Study after study has been conducted on safety management without ever engaging critically with the term safety or examining how it became one with the science of management. Producing comprehensive accounts of all ‘unharmed’ and ‘uninjured’ events is mundane and resource-intensive. Instead, the alternative approach is to examine harm and injuries both potential and actual. What we get is ‘unsafety management’. If we regard management as a question of measure and control in order to allocate material and manpower, it follows that managing safety is a question of measuring and controlling unsafe events. But this approach has become problematic at all levels, from board room to engine room.
Mixed messages
In April 2010, the fire and explosion onboard the Deepwater Horizon killed 11 people and resulted in the most significant oil spill in the history of the United States. The investigation brought to light a number of organisational factors, of which the role of senior management in motivating the employees was considered of extreme importance.
Senior management ambitiously promotes a ‘zero accident’ culture to its employees through policy statements. This is not a moral or ethical stance; it is the result of intense market competition and insatiable customer demands. A company that experiences and reports accidents is regarded as ‘unsafe’ and stands much less chance of acquiring further business. Accidents are undesirable for reputational reasons: the positive contribution that maritime transport makes to global economy is far less conspicuous than the negative attention it draws following an accident. So the message from the boardroom is clear – no accidents please!
What is more, along with the utopia of ‘zero accidents’ comes ‘zero defects’ and ‘zero off-hires’. The intentions are good of course – but intentions become company targets, company targets are internalised in every individual employee’s appraisal and all this results in mixed messages. ‘Maintain safe speed – but don’t arrive late’ or ‘Safety first – you know what I mean!’ [Editor’s note; see ‘Don’t sweep safety under the carpet’ Seaways, May 2015 for further discussion of this problem.]
Measuring safety
We are often told that that which cannot be measured cannot be managed. The problem with safety is not how it is managed but instead how it is measured. In general, the role of company safety departments is twofold. They are expected to ensure compliance with rules, regulations and company procedures, and at the same time to manage reporting and analysis of occupational (but not technical) health and safety issues. This is reflected all too often in recruitment adverts and job descriptions for HSEQ personnel. This confusion between quality and occupational safety, and the divorce of occupational safety from technical safety can lead to issues in both measuring and managing safety.
Occupational health and safety (OHS) indicators
OHSAS 18001 defines occupational health and safety as ‘All of the factors and conditions that affect or could affect the health and safety in the workplace’. In practice, OHS is measured in terms of ill health, minor incidents, and incidents resulting in restricted work with more serious occurrences recorded as lost time incidents. Events of this type are frequent, which allows companies to study patterns and trends in establishing safety. The world of statistics thrives on input and vessels are encouraged to report every single incident experienced onboard. But if the safety departments are not adequately resourced to deal with these reports, the quality and thoroughness of analysis is compromised. Several studies have found that the number of incidents reported is not always a genuine reflection of safety.
In addition, there is a degree of misrepresentation in reporting incidents. For a company operating a handful of vessels leased by a reputable charterer, a serious incident might mean closing down business and declaring bankruptcy. For a Master it would mean endless queries from every possible stakeholder and ‘gruesome paperwork’. But pragmatic problems can also be met with pragmatic solutions. And this is simple on a vessel which is mobile, and far away from ‘head office’. Simply report incidents selectively – depending on whether the severity of the incident makes it impossible not to report, or whether the consequences of the incident are not worthy of the attention and ‘paperwork’ they demand. How else is it possible for a vessel manned by minimum crews stretched to the limit, operating in harsh weather conditions and tight port schedules to maintain 300 days free of lost time incidents (LTI)? And if this is not enough, consecutive years are expected to demonstrate continuous improvements in LTIs.
OHSA and technical safety
The methodology for establishing trends in high frequency incidents is based on examining reactive indicators (or lagging indicators) that could lead to serious accidents. This methodology was first established by Herbert Heinrich in the year 1931. According to Heinrich, most accidents in the workplace shared a common root cause, and major injuries could be prevented by understanding and addressing the common root causes generally linked with workers’ behaviour. For every accident that caused a major injury, Heinrich found there were 29 accidents that caused minor injuries and 300 accidents that caused no injury at all. Contemporary literature uses terms such as minor injuries, restricted work injuries (RTI), and lost time incidents (LTIs) to explain Heinrich’s Law. But the application of Heinrich’s Law in today’s world is questionable.
It is difficult to establish trends for major accidents with the potential for serious injuries or multiple fatalities, such as fire in machinery spaces, hull failure, explosion etc. A vessel may not have had a fire in machinery spaces in five years, and all of a sudden experience two incidents in the subsequent year. In such cases, technical safety (or process safety) is used as a measure of safety management. Technical safety is contingent upon design intent, engineering modifications, maintenance management, etc. Hull structure integrity, maintenance of pressurised fuel lines, operational readiness of fire detection and protection systems etc. are all examples of technical safety.
It is here that the application of Heinrich’s Law becomes weak. For instance, the use of incorrect personal protective equipment (PPE) may not be of much assistance if the pressure relief valve on a boiler becomes inoperative. Neither does Heinrich’s Law explain the underlying reason for loss of life resulting from a shot circuit in the electrical switchboard if the safety awareness of engineers in the past has raised no concern.
Substandard design, overdue maintenance or critical spare parts awaiting replacement are all things that require commitment from the senior management; they are not a reflection of behavioural problems at the grassroots. The problem is largely the result of a tenuous relationship between OHS and technical safety. The use of OHS incident data alone does not help in understanding and preventing serious accidents from occurring.
But this is not to say that Heinrich’s Law does not apply to technical safety. Incident reports such as ‘slight leakage in lubricating oil pump’, ‘small crack in a double bottom tank’, ‘minor engineering modifications without approval’ if unnoticed may lead to serious outcomes. But all this requires seriously questioning and analysing the nature of incidents, rather than just counting the number of reports.
Another line of inquiry is the absence of technical safety from the role of safety departments in many companies. In many ways, the two departments within the same company can operate in isolation. This is evident from the clear functional separation between safety management and maintenance management. In general, the technical department is left to measure its own (safety) performance with little intervention from the safety department. And where technical function reports to operations (rather than directly to senior management), technical excellence can become a matter of reducing risks to ‘as low as reasonably practicable’.
Safety versus quality
The original quality assurance standard, BSI 5750, which has since been superseded by the ISO 9000 series, was meant to provide ‘certified reliability’ to firms looking to expand business in emerging economies. Here, the term ‘quality’ does not refer to improvement in product or processes; it is about consistency in managing operations and meeting customer requirements. Quality standards have served well as a set of generic management standards aimed at limiting the liability and insurance expenses of companies.
The ISM Code borrows its methodology and structure from the ISO quality standards, but is based around safety and environmental protection, rather than customer needs. However successful this approach has been, it has also proved a major source of contention. So intense is the relationship between quality and safety that companies have difficulties distinguishing between quality and safety indicators. It is in the interest of companies to avoid accidents in the same way as it is in their interests not to experience downtime and off hire time. Maintenance of safety equipment is critical not least for safety but also for operations. No customer is interested in hiring a substandard vessel with questionable maintenance standards.
The problem is that quality as we understand it today is about liability management. It is not always appropriate to manage safety in the same way. Quality objectives can easily get confused with safety especially when HSEQ falls within the same remit. This is quite a challenge when the same people who work in the safety department also end up working across the quality, environment and health departments. Take the example of an inoperative watertight door in the engine room that in the ship owner’s understanding may lead to vessel detention by port state control. Should this be treated as a quality issue, resulting in a delay in port which may have severe reputational and commercial implications, or as a threat to vessel and crew safety?
Both assumptions are valid, but the way the incident is viewed may affect the way that it is handled. If the matter is treated as a quality issue, the first reaction will be to notify the flag state administration, classification society, insurance company and in general demonstrate due diligence. On the other hand, if it is seen as a safety issue, the immediate response is to examine the technical and operational risk of a defective watertight door, the potential risk of progressive flooding through compartments in the worst case of hull failure, loss of power due to flooding in machinery spaces, the impact on damage stability, and the assessment of crew competence in handling difficult situations. The management of safety can vary significantly from adopting minimum compliance to a genuine concern for safety of life and property. But even compliance as a measure of safety is questionable.
Compliance in safety management
Compliance (in terms of whether shipboard tasks and operations meet the standards required) can be assessed against company procedures and/or rules and regulations. Where deviations are found, nonconformances are issued and become fundamental to measuring and managing safety. But this approach has problems at many levels.
Procedures are rarely written to cover every conceivable situation, even for a single operation. Procedures written by a Norwegian operator and assessed by a Polish auditor may not always be easily understood by a Russian master. Where procedures are written without crew input, there is a good chance that not following procedures may be a safer choice. Even a simple four step procedure for release of the CO2 system can be interpreted in various ways. If not correctly written, the procedure might miss out critical steps such as carrying out a head count of crew members or shutting off the dampers before releasing the gas. Similarly, documenting a non-conformance as a result of not complying with a plan or process (for example taking short cuts in passage plans) may completely miss both the cause and the outcome (for example limited time at hand). In the absence of intelligent analysis, the relationship between non-conformance with procedures and safety is questionable.
Using non-conformance with regulations and conventions as a measure of safety is a matter of equal interest. Maritime regulations and conventions can be very detailed and prescriptive. Further knowledge of relevant technical codes, circulars and special flag state requirements only makes the requirements more complicated. Certain regulations and conventions may also conflict. For example, the security plan when in piracy areas may impede safe access. Ballast water exchange requirements at sea may have implications for vessel safety and stability.
Inspectors, surveyors and HSEQ staff, like all human beings, suffer from cognitive limitations. What you seek is what you find but what you find is often what you know. A non-conformance issued against a vessel may be the outcome of preferences, biases, specialist knowledge, past experiences or even social and political agendas. Equally, inspections carried out with detailed checklists by less experienced staff without a genuine appreciation of risk may not be a true measure of safety. Several ships have had non-conformances issued for not segregating garbage in accordance with the MARPOL requirements when the entire port and surrounding communities have been dumping garbage right at the entrance of port. Compliance should therefore be used critically as a measure of safety.
Recommendations
If management requires measuring, then measuring safety requires us to establish reliable indicators of safety and make them work. These indicators can be highly interactive and conflicting. Matters of personal safety may not always mesh smoothly with technical safety. Indicators can be leading (pro-active) and lagging (reactive). Reactive indicators may also be proactive indicators of a serious accident waiting to happen. Therefore, personal injury, failure of equipment, violation of procedures or any other form of reactive indicator, needs thorough analysis that goes beyond simplified statistics and graphs.
Non-conformances as reactive indicators often result in a detailed review of procedures or training of crew, without making sense of why these procedures have became meaningless to those at the operating end. Introducing more detailed procedures will only undermine trust levels and result in even further non-conformances. All this may not necessarily serve the true intent of safety management.
Even more challenging is the monitoring and measuring of proactive indicators, as it is not always easy to envisage incidents that have not occurred. Measuring safety through predicting what may go wrong in the future requires unease and reflection, particularly for practitioners with extensive work experience. It begins with examining what is ‘usual’ and what is ‘normal’ within the company and onboard ship. A minor intake of water in the stern tube, a regular fault alarm on the fire panel and a daily issue of bilges getting flooded are no longer regarded as risks by those serving onboard the vessel. The unusual and abnormal becomes normalised in routine work – until such time as it leads to an undesirable outcome.
For this reason, it is important that not every inspection and ship visit is based on agendas or planned inspections with detailed checklists. Ship visits, especially those from senior staff, should aim to engage with the crew in trying to make sense of everyday work patterns. For those in senior positions, it is also important to develop the ability for humble listening, rather than shutting up the crew by retelling their own experiences and cost saving sagas. Simple questions, such as asking what is the most dangerous job that the crew member performs and how it could be improved, can generate powerful responses. Engage with people at all levels, not only in the comfort of the Master’s and chief engineer’s offices. Companies should not expect fresh perspectives if the same staff visit the same vessels on every occasion. Diversity is a proven source of organisational resilience and safety.
Intention is key to measuring and managing safety. The absence of any genuine concern or understanding of safety risks will lead to defensive attitudes that only generate mindless paperwork. More paperwork only exposes more holes in the system, and will eventually lead to embarrassment in the courtroom. Of course, there is an easy way out – blame the seafarer!
The views expressed in this paper may not necessarily represent the views of the company which the author represents.
