a plausible rather than necessarily accurate telling of
• 11:41
  the story. Also, this was based on a second
• 11:45
  order analysis of investigation reports.
• 11:48
  What we mean is even the investigators weren't there
• 11:51
  before the accident, so they're trying to reconstruct a
• 11:55
  plausible explanation based on testimonies and data, and then
• 11:58
  you've got a group of researchers taking their
• 12:00
  construction and reconstructing it.
• 12:02
  Also, it's based on counterfactuals, idolise
• 12:05
  statements or beliefs from the investigators on what a good
• 12:08
  audit or system should look like.
• 12:10
  In any case, what can we make of the findings?
• 12:13
  Audits may not consistently serve as robust indicators of
• 12:17
  weak signals or early warning signs of danger.
• 12:20
  Therefore, instead of simply being tools for problem solving,
• 12:24
  paraphrasing Dixon Woods, they can sometimes become the
• 12:27
  machinery of comfort seeking. We need to critically evaluate
• 12:31
  our audits against our own expectations.
• 12:33
  Are they doing what we think they are?
• 12:36
  Could they ever do what we expect from them?
• 12:38
  Are they configured and resourced to identify major
• 12:42
  hazards or barrier effectiveness?
• 12:44
  Real work? Degraded operating modes?
• 12:47
  Actual competencies? Risk awareness?
• 12:50
  Whatever it is, Do we have any way to monitor their
• 12:53
  performance? How do we know that they're
• 12:56
  working or not working? Are your audits failing silently
• 13:00
  and how would you know? That's it on Safe as I'm Ben
• 13:04
  Hutchinson, please help share, rate and review, and check out
• 13:09
  safetyinsights.org for more research.
• 13:12
  Finally, feel free to support Safe AS by shouting a coffee
• 13:16
  link in the show notes.