Document 1800449

Health and Safety
Executive
Risk leadership and organisational type
Prepared by Lancaster University
for the Health and Safety Executive 2009
RR756
Research Report
Health and Safety
Executive
Risk leadership and organisational type
J S Busby & A Collins
Lancaster University Management School
Lancaster Universtity
Lancaster
L41 4YX
The anecdotal experience of new entrants in the UK offshore industry is that they are not, as a group, safer
or less safe than established organisations. Similarly, the organisational arrangements that are sometimes
associated with new entrants – such as the separation of ownership and operation – are not clearly less safe
than more traditional arrangements. What seems to matter more is a deeper capacity to make chosen ways
of organising work. This particularly involves being ‘rigorous’: not just developing effective safety practices but
dealing with the by-products and side-effects of such practices.
An analysis of a set of accident reports, and a set of interviews carried out with HSE inspectors and staff in
five offshore operators, produced a detailed account of what this kind of rigour looked like in practice. The
analysis also indicated that being rigorous was an organisational practice that itself had by-products needing
to be managed. So rigour needs to be seen as a continual practice of being committed to particular actions
and at the same time being attentive to the consequences. Rigour of this kind points to a strong emphasis on
leadership – leadership that promotes an attention to refining practice that does not seem to come naturally or
easily to organisations.
Organisations that were new entrants to the industry faced problems that made particular demands on their
capacities to be rigorous. For example, they had to maintain safety while managing transitions in ownership
and organisational culture, getting used to new labour market conditions and regulatory requirements, and
coping with the physical and organisational legacies inherited from previous owners of an installation. The
recommendation is that this concept of rigour becomes a part of the way in which safety management
systems are scrutinised.
This report and the work it describes were funded by the Health and Safety Executive (HSE). Its contents,
including any opinions and/or conclusions expressed, are those of the author alone and do not necessarily
reflect HSE policy.
HSE Books
© Crown copyright 2009
First published 2009
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner.
Applications for reproduction should be made in writing to:
Licensing Division, Her Majesty’s Stationery Office,
St Clements House, 2-16 Colegate, Norwich NR3 1BQ
or by e-mail to [email protected]
ACKNOWLEDGEMENTS
Many thanks are due to all those who gave up their time to
be interviewed, and to those who arranged access for us to
their organizations. All were generous with their time, went
to some trouble to make themselves available, and offered
their opinions freely and openly. The costs of the interviews
to these organizations were borne by them. As a condition
of participation both the individuals and the firms involved in
the interviews remain anonymous, but we are very grateful
for their help and considerable insight. Particular thanks are
due to Rob Miles of the HSE.
ii
CONTENTS
1
2
3
4
5
6
7
8
9
10
Introduction
Background
Methods
Aspects of rigour
Relationships among the aspects of rigour
Rigour in new entrants
Leadership and rigour
Recommendations
Conclusion
References
1
4
7
11
26
32
37
40
44
46
iii
iv
EXECUTIVE SUMMARY
The UK offshore industry has, like certain other industries, seen the entry of new operators:
operators with extensive experience elsewhere but new to the UK, and in some cases operators
with extensive experience in other roles but new to being a Duty Holder operating with an
Offshore Safety Case. The purpose of this study was to investigate what this meant for the
safety of offshore operations, and what implications it had for the way HSE scrutinized these
operations.
As in other industries, such as aviation, it has been very difficult to find objective evidence on
the comparative safety performance of organizations new to the UK offshore sector in relation
to established operators. Moreover, new entrants often take over installations formerly operated
by established companies. So their immediate safety record can say more about the legacy they
inherit than their way of organizing. Even if one group or other were objectively safer, in a goal
setting regime a regulator cannot simply impose one way of organizing. Therefore this study
focused on process and practice rather than outcome.
In addition, anecdotal evidence did not mark out particular ways of organizing as being less or
more safe than others. Having large technical staffs and a strong reliance on rules and
procedures was not clearly better or worse than the opposite, for example; and subcontracted
activity was not clearly better or worse than in-house activity. Therefore the study looked
particularly at the deeper capacities – or ‘rigour’– that organizations exhibited, rather than their
chosen ways of organizing. A central aspect of this is that, instead of addressing the direct
question of how an organization deals with its circumstances, it addresses the question of how it
deals with the needs and by-products of its way of responding to these circumstances. For
example, what was most interesting was not whether an organization used high levels of
protective redundancy to minimize risk in a particular system, but whether it managed the sideeffects of relying on redundancy (or the side-effects of not relying on redundancy).
This involved looking for aspects of rigour in the way people understood both failure and the
absence of failure. First, in a relatively small exercise, a set of offshore accident reports was
analysed. Second, in a larger exercise, a set of interviews was carried out in HSE, three new
entrant operators, and two established operators. Seventy-seven interviews were conducted in
all, and both interviews and reports were analysed qualitatively. The result was a description of
what it means for an organization to be rigorous in its management of safety: a set of qualities
that helped deal with the requirements and by-products of the way an activity was organized.
For example, one aspect of rigour was the quality of being ‘situated’: of avoiding the use of
over-generalised approaches to dealing with situations that arose from trying to be consistent.
However, qualities of this kind have by-products themselves, so rigour needs to be seen as a
process of continually dealing with the consequences of the way you work.
Some of these qualities were particularly important to new entrants because they involved
transitions in ownership, responsibility or practice. These were most often and most clearly
encountered when a new operator acquired an existing installation. Such qualities were evident,
in interviewees’ observations, sometimes because they were present and sometimes because
they were absent. They provide a basic approach for a scrutinizing body, such as HSE, to look
at organizations – whether they are established operators or new entrants – that seems to be
equally applicable to all kinds of organization, regardless of the ways of organizing they have
chosen. They also have important implications for safety leadership: they point to what it is that
leaders need to bring about, in organizing for safety, that does not naturally or inherently exist
in organized activity. Such leadership does not need to be exercised by people with formal
authority. But it does require an insight into how organizations achieve and fail to achieve
v
safety in a way that gets beyond the shallow and literal understanding of what we think of as the
typical resources that organization have in order to achieve safety – like redundancy.
Our recommendation is that the scrutiny of operating organizations’ safety management systems
and processes draws on this concept of rigour as managing the by-products of the way you
manage safety. It suits a goal-setting approach because it emphasizes not the organizational
model that operators choose but their capacity to follow through on the implications of their
chosen model and ensure it produces safety. It is an approach that suits all kinds of organization,
but naturally suits an industry in which there are new entrants that are making different
organizational choices from established companies, and which face additional challenges as a
result of their status as new entrants.
iv
1 INTRODUCTION
Recent years have seen the entry of small, low-cost operators without large technical staffs, long
historical experience and extensive standards to intrinsically hazardous industries, such as
aviation and offshore hydrocarbons extraction. Perhaps unexpectedly there appears not to have
been a marked increase in failures – either as near-misses or fully-developed breakdowns. This
raises basic questions about whether high reliability organization (Roberts, 1990; La Porte and
Consolini, 1991; La Porte, 1996) means adhering to one particular way of organizing, or
whether different ways of organizing (for example with highly formal, rule-oriented systems, or
with much more informal, more negotiated approaches) can achieve similar levels of reliability.
And if different ways of organizing can be equally reliable, what is that makes them equally
reliable, and what differentiates reliable from unreliable organizations?
This also raises questions about how regulators deal with hazardous operations. How far, for
instance, should they insist on codified practices and standards, how much technical expertise
should they expect within the operating organization, and how much can they rely on formal
processes of risk assessment? Past studies point to the importance of regulatory inspections in
producing the kind of behavior in operating staff that produces high reliability (La Porte and
Thomas, 1995), but this probably depends on inspections that support rather than undermine the
right kinds of behavior.
The purpose of this study has been to investigate issues of safety surrounding new entrants in
the UK offshore industry, and in particular to compare and contrast how new entrants and
established operators achieve safe operations. To quite a large extent this has involved looking
at the organization on installations that changed ownership, generally passing from established
firms to new entrants, often close to the end of the installations’ design lives. We have not,
however, tried to measure objectively whether new entrants as a group are safer or less safe than
established operators. One problem with trying to do this is that the events of interest – large
scale catastrophic failures – are rare. Another is that using proxy outcomes like leaks, or
regulatory actions (such as prohibition notes) is not particularly informative. Such outcomes
appear to be as much a function of the legacy that current owners may have been left as the way
the current owners organize their activity. Two of the more serious failures described by
interviewees in our fieldwork concerned systemic vulnerabilities that had been inherited from
previous owners of an installation. The same problem has been encountered in studies of other
industries where there has been a large influx of new operators, such as the aviation industry
following deregulation. Although in aviation (in the US especially) there is a good deal more
data on the relative performance of established firms and new operators following deregulation,
analysis still seems to be inconclusive (for example Bier et al, 2003; Oster et al, 1992).
Moreover, even if we could somehow determine that (on average) being a new entrant made an
operating firm more reliable or less reliable, this knowledge could not easily be acted on.
Specific firms may well operate quite differently from the ‘average’ of their group. And firms
cannot simply be made into new entrants or established operators, nor simply have the qualities
of new or established operators imposed on them. From a regulatory standpoint, if a company is
operating within the law the regulator has little basis for telling it to change its nature or
practice.
In fact, as suggested at the start, the anecdotal evidence seems to say that there is no one type of
organization – whether established or new, whether highly bureaucratized or relatively informal
– that is conclusively better. In a small number of interviews that preceded this work, several
regulatory inspectors instead pointed to a somewhat vaguer, but deeper, explanation of
1
reliability. This essentially concerned the capacity of organizations to recognize the implications
of whatever ways of organizing they had chosen, to refine whatever practices they had chosen,
and to ‘follow through’ on their choices. It was less the particular organizational choices they
made (for example about whether to subcontract certain activities or operate them internally),
and more the thoroughness with which they put those choices into effect. This is not to say that
the choices were arbitrary. But the basic feeling was that they were less instrumental in
achieving reliability than the capacity to make those choices work. For example, in some cases
the organization owning an installation was quite different from the organization that operated
it. What mattered to safety, in the experience of some observers at least, was not whether
ownership and operation were separated, but whether the consequences of this separation were
fully understood and thoroughly managed.
Figure 1 summarises this basic rationale.
Figure 1 Rationale for the research approach
Outcomes of
interest ( major
accidents) are
too rare to
measure
Proxy measures (eg
leaks, regulatory
actions) are as much a
function of physical
legacy as current way of
organizing
You cannot
dictate particular
ways of
organizing in a
goal-setting
regime
Different firms
seem to be able to
make different
ways of organizing
equally effective
Investigation of the deeper
capacities that produce safety
and their particular application in
new entrants
This focus – on the deeper capacities of organizations to follow through on their decisions about
how to manage safety – means that we are less concerned with the direct problem of ‘how does
an organization manage hazards?’, and more concerned with the indirect problem of ‘how does
it deal with the needs and by-products of its own way of responding to these hazards?’. In the
case of new entrants there seem to be particular circumstances that they need to be good at
dealing with: for example, the legacy problems of taking over existing and sometimes old
installations. Our primary interest has been in what happens when new entrants respond to these
problems, as shown in Figure 2, and whether they have the capacity to manage this. Such a
focus is consistent with the idea that organizations’ ‘encounters with risk’ (Hutter and Power,
2005) are as much encounters with their own limitations and by-products as they are with
external threats. Organizations managing risk have to deal with the all the problems that arise
from organizing itself, quite apart from the problems that their environments present them with.
2
Figure 2 Capacities for dealing with the problems produced by organization
Circumstances as
source of hazard
• Eg legacy of
unknown
integrity of
safety
procedures
Organizational
response to this
hazard
• Eg
superimpose
own standards
of procedural
compliance
Problems created
by organizational
response
• Eg current
systems for
ensuring
procedures
are feasible
are
inadequate
Deeper capacities
for dealing with
problems of
organization
• Eg strong
socialization to
ensure
emerging
problems are
known about
The study involved an analysis both of how failure had occurred in the past and how reliability
or safety were being accomplished in the present. The analysis of failure involved a survey of
offshore accident and incident reports; the analysis of accomplishment involved a programme of
interviews of HSE inspectors and staff in operating companies. Three of the operating
companies were, in one sense or another, new entrants, and two were established firms. In the
remainder of the report there is a short review of the relevant literature, a description of the
methods used in the study, an account of the findings, and a discussion of what we can infer,
and what implications this has. The aim is to provide guidance to HSE, in particular, on how to
scrutinize the way offshore operations are organized and managed.
3
2 BACKGROUND
The purpose of this section is to review the relevant literature, very briefly. The literature that
most obviously concerns the way in which organizations attain very high levels of safety is that
on high reliability organizations (or HROs). This literature points to a number of ways in which
social organization solves the problem of making inherently hazardous systems acceptably
reliable. It refers to redundancy and slack of various kinds (for example Roberts, 1990; Rochlin
et al, 1987; Schulman 1993). It places considerable stress on learning from simulated rather than
concrete experience (Weick, 1987), on the continuous search for improvement (La Porte, 1996),
and on the avoidance of blame (La Porte, 1996; Grabowski and Roberts, 1997). It refers to
notions of ‘heedful inter-relating’ (Weick and Roberts, 1993), ‘collective mindfulness’, (Weick
et al, 1999) and ‘extraordinarily dense’ patterns of cooperative behavior (La Porte, 1996). And it
draws on the idea of cultures of reliability (Weick, 1987) and flexible, expert-centred authority
structures (Roberts et al, 1994; La Porte and Consolini, 1991; La Porte, 1996; Bigley and
Roberts, 2001).
There is also a recurring theme of strength in adversity. What gets an organization from having
merely ordinary levels of reliability to high reliability is, counter-intuitively, an environment
that is particularly testing. Or it is the apparently counter-productive and self-confounding
behavior of the organization itself. So, for example, Weick (1987) points out that reliability
tends to increase when performance pressures are high, rather than low, as can be seen by the
fall in error rates when air traffic control centers are handling heavy workloads. It turns out that
it is in conditions of heavy, rather than light, load that air traffic controllers sweep the entire
radar screen. Rochlin et al (1987) essentially say that the instability and turbulence produced by
regular crew turnover and rotation on naval vessels is a source of, not impediment to, reliability.
The continual retraining that this requires seems to avoid the loss of vigilance that Rochlin et al
associate with more stable ‘civilian’ organizations. It also leads to a regular scrutiny of
operating procedures that makes them more robust. And the movement of people about the
naval organization rapidly diffuses lessons learned from practice. Early ideas about HROs
seemed to contradict the notion of strength in adversity, referring for instance to the ‘buffering’
of environmental surprises and protecting the stability of a technical core (La Porte and
Consolini, 1991). But subsequent work emphasized accepting and dealing with fluctuations
instead of trying to remove them, seeking resilience rather than invariance, and tolerating and
even protecting organizational ambiguities in order to cope with unforeseen events (Schulman,
1993; Roe et al, 2005).
This idea of strength through adversity seems explicable when we look at the quality of
collective mindfulness that Weick et al (1999) particularly stress. Adversity produces reliability
because it provokes a compensating, or even over-compensating reaction, provided there is
mindfulness of this adversity. This notion of reflecting on what makes a setting adverse is
particularly striking when the adversity is of your own making – which is seen most clearly in
Rochlin et al’s (1987) examples of what the US navy does to make life difficult for itself, yet
seems to profit from.
The idea of being mindful also reflects what Weick wrote earlier (Weick, 1979): ‘Most
managers get into trouble because they forget to think in circles. Managerial problems persist
because managers continue to believe that there are such things as unilateral causation,
independent and dependent variables, origins, and terminations’. Reliability is not simply a
function of a series of identifiable factors, whether internal to an organization or external: it is
equally a function of how those factors are interpreted and responded to; and even a function of
how the responses are responded to. Thus forgetting to think of organization in this circular
4
pattern seems likely to lead to the view that the problem of reliability is simply making the right
choices of organizational structure or process – whereas a better view would be that reliability is
obtained by continually acting and reflecting in order to act again. This takes us very close to
the point we reached in the Introduction: the idea that what seemed to matter was making your
choices work, rather than making the optimal choices in the first place. The particular point
about strength from adversity is that continuing adverse conditions are a stimulus to take this
more circular approach to achieving reliability.
The main challenge in achieving organizational reliability becomes the appreciation of this
circularity when there are good reasons to avoid acknowledging it: the need to solve problems
once and for all, and the need to demonstrate progress and improvement, for example. Attaining
this appreciation, an appreciation that seems deeper than the more obvious reliance on particular
safety-oriented practices and devices, is perhaps the best way of describing what we could mean
by ‘rigour’. ‘Rigour’ was a term that interviewees, across all the participating organizations,
occasionally used to say there was a right, appropriate or proper way of acting: one that
suggested a deeper, more serious or more committed approach. For example it was occasionally
used as a criterion for comparing organizations:
‘What was working at X like in comparison with Y? There is no comparison really… in
respect of how we manage safety, if that’s what we’re looking at in particular, I think
there was a lot less rigour at that point.’
It was used as a way of saying that specific measures, like procedures, only take you so far:
‘…it was one of those cases where operations thought that X were doing one thing and
X thought they were doing something else… so yes you’ve got to have these procedures
in place but at the end of the day you have to have the rigour of the… people’.
It was used as a way of indicating that merely ‘having’ safety management or (in this case)
integrity management was not enough:
‘…a big issue was our integrity management… there was not a culture of rigorous
integrity management’
It was used to indicate that an organization was dealing with issues of integrity and safety but
that its efforts were in some way still incomplete:
‘…just to stay under control of an organisation of this scale you have got to go towards
standardisation and a lot more rigour around that... But the rigour of, quality closure of
actions, quality compliance of procedures, it’s just, it’s an area that we’re working on’’
It was used to indicate a certain depth of protection:
‘I think with a new operator, a smaller operator, just in general, that tolerance for risk
can be greater, in which case not quite the same number of barriers get put in place…
Putting all those barriers in place… to me implies rigour. We would apply a more
rigorous approach to risk awareness and risk mitigation than perhaps small
organizations.’
And it was used to say that ways of doing things were thorough, painstaking and properly
completed:
‘…you know there’s quite a rigorous process by which we record what we’re going to
do, risk assess what we’re going to do, get everyone to buy into what we’re going to do
etc etc. Then close out when we’ve done it, document that you’ve done it and update
any necessary bits and bobs paperwork wise.’
Our use of the term ‘rigour’ therefore broadly seemed to fit the way in which interviewees used
it.
The reason for not simply reusing the term ‘mindfulness’ as found in Weick et al (1999) and
Weick and Sutcliffe (2006) is that it is not just about being mindful, it is also about acting on
this mindfulness. We can see this in Weick et al’s (1999) formulation of mindfulness – which is
strongly cognitive – set beside Sagan’s more political thinking (1994). Organizations that are
political do not see an automatic translation of mindfulness into action, as in fact Rijpma (1997)
5
points out. Learning starts out as cognition, but then has to become politics in order to have any
effect. Therefore we have stressed not so much a mindful way of thinking as a rigorous way of
acting – a way of acting that, in particular, involves attending to the consequences and
entailments of whatever ways of organizing have been chosen by the actors in question. The
‘rigour’ label is the closest we could get to this idea. Rigour also has the advantage of not
privileging any particular source of reliability-enhancing factors. It does not say that the source
has to be culture, or psychology, for example, because in principle either could be a source of
rigorous notions of acting, as could rule systems, or physical devices.
This is consistent with the notion, explained in the Introduction, that what matters in the
achievement of reliability is less the choice of ways of organizing, and more the attention to and
(over)compensation of the consequences and entailments of this choice. This seems to fly in the
face of traditional thinking that stresses specific means of attaining reliability, like redundancy.
But the extent to which redundancy really confers reliability is disputed anyway (for example
Sagan, 2004). There are some kinds of redundancy, in some situations, that seem to be worse
than useless: for example the social redundancy in which person A is meant to be checking the
work of person B, but where both fail to do any checking knowing that the other will be doing
it. A better statement about redundancy would be to say that reliability comes from either 1)
having high redundancy and coping with the consequences or 2) having little redundancy and
coping with the consequences of that. What matters is acting on the consequences of having
more redundancy or less redundancy, just as much as the choice of how much redundancy to
have.
6
3 METHODS
3.1 RESEARCH DESIGN
The were two main parts to the method: the first to analyse what the nature of failure said about
rigour, when it was absent; the second to analyse what the nature of success (the avoidance of
accidents, so far) said about rigour when it was present. Data for the first was provided by
reports of offshore accidents; data about the second was provided by a range of interviews. This
data was not used as objective evidence of what made offshore operations safe or unsafe, but as
evidence of organizations either failing to, or managing to, be rigorous: failing or managing to
deal with the by-products of their ways of working. These particularly concerned ways of
working that were meant to be safe. But we have not tried to infer any simple relationships of
cause and effect between being rigorous and being safe. For example, in one interview,
someone claimed that building safety incentives into outsourcing contracts was important to
avoid such contracts rewarding apparently productive but unsafe behaviour. This was evidence
of a kind of rigour – recognizing that a consequence of relying on contractors’ common sense to
keep them safe could be defeated by contracts that rewarded productivity, and changing the
contracts so that they also rewarded being safe. But we cannot assume that any organization in
any situation doing the same thing, in some mechanistic way, will make it safe.
The basic approach was to find as many examples of this kind as we could in the data, to group
them into general categories, and then to ask how they were related to each other.
3.2 ACCIDENT REPORTS
The accident analysis was the smaller of the two parts of the work. The findings contribute to
the final conclusions, but the exercise also provided important background for the interviews –
notably by helping the interviewers understand some of the context in which interviewees were
talking.
It involved two datasets: 1) a set of 40 incident reports published by the StepChange
organization, which are mostly of minor incidents on offshore installations in UK waters,
analysed informally by local individuals, and 2) a set of 34 MMS (Minerals Management
Service) investigatory reports on incidents in the Gulf of Mexico, which are much more
extensive accounts of more formally investigated cases. The StepChange reports are typically a
page or so of narrative, whereas the MMS reports are typically 40 pages of narrative with
diagrams and photographs. There are limitations in both datasets, and in the whole process of
analyzing such reports. They may give a misleading view in hindsight of what was really
knowable at the time, and they are the interpretations of particular individuals. As public
documents they are also very likely to be subjected to self-censorship. Nonetheless our aim is
not to diagnose particular incidents definitively, but to find out how organizations practice, or
fail to practice, rigour in the sense described earlier.
The procedure was to work through each report and look for causal or contributory factors that
involved in some way 1) choosing a way of organizing and 2) failing to manage the
consequences of this choice. Each factor of this kind was generalized upon as a kind of rigour.
For example, in one case a permit-to-work system was not fully understood and as a result not
properly used. This was inferred to be a case of ‘rigour as giving substance to a nominal
system’. In other words, there was a system in name but, in the absence of an understanding
7
how to use it and an understanding of why to use it, it remained nominal or token and incapable
of achieving what it was supposed to achieve.
An attempt was then made to produce general aspects of rigour from these specific deficits. For
example, the idea of rigour as making a nominal system into something that was properly
implemented was seen as an example of a general idea of ‘substantiveness’. In other words, one
aspect of what we mean by rigour in an activity is that it is substantive, dealing with substance
not mere form or appearance. This process of going from particular observations to general
aspects of rigour was inductive rather than deductive – and involved stripping away aspects of
the context in particular cases that seemed uninteresting. This is a subjective process, as a
particular analyst makes his or her own judgment about what is interesting, and it assumes that
there is no objectively correct way of categorizing some phenomenon. Also, in many cases, the
same incident could be categorized in more than one way, so that sometimes several aspects of
rigour were implicated in one case. The main reason for adopting such a method, despite its
subjectivity, is that it suits the purpose of drawing as much as possible from the insights of those
writing the reports, and at the same time organizing them in a way that fits the general idea of
rigour as a deeper capacity for making activity safe.
3.3 OPERATOR AND INSPECTOR INTERVIEWS
The dataset here consisted of verbatim transcripts of unstructured interviews with 1) 15 offshore
installation inspectors in HSE and 2) a range of staff (from technicians to production directors)
in five offshore operating companies. Please see Table 1 for a list of the interviews in the five
companies. We undertook not to disclose the identity of the companies or the interviewees. The
aim was to interview people across a wide range of seniorities in each company, with a roughly
even distribution between operations staff and health and safety staff, but we were limited by
individuals’ availability during the period given over to fieldwork.
The interviewees in HSE were asked about their backgrounds, their duties as they saw them,
and the particular operating companies with whom they were involved. They were asked about
their experiences and observations of these companies in terms of their organizational and
managerial qualities, and how these seemed to have been linked to safety.
The interviewees in operating companies were first asked to talk about their duties and their
activities, and then their roles in safety – both formal and informal. They were asked about
issues that had arisen in our discussions with inspectors about them, and about issues that had
arisen in earlier interviews in the same company. For example, where there had been significant
events during the change of ownership of an installation, it was important to get the perspective
of different people on what practices had in fact been relevant at the time, and how these had
contributed to or undermined safety.
The aim was not to achieve an accurate, factual account of specific events but to get
interviewees’ observations, experiences and insights into how different practices were linked to
safety – and in particular to identify different aspects of the ‘rigour’ we described earlier. If
someone talked about some practice contributing to safety because it dealt with some
organizational issue or problem we took it at face value as an aspect of rigour. This does not
mean we simply accepted this as an accurate account of what happened in a particular situation.
There was no attempt in the interviews to ask a single, common set of questions as it was
important to be able to follow up on interesting accounts and explanations and gain both a
deeper and more concrete understanding of what interviewees had inferred from their
experience. Interviewees’ insights were gathered both when they were offered in an affirmatory
8
sense (saying a particular aspect of rigour was found in their organization) and in a negative
sense (saying an aspect of rigour was missing).
Table 1 Interviews in operating companies
Nature of organization
Interviewees
Medium-sized operator, 16, ranging in seniority from technician to director, of which 9 had health and
relatively recent entrant safety posts specifically
to the UK sector
Medium-sized operator, 15, ranging in seniority from operator to director, of which 4 had health and
relatively recent entrant safety posts specifically
to the UK sector
Medium-sized operator, 11, ranging in seniority from engineer to offshore installation manager, of
relatively recent to the which 6 had health and safety posts specifically
roles of ownership and
duty holder-ship
Large operator,
established in the UK
sector over a long
period
13, ranging in seniority from technician to head of sector, of which 5 had
health and safety posts specifically
Large operator,
established in the UK
sector over a long
period
11, ranging in seniority from technician to UK health and safety manager, of
which 4 had health and safety posts specifically
The interview transcripts were analysed in a ‘grounded’ way: that is, without a preconceived
theory, only the general principle of looking for aspects of rigour. An example was of how
people described the function of the safety organization within their firm. Some, for example,
said in a straightforward way that this should be subordinate to the operating organization;
others, at the same, said that they recognized a danger was that the safety organization would
lose its capacity to think and act independently, and talked about how to preserve this
independence even when it was the operating organization that ultimately made decisions and
held budgets. The second kind of response we took as being an example of rigour. It points to a
deeper capacity than simply having a safety organization, and simply having a clear definition
of its responsibilities, and it deals with a by-product of giving this organization a particular kind
of official relationship with the operating organization.
As with the accident analysis, an attempt was made to find a way of grouping and classifying
these qualities, and of then looking at their inter-relationships. The procedure was similar to
established processes of grounded analysis (for example Glaser and Strauss 1967), although
various elements – like sampling – were determined by what was feasible rather than what was
theoretically desirable. The basic procedure of generating classifications of things, and looking
at their similarities and differences, is also a common one (for example Schatzman and Strauss
1973; Strauss and Corbin, 1990). For the justification for such methods please see texts on
qualitative research (for example Berg, 1989; Bryman and Burgess, 1994; Mason, 1996;
Walker, 1985).
In some organizations, the same aspect would crop up in different interviewees’ accounts as
being present and absent, but this was sometimes in the context of different installations, so we
9
did not try to make any inferences from such apparent discrepancies. Also, many of the
absences were past rather than present: they were descriptions of some kind of rigour that had
been absent in the past – that may well have come into existence in the present. This means that
our data cannot be used to say that one organization is better than another because it somehow
demonstrates more rigour.
Finally, it is important to reiterate that we did not try to assess whether interviewees were
making factually correct assertions. We naturally noticed in the course of the interviews within
a particular organization whether people made contradictory statements about whether particular
practices existed or not. In one, for example, there was no consensus about whether the
organization had a ‘just culture’. What was of more interest to us were interviewees’ insights
into the consequences and by-products of such practices, whether they are approved of them or
not, and whether they thought they existed or not.
10
4 ASPECTS OF RIGOUR
4.1 ASPECTS FROM THE ACCIDENT REPORTS
The main qualities that we inferred from the accident reports as being distinct aspects of rigour
are shown in Table 2, together with brief explanations. These were our generalizations on what
the report writers had somehow indicated were important aspects of organizing that would have
contributed to safety or reliability, which we interpreted as being somehow additional to, or
deeper than, a choice of how to organize.
Table 2 General aspects of rigour inferred from accident reports
Aspect of
rigour
Explanation
Being
analytical
Being thoughtful, formal, penetrating and profound rather than shallow and intuitive
Being
authoritative
Being a source of authority, expertise and direction, and being willing to exercise
power
Being
bounded
Being constrained in your ambitions and objectives, not extending capabilities too far
Being
collective
Being concerned to involve people widely, to consult, to engage in joint decision
making
Being
compliant
Being willing to follow agreed norms and standards
Being current Being up-to-date, being adapted to the existing environment, being aware of change
from an historical norm or expectation
Being
embodied
Being put into a concrete, specific form in contracts, agreements and so on that create
obligations
Being engaged Being actively a part of a larger system, and being connected with others working to
achieve the same ends
Being
informative
Being a source of information and understanding for those who have dealings with the
activity
Being planful
Being systematic in making prior arrangements and plans
Being
reflexive
Being able to reflect on the limitations and consequences of the activity itself
Being
resourced
Being supported by sufficient and appropriate resources, including aids and assistance
Being
sceptical
Being aware of, and inquisitive about, potential problems, errors and differences of
interpretation
Being serious
Being sufficiently concerned, conscientious and energetic, not being casual, passive or
superficial
Being situated Being tailored to specific circumstances and not just lazily inherited from a general
procedure or practice
Being
substantive
Being concerned with substance, action and deeper implications, not being merely
token or nominal
11
Aspect of
rigour
Explanation
Being
unambiguous
Being clear and specific and leaving no problematic or unproductive doubt
Being uniform Being similar or consistent in different places or on different occasions, without
unconsidered variation
Many of these are pedestrian and offer little insight: for example the quality of being resourced,
or being serious, or being bounded in your ambitions. They are qualities that most people would
naturally look for in an organized activity. Others repeat themes found in the literature outlined
in Chapter 3: for example, the idea of scepticism – of an organization that looks for signs of
vulnerability or failure instead of making a default assumption that, in the absence of anything
particularly obvious, all will be well. But some emphasise qualities that some of the literature
tends to discount – like being ‘planful’. And, as we describe further in the next sub-section,
some look contradictory.
Table 3 gives examples for each of the qualities in specific cases. The table shows the source of
each example, our very brief outline of how the accident was diagnosed, and the rigour that the
diagnosis seems to imply. It is important to emphasise that the same case was often a basis for
inferring several qualities, so the aspect of rigour linked to a case in this table was not intended
as a way of encapsulating the case as a whole. The most relevant aspect of the diagnosis to the
aspect of rigour in question, in each example, has been italicized.
Table 3 Examples of the aspects of rigour found in accident reports
Quality of
activity
implying
rigour
Shortfall in
Case source
rigour in case
Diagnosis in case
Being
analytical
Failure of
individual to
carry out
reasonable
technical
calculations
MMS 2007037
Ejected
tubing and
loss of well
control
Attempt to free stuck tubing led to parting and ejection of
slips that struck an individual and led to loss of well
control; failure by the deceased to calculate adequate
safety factor when determining maximum pull force;
deceased acted beyond his authority; ineffective
managerial oversight at all levels; operator entirely reliant
on consultants; operation should in any case have been
shut down and regulator approval sought; neither of the
operator’s supervisors shut down the job in spite of the
safety violations and unsafe work practices – nor report
these to their managers; the operations manager approved
the activity with assumptions he failed to verify and was
disengaged from day-to-day operation; he also failed to
follow up an unmet request for details of the procedure; an
office consultant was misinformed about the operation but
failed to make any visit and failed to recognise potential
conflict of interest with the deceased representing two
firms
Being
authoritative
Failure to
know of
individual’s
MMS 2004046
Crushing by
Person walked unobserved to crane side of pipe rack and
attempt to stop load swinging led to fatal crushing;
employee’s enthusiasm evidence on previous occasions
12
Quality of
activity
implying
rigour
Shortfall in
Case source
rigour in case
Diagnosis in case
lack of
qualifications,
failure to
address past
transgressions,
failure to
address him
directly
and supervisory failed to act on this or his inexperience;
supervisor was ignorant of his lack of formal training,
allowed insubordination and failed to deal with individual
directly, contributing to command uncertainty; company
had no training schedule or policy; company failed to have
documented directions for representative on site
swinging
suspended
load
following
supervisor’s
ignorance of
lack of
formal
training
Being
bounded
Absence of
StepChange
danger area as 973
exclusion zone Tow pin
incident
Tow wire snagged, came free, caused person to step back
and be caught in closing tow pins; tow pins did not have
audible alarm when operated; due to crew change
occurring at same time tow pin operator was distracted;
revised set of procedures include only raising one tow pin
a time, danger area around pins to ensure no crew
members inside whilst pins operated; management of
change due to increased hazards while crew changing
Being
collective
Failure to
ensure that the
job safety
analysis was
attended by all
relevant staff
MMS 2007045
Tubing
fracture and
BOP fall
Tubing supporting BOP stack assembly bent suddenly
under the load causing the BOP to break free and fall
overboard. A CT technician was attached to the BOP
Assembly by his safety line and was pulled overboard.
There were no engineering calculations, the temporary
work platform precluded attachment of safety lines, there
was a lack of detailed planning and no discussion of
potential anomaly, the contractors were not involved in the
planning who did not know the unusual nature of the setup until reaching site, there was no JSA meeting or shift
hand-off meeting, and no oversight of the contractor by the
operator
Being
compliant
Failure to
follow
corporate
safety
guidelines
MMS 2005078
Snagged
barricade
carried up
and fell
Barricade snagged because shackle installed pin-up and
shackle had no shims to centre it. Failure to follow
corporate safety guidelines requiring pre-checks and
spotter not leaving post during man-riding. Also, uncertain
command structure introduced a lack of organization and
work direction, led to failure to perform job safety
analysis, and allowed violation of guidelines. Possibly also
unusual level of fatigue following long transport time and
attenuated rest period
Being
current
Mothballing
of item
avoided
upgrade
StepChange
969
Failure to
follow safe
systems of
work (PTW)
leads to
hydrocarbon
release
During attempts to open a valve on a mothballed test
header, a plug shot out of the valve body; personnel
evacuated; then assumed that test header isolation valve
closed and decision made to repressurise line; this resulted
in a second larger hydrocarbon release from bleed port as
personnel fitting a replacement plug. Review conducted to
bring valve back into service inadequate and did not
identify need to replace bleed plug; previous incident
involving corrosion of bleed plug prompted replacement of
several plugs on operating valves but as this valve was
mothballed at the time the plug was not replaced;
following initial release, PTW not reviewed to ensure new
valve plug fitted, gas trapped in system isolated and
13
Quality of
activity
implying
rigour
Shortfall in
Case source
rigour in case
Diagnosis in case
vented, new or changed hazards identified, adequate
controls in place, clearly defined and communicated
process steps; lack of communication between control
room and personnel in field such that people not made
aware of what actions taken or about to be taken
Being
embodied
Absence of
contractual
requirement to
ship
equipment in
safe state
StepChange
966
Unsecured
coil
Cladding cut from spool of coiled tubing, no chain
securing coil end to drum, coil sprung up and became
loose on drum striking individual; no safety check of
critical equipment at arrival on platform; no contractual
requirement for coil ends to be chained to reel; lack of
recognition of this as non-routine job
Being
engaged
Failure to
oversee,
communicate
prioritise and
assign work
MMS 2004075
Loss of well
control from
injection
fitting
corrosion
and leak
Leak through severely corroded and thus weakened plastic
injection fitting; corrosion from extended service in harsh
splash zone, coupled with absence of historic maintenance.
Management failure to support and oversee work meant
failure to inspect and maintain wellhead components, to
communicate regularly with on-site staff, to give written
instruction to contractors, to perform thorough job safety
analysis, to have specific written tasks and assignments
Being
informative
Absence of
alarm
indicating
equipment
operating
StepChange
973
Tow pin
incident
Tow wire snagged, came free, caused person to step back
and be caught in closing tow pins; tow pins did not have
audible alarm when operated; due to crew change
occurring at same time tow pin operator was distracted;
revised set of procedures include only raising one tow pin
a time, danger area around pins to ensure no crew
members inside whilst pins operated; management of
change due to increased hazards while crew changing
Being
planful
Failure to plan
unusuallyconfigured
operation in
detail in
collaboration
with
contractor
conducting it
MMS 2007045
Tubing
fracture and
BOP fall
Tubing supporting BOP stack assembly bent suddenly
under the load causing the BOP to break free and fall
overboard. A CT technician was attached to the BOP
Assembly by his safety line and was pulled overboard.
There were no engineering calculations, the temporary
work platform precluded attachment of safety lines, there
was a lack of detailed planning and no discussion of
potential anomaly, the contractors were not involved in the
planning who did not know the unusual nature of the setup until reaching site, there was no JSA meeting or shift
hand-off meeting, and no oversight of the contractor by the
operator
Being
reflexive
Failure to
recognise
hazards of
hazard
response
StepChange
974
Gas release
after shut-in
for cyclone
Gas release from corroded section of riser above water-line
and not accessible to internal or external inspection; no
inspection hatches on the caisson, and diameter of this
section of gas riser too small to allow intelligent pigging.
Should highlight any latent defects in inspection and
maintenance regimes in inspection reports; should ensure
equipment designed to provide adequate access for
inspection & maintenance; should recognise that when
responding to a potential gas release the response to the
initiating event can also contribute to harm to people.
14
Quality of
activity
implying
rigour
Shortfall in
Case source
rigour in case
Diagnosis in case
Being
resourced
Failure to
facilitate
manual
handling
operation
StepChange
971
Pinched
finger
changing
crane block
falls
Need to clearly highlight potential pinch points during the
risk assessment and toolbox talks and ensure mitigating
factors are in place; carry out a thorough review of
different options in carrying out this task; remove manual
handling and pinch point hazard; construct frame to hold
the block upright during the change out operation
Being
sceptical
Failure to
monitor
redundant
pressure gauge
MMS 2005007
Loss of well
control after
pressure
gauge failure
and test
waiver
Loss of control after causing burst: well gauges on driller’s
console failed to measure and record pressure accurately
and, partly because of false pressure readings, appropriate
actions to mitigate rising pressures not initiated;
redundant gauge not checked; and casing failed
catastrophically at pressures below design because of
undetected wear; metal recovery from ditch magnets
reported irregularly and apparently not heeded; required
test of casing that may have revealed wear was postponed
11 days after waiver from the regulations requiring a 30day test was granted; information on metal recovery not
included in data used to request waiver
Being
serious
Failure to
meet defined
operating
constraints of
tool
StepChange
963
Shallow
cutting pipe
casing using
a Radial
Cutting
Torch
resulted in
uncontrolled
release of
energy at
surface
Attempt to cut casing using Radial Cutting Torch failed,
resulting in release of energy; caused by fluid level depth
being insufficient directly below RCT, resulting in tool
being forced up well when detonated; risk assessment and
toolbox talk had identified possibility of a discharge at
surface and all appropriate measures in place; defined
operating parameters of using such a tool state that there
should be a minimum of 30 metres dry column below tool
Being
situated
Failure to
tailor setting
to specific
well
MMS 2004010
Loss of well
control
following
loss of drill
fluids to
highly
permeable
layer
Loss of drilling fluids to highly permeable, geologically
anomalous, thick sand deposit encountered while drilling;
sand zone not identified in 4 wells previously drilled from
platform, and encountered less than 100 ft from nearest
location of those wells; failure or inability to forecast
presence of thick anomalous sand through use of sparker
and shallow gas hazard surveys; lack of forewarning of
odd morphology contributed to failure to plan for difficult
circulation problems; generic setting depth of drive-pipe
prevented emergency isolation of thief zone, possibly set by
construction department at generic depth, rather than at a
depth tailored to actual well-specific requirements
determined by drilling operations
Being
substantive
PTW system
given nominal
rather than
substantive
attention
StepChange
981
Confined
space
working
Onshore pumping operation went through wrong operating
sequence allowing backflood of oil into engine room. PTW
system was not fully understood and not properly used –
needs to be explicit, specific, checked, countersigned
15
Quality of
activity
implying
rigour
Shortfall in
Case source
rigour in case
Diagnosis in case
Being
unambiguous
Cues &
instructions
provided by
task analysis
lacked
specificity
MMS 2004004
Individual
leaned over
walkway to
wrap light
fixture that
gave way
Contractor employee’s decision to ignore supervisor’s
instructions to use PPE; given employee’s experience,
training, and performance appraisal, as well as the
proximity of his PPE to the site from which he fell, this
decision inexplicable. Contributing cause was informality
of Job Safety Analysis with only reference to PPE as
‘P.P.E. at all times.’
Being
uniform
Absence of
standard
practice
requiring
updated
surveys for
new wells
being drilled
from
previously
drilled
locations
MMS 2006021
Loss of well
control from
influx of gas
from
unidentified
pressurized
zone
Loss of control from influx of gas from unidentified
pressurised zone. This may have been migration of gas
from one of the previously drilled reservoirs into the
originally under-pressured zone; or it may have been a
localized pocket of gas that would not have been seen in
any of the previous seismic information. A possible
contributing cause is the absence of both regulatory
requirements and standard industry practice requiring
updated shallow hazards surveys for new wells being
drilled from previously drilled locations
The implications of this analysis, especially the inter-relationships among the qualities listed in
Table 2, are dealt with in the Discussion.
There are several limitations of this analysis:
1. The observations found in accident reports are bound to be partial because they involve the
diagnosis of specific events rather than saying in some general way how failure occurs.
Thus, for example, a specific diagnosis might see a central problem with procedural
compliance as an insufficient understanding among individuals about what a procedure was
for. But this does not necessarily give us an insight into all the other issues arising around
procedures, such as the insufficient understanding among procedure writers of the
conditions in which they have to be applied.
2. Many of the incidents we analysed involved small scale issues of personal safety that might
be seen as being unrelated to the vulnerability to large-scale catastrophic failure.
3. The reports may be idiosyncratic interpretations of events, on the one hand, or (especially in
the case of the larger and more formally investigated accidents) say only what was
consensual among those contributing to the investigation.
4. Given the complexity and subtlety of what could be meant by the ‘deeper’ capacities of
organization to maintain safety, and the complexity of the setting, the sample of 74 accident
reports is a small one and it is unlikely that the list of qualities shown in Table 2 is
comprehensive.
It is also important to say that the labels we have used are to some extent arbitrary: different
analysts would see slightly different qualities and capacities and give them different labels.
16
4.2 ASPECTS FROM THE INTERVIEWS
A similar set of distinct aspects of rigour was tabulated on the basis of the interviews, and these
are shown in Tables 4, 5 and 6. Because, during interviews, it is possible to ask interviewees
just why they thought particular qualities important we can also make more inferences about
just what it is about organized activity that these aspects of rigour deal with. Table 5 therefore
has a column summarizing what each aspect of rigour achieves – and in each case this is framed
in terms of the problems that organizations cause for themselves in the ways they work and the
ways they respond to threats to safety in their environments.
Table 4 Aspects of rigour found in interviews
Aspect of rigour
Explanation
Being active
Being predictive and pro-active or self-actualised, prioritising problems for oneself,
taking action before others prompt it
Being analytical
Being systematic, methodical and grounded in analysis rather than intuition or mere
convenience
Being authoritative Being exercised with authority, definitively and legitimately
Being
circumscribed
Being constrained, realistic or limited in scope or ambition or action
Being
communicative
Being based on the expectation of needing dense patterns of inter-communication
and mutual information (similar to observations in the literature on ‘extraordinarily
dense’ patterns of cooperative behavior: La Porte, 1996)
Being completed
Being carried through or logically completed from insight through to action and
monitoring
Being current
Being current, up-to-date, fully refined or modified
Being
disintermediated
Being done without intermediaries by direct interaction of (for example) individuals
and managers
Being dutiful
Being based on a notion of duty rather than an analysis of costs and benefits
Being engaged
Being closely involved, engaged, interested and open, whether between different
levels of authority, links in a supply chain, or divisions of an organization, in
recognition that safety is a joint accomplishment
Being essentialistic Being focused on the most important aspects or foundational elements of a situation
Being generalised
Being uniform, consistent or general in approach rather than allowing uncontrolled
local variation or completely idiosyncratic diagnosis
Being internalised
Being done within a process or organization rather than being delegated or
subcontracted elsewhere
Being legitimising
Being concerned with legitimising and regularly relegitimising desirable activity
Being moderate
Being measured or partial in the way of acting, rather than extreme or total
Being multicentred Being carried out with multiple centres of authority and responsibility, rather than
concentration in a single command structure
Being orderly
Being concerned with order, tidiness, the absence of clutter and confusion
Being painstaking
Being done with attention to detail or minor aspects or deficiencies
Being political
Being based on an understanding of the power of relevant groups and the need to
recruit powerful groups in favour of safety
Being reflexive
Being able to reason about and deal with limitations of your own process
17
Aspect of rigour
Explanation
Being resolute
Being resolved to settle an issue, being prepared to grasp nettles, being willing to be
embarrassed and generally being willing to suffer immediate cost to deal with a
basic problem
Being resourced
Being done with sufficient support, resource or funding to both meet an objective
logically and to recruit others into supporting your efforts
Being respectful
Being heedful of expertise rather than simply subordinating it to managerial
authority (another theme found in the high reliability organizations literature)
Being situated
Being adapted to the situation, not generic or rule-bound
Being socialised
Being aware of, and using, systems of social obligation to achieve desirable ends
Being solicitous
Being done in a way that seeks opinion, welcomes it without challenge and is
sceptical of one’s own knowledgability
Being stabilising
Being oriented towards the stability or constancy needed to act effectively
Being synthesised
Being integrated, pulled together or global in understanding of system-level
phenomena like cumulative degradation and the deterioration of multiple defences
Being systematised Being based on systems, and plans: being ordered and integrated
Being unequivocal
Being committed to a specific, explicit model or ideal or policy
Table 5 What the aspects of rigour found in interviews achieve
Aspect of rigour
What this achieves
Being active
Overcoming tendencies to allow the environment to structure and prioritise your
reactions, and generally to be passive and reactive
Being analytical
Overcoming tendencies to act rapidly and avoid effortful, time consuming analysis
Being authoritative Overcoming goal and leadership uncertainties arising from complex activity
Being
circumscribed
Overcoming the tendency to act with enthusiasm and speed that can come unstuck if
not accompanied by a clear sense of what must be accomplished
Being
communicative
Overcoming the problems of division of labour, the expectation that a logical
division of labour avoids the need for communication, and narrow rules of thumb
about a ‘need to know’
Being completed
Overcoming the tendency to act in token ways, to deny resources to monitoring and
follow-up, and to allow maintenance backlogs to develop without apparent limit
Being current
Overcoming tendencies in complex systems for local elements to become out of
date as they fail to receive refreshed information, or fail to act on it, or act on
informal and incorrect understandings
Being
disintermediated
Overcoming the tendency to create intermediaries for representing or conveying a
group’s opinion in order to avoid intrusive contacts
Being dutiful
Overcoming the tendency to resolve issues on the balance of cost and benefit and
the balance of competing interests, and therefore (for example) dismiss weak signals
of potential problems
Being engaged
Overcoming the divisive effects of differing goals, differing origins, competition for
power or resources, or historical distrust
Being essentialistic Overcoming over-elaboration and confusion arising from operating complex
systems with multiple stakeholders; and overcoming the temptations of doing what
is straightforward or superficial rather than what most matters because of
18
Aspect of rigour
What this achieves
organizational pressures on resources and organizational rewarding of token
conformance
Being generalised
Overcoming the tendency for local actors to extemporise, diagnose problems
without thought to their systemic nature, and base their actions on purely local
logics that might compromise global qualities like safety (as in the literature: for
example Rasmussen, 1990; Snook, 2000)
Being internalised
Overcoming the loss of influence and capacity from externalising important
expertise and the tendency to ‘outsource’
Being legitimising
Overcoming the influence of informal and cultural norms where these contradict
formal controls (see in particular the idea of normalised deviance: Vaughan, 1996)
Being moderate
Overcoming the self-limiting qualities of remedies easily carried to excess (see the
literature citing social loafing for example: Sagan, 1993) that can produce cynicism
or even ridicule; overcoming tendencies to be doctrinaire or dogmatic about the
need for some protective practice, and the tendency to over-sell a practice (and
therefore over-do its application) in order to overcome resistance
Being multicentred Overcoming the imperative to achieve unambiguous, univocal authority by putting
protective functions in the ‘line’
Being orderly
Overcoming tendencies towards ‘entropy’ in organization. (The literature refers to
the need for maintenance activity to do this – for example Grabowski and Roberts,
1997; but it also refers to the opposite ‘negentropic’ tendency – for example
Pidgeon and O’Leary, 2000)
Being painstaking
Overcoming the tendency of normal prioritisation systems and imperatives to
dismiss the physical and symbolic potential in apparently minor defects
(see the literature on weak signals, eg Weick and Sutcliffe, 2001)
Being political
Overcoming tendencies to believe that the case for safety speaks for itself, that a
logical need is enough to mobilise action and resources
Being reflexive
Overcoming the traps of being limited by your own assumptions and convictions
that arises from a commitment to particular views of the world; (see the literature on
‘mindfulness’)
Being resolute
Overcoming the tendency to avoid the embarrassment of acknowledging
fundamental problems, to incur short term costs and to defer difficult issues for later
regimes
Being resourced
Overcoming the tendencies to reduce costs and postpone spending needed to
maintain systems under commercial pressure
Being respectful
Overcoming the demotion of expertise that follows the dominance of managerial
staff (see the literature on deferring to expertise, eg La Porte and Consolini, 1991)
Being situated
Overcoming over-generalised approaches to dealing with situations that arises from
attempts at consistency and uniformity
Being socialised
Overcoming the tendency to expect that logically obvious actions are bound to be
taken in a social organization, and overcoming the tendency to focus merely on the
effects of action on the current problem (rather than also consider future
relationships)
Being solicitous
Overcoming the tendency to self-referentiality, conceit and defensiveness from a
long, successful history
Being stabilising
Overcoming not just environmental tendencies like an itinerant workforce but the
exacerbating consequences of your own policies like not optimising working
conditions
19
Aspect of rigour
What this achieves
Being synthesised
Overcoming tendencies to fragment knowledge of deficiency and defect along
divisional or departmental lines
Being systematised Overcoming the tendency for local actors to extemporise and base their actions on
purely local logics that might compromise global qualities like safety (as in the
literature: for example Rasmussen, 1990; Snook, 2000)
Being unequivocal Overcoming tendencies to have ambiguous or equivocal policies or models in order
to deal either with the problem that all models have by-products or the problem of
getting consensus among staff
Table 6 gives examples of fragments of the interview transcripts that were categorized under
these aspects of rigour. Sometimes the fragments refer to the presence of such a quality,
sometimes the absence.
Table 6 Examples of the aspects of rigour found in interviews
Aspect of
rigour
Specific
description
Interview fragment
Being
active
Rigour as
actively
seeking your
own standards,
not passively
waiting for
them to be
imposed by eg
clients
‘it’s been very, very difficult to have the senior management influence….in
terms of [X] senior management to influence the way they manage their
crews, they’ve not been at all forthcoming they have done nothing of their
own volition, effectively we have imposed particular standards on the rig
and made them adhere to them by measuring them on a fortnightly
basis…because we put a safety improvement plan in place in April last year
for the rig because the [X] management wouldn’t do it’
Being
analytical
Rigour as
thoughtfulness
about, rather
than avoidance
of,
economising
‘[X] was wanting to push the envelope more, to try things, to cut the well
design down… and there’s nothing wrong with that but it should be done in
a structured way and it should be done with a proper assessment and that
one example was that they were trying to push things through without I
think really fully thinking stuff out’
Being
authoritative
Rigour as
exerting
personal
authority rather
than relying
solely on
systems
‘… had [an] MD with strong views on bureaucracy – very simple
management systems, although did have risk assessments which were
written and worked to – but very dominated by the boss – forceful,
extravert, wouldn’t tolerate mucking about, meant it about safety – and his
workers knew they could refuse a customer request on site if they thought
something unsafe – kept things stripped down, very experienced workforce’
Being
circumscribed
Rigour as
restraining
ambition which
might produce
merely token
achievement
‘we’ve got an HSE improvement plan for this year which is just staggering
in terms of what we’re actually trying to achieve and I just think ….you
might get there but it won’t be by delivering a quality product, it will be by
putting something in place that kind of ticks a box’
Being
communicative
Rigour as
communicating
back to those
reporting
failures and
‘I think probably [X] as a whole aren’t very good as a whole at feeding
back what comes of your queries so at a safety meeting you might raise
something (e.g. a handrail) and there’s no kind of trail for it until the next
time it’s raised, and somebody will say oh yes we looked at that I think and
this is the answer, and so again that’s an ownership thing if you ask a
20
Aspect of
rigour
Specific
description
Interview fragment
defects
question and somebody says right I will find the answer for you they should
really personally, they should feeding that back, downwards, …it should be
a two way flow of information’
Being
completed
Rigour as
carrying
through audit
activity to
diagnosis and
completed
actions
‘if we were looking at the permits they would set themselves a target for
auditing permits say 10 per cent of all permits issued and when we went out
there they had more than met that target, not only do they carry out audits
but they would identify the findings from those audits and they would learn
lessons from them and implement those lessons… I mean a lot of people do
what we …what I would call a compliance audit you know they just check
things are in place and if they are not in place then they will make sure that
they put them in place but I think [X] go one more step than that and they
not only find out that things are not in place but they will identify why they
are not there and therefore they would look at their procedures and amend
their procedures to ensure that they’re changed so its not just compliance
and making sure things are right it’s also finding out why they went wrong
in the first place’
Being
current
Rigour as
maintaining
currency and
removing
obsolete
procedures
‘…and if you can’t find it there, then there’s another system which is more
of an electronic filing system you can go in through the back door if you
like to try and find it, this is very, very common you find something which
you think then is the up-to-date document that you’ve not got through the
official channel and you start using it and it’s not its been superseded, it’s
been removed but for some reason it’s been left within [the system]’
Being
disintermediated
Rigour as
avoiding
intermediation
of safety
representatives
‘I said well why do you think you know there was a couple of vacancies,
why do you think you can’t get them, and he said well honestly I don’t
think people think they need them…and having pursued that a little bit that
seemed to be quite genuine …it seemed to be reflected in people we spoke
to about, you know, what would happen in certain circumstances, well we
just contact the supervisor, it’s almost sorted, any issues sorted by the line
without …we don’t have to go to a…you know complaint or through a third
party….so you know morale was high that was the sort of attitude of the
installation’
Being
dutiful
Rigour as
acting out of
duty rather
than cost
benefit analysis
which justifies
passivity
‘the corrosion was picked [up] by HSE… the process equipment’s fine and
made in modern materials but not the structure… the problem is that when
HSE give guidance they can always say ‘we will do that soon’… and the
mindset in HSE can be to wait until there’s a problem as the law doesn’t
allow us to intervene until there is… In [region A] it’s a local regulator and
instead of doing cost benefit analysis they just decide it’s a duty’
Being
engaged
Rigour as
engagement
among groups
even when it
involves
confrontation
‘they listened and that’s healthy and you want to see that…never mind if its
confrontation as long as both parties realise it’s a negotiation process and it
took a little while for the workforce representatives there to understand that
you went in there fought your corner and got as much as you can get and
that was a very, very healthy working relationship there….they had a
professional regard for each other and that’s the kind of thing that you’re
looking for, you know it’s a healthy live dialogue that you’re seeing and
that the workforce is integrated as the management can allow them to be’
Being
Rigour as
essentialist steady, un-ic
ostentatious
maintenance of
capability
‘there were three businesses on the site and depending on which way
people went when they got through the fence they’d behave one way or the
other – refinery, pipeline business, chemicals business.. refinery was the
biggest and series of incidents and accidents all associated with this – much
more go-go-go, action oriented management – boring maintenance got no
attention – seagull managers from other parts of the business flew in, did a
21
Aspect of
rigour
Specific
description
Interview fragment
project and flew off again – whereas the chemical business was a lot more
patient, concentrated on eg upgrading the paint on their vessels – doing the
boring things’
Being
Rigour as
generalised trying to be
consistent in
approach at
different
locations
‘we split one of the OIM’s [ ] to do one week on [X] and one week on [Y].
We found we learnt a lot through that process in terms of how things are
being applied on one platform versus another and there was some subtle
differences in terms of isolations and stuff but… again we’ve worked hard
to ensure that there is consistency and we also have our HSE and SR group
that are independent to operations and have a single point in common in
terms of [Z] [HSE Manager]. Because any HSE policies would come
through [Z] he would ensure they would get distributed and… implemented
in the same way on board both platforms, and we also bring our [safety
staff] together on a regular basis to ensure things are being done the same
on the instructions’
Being
internalised
Rigour as
retaining some
direct
workforce to
ensure
commitment
‘[X] had got to the point of outsourcing everything but the OIM, but
realised they’d gone too far and were now recruiting supervisors to be
employed by [X], although this was complicated by expansion and the lack
of engineers… it’s back to the company having its own engineers who are
able to be authoritative… the problem is ownership – if you outsource a
foreman or supervisor do they really own the problem?’
Being
legitimising
Rigour as
legitimising
and relegitimising the
stopping of
unsafe
activities
‘and their commitment to safety – in terms of, if anything, if people had got
any concerns then they can raise them, stop the job etc… again if you ask
anybody at any level and said look if you were concerned about this did
you feel free to you know stop the job or raise concerns, yeh no problem
…so that sort of culture… it’s interesting that [Y] seem to have reinvigorated the Stop system’
Being
moderate
Rigour as
avoiding
precautions
that might be
seen as
pedantic or
trivial
‘…but they don’t take it to the extremes that the likes of [X], the last
platform I was on [X] took the bread knife out the galley so you that
couldn’t cut a bread roll, they didnae trust you to cut a bread roll without
cutting through your hands I mean they would sign a permit for you to
work with 11,000 volts but they wouldnae trust you to cut a bread roll, so
they went to extremes you know and so far [X] hasn’t done that so for that
point of view I would say that they’re a bit more realistic about the safety
side’
Being
multicentred
Rigour as
maintaining
some
independence
safety authority
‘yes it’s a design to get it close to the operation but at the same time very
conscious of the need for independence, so as well as being direct report to
me, [X] has dotted reporting relationship to [Y] who is the managing
director, he also has a dotted reporting relationship to corporate, [Z] in
particular and there are a number of devices that are available to anybody in
[X] to raise health, safety and environmental issues that can be internal,
through our integrity hotline, or it can be external through the likes of HSE
so we feel there’s enough independence around that it doesn’t create
conflict of interest having it closer to the operations groups than further
away’
Being
orderly
Rigour as
orderly and
controlled
dissemination
of
documentation
‘big issue we’ve got at the moment is the management system the UK
management system …it’s business, it’s safety and its environment and
recently discovered there is holes in that it’s not been applied consistently,
documents that people are using they think are up to date because they’ve
got them through a back route, is not necessarily the document that … they
should be using…so there’s actually a project kicked off to take a look at
that’
22
Aspect of
rigour
Specific
description
Interview fragment
Being
painstaking
Rigour as
sensitivity to
significance of
small
violations
‘I know this sounds a bit of a cliché but they do have safety first at all their
meetings, that’s a key part of being at [X] – safety first on the agenda, all
our morning calls for instance start with safety, we talked about the minor
incidents this morning, we talked about a lighter in the washing machine
and we talked about it for five minutes because it’s really important –
somebody had taken a cigarette lighter offshore with them which is a big no
no, and also it was found in the washing machine so there’s two things
there, one, we’ve got foreign objects in the washing machine which can
cause a lot of trouble and if the washing machine goes down for instance
you may have a downed man. I know it sounds crazy but… and we had the
issue of the cigarette lighter being taken offshore and we’ve got a lot of
third parties out on the rig at the moment so we’re having that long
discussion this morning, we only have half an hour for each rig but 5
minutes of that was consumed by this discussion of a lighter’
Being
political
Rigour as
recognizing
and exploiting
the authority of
particular
groups to
secure
resources
‘for example the people running [X] needed a resource from the central [Y]
office and they couldn’t get it until we gave them an Improvement Notice
and then they got it straight it away…it was sort of these people had
responsibility without authority …they had responsibility for keeping the
maintenance programme going and getting it going but they didn’t have the
authority to get priority over the resources within [Y], and that’s the
problem with a company that grows and fragments itself, and then we have
to come along and enforce and they say oh yes we’re getting someone on
Monday….we’ve been trying for 6 months and we haven’t been able to get
[them], thank you very much for helping us, and that’s quite often the case
…the guys who are at the sort of doing level are tearing their hair out
because they know what’s wrong and they know what they need to fix it
but can’t get what they need …and then we’ll come along and we’ll say is
there any area we can assist you?’
Being
reflexive
Rigour as
being honest
with oneself
about the
motives for
taking short
cuts
‘Some people will take short cuts through lack of competence or its easier
to do it this way, it’s a short cut for them to save time, a number of reasons
behind it but again its all about looking at yourself, being honest with
yourself, and being honest with the people around you.’
Being
relentless
Rigour as
continually
bringing
attention back
to protection
‘but certainly the [X] one needs a little bit of re-energising, re-crafting,
remind people what it is all about, it doesn’t matter what tool you use in
safety, in my opinion it will inevitably slide off… and you have to
constantly re-energise and it will come off, constantly re-energise and it
will come off.’
Being
resolute
Rigour as
seeing past the
temptations of
short-term selfpresentation
and selfpromotion
‘secondary to that you have the support of the senior management from the
top down, safety first is the message from these people and they genuinely
mean it, you know they have management visits offshore, at weekends and
things which we don’t really see but their commitment to it is I would say
first rate, particularly from [person X] who is the ops director for Aberdeen
and I’ve seen it in [location A] as well, and [location B] as well… when
I’ve worked on those locations as well with [X], so it’s not something in the
UK, the message is the same the whole way across. A recent fatality we had
on one of the drilling rigs in [location C], we had no response from the
drilling company and [our company] undertook an enormous investigation
and were hugely self-critical taking into account that they recruited this
rig… they’re not scared to look in, they’re not scared to be self critical and
look how we can be better, I think that’s very important’
23
Aspect of
rigour
Specific
description
Interview fragment
Being
resourced
Rigour as
making
organizational
arrangements
that ensure
adequate
funding
‘there wasn’t an awful lot of autonomy within [X’s] hands but that’s
changed I believe in the last couple of years and [X] have much greater
authority to actually spend the money that’s required and I think there is a
better flow of finances from [Y] and [Z] who are actually investing quite a
lot through [X] and the installations … the [Y] and [Z] do sit in on quite a
lot of the meetings and keep a close eye on what’s going on and they do
hold the purse strings at the end of the day so while they have got a lot
more leeway to spend money and direct to where they think and I think
probably the channels for getting money are a bit easier there is obviously a
lot of scrutiny because it’s a lot of money’
Being
respectful
Rigour as
giving
authority to
technical
expertise
‘the demise of the engineering function… some of the new companies eg
[X] are much stronger in the engineering function – eg if a new pump was
required… in [Y] the first thing they’d say is ‘write a business case’
whereas in [X] it would be ‘send me the pump’ … drilling companies are
more engineering driven and so the demise of engineering authority much
less…’
Being
situated
Rigour as
allowing
adaptation of
procedures in
specific
situations for
good reasons
‘sometimes it was written quite appropriate for one situation but for the
other situation it didn’t quite work. And now it’s recreated, as long you do
the shalls then the shoulds you can [adapt] to a situation. And I think that’s
going to be a significant step forward in making simpler, easier, make clear
to people what they have to and the guidance is there for how to do it... It’s
a bit like the HSE guidance, you have to have a good reason for not doing
it. You can’t just say I don’t want to do that, you have to have a good
reason for not doing it and have something equivalent and appropriate in
place. But yes, which is sometimes you can’t write procedures that cover
every possible scenario or situation. ‘
Being
socialised
Rigour as
concentrating
on maintaining
social relations
‘the work force needs to feel comfortable with us and know that we’re there
to help, not to dictate and… big stick……back to this communication thing,
they need to know if they are unsure of anything they can come straight to
us and say… but people won’t ask you that question because of this, oh
well you should have known in the first place… so our commitment to
safety should just be very understanding and communicating and just don’t
get angry with them’
Being
solicitous
Rigour as
seeking
independent
opinion
‘in the past we have been using the HSE as a sound board if you like, so
when we do a risk assessment as part of our management of change
procedures we need some point of contact with HSE, and they provide an
independent review so they are not purely a… police if you like, they’re not
purely to police but they are a genuine independent body which helps us to
make sure that what we have in place is safe’
Being
stabilising
Rigour as
stabilising the
workforce to
maintain
competence
‘we’ve been quite stable since I would say the last 18 month or so and
we’ve had very little turnover on [installation X] and [installation Y] –
probably 2%, something like that I would probably say that 5%, 6% was a
reasonably healthy turnover because it’s good if you can move people
around a bit ….but as you say if you get too many, we had at one point
nearly 50% of our production operating team we lost in a very short time,
so it is difficult to get experienced people in who can become competent, to
do what you want them to do in a relatively short period of time… and I
think one of the ways we stabilised that was to have one of the best
packages for contractors in the UK sector’
Being
synthesised
Rigour as
assembling an
overall
‘carried out an inspection on [X] and we found some fairly serious
problems which they had totally missed, they were individual things that all
impacted on one another and they’d missed the overall picture, it’s called
24
Aspect of
rigour
Specific
description
Interview fragment
understanding
of multiple
failures and
vulnerabilities
cumulative degradation, that’s our catchphrase, it’s where you have a lot of
different things going wrong or potentially failing and the companies will
quite often will risk assess these individual things and put in measures to
make sure they don’t cause a problem, but that’s in isolation they don’t
look at the whole picture’
Being
systematised
Rigour as
ensuring
opportunistic
actions do not
undermine
planned
activity and
controls
‘I imagine they were struggling to get work done, they had a big project
coming in and they knew they wouldn’t have any bed space for all of the
people they needed to do the work, but then something happened which
meant that the installation had got to shut down for a …nothing to do with
them, had to shut down so they were thinking how can we bring this work
forwards …oh look we’re doing a job on this particular piece of plant and
we’ve got some isolations in place for that could we use those isolations to
do some of the work that we wanted to do in a few months time …let’s do
that and after not very much planning they went ahead to do this bigger job
but the isolations in question, you know the isolations that were in place,
were not compatible with the isolations that were being required for this
subsequent and larger job and you know a permit to work has to be made
up, risk assessment has to be done there’s got to be quite a bit of discussion
and basically what happened was a fitter went out and he ….started taking
apart pipework that wasn’t isolated… he should have been accompanied by
a process operative who would have been in a better position to know what
was isolated and what wasn’t isolated but that didn’t happen’
Being
unequivocal
Rigour as
avoiding
impressions of
equivocality
about safety
versus
production
‘I think it’s very, very important that you’re not seen to have two faces, that
some of the time you’re talking about health, safety, environmental
management but most of the time or some of the time you’re talking about
business, the two absolutely just have to be intertwined’
There are both similarities and differences in the aspects of rigour that emerged from the
accident report analysis and the interviews. But it is hard to read any significance into these, as
both parts of the work involved relatively small samples.
25
5 RELATIONSHIPS AMONG THE ASPECTS OF RIGOUR
5.1 ASPECTS OF RIGOUR THAT OVERLAP
In many ways the aspects of rigour overlap. For example, being communicative and being
engaged involve ways of behaving that look very similar in practice and have similar ends in
overcoming natural tendencies towards fragmentation. Being moderate and being circumscribed
are both concerned with the self-limiting qualities of organizational attention to an issue. The
former is more about taking particular doctrines to excess (like withdrawing bread knives on
health and safety grounds), and the latter is more about acting with a zeal that organizational
capacities cannot match (like implementing a programme of change faster than the ability to
inform the workforce can accommodate). But they overlap and both are likely to be relevant
together in many situations.
One reason why different aspects strongly overlap is that, although we have identified aspects of
rigour that are distinct in theory – the labels mean different things – in reality particular
practices typically deal with more than one aspect. What people do is not driven by theoretical
labels and even specific actions often address more than one problem. For example, being
painstaking and being situated are both served by the practice of being good at detailed problem
solving. Another reason why the aspects overlap is that they are inevitably connected up in a
complex world. For example, being situated is related to being engaged in the sense that it can
be because you are situated (and skeptical of the validity of general rules and instructions in
specific situations) that you see it as being worthwhile to stay engaged with other parties
working in the vicinity. Being situated and being engaged do not mean the same thing: but they
probably tend to go together.
Another reason for the overlapping is that some actions can be rigorous for more than one
reason. For example, investing in maintenance is intrinsically important and may overcome
tendencies to economise, especially when revenues are diminished. But it may also be important
in avoiding cynicism in a workforce that is used to hearing about the importance of safety while
seeing the apparent neglect of maintenance. As one interviewee said:
‘I think it’s about showing them walk the walk rather than just talking the talk and it’s
very easy just to say one thing but actually follow it through and actually stick by the
promises and actually deliver on what they say they’re going to deliver and show
something real and tangible to the workforce… [what] the safety reps fed back,
voluntarily was that they felt since we had taken over these assets, they were very
complimentary because they had seen evidence of that investment. They had seen
everything from refurbished accommodation, galleys to … you’ve finally fixed this
piece of kit or there’s a commitment to spend money and they’re actually seeing
delivery...’
5.2 ASPECTS OF RIGOUR THAT APPEAR CONTRADICTORY
However, some of the aspects of rigour look distinctly contradictory. For example, the quality
of being situated – meaning that the way of carrying out the activity should be responsive to
local conditions and not unthinkingly generic – looks contradictory to the quality of being
‘uniform’ – meaning consistent across places and times. Both qualities serve important and
obvious ends, but can point in different directions on any given occasion. This is reflected in the
literature that in some places emphasizes local adaptation as a primary source of catastrophic
26
failure (for example Snook, 2000), but in others emphasizes the importance of getting beyond
the use of general concepts and categories (for example Weick and Sutcliffe, 2006). The
qualities of being ‘multicentred’ and being ‘engaged’ can also look contradictory. Both were
found particularly in discussions of safety organizations, and how far they should be separated
from the operating part of an organization. The issue is that, in most people’s accounts, a safety
organization is a problem if cannot remain independent, but it is also a problem if it is not
engaged with an operating organization, and staying while engaged while staying independent
can appear contradictory.
Similarly, the capacity to be ‘relentless’ and the capacity to be ‘painstaking’ could both
contradict the capacity to be ‘moderate’ in particular circumstances. Thus some interviewees’
observations supported the importance of moderation – for example where precautionary rules
seemed to be applied to trivial cases with the effect of simply making people cynical. Other
interviewees’ observations supported the importance of taking pains with small things, both
because they had the potential to lead to bigger things and because this signaled their
seriousness about safety.
Even within the same interviews people sometimes seemed to suggest contradictory strategies.
For example one talked about managing contractors, and at one point advocated the practice of
using commercial contracts to give people the right incentives toward safety (and avoid the
wrong ones that simply stressed production):
‘one of the things that we do [is] to ensure our contractors are motivated, to have good
T’s and C’s… by having incentive clauses within our contracts for things like attrition
and performance and stuff like that’
But at another point the same interviewee said the best way of influencing contractors was by
socialization not contracts:
‘my experience is that you have to work with your contractors, it can’t be a carrot and
stick thing, you have to work with them, ensure that we all understand what our
common goal is in terms of … performance and what we’re trying to achieve and
basically talk to our contractors if we do have concerns… it’s no different than
performance management on staff.”
Sometimes interviewees spoke quite consciously about the ‘paradoxes’ they observed, for
example between the value of standardization and the value of specificity (or being uniform and
being situated):
‘… I mean each transition is different and they’re all the same…its paradoxical like
that, the issues are always going to be the same, the solutions…you’ve got to think of
each one separately I mean we are looking at an overseas one a central European one at
the moment ... mature oil field, dismal production, completely different culture and yet
we’re able to use, at least I think we’re able to use, that’s what we’re proposing to use,
the framework of our standard transition plan but we know that when we actually start
doing the detailed planning a lot of that is going to change…’
5.3 ASPECTS OF RIGOUR THAT APPEAR AMBIGUOUS
Contradictions of the kind just described arise because, in a complex organization, any practice
or way of behaving seems almost bound to produce a multiplicity of consequences (see for
example Jervis, 1997), some favorable and some not. But problems with labeling a practice as
rigorous also arise because the idea of ‘rigour’ leaves open a lot of room for interpretation. For
example, there was an example described in one of the interviews where a sacking over safety
was portrayed as vindictiveness. In cases like this, rigour could be construed as being ‘sticking
to your guns’ and doing what you think is right, regardless of politics. But rigour could also be
construed as the opposite – of acting in a way that takes account of politics because that is how
27
to maintain the social relationships that are needed to ensure you influence people on safety
issues. It is not just that sacking someone has mixed effects, but that it can be given meaning in
quite different ways, as both rigour and the absence of rigour.
In another example, one interviewee criticized HSE’s categorization of leaks, criticizing HSE
action that had been taken against his company partly because of the way a small hole leaking
over an extended time, in the open, had been misleadingly categorized as a significant release.
An aspect of rigour in this account was therefore the need to avoid relying on crude
categorizations and instead understand detailed influences on failure. This is consistent with
work in the literature on ‘mindfulness’ and the need to avoid relying on crude categorizations to
deal with widely varying situations (for example Weick and Sutcliffe, 2001). But it could
equally be argued that being rigorous involves being committed to your rules and categories,
and not blurring their boundaries for the sake of easy relationships with others. In the same
interview, the interviewee talked about having over-reported leaks to HSE in the past, and
explained how – by considering what had to be reported by law and what was in some sense
really hazardous – the firm could now report many fewer leaks. You could argue that this was a
rigorous approach to take because it tried to differentiate what really mattered from what didn’t;
but you could also argue that it would be rigorous to report everything on the basis that a more
moderate approach allows convenience and self-presentation to determine what is reported in
practice. And another interviewee in the same organization in fact said just this, and claimed
that it was essentially corporate policy to report and attend to all leaks of any magnitude.
5.3 BEING RECURSIVE ABOUT RIGOUR
The way in which the aspects of rigour overlap suggests that they cannot stand alone, and must
be seen as parts of a picture that only makes sense as a whole. The way in which they seem
contradictory suggests that different ways of being rigorous might be needed in different
circumstances. And the ambiguity of what being rigorous means in any given case suggests that
different ways of being rigorous can be made to work, perhaps even in similar circumstances. In
all, it does not make sense simply to say there is one way of being rigorous, nor that the various
aspects of rigour listed in Section 4 are independent qualities of practice that can be tested for,
one after the other. Instead, being rigorous seems to be a matter of choice about how to be
rigorous, and this choice itself needs to be a rigorous one. If you cannot lay down one way of
being rigorous for all occasions, you have to have a capacity not only to be rigorous, but to
choose the right way of being rigorous.
Moreover, these aspects of rigour are also qualities of organization that respond to some threat
or problem – so, although they are a stage beyond the organizational responses to whose byproducts they are directed, they are still organizational responses. They are themselves therefore
sources of problems in their own right. This seems obvious when looking at them individually.
For example the quality of being ‘engaged’ in isolation is problematic when the engagement is
with someone or something that has become discredited or ineffectual. Being engaged cannot be
counted as an unequivocally useful quality. It is generally a good way of dealing with other byproducts of organization (like natural tendencies to concentrate on legal and contractual controls
over relationships), but it can pose its own problems. Such aspects of rigour can similarly be
problematic when they seem to undermine general, and useful, social norms such as mutual
tolerance. The idea of peer monitoring and ‘behavioural safety’, for example, can lead
individuals to confront others in a way that could be perceived as dimishing another’s status, or
even as aggression. It then becomes important to have a strong process of acculturation that
gives people the expectation that peer observation is normal and routine, and not an
infringement of an individual’s freedom or privacy. For example, one interviewee said:
28
‘We role this out to all the crews, look you’re going to get STOPPED, its not an act of
aggression, if you’re used to STOP we encourage to use it as a tool… if you see
something you don’t think is safe if you don’t feel confident about voicing it
…identifying yourself, do it anonymously, stick a hazard card in the box and tell
someone you’ve shoved it in there and I will come and get it… it is emphasised that
hard on every induction for every vendor and visitor, for our own people it’s literally
ingrained into them… I mean if you’re on a job you’re more than likely [if you’ve got a
permit out] have somebody come over and have a chat… a chat with you about it…it
sounds like an informal conversation, it’s not an act of aggression.’
All this suggests that you have to be rigorous about being rigorous. You have to have good
ways of choosing which of the aspects of rigour to apply in particular circumstances (for
example whether to be more situated or more uniform), and you have to be attentive to the byproducts of your choice. This is being ‘recursive’: applying a way of thinking or doing to some
problem, but also applying a way of thinking to the way of thinking, and so on. Sometimes it is
quite explicit, for example in the practice of auditing audit processes:
‘we audit the audits, we assess whether the audits have been done correctly, who’s done
them, are people trained to do them … we will look at a sample of the audits.’
Similarly another said:
‘So you’ve got a triangle effect of corporate audits. At the very top where you do two or
three or four a year. You’ve then got a kind of divisional management level and you’ve
got an operational management level and then you’ve got the operational execution
level offshore. It’s a bit like a triangle for fatalities for 600, you know, near-misses or
whatever down here. It’s a bit like that you know, you’ve got a much much broader
base of numbers in terms of we do stop audits, we do monitoring audits, we do
compliance checks and that kind of thing.’
Another way of looking at this is to say that acting rigorously is itself a practice, and like all
other practices it will have preconditions, maintenance requirements, and by-products: so it
wouldn’t be rigorous not to apply the same standards to being rigorous. Figure 3 is intended to
illustrate this.
Figure 3 The recursive nature of rigour
Basic activity
• Eg
dismantling
process
equipment
Rigorous
practice
• Eg
following a
permit-towork
system
Being rigorous
about the
rigorous
practice
• Eg auditing
the permitto-work
system
Being rigorous
about the
rigorous
practice
• Eg
(re)training
the auditors
etc
It is similar to the problem of who guards the guards. As soon as you set up a way of protecting
the reliability of some system with some device you have to work out how to protect the
reliability of the protective devices. We accept there is a never a point at which you can stop
protecting the means of protection, logically. In practice you go as far as you reasonably can,
but any profound understanding of the problems of protecting systems has to incorporate this
idea of recursion.
29
An example of how rigour seems to be recursive, not just complex, is in the issue of ‘blame
cultures’ and ‘just cultures’. Traditionally, perhaps, there has been a strong understanding in
organizations that accountability is important, and it is natural that following failure this
accountability is translated into blame. But then there has been an understanding that this has
by-products, not least that it leads people to cover up failures and avoid reporting potentially
informative errors and near misses. No-blame cultures, in turn, seem to have had their own byproducts, such as an indifference to getting to the bottom of issues for which no-one can be
blamed. We therefore have a more refined idea in terms of ‘just cultures’ – which a number of
interviewees referred to. But again, these also produced problems, for example:
‘I don’t agree with the just culture system, no... I think it breeds a culture where people
are less willing to discuss any failures, or any mishaps, in other words keep quiet if
something were to happen or a near miss they would be less likely to report near misses
that might have happened, they got away with it…and they might just say well I won’t
mention at all because otherwise I’ll get grief I’ll get a just culture….so it’s easier and
simpler not to say anything… I mean at one time very early on when I came on this
platform we didn’t have this just culture and if anything occurred people were more
willing to mention it and say well that was a near miss and share the lessons learned
amongst the team and very, very occasionally we would get the guy involved to sit
down with the team and just go thro what happened, no pressure, no comeback, no just
culture and I think that’s a far better system…’
So the just culture has its own problems and by-products, like the fear of a miscarriage of
justice, and the burden and embarrassment of going through the just culture procedure. So the
problem is never definitively ‘solved’. You just keep refining your practice from day to day as
best you can, and at any stage you should always bear in mind the by-products of your chosen
approach (rather than think the problem soluble) – and then move on to the next problem.
5.4 SOME CONNECTIONS WITH EARLIER LITERATURE
There are various themes in the literature on organizations and organizational reliability to
which this notion of rigour is connected. One is the idea that social organizations produce
defences against the important problems of embarrassment and losing face – but that the byproducts of doing so are ‘misunderstandings, distortions, and self-fulfilling and self-sealing
processes’ (Argyris, 1990). From this emerges a concept of ‘double-loop learning’ that can deal
with errors in governing values, not merely perturbations in the environment. Another theme in
the literature is the idea that organizational reliability requires us to think in terms of systems,
where the entities we are trying to manage are inter-connected in ways that produce feedback
loops of one sort or another, and effects that our intuition tends to ignore (for example Jervis,
1997). We have to expect any action we take in complex systems to have by-products of various
kinds. This leads on to a third theme in the literature – that of a ‘law of unintended
consequences’, arising ‘from individual actions and the collisions and coincidences among
them’ (Vernon, 1979). Part of the problem is that we often have to act with confidence when the
information available to us is incomplete; part of the problem is making errors, including wish
fulfillment; and part of the problem is that our concern with the immediate consequences of
some action tends to exclude consideration of other consequences. Yet, because we never act in
a psychological or social vacuum, the effects are bound to ramify into other spheres of value
and interest (Merton, 1936). A fourth idea, mentioned in section 2, is that of collective
mindfulness (Weick et al, 1999) and the need to avoid becoming trapped by the concepts and
categories we have learned. In other words, however much these concepts serve us, they also
impede us, making it difficult to appreciate new situations that they do not readily fit.
30
The concept of rigour, as a capacity of an organization to continually respond to the by-products
of its own responses, therefore broadly fits in with an existing body of thinking. This stresses
the way in which organizations lose reliability arises as much from the way they deal with the
world as with the problems the world inflicts upon them. And it stresses the continuous-ness of
the task of adaptation, learning, improvement, problem solving and so on. The task is hampered
if you approach it with the idea of completing it once and for all.
31
6 RIGOUR IN NEW ENTRANTS
The working thesis has been that new entrants as a group are not uniformly less safe or more
safe than established operators – and that you need to look in depth at their processes and
practices for the quality of rigour. What is a ‘new entrant’ is also a matter of definition or
convention rather than an obvious grouping of firms, and very much a matter of degree.
Nonetheless, firms that establish operations in new parts of the world, firms that take on
expanded roles and firms that acquire installations from others face distinct challenges. They
have to find ways of being rigorous in particular connection with a number of issues:
1. Managing the transitions when an installation changes ownership.
2. Dealing with the legacies inherited from previous operators, both in equipment and culture.
3. Adapting to conditions in the region, for example becoming acquainted with regulatory
expectations, and with different labour market conditions.
4. Adopting new, or hitherto relatively unusual, organizational arrangements, for example
separating ownership from being a safety case duty holder.
6.1 MANAGING TRANSITIONS IN OWNERSHIP
One of the main issues involved in transitions seem to the stability of the workforce. For
example:
‘if you have an all staff people environment and change that with the same people
which is what happened effectively when [company X] took over the [A] asset they
changed the business model primarily to cut costs, because [A] was a very high
operating cost asset and even [company Y] were trying to cut costs by 20%, so when
[X] came in, one of the ways to do it was to totally change the business model so rather
than primarily a 90% insourced staff organisation they went totally the opposite way,
making it primarily an outsourced organisation, onshore and offshore. But turning the
majority of staff people into contract people – that just created 18 months of heartache
and pain, there was again, totally dissatisfied people because one minute they were
working for an oil company, the next minute working for a contractor, contract terms
and conditions a lot less than the operator, offshore they were on a 2 and 3, they went to
a 2 and 2, on the basic … rates so there was no way… they were going to stay… we
couldn’t keep sufficient number of competent people offshore to run the facility…’
The same interviewee went on to say:
‘…and I think one of the ways we stabilised that was to have one of the best packages
for contractors in the UK sector, and certainly we’re [company Z]’s best contract to
work on by far within the UK, so improving their package really, salaries, bonuses,
rotas we needed to do that to stem the flow a bit, but it’s stopped so I guess we achieved
what we need to do, and I guess the market’s slowed down a little bit… but I think the
primary mover was [us] putting money into it to try and improve the package so that
people would want to stay.’
Thus aspects of rigour that were stabilizing seemed to be particularly important in managing
transitions.
But it was not always approaches that aimed at maximizing stability and minimizing changes in
the workforce that seemed most effective. Another interviewee talked about the beneficial
mixing and renewing effect of recruiting a new staff with diverse backgrounds, for instance:
‘I found when we got our technicians on board they came on with various experiences
[and knowledge bases] and it was actually good to throw that all into the mix because if
you keep a core of [company X] people they will always do it the [X] way, and it might
32
not be the right way so it was good to have a total clearout near enough and just have 4
or 5 guys, the rest of the body mix was new… [but in another location] they’ll have a
major issue because all the guys are swapping across, they’ve not got voluntary
severance, it’s the spirit of TUPE, they’re going across with, and they’ll be lacking new
ideas to get these platforms up and running and make them more effective because
they’ve sold the existing guys that have been there for 25 years. And that’s why
[installation A]… from the transition till now we’ve just improved, improved, improved
because we never had guys that had this asset history that wanted to stay doing it the
[X] way so that’s how we came on leaps and bounds, different ideas and innovation.’
The way in which different interviewees stress almost opposing approaches – stabilizing a
workforce or comprehensively renewing it – indicates that different organizations, perhaps in
different circumstances, find it necessary to be rigorous in quite different ways.
6.2 DEALING WITH LEGACIES
The issue of dealing with legacies involved such problems as uncertainties in the physical
condition of equipment and in documentation – for example:
‘…historically in some cases it’s quite important… to be able to refer back to the
documentation. But not all the documentation was handed over. I guess in some cases
there may well have been issues around intellectual property that made that [things]
difficult. But in other cases it was simply just very difficult to get, the documentation
process had probably lapsed in some cases because the asset was no longer considered
to be a viable concern’
Similarly:
‘I think what we have learned… before you take something over it is very difficult to
get a comprehensive view of what you are taking over, I think there is a lot of
commercial issues that would prevent people from allowing you offshore effectively…
but the moment we’ve got the key then we should be all over the place and do a very,
very thorough review and we are setting ourselves up for that for future acquisitions if
we are going to make any… we would have to do a very thorough review after having
taking over the facility because I think realistically it is difficult to access before...’
Experience varied as to how problematic the legacy was. For example:
[X] [established firm] had got themselves in such bad odour with the HSE and everyone
else in the North Aea that they had taken the opposite tack and spent huge sums of
money in getting them back up to a saleable standard…and I mean a lot of money, there
is still a lot to be spent, tens of millions of pounds to be spent but [X] had spent, I don’t
know, a hundred million or something like that in the 2 or 3 years before they put them
up for sale. [interviewer] So… some good has come from it and companies no longer
think they can actually pass on assets [in poor condition]? [interviewee] I’m not saying
it will never happen again but certainly it’s a lot less likely, this one was stripped in
effect and run down… there was a deliberate reduction in what I would call the bread
and butter maintenance, fabric maintenance, preserving the long term integrity of the
asset by [Y] [established firm] who had bought it from [Z] [established firm], didn’t
really want it, they wanted other things from [Z] but they didn’t want this so when it got
absorbed in [B] [region]…there was almost a... an unhealthy glee over stopping a lot of
the work that was going on in the [A][installation] just cut back, cut back... and of
course by the time [V] [new owner] got it that was pretty obvious.’
Management of legacy issues was problematic both because systems were run down as the
installation was nearing the end of its expected design life, and because of concerns about
commercial confidentiality that impeded the exchange of information.
33
The emphasis was not entirely on the physical legacy that new entrants had to manage: there
were also issues surrounding the adequacy of inherited procedural systems. The acquiring
organization therefore needed to expect to overhaul the procedures it inherited, although this
was sometimes seen as part of what should be a regular overhaul:
‘[interviewer] As part of your process I take it you start checking the procedures, to
make sure… [interviewee] Oh yes absolutely. [interviewer] What sort of time frame are
you looking at? [interviewee] I would think that within a 12 month period from
transition date, that… you’ll find that most procedures have a review date of 12 months
anyway… we actually introduce an active monitoring programme which is tier 3 which
is local level and… that active monitoring includes reviewing the actual procedures
associated with those activities so at a local level they’re actually reviewed and if there
are anomalies then that information is passed through to onshore and that’s when that
particular procedure is given a more detailed review.’
Aspects of rigour that were particular concerned with maintaining currency seemed important in
cases like this.
6.3 ADAPTING TO CONDITIONS IN THE UKCS
One of the challenges of adapting to conditions in the UKCS was understanding the roles and
powers of the regulator. One organization, according to interviewees, had not fully appreciated
this when they entered the sector and appeared to show little willingness to find out what these
roles and powers were. Another organization, according to its members, had shown more or less
the opposite attitude. Thus ‘engagement’ as an aspect of rigour seemed important. Some
interviewees felt that they were naturally the subject of greater attention from the regulator, for
example:
‘We are not necessarily the easy target but we are an area of interest to them because
they are… the old, old assets with a new owner who’s got money to invest and an
interest and everything and as they take something from the old and quite steady state or
maybe even declining and try to ramp up activity levels on something that’s quite old…
it’s like taking your old fiesta and trying to rally drive it… so by the step change and
change in culture and activities that we’re doing we are finding ourselves in a much
more hazardous environment and we’re getting a lot of interest and inspections as a
result.’
A second challenge to entering the UKCS involved understanding the conditions and norms in
the labour market. Again, one organization seemed unable to appreciate these, according to
some of the interviewees. The claim was that the UK workforce was particularly itinerant, and
this made it important to have comprehensive codes and standards. The organization in question
resisted this because it preferred to rely on people’s competence, which it had been able to do
historically with a more stable workforce.
More generally, in the context of new entrants, an important aspect of rigour is realizing that
your inferences about how best to organize your affairs arise from your particular historical
experience. It is important to be sensitive to how different conditions can make these inferences
invalid as you extend your activities or the world changes.
6.4 ADOPTING NEW OR UNUSUAL ORGANIZATIONAL ARRANGEMENTS
On the issues raised by the adoption of new or unusual organizational arrangements, like the
separation of ownership and operation, interviewees in one firm particularly talked about the
difficulties that had arisen in the triangular organizational relationships that arise. For example
34
an owner may contract a drilling company while contracting an operating company to act as the
duty holder. This creates possibilities for unforeseen conflicts in activity and responsibility that
are more readily seen and dealt with where the owner and duty holder are the same
organization. An obvious aspect of rigour in such cases is a strong engagement among the
relevant parties. For example:
‘So the reason the interface was developed was to try and get the well operator and
licensed operator, the drilling contractor and our own people to understand it’s not just a
case of leaving [X] or [Y] to talk to [Z]: we have to get involved in the conversations
too.’
There also appeared to be a more extended decision making process when the main fundholder
was not the duty holder. For example:
‘…being in [X] [duty holder but not owner] isn’t like being in [Y] [owner is duty
holder] where you know somebody comes up with an idea and it gets fed up and you
know all the people in the chain and they think oh that’s a great idea lets do that. What
happens is that somebody comes up with a suggestion and we think yes absolutely we
need to do something about that, that’s great and then it goes all the way up the chain.
And then it gets as far as the operations manager and director and it’s like yes that’s
great but we need to get, we need to pay for it somehow, and therefore it needs to come
out of opex budgets. And so, and then we have to pass that cost back to the client and
the client will say I don’t see why we need to pay for, why do we pay for that? That’s a
[X] thing. And then it gets into this kind of vacuum. And so certain things will make it
through but I would imagine that there are a fair degree of excellent ideas and things
that we should be getting after and fixing that don’t manage to make it past that stage.’
Such situations point to an important aspect of rigour as having organizational mechanisms that
ensure adequate resourcing in the context of more complex commercial situations. The fact that
a duty holder had a commercial relationship with the fund holder as client could also be
problematic in exerting the kind of authority needed to meet a duty holder’s responsibility:
‘[interviewer]…you said to me on the [X] about this master – servant relationship…
[interviewee] it does, it makes it extremely difficult and as a consequence of that it puts
people in difficult situations when it comes to actually challenging what the client is
doing.’
So rigour in such a context is also about being principled or dutiful: about having a clear sense
when there is a duty to be performed even when commercial conditions or relationships make it
difficult.
Generally, the study indicated that being a new entrant does not require a different kind of
rigour. Qualities such as being reflexive, being dutiful, being fully resourced, being strongly
engaged and so on seem to apply equally to all organizations. Such qualities can be obtained in
different ways, of course: reflexiveness can be systematized and embedded in an organization in
codes and procedures, or it can be realized in a much more informal way as a cultural
expectation of people who work in the organization. But the quality itself is so general that there
is no type of organization that does not need it. Nonetheless, it was evident that new entrants
operate in different circumstances from established firms and sometimes pursue different ways
of organizing. What they have to be rigorous about is therefore distinctive, and scrutinizing
activity in new entrants means looking at their capacities to be rigorous in those things that
present them with particular challenges – as indicated in Figure 4.
35
Figure 4 Rigour in the context of new entrants
Context of being a
new entrant
• Managing
transitions
• Dealing with
legacy
• Adapting to new
conditions and
arrangements
General aspects
of rigour
• Being
socialised
• Being
engaged
• Being
reflexive
• Etc
Particularly
relevant
aspects of
rigour
Scrutiny
In addition to the kind of new entrants involved in this study – established and substantial firms
that moved into the UKCS, usually by acquisition – there is a population of small companies
which are new organizations, perhaps typically involved in a single well subsea development
with a tie-back to a nearby platform. The platform operator will be the safety case duty holder,
rather than the companies in question. Such companies were said by interviewees to be ‘lean
and mean’ and ‘maybe cut corners a bit sometimes’ but ‘don’t have all the hierarchy and the
slow decision making of the multi-national’. Although they have duties under health and safety
law, because they are not safety case duty holders they ‘probably aren’t on the HSE’s radar’.
Nonetheless their presence is significant, not least because they are probably tomorrow’s safety
case duty holders (Moody, undated), because their funding pattern seems to leave them with
little resource to invest proactively in safety, and because they may have little understanding of
regulation in the UK sector.
The basic idea of rigour – as responding to the limitations of your own responses – is as valid to
such organizations as it is to larger and more established ones. The difficulty is perhaps that
small and young organizations are unlikely to have a formal or visible capacity of this kind.
This is likely to be exacerbated if the basic rationale for such organizations is to avoid
overheads, since the avoidance of overheads seems to demand a concentration on basic
production processes. Nonetheless the idea of rigour does not point to a particular
organizational form: if anything it points in the opposite direction – to the idea that different
forms are equally valid. And it seems possible to test the rigour of a small, lean firm’s practice
as much as a large, established one’s. For example, one of the aspects of rigour listed in Chapter
4 was that of ‘essentialism’: of concentrating on the essence of what you are doing, to avoid
over-elaboration and over-complexity. Short decision paths and short decision times are also
likely to make practices more ‘completed’: in other words, lines of investigation and
development are more likely to be brought to rapid completion.
36
7 LEADERSHIP AND RIGOUR
The concept of rigour is naturally associated with questions of leadership because it has
connotations of taking an approach that is somehow better than the merely adequate, the
habitual or the routine. It suggests a need to step beyond comfortable and perhaps familiar ways
of acting. It is therefore unlikely to come about and be maintained without certain people
exercising leadership: having an understanding that is in advance of their peers’ and colleagues’,
being prepared to follow through on this understanding, and exercising what influence they
have to promote it. This can perhaps be seen in at least some of the aspects of rigour listed
earlier. For example reflexiveness – looking at your own processes and being candid about their
limitations and by-products – is not necessarily a straightforward process. The idea that
organizations place obstacles in the way of ‘double-loop’ learning is well known in the
literature (for example Argyris, 1990). It takes someone to risk unpopularity, criticism and even
ostracism to promote the cause of reflexiveness in an organization that is unused to it. Even the
more pedestrian aspects of rigour, like ensuring activities are well resourced, can require acts of
leadership when resources are short – a situation that seems to arise for at least part of the
business cycle in the offshore industry.
It is interesting that the term ‘organizational defences’ can be used both in the pejorative sense
of defences against embarrassment that stop organizations learning (Argyris, 1990) and in the
more approving sense of defences against hazardous occurrences that stop the development of
accidents (Reason, 1990). But the two do not seem to go hand in hand. The capacities that
organizations naturally seem to develop to deal with threats to their self-esteem, status and
public image are not the same as the capacities they need to deal with threats of breakdown and
catastrophic failure. If anything, developing the former seems to make it harder to develop the
latter. Developing the latter, and developing rigour in particular, seems to need a particular will
and exercise of leadership.
The link between rigour and leadership is not one-way, however. While leadership is needed for
rigour, it makes sense also to say that rigour is needed for leadership. People can lead in a
formal, nominal or token sense, and we speak of ‘leaders’ as those who have nominal authority,
sometimes while disparaging what they actually accomplish. But we also have a notion of
profound or genuine leadership that involves some capacity or performance that is ahead of
what is normal or routine. This looks like leadership of a more ‘rigorous’ kind. There is
therefore a bi-directional relationship between rigour and leadership, as indicated in Figure 5.
Rigour does not inherently exist in organized activity and leadership is needed to bring it about;
but leadership itself is not inherently influential, or influential in the right direction, so needs to
have the quality of rigour if it is to accomplish much.
Figure 5 Rigour and leadership
Rigour as a necessary
quality of leadership
Rigour
Leadership
Leadership as being necessary
to the achievement of rigour
An important element of leadership is promoting the idea that experiencing the by-products of a
practice is not a reason for abandoning it. In one of the firms participating in the study,
interviewees particularly talked about the highly socialized nature of its practice. Several of
37
them recognized the problems this caused. But their remedy was not to give up on the practice:
it was to become more aware of its nature and its consequences, and deal with those in turn.
They also made frequent references to certain individuals whose commitment to the practice
seemed to be highly influential on the workforce, and they spoke of it as a basic element of the
organization’s identity, for example:
‘…I think that is a great base to work from because it’s supported in [head office], it’s
supported [by] senior management in the UK, and from us to offshore, so that message
of doing the right thing and how we deal things is just at important as the result, is
instilled right throughout the organization.’
This sense of it being basic to the organization seemed to provide assurance that the practice
was one to remain committed to, despite its drawbacks.
What seems to go hand-in-hand with the risk of giving up on a valid practice because of its byproducts is the risk of avoiding a valid practice by adopting coping strategies that help people
cope but prolong or maintain a problem instead of solving it in any profound way. This is found
in the organizational literature. For example, Argyris (1990) discusses cases where managers
realize their presence in meetings can be inhibitory, so encourage others to meet privately to
discuss issues in the open, and then bring the outcomes to them. The problem is that such
practices perpetuate the division between managers and subordinates. This same issue arose in
the interviews, and it was seen as a considerable step forward when OIMs could be invited to
safety representatives’ meetings, and when it was realized this need not inhibit the discussion in
those meetings:
‘but increasingly ….some of the OIM’s ask particularly… there’s one who joined the
company latterly… he didn’t shoe-horn his way in, he asked questions of the safety reps
and said would you put the questions to your work force, would there be an objection to
me either speaking for 10 minutes, only by invitation, or would have people have any
objection to me sitting in the safety meeting and so…it went across five shifts… they
decided no, they hadn’t got anything to hide whatsoever and if they want to say
something in front of an OIM they didn’t feel impeded by the physical presence of any
of the 3 OIM’s which I think is extremely positive.’
This practice of direct engagement has the by-product of inhibiting certain kinds of exchange,
but is nonetheless a valid practice. It is probably better to deal with the by-products than avoid
the practice. Coping strategies, like excluding OIMs from safety representative meetings,
ultimately get in the way of adopting the practice. In cases like this it looked very much like an
act of leadership to overcome the coping strategy and make a commitment to what was felt to be
the right practice.
Perhaps the most important aspect of rigour that would be associated with leadership would be
socialization – since leadership is naturally seen as a social act. This had different levels of
prominence in different organizations, and interviewees themselves spoke about quite stark
contrasts between organizations that relied heavily on bureaucracy and those relying on
extensive negotiation. The latter were strongly socialized in the sense that their activity relied
heavily on systems of social obligation rather than formal legitimacy and formal obligation. But
bureaucracy and socialization were not mutually exclusive. One of the more important aspects
of a socialized approach was that it recognized that procedures were sometimes violated, despite
their logical importance, because individuals became cynical, or complacent, or lacked
understanding of the full rationale for codified ways of working. This led to a recognition of the
need to consult, negotiate and use social resources like informal norms and feelings of
obligation toward others in order to achieve compliance.
Socialised approaches also seemed to be necessary because procedures simply didn’t yield
enough information. For example, interviewees talked about the practice of having ‘huddles’ to
review planned permits to work where the work in question would produce interference
38
between different tasks. Producing a socialized approach to activity seemed to need leadership
because of an inherent tendency among some individuals to rely unrealistically on the logical or
technical qualities of a procedure to persuade people to follow them, and to rely on formal
authority to achieve what they thought to be appropriate. Being socialised was not inevitable.
Such situations suggest several stages to the development of leadership. At the most basic level
there is an understanding of the importance of protective measures and practices, like safety
meetings. There is an optimism about what they can achieve, but no particular recognition of
their by-products and drawbacks. Leadership is needed because of the strong tendency in
organizations to emphasise production goals. At the next level, there is a recognition that safety
measures and practices do have limitations and problems, and these are taken as a reason to
limit the commitment to such practices. They might be maintained for reasons of display as
much as what is thought to be their intrinsic worth, and coping strategies emerge to deal with
the problems. Leadership is needed to avoid unreasonable optimism, and an inability to see the
by-products. But there is a further level of development in which there is a strong and heavily
emphasized commitment to what are taken as being ‘right’ practices and qualities, together with
a willingness to see their by-products and manage them in a way that does not dilute the basic
commitment. Leadership is needed because a recognition of by-products is likely to make
people equivocal and cynical. Figure 6 illustrates this.
Figure 6 Stages of maturity in leadership
Rigorous: promoting commitment to
important qualities, managing their byproducts, averting equivocality and cynicism
Developed: recognizing the limitations and
drawbacks of protective measures and
practices, limiting the commitment to them
Basic: achieving a concern with protection,
overcoming preoccupation with efficiency
and productivity, optimistic about protective
measures
39
Maturity in
leadership
8 RECOMMENDATIONS
8.1 LOOKING FOR ASPECTS OF RIGOUR
The first recommendation is that scrutinizing operations should involve looking for the aspects
of rigour that emerged from the study. Whether this is done by operators themselves, or
outsiders like regulatory inspectors, the way in which operators manage the needs and byproducts of their own responses should be a central object of scrutiny. It is this that gets the
scrutiny beyond merely ticking boxes – checking the nominal adoption of particular systems –
and on to the deeper understanding and more effective practice of safety.
One approach is to use the aspects of rigour listed in Section 4 as a checklist. In principle you
can look at an activity and assess whether these aspects can be found in the way the activity is
conducted. This at least makes a start on getting beyond the surface form of the activity, and
draws people’s focus towards the way in which they work, not just the work itself, and towards
the nature of their practice and how well founded it is.
It is important to point out that the various aspects of rigour can be applied at different levels of
generality. Some deal with very general by-products of organizing probably found in all
organizations, whereas others deal with specific practices in specific organizations. One way of
structuring the process of applying the list of aspects is therefore to look for rigour at these
different levels, as indicated in Figure 7.
Figure 7 Applying the idea of rigour at different levels of generality
Aspects of rigour
• Being socialized
• Being reflexive
• Being situated
• Being systematised
• …
Level of application
• All practice in all organizations
o Eg tendency to self-referentiality
• All practice in specific organizations
o Eg paternalistic culture
• Specific practices in all organizations
o Eg putting safety ‘in the line’
• Specific practices in specific organizations
o Eg setting targets for closing out snags
8.2 LOOKING FOR RIGOUR IN THE ROUND
The problem with this approach is, as suggested in Section 5, that the various aspects of rigour
sometimes overlap and sometimes seem to contradict each other, and in any case that what is
rigorous in any given situation can be very ambiguous. A better test is the idea that rigour
40
ultimately means managing the by-products of your own processes of safety management. This
means scrutinizing all safety management activity to see whether, for example, there is a
commitment to a clear model of organization (for example putting safety ‘in the line’) and an
equally clear commitment to dealing with its consequences (for example the loss of an
independent view, or the loss of any ability to stand up to production demands).
A general commitment to the idea of managing safety by goal setting rather than prescription
would mean that looking for evidence that an organization is being rigorous, in this sense,
becomes more important than looking for evidence it has adopted specific practices. It would
mean, for example, making no particular judgment as to whether a company should keep safety
‘in the line’ or give a separate safety organization executive powers. The only judgment is
whether it fully understands the consequences of whichever approach it has chosen, and
manages the consequences rigorously in turn. This may be difficult to do, if your experience has
pointed to one practice being clearly better than another in some way. But it has advantages, and
lets a third party such as regulator can take a view on an organization without taking a ‘side’,
especially on the more political issues. It can take a view as to whether the chosen line of action
has been taken with some recognition of the by-products and the maintenance needs; it does not
need to take a view on whether the chosen line of action was somehow correct. It does not need
to say ‘this sacking was appropriate’, or the opposite; but does need to say whether the sacking
was done with an understanding of the consequences, and the consequences of the
consequences.
8.2 RIGOUR IN RELATIONSHIPS WITH THE REGULATOR
Many aspects of rigour concern relationships between organizations, particularly between
operators and contractors. These often look equally applicable to relationships between a
regulator and an operator, and in fact some aspects of rigour specifically concern this
relationship. Some essentially involve operators behaving in a rigorous way towards the
regulator. But it is important to remember how organizations to quite a large degree create their
own environments, and that operators’ responses to regulatory activity might reflect the nature
of this activity as well as their natural inclinations. Therefore we think it is important that HSE
can reflect on its relationships with operators in terms of their rigour, and perhaps use some of
the analysis given above as a basis for doing this. For example, one aspect of rigour – linked to
general ideas about ‘no blame’ cultures – is recognizing that the reliability of a system depends
in part on the behaviour of whoever is relying on it in some fairly obvious ways. When people
in interviews were asked about their relationships with HSE they often concentrated on whether
what they perceived as HSE’s approach encouraged or discouraged them from being open,
sharing knowledge and seeking advice.
Although this was not the main object of our analysis, the operators’ explanations of how to
manage the relationship with the regulator diverged quite sharply. Some saw the HSE as a
legitimate and useful source of ‘challenges’. This was part of a more general aspect of rigour
that recognized the danger of an organization becoming inward-looking for its standards of
behavior, and the benefits of having outside opinion or external norms to test behavior against.
But others saw the HSE as a source of potential disruption to be minimized or mitigated in some
way. One interviewee described a distinctly risk-based approach whereby the HSE was to be
‘kept at bay’, and the occasional ‘trouble’ with HSE being a part of doing business. And some
had fairly critical opinions of both the validity and usefulness of HSE inspectors’ observations –
criticizing their harshness, their narrowness and supposed lack of ‘practicality’, and the way in
which they felt they were put ‘under a spotlight’. Whether these were valid accounts or not, they
seem likely to have conditioned the way in which those who voiced them approached their
dealings with HSE.
41
It is natural to think that the more positive attitudes among operators will elicit more engaged
and helpful actions on the part of the regulator. Being sensitive to this was an aspect of rigour
found in our analysis, and there is a literature on such effects: see for example Jervis, 1997, p.
49). So the operators’ and regulator’s management of the relationship between them need to be
seen as co-evolving and mutually influencing. As with aspects of rigour in other relationships
(such as those between operators and contractors) the essential element seems to be a strongly
engaged approach, where the two organizations are sufficiently communicative that they can get
into a virtuous circle of responding to the other’s concerns and being responded to in equal
measure. This is perhaps especially important in the case of new entrants who, although they
might have lengthy experience elsewhere, are new to the sector and to the regulator. As
mentioned earlier, interviewees said there were wide variations between organizations such that
one new entrant was a good deal more concerned with finding out about regulatory
arrangements and norms than another.
But again it is important to see rigour not as a particular practice – for example engagement
between regulator and regulated – but as a responsiveness to the by-products of your own
responses. One of the problems of engagement for the regulator is that duty holders might see
engagement as a dilution of their own responsibilities, leading to a perception that these are
shared with the regulator. There was a sensitivity to this in interviews with inspectors. Some
talked about the differing levels of receptivity among duty holders to regulatory advice, and
pointed to the way in which large, established operators tended to have large technical staffs
who could ‘push back’ against regulatory opinion. Yet inspectors did not voice a simple
preference for the practice of other, usually smaller and newer organizations, to be more
receptive to their advice. There was a recognition that some ‘push back’ could be desirable, and
that the challenging was two-way rather than one-way. This seemed to help address the
potential problem of duty holders believing their responsibilities to be diluted when they went
along with regulatory advice. It could be seen as being ironic that a regulator would find it
frustrating to be constantly challenged by duty holders, and yet – when it wasn’t challenged –
not to be entirely happy about that either. But this consistent skepticism is perhaps exactly the
quality that is needed.
Another difficulty with the prescription that regulator and regulated should be strongly engaged
is that both parties to a relationship also have to respond to other aspects of their environment in
the way they behave. Some interviewees explained what they saw as being a counter-productive
‘aggressiveness’ on the part of HSE as arising from the need for HSE to demonstrate that they
were not being soft on highly profitable oil companies. This was by no means the consensus,
but it is informative. As with all organizational responses, the question is what is the desired,
main effect, and what are the by-products that need managing. If the main effect is influence
over regulated firms then the problem of being seen as being soft is a by-product that has to be
somehow managed. If the main effect is creating a good opinion then the problem of impeding
the relationship with operators is the by-product that has to be managed – as indicated in Figure
8. The danger of not being clear about this is that you loose the main effect you want because
you give up a practice on the basis of its by-product.
42
Figure 8 Determining the main effect and the by-product
Practice:
Be solicitous and engaged
in regulatory relationships
Main effect:
Helps develop informative
relationship with operators
By-product:
Leads to
impressions of
regulatory
capture
Practice:
Be guarded and evaluative
in regulatory relationships
Main effect:
Avoids impressions of
regulatory capture
43
By-product:
Impedes
development of
informative
relationship
with operators
9 CONCLUSION
9.1 SUMMARY OF THE STUDY
The premise of the study was that what mattered most to safety was not specific organizational
choices, such as how much activity to sub-contract, or how far to proceduralise this activity, but
a deeper capacity to make such choices work. What came out of the study was a detailed
understanding of what this capacity looks like at a concrete level. It typically involved
answering not the direct question of ‘how does the organization deal with circumstances?’ but
the deeper question of ‘how does it deal with the needs and by-products of its own way of
responding to these circumstances?’
The empirical part of the study analysed accident reports and interviews with staff in five
operating companies, and the regulator, in order to determine the specific aspects of this deeper
quality, labeled ‘rigour’. These aspects were wide-ranging, often overlapping and in some cases
contradictory. This, and the way in which behaving rigorously was also a practice that had its
own needs and by-products, pointed to the importance of thinking about rigour as being
recursive: you respond to safety issues in a particular way, then you respond to the by-products
of these responses, then you response to the by-products of those responses, and so on.
The various, detailed aspects of rigour were shared by both new entrants and established
companies. But new entrants were coping with specific problems that placed particular
emphasis on certain of these aspects: for example, the need to manage transitions in ownership
meant having practices that were robust to misunderstandings. Therefore the scrutiny of
operating organizations involves a general consideration of whether they exhibit the various
aspects of rigour, together with a specific focus on the aspects most relevant to their
circumstances.
This notion of rigour seemed to be strongly linked to what is expected of leadership in the
general realm of safety. Aspects of rigour seemed to be neither inherent in ways of organizing,
nor particularly easy to achieve and maintain. It took positive effort, sometimes in the face of
received wisdom and sometimes in the face of strong countervailing pressures, and involved an
approach that was both committed to some particular way of organizing and yet was clear about
its by-products. A simple framework was proposed that distinguished three levels of this
leadership. In the first, leadership only got as far as solving the first-order problem: finding
ways of directly improving safety. In the second, it recognized the problems that these in turn
produced, but generally took these as a sign that improvement was inherently limited. In the
third, there was a recognition that such by-products could themselves be managed.
9.2 LIMITATIONS OF THE STUDY
The first main limitation, as indicated earlier, is the partly subjective nature of a qualitative,
grounded analysis. There is a good deal of latitude in how the framing ideas, in the case to do
with ‘rigour’, are interpreted when looking at the data, there is a lot of subjectivity in selecting
which fragments of an interview or an accident report fit this framing idea, and there is a similar
subjectivity in labeling what aspect of rigour these fragments refer to. The defence is that the
various aspects of rigour that came out of the analysis do not have to be definitive in order to be
useful as a guide to scrutinizing organizations that should be being rigorous.
44
The second main limitation is that the data are similarly selective. The interviews were
unstructured and what the interviewees explained, and how far they explained it, was a function
of the direction established by the interviewer. And the particular explanations the interviewees
chose to give was as much a product of being in an interview as it was of their experience at
work. Accident reports are written by different people with different preconceptions, and
similarly what gets reported is as much a function of the pressures on reporting as what the
reporters really think mattered. The defence here is that neither interviews nor accident reports
were used as sources of factual data about specific events: they were sources of individuals’
insights into how organizations produce safety, and the job of the analysis was to make sense of
these in the round.
The third main limitation is that the study was based on the idea that it was important to study
practice, not outcomes, and that the most important element of practice was how well it dealt
with its own by-products. We started with the informal belief that new entrants as a group could
not be proved either safer or less safe than established operators, so what was important for
safety was not being a new entrant but how you went about being a new entrant (and similarly
what was important about being an established operator was how you went about being an
established operator). This was a premise, not a conjecture that was tested during the course of
the study. It was a convenient conjecture, because it looked as though it would not be possible
to measure the relative safety performance of new entrants and established operators, and even
if it were it would be very hard to know what to make of the results. But it was a premise and
we have not proved it in any sense.
45
9 REFERENCES
Argyris, C. (1990). Overcoming Organizational Defenses. Allyn and Bacon (Needham Heights,
MA).
Berg, B.L. (1989). Qualitative Research Methods. Allyn and Bacon (Boston MA).
Bier, V., Joosten, J. and Glyer, D. (2003). Effects of Deregulation on Safety. Kluwer Academic
Publishers (Dordrecht).
Bigley, G.A. and Roberts, K.H. (2001). The incident command system: high reliability
organizing for complex and volatile task environments. Academy of Management Journal, 44, 1281-1300.
Bond, F.W. and Hayes, S.C. (2002). ACT at work. In Bond, F.W. and Dryden, W. (Eds.),
Handbook of Brief Cognitive Behaviour Therapy, Wiley (Chichester UK).
Bryman, A. and Burgess, R.G. (Eds.) (1994). Analyzing Qualitative Data. Routledge (London).
Glaser, B.G. and Strauss, A.L. (1967). The Discovery of Grounded Theory. Aldine Publishing Company (New York).
Grabowski, M. and Roberts, K. (1997) Risk mitigation in large-scale systems: lessons from high
reliability organizations. California Management Review, 39, 152-161.
Hutter, B.M. and Power, M.K. (2005). Organizational encounters with risk: an introduction. In
Hutter, B.M. and Power, M.K. (Eds.), Organizational Encounters with Risk. Cambridge University Press (Cambridge), pp. 1-32.
Jervis, R. (1997). System Effects. Complexity in Political and Social Life. Princeton University
Press (Princeton, NJ).
La Porte, T.R. (1996) High reliability organizations: unlikely, demanding and at risk. Journal of
Contingencies and Crisis Management, 4, 60-71.
La Porte, T.R. and Consolini, P.M. (1991) Working in practice but bot in theory: theoretical
challenges of ‘High Reliability Organizations’. Journal of Public Administration Research and
Theory, 1, 19-47.
La Porte ,T.R. and Thomas, C.W. (1995). ‘Regulatory compliance and the ethos of quality
enhancement: surprises in nuclear power plant operations’. Journal of Public Administration
Research and Theory, 5, 109-137.
Mason, J. (1996). Qualitative Researching. Sage Publications (London UK).
Merton, R.K. (1936). The unanticipated consequences of purposive social action. American
Sociological Review, 1, 894-904.
Moody, G. (undated). UKCS Smaller Operators. HSE presentation material.
Oster, C.V., Strong, J.S., Zorn, C.K. (1992). Why Airplanes Crash: Aviation Safety in a
Changing World. Oxford University Press (Oxford).
Pidgeon, N. and O’Leary, M. (2000). Man-made disasters: why technology and organizations
(sometimes) fail. Safety Science, 34, 15-30.
Rasmussen, J. (1990). The role of error in organizing behaviour. Ergonomics, 33, 1185-1200.
Reason, J. (1990). The contribution of latent human failures to the breakdown of complex
systems. Philosophical Transactions of the Royal Society, Part B, 327: 475-484.
Reason, J. (1997). Managing the Risks of Organizational Accidents. Ashgate (Aldershot, UK).
Rijpma, J.A. (1997). Complexity, tight-coupling and reliability: connecting normal accidents
theory and high reliability theory. Journal of Contingencies and Crisis Management, 5: 15-23.
Roberts, K.H. (1990). Some characteristics of one type of high reliability organization.
Organization Science, 1, 160-176.
Roberts, K.H., Stout, S.K. and Halpern, J.J. (1994). Decision dynamics in two high reliability
organizations. Management Science, 40, 614-624.
Rochlin, G.I., La Porte, T.R. and Roberts, K.H. (1987) The self-designing high reliability
organization: aircraft carrier operations at sea. Navel War College Review, 40, 76-90.
46
Roe, E., Schulman, P., Van Eeten, M. and De Bruijne, M. (2005). High-reliability bandwidth
management in large technical systems: findings and implications of two case studies,” Journal
of Public Administration Research and Theory, 15, 263-281.
Sagan, S.D. (1993) The Limits of Safety: Organizations, Accidents, and Nuclear Weapons.
Princeton University Press, Princeton.
Sagan, S.D. (1994) Toward a political theory of organizational reliability. Journal of
Contingencies and Crisis Management, 2, 228-240.
Sagan, S.D. (2004). The problem of redundancy problem: why more nuclear security forces
may produce less nuclear security. Risk Analysis, 24, 935-946.
Schatzman, L. and Strauss, A.L. (1973). Field Research. Prentice-Hall (Englewood Cliffs NJ).
Schulman, P.R. (1993) Negotiated order of organizational reliability. Administration and
Society, 25, 356-372.
Snook, S.A. (2000). Friendly Fire: The Accidental Shootdown of US Black Hawks Over
Northern Iraq. Princeton University Press (Princeton, NJ).
Strauss, A. and Corbin, J. (1990). Basics of Qualitative Research. Sage Publications (Newbury
Park, CA).
Vaughan, D. (1996). The Challenger Launch Decision. University of Chicago Press (Chicago).
Vernon, R. (1979). Unintended consequences. Political Theory, 7, 57-73.
Walker, R. (Ed.) (1985). Applied Qualitative Research. Gower (Aldershot UK).
Weick, K.E. (1979). The Social Psychology of Organizing. Addison-Wesley (Reading, MA).
Weick, K.E. (1987). Organizational culture as a source of high reliability. California
Management Review, XXIX, 112-127.
Weick, K.E. and Roberts, K.H. (1993). Collective mind in organizations: heedful interrelating
on flight decks. Administrative Science Quarterly, 38, 357-381.
Weick, K.E., Sutcliffe, K.M. and Obstfield, D. (1999). Organizing for high reliability: processes
of collective mindfulness. Research in Organizational Behavior, 21, 81-123.
Weick, K.E. and Sutcliffe, K.M. (2001). Managing the Unexpected: Assuring High
Performance in an Age of Complexity. Jossey-Bass (San Francisco).
Weick, K.E. and Sutcliffe, K.M. (2006). Mindfulness and the quality of organizational attention.
Organization Science, 17, 514-524.
47
48
49
Published by the Health and Safety Executive
11/09
Health and Safety
Executive
Risk leadership and organisational type
The anecdotal experience of new entrants in the UK
offshore industry is that they are not, as a group, safer
or less safe than established organisations. Similarly,
the organisational arrangements that are sometimes
associated with new entrants – such as the separation
of ownership and operation – are not clearly less safe
than more traditional arrangements. What seems to
matter more is a deeper capacity to make chosen ways
of organising work. This particularly involves being
‘rigorous’: not just developing effective safety practices
but dealing with the by-products and side-effects of
such practices.
An analysis of a set of accident reports, and a set of
interviews carried out with HSE inspectors and staff in
five offshore operators, produced a detailed account
of what this kind of rigour looked like in practice.
The analysis also indicated that being rigorous was
an organisational practice that itself had by-products
needing to be managed. So rigour needs to be seen as
a continual practice of being committed to particular
actions and at the same time being attentive to the
consequences. Rigour of this kind points to a strong
emphasis on leadership – leadership that promotes
an attention to refining practice that does not seem to
come naturally or easily to organisations.
Organisations that were new entrants to the industry
faced problems that made particular demands on their
capacities to be rigorous. For example, they had to
maintain safety while managing transitions in ownership
and organisational culture, getting used to new labour
market conditions and regulatory requirements, and
coping with the physical and organisational legacies
inherited from previous owners of an installation. The
recommendation is that this concept of rigour becomes
a part of the way in which safety management systems
are scrutinised.
This report and the work it describes were funded by
the Health and Safety Executive (HSE). Its contents,
including any opinions and/or conclusions expressed,
are those of the author alone and do not necessarily
reflect HSE policy.
RR756
www.hse.gov.uk