Protocol Area C. Identify Threats, Data Integration, and Risk Assessment

C.01 Threat Identification

C.02 Data Gathering and Integration

C.03 Risk Assessment

C.04 Validation of the Risk Assessment

C.05 Plastic Transmission Pipeline

Explanation of Protocol Format

Each protocol element will have top-tier protocols that address the high level requirements. The regulatory requirement upon which the protocol is based is contained in brackets; e.g., [§192.905(a)]

Each top-tier protocol will have detailed "sub-tier" protocols which collectively lead the inspector to draw overall conclusions about compliance with the top-tier protocol. The regulatory requirement, upon which each sub-tier protocol is based, is also contained in brackets.

• The typical sentence structure used in the protocols follows the form of "Verify that [describe the requirement]." The use and meaning of the term "verify" is expanded upon below.
• PHMSA will "verify" an operator’s compliance status with respect to each requirement. In order to perform this verification, PHMSA will inspect the operator’s documented processes and procedures in order to determine if a program has been established that complies with rule requirements. In addition, PHMSA will inspect an operator’s implementation records to determine if the operator is effectively implementing its programs and processes. The purpose of the PHMSA verification/inspection is not to perform a quality check of every integrity related activity. The PHMSA inspection is conducted in the form of an audit. As a result, the PHMSA inspection will typically perform an inspection of selected operator records sufficient in breadth and depth to give the inspection team adequate understanding regarding the degree of an operator's commitment to compliance with applicable requirements and/or the degree to which the operator's program has been effective with respect to achieving compliance. PHMSA may use any number of inspection or audit techniques to identify potential compliance issues. Program documents may be inspected to determine if adequate processes have been developed and documented to the degree necessary for competent professionals to understand and effectively implement the process with results that are consistent and repeatable. For example, one technique that might be used by the inspection team is a "vertical slice" in which a specific covered segment or pipeline system is selected to perform a detailed inspection of every aspect of integrity management, thus following a specific example through the entire process of integrity management. Based on those reviews, OPS will identify potential non-compliances with rule requirements. PHMSA can not and will not certify nor conclude that an operator is in full compliance with rule requirements, even if the inspection does not identify any areas of non-compliance. Operators are wholly responsible for compliance with regulations.
• References to regulatory requirements may include references to specific rule sections/paragraphs and/or to industry standards that are invoked in the rule. As specified in §192.7, any requirement invoked by reference is a requirement of the rule as though it were set out in full in the regulation.
• Protocols are subject to change without notice.
• Protocols are an initial guide for use by OPS inspectors during Integrity Management inspections. Inspectors will develop additional questioning during the course of the inspection to investigate the specifics of an operator's program. Protocols are not to be construed as an exhaustive list of questions that may be presented to operators during an inspection.
• Protocols are made publicly available as a courtesy to operators as they develop their Integrity Management program, as well as other stakeholders.