Risk Management Program Standard

For Use in the Pipeline Risk Management Demonstration Program

Produced by

The Joint Risk Management Program Standard Team

The Office of Pipeline Safety

American Petroleum Institute

Interstate Natural Gas Association of America

National Association of Regulatory Utility Commissions

National Association of Pipeline Safety Representatives

Gas Research Institute

DRAFT

September 24, 1996

Contents

Page

I.	Introduction	I-1

I.1	Background	I-1

I.2	Purpose	I-2

I.3	Applicability	I-2

I.4	Scope	I-3

I.5	Guiding Principles	I-5

I.6	Organization of This Standard	I-7

II.	Overview of a Risk Management Program	II-1

II.1	Program Elements Overview	II-1

II.2	Process Elements Overview	II-3

II.2.1	Risk Assessment	II-4

II.2.2	Risk Control and Decision Support	II-5

II.2.3	Performance Monitoring and Feedback	II-6

III.	Risk Management Program Elements	III-1

III.1	Administration	III-1

III.1.1	Roles and Responsibilities	III-1

III.1.2	Personnel Qualifications	III-1

III.1.3	Management of Change	III-1

III.2	Communication	III-2

III.3	Documentation	III-2

III.4	Program Evaluation and Improvement	III-3

Contents (Continued)

Page

IV.	Risk Management Process Elements	IV-1

IV.1	Risk Assessment	IV-1

IV.1.1	Scoping and Screening Analysis	IV-1

IV.1.2	Event Identification	IV-3

IV.1.3	Frequency Analysis	IV-6

IV.1.4	Consequence Analysis	IV-7

IV.1.5	Risk Estimation	IV-7

IV.2	Risk Control and Decision Support	IV-8

IV.2.1	Identification of Risk Control Issues	IV-8

IV.2.2	Identification of Risk Control Options	IV-10

IV.2.3	Evaluation and Comparison of Risk Control Options	IV-13

IV.2.4	Selection of Risk Control Options	IV-14

IV.3	Performance Monitoring and Feedback	IV-15

IV.3.1	Selection of Performance Measures	IV-17

IV.3.2	Monitoring and Evaluating Performance	IV-19

IV.3.3	Modifications to the Risk Management Program	IV-20

V.	Conclusions	V-1

Appendix A. Joint Risk Management Program Standard Team	A-1

Figures
Page

I-1.	The Pipeline Risk Management Project	I-4

II-1.	Risk Management Program Overview	II-2

IV-1.	The Risk Assessment Process Element	IV-2

IV-2.	Progression of a Pipeline Incident	IV-4

IV-3.	The Risk Control and Decision Support Process Element	IV-9

IV-4.	Risk Control Activities During Progression of a Pipeline Incident	IV-11

IV-5.	The Performance Monitoring and Feedback Process Element	IV-16

IV-6.	Performance Measures Associated with Stages of a Pipeline Incident	IV-18

I.	Introduction

I.1	Background

The first priority of the United States pipeline industry, the Office of Pipeline Safety, and state pipeline regulators is to protect the public, the environment, and property while maintaining an efficient and reliable pipeline system. Currently, the primary regulatory basis for achieving these safety goals in the pipeline industry is the set of regulations embodied in Title 49 of the Code of Federal Regulations Parts 190-199. In addition, pipeline companies perform many discretionary activities over and above the regulations to achieve these goals. Both the industry and regulators are looking for alternative approaches to further improve safety in cost-effective ways.

"Safety" is the protection of the public, the environment, and property. "Risk" is any threat to achieving those goals. Both the industry and regulators believe that risk management has the potential to provide a valuable tool to help further improve safety and allocate resources cost effectively, by

▪	Analyzing the precursor events and causes of potential pipeline incidents

▪	Examining both the likelihood and severity of potential pipeline incidents

▪	Providing a comprehensive and integrated means for examining and comparing the complete spectrum of risks and prevention/mitigation strategies

▪	Providing a structured, easily communicated means for identifying and prioritizing pipeline risks and risk-reduction measures

▪	Establishing and tracking performance measures to ensure safety improvement.

The industry and regulators formed two partnership teams to investigate the potential application of risk management within the pipeline industry. The Liquid Risk Assessment Quality Team ( RAQT ), jointly sponsored by the Office of Pipeline Safety ( OPS ) and the American Petroleum Institute (API), examined the potential use of risk management within the hazardous liquid pipeline industry. The Gas Risk Assessment Quality Team, jointly sponsored by the OPS and the Interstate Natural Gas Association of America ( INGAA ), examined the potential use of risk management within the natural gas pipeline industry. Both teams concluded that risk management had the potential to produce equal or greater levels of safety in a more cost-effective manner than the current regulatory scheme, but recommended that a multiyear Risk Management Demonstration Project be implemented to determine the feasibility of risk management programs and to ascertain the practical benefits that can be derived from such programs.

These teams' recommendations were discussed in a public conference on risk management in November 1995. This conference resulted in acceptance of the Risk Management Demonstration Project with the stipulation that a standard be developed that would define the necessary elements and characteristics of a risk management program. As a result of the November 1995 risk management conference, a joint risk assessment quality action team ( JRAQT ) was formed to develop the risk management demonstration program standard.

I.2	Purpose

The program standard is intended to serve as a common rational basis upon which the pipeline industry and its regulators can interactively develop, assess, and refine effective risk management programs and proposals. It is not intended to provide a detailed instruction manual that can be followed by rote by pipeline companies to develop a program or proposal, or a checklist for OPS to use to review company risk management proposals.

This program standard defines the program and process elements of a comprehensive risk management program that all Risk Management Demonstration Project proposals shall contain. At the same time, the standard allows flexibility to each company to customize its risk management program to fit its particular needs and corporate practices, provided that the program supports the scope and goals of the demonstration project proposal. This program standard also includes an evaluation and improvement element that enables programs to evolve as experience is gained.

This program standard plays an important role in the pipeline industry's risk management demonstration program. This program standard, by describing the necessary basic elements and characteristics of a pipeline company risk management program, is to be used by

▪	Individual pipeline companies that are developing risk management programs for internal use

▪	Individual pipeline companies that are developing specific proposals to submit for consideration in the Risk Management Demonstration Project

▪	OPS as a basis for developing the processes it will use to review risk management programs and approve specific Risk Management Demonstration Project proposals submitted by individual companies.

I.3	Applicability

This program standard will be updated and refined as lessons are learned from the demonstration program. It is anticipated that this program standard will provide a starting point for the development of one or more national consensus standards or industry recommended practices.

This program standard is applicable to risk management programs that include any designated portion, or the entirety of any hazardous liquid or natural gas pipeline system and all associated design, construction, testing, operations, maintenance, and abandonment activities. A pipeline system includes all physical facilities through which hazardous liquids or gas moves in transportation, including, but not limited to, pipe, valves, other appurtenances attached to pipe, pumping units, compressor units, metering stations, regulator stations, delivery stations, holders, breakout tanks, and fabricated assemblies.

In addition to this standard, the Risk Management Demonstration Project requires a regulatory review and approval process (the Regulatory Framework), and identification of Demonstration Project Performance Measures which will be used to evaluate the effectiveness of risk management as a regulatory alternative. Figure I-1 shows the relation among the Program Standard, the Regulatory Framework, and the Demonstration Project Performance Measures. Even if a company's proposal for the Demonstration Project includes all the elements described in this Standard, participation in the Demonstration Project is at the discretion of OPS , consistent with the conditions detailed in the Regulatory Framework.

I.4	Scope

This program standard outlines a comprehensive risk management program, including

▪	The application of risk management to any or all portions of the pipeline life cycle, including design, construction, testing, operations, maintenance, and abandonment

▪	The complete risk management process, including risk assessment, risk control and decision support, and performance monitoring and feedback

▪	The integration of risk management into the corporation's business practices, including administration, communication, documentation, and program evaluation.

I.5	Guiding Principles

The following guiding principles describe the overriding attributes and characteristics that all risk management programs should exhibit. These guiding principles are reflected in the individual sections of the standard, and can be used by developers and reviewers of risk management programs to place in appropriate context the individual portions of this standard and to help ensure that the expected outcomes of the integrated program will be achieved by the collective effect of the program's individual parts.

1.	Risk Management is a comprehensive management decision support process, implemented as a program, integrated through defined roles and responsibilities into the day-to-day operations, maintenance, engineering, management, and regulatory decisions of the operator.

Risk management produces, structures, and presents the best available risk information to support and facilitate better management decision making.

Risk management allows management decisions and their bases to be more easily communicated.

Risk management is a comprehensive management decision making process that includes the identification and analysis of risks; the identification, analysis, and selection of alternative measures to control risks; and the subsequent assessment of performance.

Risk management does not replace pipeline company managers or regulators with computer models. Corporate managers and regulators make decisions. These decisions are aided by, but not dictated by, technical models and quantitative analyses.

Risk management is an integrative process, allowing operators and regulators to address multiple aspects and practices of pipeline design, construction, testing, operation, maintenance, and abandonment in a combined, holistic way to maximize overall benefits.

Risk management is a continuous process, with initial output from any portion of the process often being updated and refined using information fed back from subsequent portions of the overall decision making and implementation process.

Risk management requires corporate management leadership, commitment, and accountability. Clear lines of responsibility and accountability for risk management need to be established from the highest level of management down.

2.	Risk can be controlled through the cost-effective application of finite resources.

Risk management inherently involves subjective trade-offs among different, and often competing, goals.

Risk management logically structures, brings consistency to, documents, and clarifies the trade-offs of risks, uncertainties, and benefits among competing alternatives.

Risk management allows experienced operators and regulators to apply best engineering practices and judgment to develop integrated solutions to pipeline safety problems as an alternative to event-driven, regulatory-dictated solutions.

3.	Risk cannot be totally eliminated.

Risk is an inherent part of life and is associated with all industrial activities.

The overall risk of a pipeline can be reduced, controlled, or altered, but it cannot be reduced to zero.

The process or result of reducing risks of one source or type can affect risks of another source or type.

4.	Risk management increases, integrates, and enhances the value of information concerning pipeline safety.

Risk management requires suitable and sufficient data to be developed and maintained concerning system design and operational characteristics, including reliability and maintenance histories of pipeline system components. In many cases this information exceeds that which is currently developed, maintained, and reported.

Risk management addresses both the likelihood and consequences of pipeline incidents. In this context, "incidents" refers to unwanted events such as unintended releases, leaks, and near misses.

Risk management addresses the entire life cycle of the pipeline system, considering the interfaces and dependencies among pipeline design, construction, operation, and maintenance.

Risk management examines the entire spectrum of risks, from the relatively frequent minor events that pose little or no risk, to the very low probability incidents that could cause significant harm.

Risk management identifies and assesses the relative merits of activities to reduce the likelihood of incidents as well as activities to mitigate the consequences of incidents should they occur.

By placing each source of risk in its proper perspective, and by depicting the relative impact of potential risk-reduction measures on overall risk, risk management can facilitate communication among operators, regulators, and the public concerning the nature of pipeline risks and the rational basis for decisions on how to manage these risks.

5.	Risk management programs are structured but flexible, allowing customized approaches to be developed for specific issues and situations, encouraging innovation, and supporting continuous improvement.

There are numerous levels of detail and model complexity that can be beneficially developed and implemented within a risk management program. The technical models used within the program should be commensurate with the level and type of the risks being analyzed, and should be capable of generating the level of information detail and confidence needed to support the specific decisions being made.

Risk management programs should be implemented as ongoing, "living" programs, evolving and continuously improving as experience is gained and new data are obtained.

6.	The implementation of a risk management program should result in a level of public safety and environmental protection equal to or greater than that which existed prior to implementation of the program.

Risk management programs include performance measures and call for explicit and visible monitoring, tracking, and reporting of progress against expected outcomes.

Risk management programs, data, and results are structured in a manner that can be audited.

1.6	Organization of This Standard

This standard presents a summary overview of risk management programs and processes (Section II), followed by a detailed explanation of program elements (Section III) and process elements (Section IV). It concludes with a statement of implications for industry, the public, and the regulatory community. A roster of the Program Standard Team appears in Appendix A.

II.	Overview of a Risk Management Program

A risk management program can be structured in many ways, but all programs shall contain the key program and process elements described below (see Figure II-1).

II.1	Program Elements Overview

Program elements are those portions of the overall corporate programmatic infrastructure that ensure that risk management is developed and implemented as an integral part of the day-to-day business practices of the company. Those corporate programmatic infrastructure elements include

▪	Administration. Corporate policies and administrative procedures shall include the implementation of risk management programs, including assignment of roles and responsibilities for risk management activities. The processes used by the corporation to ensure personnel qualifications shall ensure that individuals have the necessary experience and skills to perform their risk management roles and responsibilities in a high-quality manner.

▪	Communication. The organization's internal communication processes shall ensure that information concerning the goals of the risk management program, structure and processes, relevant input data, and risk management results and decisions are communicated throughout the organization. The organization's external communication processes should ensure that regulator and other stakeholder interests and concerns relative to risk management are considered, and that risk management program goals and results are communicated to and discussed with Federal, State, and local regulators, the public, and other stakeholders as appropriate.

▪	Documentation. The organization's documentation processes and systems shall include the acquisition, processing, storing, and reporting of risk management data and information.

▪	Program Evaluation and Improvement. The organization's program evaluation processes and systems shall ensure that the risk management program's activities, decisions, and results are continually monitored, to assess progress in managing risk, and to improve the overall risk management program.

Risk Management Program Elements are addressed in detail in Section III of this program standard.

II.2	Process Elements Overview

Risk management process elements are the technical and analytical portions of a risk management program needed to assess risks, identify possible ways to control these risks, allocate resources to control risks, monitor performance, and apply information learned to improve the process.

Figure II-1 depicts the major risk management process elements. Although there is a natural, logical flow to the process elements, risk management programs are, in practice, iterative processes with considerable interaction and feedback among the process elements. Initial risk assessment activities may be expanded or re-examined based on the outcome of subsequent activities to define effective risk control measures. The monitoring of performance may suggest that initial assumptions or data were inadequate, and need to be updated or rethought. A risk management program is a dynamic process, which continually develops new data and information that can be used in each step of the process to make improved and better informed decisions.

The first key step of a risk management program is defining the scope of the program. The initial scope definition includes

▪	The physical boundaries of the pipeline system that will be addressed

▪	The portions of the life cycle that will be addressed (e.g., will design and construction issues be examined, or will the study focus on operational and maintenance problems and solutions?)

▪	The breadth of the analyses (e.g., will all types of failure modes and potential solutions be considered, or will the program focus on specific types of failure modes?).

The scope of the program shall be consistent with the goals of the company's risk management program. A screening level risk assessment (see next section) can often be effectively used to help focus the scope of the risk management program on the most important issues and opportunities for improvement. Limited, focused-scope risk management programs are, in fact, often a prudent way of introducing a risk management program into an organization, allowing experience and skills to be developed in a controlled manner. However, the scope of the risk management program shall consider system components and failure modes that have a significant effect on risk management conclusions and decisions.

II.2.1	Risk Assessment

The Risk Assessment portion of a risk management program addresses the following basic questions:

What adverse events can happen?

▪	What types of adverse consequences are of concern and will be addressed by the risk management program?

▪	What event or series of events would have to occur to cause these undesirable consequences?

▪	How could these events occur (i.e., what are the logical combinations of possible contributing causes that would result in these events)?

How likely are these events to occur?

How severe would the consequences be if the events did occur?

▪	Given the occurrence of the event(s), what are the specific physical mechanisms or pathways by which the event could lead to harm to the public, employees and contractors, the environment, private and public property, or other valued entities?

▪	What would be the expected size or severity of the release of hazardous material from the event?

▪	What would be the nature and severity of the impact of the event(s) on the public, employees and contractors, the environment, private and public property, or other valued entities?

Inputs to the risk assessment typically include data and information about the design and age of the pipe, the soil surrounding the pipeline and other external factors, operational and maintenance practices, operating history, test history, inspection findings, and the proximity and distribution of population, third party construction activities, environmentally sensitive areas, and unusually sensitive areas.

The risk assessment element results in an understanding of the "risk profile": the contributors to the overall risk of the segment of pipeline being analyzed, and the relative importance of each of these contributors. This understanding of the current risk profile provides the basis for defining and deciding among ways to reduce these risks, which is the next step in the risk management process.

Risk assessments are often performed in an iterative manner. For example, a screening level, or "first-cut" risk assessment, employing less detailed analyses, is often used to focus the scope of the program and identify those areas where more detailed analyses should be performed.

Risk assessment is addressed in more detail in Section IV.1 of this standard.

II.2.2	Risk Control and Decision Support

In this portion of the risk management program, the organization examines options for controlling the risks identified in the previous step and makes decisions concerning which specific risk control activities to perform and when to perform them.

A "risk control activity" can be a current practice or a change in the way that the pipeline is designed, constructed, tested, operated, or maintained for the purposes of improving the risk profile of the pipeline. For example, risk control activities can include additions of isolation valves, increases (or decreases) in surveillance or testing intervals, changes in the timing or nature of a maintenance activity, operating the system under different conditions, etc.

The expected outcome of this step is the identification of an overall set of risk control activities that collectively achieves the risk management goals of the operating company and produces an equal or greater level of safety.

Risk control and decision support address the following questions:

What could be done to control risks?

▪	Given our understanding of the current risk and its contributors, where can improvements in design or operation be made to reduce risk or more efficiently control risk?

▪	What are possible ways of reducing the likelihood of events?

▪	What are possible ways of reducing the consequences of events?

What are the relative merits of the various risk control options?

▪	How much does each option affect each type of risk?

▪	How much does each option cost to implement?

▪	What are other benefits or incremental costs of each option?

What set of activities best achieves risk management goals?

▪	What are the most cost-effective risk control options?

▪	Are there additional compensatory actions that can be performed to cost-
effectively control residual risks?

▪	In addition to risk reduction and cost, what other factors will be considered in choosing among risk control activities?

▪	How can the various options be integrated to produce an overall set of changes that achieves the risk management goals?

▪	How can available resources be allocated to most efficiently implement the activities over time?

▪	Should additional resources be committed to reduce risks?

Risk control and decision support are addressed in more detail in Section IV.2 of this standard.

II.2.3	Performance Monitoring and Feedback

In this portion of a risk management program, the organization establishes performance measures and tracks progress to ensure that the intended effects of its actions are being achieved.

Performance monitoring and feedback address the following questions:

What improvements are expected from the risk control decisions?

▪	What changes in performance are expected from the selected set of improvements?

▪	How would these changes be expected to manifest themselves in the short, intermediate, and long term?

What measures best capture these expected outcomes?

▪	What can be measured or observed in the short term and over the long term to determine if the specific applications of risk management are producing the desired results?

▪	How can the organization demonstrate equal or greater levels of safety?

Are the selected risk control activities having the intended effects?

▪	Does actual experience confirm predictions?

How can the overall risk management process be improved?

▪	Given actual experience, does the organization need to change its decisions?

▪	How should the risk assessment and risk control processes be updated to reflect new experience?

Performance monitoring is addressed in more detail in Section IV.3 of this standard.

III.	Risk Management Program Elements

Risk management program elements form the foundation of the organizational infrastructure that supports the analytical and technical process elements of risk management. Risk management program elements deal with the overall functioning of the risk management program. The content and complexity of the risk management program elements shall be consistent with the degree of risk, the comprehensiveness of the risk management program, the quantity and quality of data available, and corporate organizational capabilities.

While there are many ways to structure a risk management program, all programs shall contain elements that address administration, communication, documentation, and program evaluation.

III.1	Administration

The risk management program should be documented to ensure that the risk management policies are established, understood (both within and outside the organization), implemented, and maintained. The risk management program shall be an integral part of normal operations. Procedures must be established for conducting the risk management program. These policies and procedures address a number of administrative requirements, including:

III.1.1	Roles and Responsibilities

The risk management program documentation shall define roles and responsibilities for conducting risk management activities within the operator's organization. Risk management should be integrated into existing functions where appropriate. Authority for decisions and necessary resources shall be defined.

III.1.2	Personnel Qualifications

Qualified personnel are essential for execution of an effective risk management program. The risk management plan shall describe the personnel qualifications necessary for the roles and responsibilities assigned as described in Section III.1.1, and define the processes that will be used to ensure that personnel performing risk management tasks possess the necessary qualifications.

III.1.3	Management of Change

The risk management plan shall include a discussion of the operator's management of change procedures. Management of change applies to approval and documentation requirements for both procedural and physical changes related to design, construction, operations, and maintenance of pipeline facilities; and procedural changes associated with the risk management program. Risk management programs should include mechanisms for gathering and assimilating new information on pipeline surroundings and conditions as situations that may affect risk change over time.

III.2	Communication

An efficient flow of information among appropriate stakeholders, both internal and external to the operating company, enhances the quality of the analyses, improves decision making, facilitates review, and builds trust.

A risk management program shall contain an internal communications element, in which information concerning the goals and implementation of the risk management program, relevant input data, and results obtained are communicated throughout the organization. A risk management program shall also contain an external communications element, in which regulator and other stakeholder interests and concerns are understood, and program goals and results are communicated to and discussed with Federal, state, and local regulators, the public, and other stakeholders as appropriate.

A risk management program shall include a formal communications plan that identifies the types of information to be communicated and the audiences to receive that information (e.g., employees, operators of other adjacent facilities, regulatory agencies, other government agencies, emergency response agencies, the general public, the affected public). Risk management programs also shall include the methods of communication (e.g., public meetings, citizen advisory panels, printed materials, videotapes, telecommunications), individuals or organizations responsible for these communications, and the methods that will be employed to receive information from these audiences.

III.3	Documentation

The risk management program shall collect and maintain documentation of the inputs, analyses, and outputs of each element of the risk management program. This documentation supports efficient internal implementation of each step of the risk management process and allows key risk management results and decisions to be traceable and defensible. The risk management program may draw on existing documentation within a company and will produce new documentation requirements associated with the risk assessment, risk control decisions, and performance monitoring.

A risk management program shall include a documentation plan that describes how the company will acquire, process, store, report, maintain, verify, and modify relevant risk management data and information (e.g., program plans and procedures, specific technical analyses with input data and assumptions, training records).

III.4	Program Evaluation and Improvement

In order to determine, report, and improve the effectiveness of the risk management program, a risk management program shall include a planned and structured evaluation of its activities and processes. Evaluation thus serves as a quality or continuous improvement element of the risk management program.

The risk management program shall include an evaluation plan that periodically examines and reports

1.	The quality and effectiveness of the administrative, communication, and documentation program elements

2.	The quality and effectiveness of the analytical processes used to assess risks, identify possible ways to control these risks, allocate resources to control risks in the most cost-effective way, and monitor performance

3.	The impacts of risk management decisions on the choice of performance measures

4.	The conclusions and reassessments about program effectiveness resulting from performance monitoring and feedback.

IV.	Risk Management Process Elements

Process elements are the technical and analytical activities needed to assess risks, identify possible ways to control these risks, allocate resources to control risks in the most cost- effective way, and monitor performance. While there are many ways to structure an overall risk management process, all processes shall contain the following elements.

IV.1	Risk Assessment

The first step of the overall risk management process is to identify and understand the specific risks that must be managed. The Risk Assessment portion of a risk management program addresses the following basic questions:

What types of risks will be addressed? (Section IV.1.1)

What adverse events can happen? (Section IV.1.2)

How likely are these events to occur? (Section IV.1.3)

How severe would the consequences be were the events to occur? (Section IV.1.4)

How is a risk profile developed? (Section IV.1.5)

The risk assessment process element, and its relationship to the other risk management process elements is illustrated in Figure IV-1.

IV.1.1	Scoping and Screening Analysis

A key first step in risk assessment is defining the scope of the analysis. The scope definition provides the framework and boundaries for the entire risk assessment process, and therefore must be well defined at the beginning of the process. An operator's risk management program shall contain a scope definition that includes:

▪	The physical boundaries of the pipeline system that will be addressed

▪	The portions of the life cycle that will be addressed (e.g., will design and construction issues be examined, or will the study focus on operational and maintenance problems and solutions?)

▪	The breadth of the analyses that will be addressed (e.g., will all types of failure modes and potential solutions be considered, or will the program focus on specific types of failure modes?).

The scope of the risk assessment shall be consistent with the overall goals of the operator's risk management program. Although successful risk management programs usually expand their scope and become more comprehensive over time, it is often not necessary to perform a detailed risk assessment of an entire pipeline system as the first step of a pipeline risk management program. There are a variety of useful ways of initially limiting the scope of a detailed risk assessment, including

1.	A "screening" analysis that identifies those segments of the pipeline that are in or near high population zones or areas unusually sensitive to environmental damage, or that have experienced poor operating histories, and therefore could reasonably be expected to pose relatively higher risks than other portions of the pipeline

2.	The identification of specific issues by operators or regulators that appear to pose higher than average risks or provide opportunities for more cost-effective risk control (e.g., significant new residential or commercial construction in the immediate area, corrosive soil conditions, etc.)

3.	The existence of special circumstances or characteristics of a specific segment of the pipeline (e.g., it is about to be transferred to another company, it shares characteristics with another pipeline in which a serious event has occurred, etc.)

Risk management programs with a limited scope are often a prudent way of introducing risk management programs into an organization, allowing experience and skills to be developed in a controlled manner. However, the scope of the risk management program shall include system components and failure modes that have a significant effect on the risk management conclusions and decisions.

The risk management program shall define and document the scope and purpose of the risk assessment, including any preliminary evaluations and screening analyses that may be undertaken. Assessments are expected to evolve over time, and periodic updates will be a part of the risk management program documentation (see Section III.3).

The system being analyzed is defined by providing a general system description, including boundaries, environment, and operating conditions. Any assumptions and constraints applicable to the system, the events, and the methods used shall be stated in the scope.

IV.1.2	Event Identification

Figure IV-2 depicts the progression of a pipeline incident. In pipeline risk management, the condition that exists with the potential for causing undesirable consequences (i.e., the "hazard") is the presence of hazardous liquids or natural gas within the pipeline. The accidental release of these substances can potentially cause uncontrolled dispersal of these

substances, with the possibility of associated fires, explosions, property damage, or environmental impacts.

A pipeline incident is the result of one or more events in a sequence that lead to loss of pipeline integrity and loss of containment of the liquid or natural gas product. Each of these events in the sequence may have one or more potential causes. For example, a rectifier failure can lead to loss of cathodic protection, which can lead to corrosion, which can lead to loss of containment. The rectifier failure itself may be caused by random component failure, lightning, etc.

A risk assessment identifies the specific events or combinations of events that could lead to loss of pipeline integrity and unintended release of product, and delineates the potential causes of these events. In subsequent risk assessment steps, the likelihood of these specific events and the severity of consequences associated with them will be estimated.

An operator's risk management program shall describe the processes, tools, and models by which pipeline incidents and their causes are identified. Pipeline incidents can be identified in a variety of ways with varying levels of detail and sophistication, including

▪	Knowledge-based processes, in which the experience of operations and maintenance personnel concerning the causes of pipeline incidents is systematically captured through interviews, checklists, failure modes and effects tables, etc.

▪	Data-based processes, in which the documented operating history (in the form of incident reporting systems, maintenance histories, etc.) of the pipeline or other, similar pipelines is examined to identify causes.

▪	Logic-based processes, in which logic models are constructed to search for and identify potential causes of pipeline incidents by systematically breaking the incidents into their contributing causes (e.g., fault trees), or by following the possible outcomes that can result from a postulated initiating event (e.g., scenario models, or event trees).

The level of detail and sophistication of the risk assessment processes and models shall be commensurate with the level of risk being evaluated and shall be able to provide the level of precision necessary to support the specific risk control decisions being made. An operator's risk management program shall justify the appropriateness of the level of detail of the risk assessment models.

IV.1.3	Frequency Analysis

Once the series of events that could lead to pipeline incidents and consequential impacts are identified, it is necessary to estimate the relative likelihood that these events will actually occur. Frequency analysis provides estimates of the relative likelihood of the event or events that lead to pipeline incidents and to adverse consequences.

Frequencies of events can be estimated in either qualitative or quantitative terms, or both. Qualitative processes often use relative categories such as "frequent," "likely," "unlikely," or "rare" to depict the likelihood of experiencing an event. Often, the qualitative categories are calibrated to ranges of quantitative frequencies (e.g., "likely" may be assigned to events with an expected frequency between 1 and 5 events per year). Quantitative processes estimate the expected number of events per unit time (e.g., 10 times per year). Semiquantitative processes often use a numeric index to estimate the relative frequency of events. For example, the frequency of third party damage events may be assigned an index score of 30, and corrosion events may be assigned an index score of 10, indicating that third party damage events are expected to occur three times as frequently as corrosion induced events.

As with event identification, frequency estimation can be performed at varying levels of detail and sophistication, including

▪	Knowledge-based processes, in which expert opinion is used to estimate the frequency of events based on experience of knowledgeable operators, inspectors, etc.

▪	Data-based processes, in which event frequencies are derived from documented operating history (in the form of incident reporting systems, maintenance histories, etc.) of the pipeline or other, similar pipelines.

▪	Logic-based processes, in which logic models (e.g., fault trees or event trees) are constructed to mathematically combine the frequencies of causal events or series of events into an estimate of pipeline incident frequency. Logic-based processes are often used when insufficient operating data exists to estimate directly the frequency of very rare events.

An operator's risk management program shall describe the processes, tools, and models by which the frequency of pipeline incidents is to be estimated. An operator's risk management program shall define and justify the appropriateness of the level of detail of the risk assessment models. Limitations or uncertainties in the analysis shall be documented.

IV.1.4	Consequence Analysis

Consequence analysis involves estimating the severity of the impacts of the identified event or sequence of events on the health and safety of people, the environment, availability of service, or other impacts included in the operator's risk management program.

Consequence analysis must consider not only the events that lead up to loss of pipeline containment, but other events (e.g., success/failure of remotely operated isolation valves to close) and considerations (e.g., population distribution) that could affect the severity of expected consequences. Consequence analysis shall consider at a minimum:

1.	The amount of hazardous substance that is released

2.	The physical pathways and dispersal mechanisms by which the substance can reach and impact employees or the public, or cause environmental damage

3.	The amount of substance that would actually be expected to reach employees, the public, or the environment through these pathways

4.	The expected effect of the released substance.

Consequences of events can be estimated in either qualitative or quantitative terms, or both. Qualitative processes often use relative categories such as "severe," "significant," "moderate," or "insignificant" to depict the severity of consequences from an event. Often, the qualitative categories are calibrated to ranges of quantitative consequences (e.g., "significant" might be assigned to events with an expected consequence of between 1 and 5 serious injuries per year). Quantitative processes estimate the expected severity level in terms of number of fatalities, serious injuries, etc. Semiquantitative processes often use a numeric index to estimate the relative consequences of events. For example, an event that is expected to lead to a fatality might be assigned an index score of 100, an event that leads to a serious injury might be assigned a smaller index score, and an event that leads to moderate property damage might be assigned a still smaller index score to indicate the relative harm associated with these impacts.

An operator's risk management program shall describe the processes, tools, and models by which the consequences of pipeline incidents are estimated. An operator's risk management program shall define and justify the appropriateness of the level of detail of the consequence models. Limitations or uncertainties in the analysis shall be documented.

IV.1.5	Risk Estimation

Risk estimation is the process of combining frequency and severity estimates into a risk value. The frequency and consequence estimated for each of the various identified events or sequences of events are combined into a risk value for that event sequence. The risk values for all identified event sequences can be combined into an overall risk value for the pipeline. The risk values may be qualitative, quantitative, or a combination of both, depending upon the processes used for frequency and consequence analysis, and the goals of the operator's risk management program.

This portion of the risk assessment process results in a "risk profile," or an overall depiction of pipeline risk and its constituent parts. This risk profile will be used in the subsequent risk management process element to define and assess potential actions to control existing risks. Risk profiles that maintain discernible estimates of frequency and severity allow distinctions to be made between low frequency/high severity events and high frequency/low severity events as well as total risk values.

An operator's risk management program shall describe the processes, tools, and models by which the frequencies and consequences of pipeline incidents are combined into overall risk values. An operator's risk management program shall define and justify the appropriateness of the level of detail of the risk estimation models. Limitations or uncertainties in the analysis shall be documented.

IV.2	Risk Control and Decision Support

The previous section of this standard describes the basic processes by which a pipeline company can identify and assess the risks associated with its pipeline systems. This section describes the processes by which the pipeline company identifies, evaluates, and chooses among alternate means to control those risks.

The Risk Control and Decision Support portion of a risk management program addresses the following basic questions:

What could be done to control risks? (Sections IV.2.1 and IV.2.2)

What are the relative merits of the various risk control options? (Section IV.2.3)

What set of activities best achieves risk management goals? (Section IV.2.4)

The risk control and decision support process element, and its relationship to the other risk management process elements is illustrated in Figure IV-3.

IV.2.1	Identification of Risk Control Issues

Risk management programs shall include formalized and structured processes to identify those specific situations where it may be possible to reduce risk, or to maintain risks at current levels in more cost-effective ways. These "risk control issues" represent potential opportunities to improve the level of protection of the public, the environment, and property by making changes to the way that the pipeline is designed, constructed, operated, or maintained. The primary goal of a company's risk management program is to provide corporate management

with information to support decisions about what specific actions, if any, should be taken to address these issues.

These risk control issues may have been identified in the original scoping of the risk management program (e.g., a maintenance manager's concern that a current maintenance practice may not be the most cost-effective way of controlling risk) or may result from a review of the risk assessment of the pipeline system (e.g., the identification of a pipeline segment with a relatively high risk due to corrosion).

Risk control issues could include

▪	Substantial contributors to overall pipeline system risk

▪	Situations where the risk, while not a major contributor to current pipeline risk, might still be cost-effectively reduced

▪	Situations where the currently applied or required risk control mechanisms may be more costly than equally effective, alternative mechanisms.

IV.2.2	Identification of Risk Control Options

Risk management programs shall include formalized and structured processes that specify risk control options for addressing the risk control issues identified in the previous step. Risk control options include those that

▪	Alter or replace a design, construction, testing, operational, or maintenance practice in such a way that the current likelihood of pipeline incidents is reduced

▪	Alter or replace such practices so that the current level of consequences associated with pipeline incidents, should they occur, is reduced

▪	Alter or replace such practices with more cost-effective practices that achieve equal or greater levels of safety

▪	Continue current practices to maintain existing levels of risk.

The progression of a pipeline incident can also be used to guide and structure the identification of risk control options. As shown in Figure IV-4, prevention, mitigation, and response actions can be defined at various points in the incident progression.

IV.2.2.1	Prevention Options

Risk management programs shall include a structured approach to identify and document possible actions to reduce the current likelihood of pipeline incidents or to prevent pipeline incidents in a more cost-effective manner. Possible actions to be investigated include, but are not limited to

▪	Enhancements to pipeline design

▪	Physical modifications to the pipeline system hardware and configuration

▪	Changes in operational practices, including changes to the allowable operating conditions

▪	Changes in maintenance practices, including the nature and frequency of maintenance and inspections

▪	Improved qualifications of personnel

▪	Changes in the way that pipeline workers, third parties, and the public are notified of safety related conditions and existing pipeline risks.

IV.2.2.2	Mitigation and Response Options

Risk management programs shall include a structured approach to identify and document possible actions to diminish the size of the release and reduce the currently anticipated level of consequences should a pipeline incident occur, or to perform existing protection and mitigation activities in a more cost-effective manner. The possible actions to be investigated include, but are not limited to:

▪	Physical modifications to the pipeline system hardware and configuration that limit or reduce the release from a pipeline in the case of an incident

▪	Improvements in operational practices, including changes to the allowable operating conditions that serve to limit or reduce the release from a pipeline in the case of an incident

▪	Improvements to qualifications of personnel and the way that pipeline operators and other personnel are trained to respond to incidents

▪	Improvements in emergency response plans, equipment, and facilities

▪	Actions to limit the proximity of the public to pipelines

▪	Actions to limit the potential for environmental damage caused by release from the pipeline

▪	Improvements in the way that pipeline employees and contractors, third parties, and the public are notified of safety related conditions and existing pipeline risks.

▪	Improvements in the way the pipeline is monitored and inspected (e.g., leak detection, surveillance, patrolling, etc.)

IV.2.2.3	Integration of Risk Control Options

Risk management programs shall include processes to produce an integrated set of potential risk control options, examining the possible conflicts and synergies between and among the individual risk control options identified above.

These integrative processes shall include an examination of the residual risk expected to remain after the identified risk control options have been implemented. Risk management programs shall include processes by which the residual risks are examined to determine whether there are additional risk control activities that could further reduce risk cost effectively.

IV.2.3	Evaluation and Comparison of Risk Control Options

Risk management programs shall include a structured process for evaluating and comparing the relative risk reduction benefits and costs of the risk control options being considered. Results of this process should support corporate management decision making.

IV.2.3.1	Evaluation of Risk Control Options

Risk management programs shall include a structured process for evaluating the relative benefits and costs of the risk control options being considered. The evaluation process includes, but is not limited to, an examination of

▪	The current risks to the public, employees and contractors, and the environment that may exist before the proposed risk control option is implemented

▪	The estimated risks to the public, employees and contractors, and the environment that may exist after the proposed risk control option is implemented

▪	The cost (or cost savings) of implementing the risk control option

▪	The potential impact, if any, on the operation or expected life of the pipeline.

The process shall describe the manner in which uncertainties in risk, cost, and other decision factors are addressed. The evaluation processes shall also include (1) an examination of the residual risk expected to remain after the identified risk control options have been implemented and (2) the consideration of additional risk control activities to address these residual risks.

IV.2.3.2	Comparison of Risk Control Options

Risk management programs shall include a structured process for comparing the risk control options being considered. The comparison process shall consider the risk-reduction benefits, the implementation costs, and other relevant factors associated with each risk control option. The comparison process shall describe

1.	The factors being considered (e.g., risk reduction to the public, risk reduction to the environment, cost to implement, etc.)

2.	The methodologies for combining these factors (e.g., expert judgment, focus groups, qualitative logic models, priority matrices, weighted benefit-cost ratios, etc.).

The methodologies used to combine benefits should be compatible with company values and shall ensure that the values of regulators and external stakeholders are appropriately considered.

IV.2.4	Selection of Risk Control Options

Risk management programs shall include a structured process by which management decides whether to take actions including, but not limited to

▪	Implementing the activity in the short term

▪	Deferring implementation of the activity to a later time

▪	Performing a portion of the activity

▪	Deferring the activity for further development

▪	Rejecting the activity

▪	Implementing temporary, compensatory actions to limit risk while other options are being developed and considered.

Implementing the selected set of risk control actions on the pipeline system is intended to provide equal or less combined risk to the public, employees and contractors, and the environment compared to the existing conditions.

IV.3	Performance Monitoring and Feedback

In the risk management process elements discussed in the preceding sections, current risks are assessed and a set of risk control activities are selected to control these risks. Performance Monitoring and Feedback provides a basis for measuring the effectiveness both of specific risk- control decisions and the entire risk management program, and to identify improvement opportunities.

A company's risk management program shall include a performance monitoring process that defines the performance measures selected, the manner and frequency in which data will be collected and the evaluation of performance against expected outcomes. In addition, the performance monitoring process shall evaluate the effectiveness of the specific program and process elements, and address appropriate improvements.

Performance monitoring and feedback addresses the following questions:

What improvements are expected from the risk control decisions? (Section IV.3.1)

What measures best capture these expected outcomes? (Section IV.3.1)

Are the selected risk control activities having the intended effects? (Section IV.3.2)

How can the overall risk management process be improved? (Section IV.3.3)

The performance measures and feedback process element, and its relationship to the other risk management process elements is illustrated in Figure IV-5.

For purposes of the Demonstration Program, the performance measures included in an operator's performance monitoring process are referred to as "local performance measures". Additional company/industry level performance measures have been identified to assess the effectiveness of risk management as a potential regulatory alternative and communicate progress during the risk management demonstration project to stakeholders. These measures will be formalized and provided in a separate document.

The levels at which performance can be measured are defined as follows:

1.	Local: This level measures performance of a subset of a pipeline system specific to the risk management demonstration project. Local performance measures would be monitored by the operator and used internally to allocate resources. They also would be used by the regulator to audit company performance in the demonstration project and ensure that equal or greater levels of safety are being achieved.

2.	Company: This level measures performance of the individual company, encompassing the entire pipeline system. Company performance measures would be used by the company to assess itself and monitor the effectiveness of its risk management program. Selected company performance measures would be used by OPS to develop a consistent industry-wide assessment of the demonstration program.

3.	Industry: This level measures performance of the entire industry by aggregating performance across companies. Performance measures at this level would be used by the government to assess the effectiveness of its regulatory program and, in particular, to ensure that risk management results in equal or greater levels of safety than current levels achieved through compliance with codified regulations.

IV.3.1	Selection of Performance Measures

Applicable measures of performance shall be established and specified for the portion of the system under risk management. Selection of performance measures will depend on the expected outcomes of the risk management program, and shall reflect the selected risk control activities. The progression of a pipeline incident can also be used to guide and structure the identification of performance measures. As shown in Figure IV-6, performance measures can be structured around intended improvements in the prevention, mitigation, or response to incidents.

At a minimum, local performance measures shall meet the following criteria:

▪	Support the intent of the risk management initiative in achieving equal or greater overall safety

▪	Are relevant to the risk control decisions being made in each proposed application, and track their short-term and long-term effectiveness

▪	Document starting conditions, either through historical data, current physical data, new test data, or comparison with similar segments

▪	Establish expected outcomes from risk-control decisions in the form of discrete values or ranges for each measure

▪	Enable auditing, monitoring, and documentation of performance.

Additional criteria that might be considered in the selection of the performance measures include:

▪	Data uniformity

▪	Cost of data collection

▪	Reliability of the measure

▪	Consistency of interpretation

▪	Ability to quantify.

Risk-related measures that could be considered include:

▪	Frequency and severity of incidents that lead to release of product

▪	Likelihood/number of casualties per release

▪	Number of customers or end-users affected per release incident

▪	Extent of environmental damage per release incident

▪	Economic cost of lost delivery per release incident

▪	Precursor or "anticipative" event measures

▪	Other measures specific to the risk control decisions.

Both direct and indirect performance measures are appropriate. Some performance measures provide direct measures of safety. Examples may include incident rates, volume of spills/releases, decrease in corrosion defects over time, and cathodic protection level. Other performance measures provide indirect measures from which safety can be inferred. Examples may include changes in pipeline mass balance (indicating undetected loss of product), right-of- way surveillance (indicating unauthorized activity that might lead to an increase in third- party damage events), customer satisfaction surveys (indicating declining reliability of service), etc.

One of the challenges in selecting direct performance measures for pipelines is that incidents are relatively infrequent. Performance monitoring with traditional event measures (such as reportable incidents) may not identify statistically significant trends. Therefore, risk management programs shall identify precursor or anticipative performance measures that indicate activities or events affecting pipeline integrity with the potential to cause a release of product.

IV.3.2	Monitoring and Evaluating Performance

The performance monitoring process shall define the mechanisms that will be used to collect information on a pre-determined basis; monitor pipeline operating conditions, operating parameters, and physical condition; and track performance against the selected performance measures.

Success of the risk management program can be evaluated by comparing performance with expected outcomes established in the plan. By appropriate selection of performance measures, this can apply to the evaluation of individual risk control decisions as well as to the overall evaluation of the risk management program. The risk management program should identify appropriate time frames to allow statistically significant trends to become evident.

Performance shortfalls can be identified based on differences between actual performance and the expected outcome. In those cases, it may be necessary to acquire additional data to confirm the shortfall, or make adjustments to the risk management program .

IV.3.3	Modifications to the Risk Management Program

The performance monitoring process shall establish criteria indicating when adjustments to risk-control decisions within the risk management program can be made, or adjustments to the risk management program itself are required. The criteria should indicate whether regulator notification and/or approval would be required. These criteria might include percentage deviation from the expected outcome, data quality, time frame, and impact of not making the adjustments (for example, would the problem self-correct?). The risk management program also should define the range of expected adjustments. To avoid bias, these criteria shall be established before a performance variance or deficiency is encountered.

V.	Conclusions

The application of risk management to pipeline operations offers potential benefits to consumers, operating companies, the general public, and the regulatory community. Implementing the program and process elements in accordance with this standard, is expected to achieve safety, environmental protection, and reliability levels equal to or greater than those existing under current compliance codes. An effective risk management program, developed in conformance with this standard, can improve communication with regulators and other stakeholders about risks and risk control priorities. Industry and regulators believe risk management offers these benefits, and the Risk Management Demonstration Program will test and verify this belief.

Appendix A

Joint Risk Management

Program Standard Team

John Gawronski	New York Public Service Commission	(Co-Chair)

Denise Hamsher	Lakehead Pipe Line Company	(Co-Chair)

Andy Drake	PanEnergy Corporation

David Feiglstock	Chevron Pipeline Company

Bruce Hansen	Office of Pipeline Safety

Dave Johnson	ENRON Operations Corporation

Fred Joyner	Office of Pipeline Safety

Anthony Karahalios	Colorado Public Utilities Commission

Jerry Langley	Williams Pipeline Company

Keith Leewis	Gas Research Institute

Robert Leonberger	Missouri Public Service Commission

Stuart Schwartz	Riverside Technology, Inc.

Nancy Wolfe	Office of the California State Fire Marshal

John Zurcher	Tenneco Energy

Team Staff

Henry Cialone	Battelle Columbus

Mike Cowgill	Radian International

Doug Read	American Petroleum Institute

Jim von Herrmann	Cycla Corporation