1

PETRONAS TECHNICAL STANDARDS

HEALTH, SAFETY AND ENVIRONMENT

INCIDENT INVESTIGATION

(GUIDELINE)

PTS 60.0501

JUNE 2006
Rev 1

PTS 60.0501
JUNE 2006
 2

PREFACE

PETRONAS Technical Standards (PTS) publications reflect the views, at the time of publication, of
PETRONAS Corporate.

They are based on the experience acquired during the involvement with the design, construction, operation and
maintenance of processing units and facilities. Where appropriate they are based on, or reference is made to,
national and international standards and codes of practice.

The objective is to set the recommended standard for good technical practice to be applied by PETRONAS'
OPUs in oil and gas production facilities, refineries, gas processing plants, chemical plants, marketing facilities
or any other such facility, and thereby to achieve maximum technical and economic benefit from
standardisation.

The information set forth in these publications is provided to users for their consideration and decision to
implement. This is of particular importance where PTS may not cover every requirement or diversity of
condition at each locality. The system of PTS is expected to be sufficiently flexible to allow individual
operating units to adapt the information set forth in PTS to their own environment and requirements.

When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the quality of work
and the attainment of the required design and engineering standards. In particular, for those requirements not
specifically covered, the Principal will expect them to follow those design and engineering practices which will
achieve the same level of integrity as reflected in the PTS. If in doubt, the Contractor or Manufacturer/Supplier
shall, without detracting from his own responsibility, consult the Principal or its technical advisor.

The right to use PTS rests with three categories of users :

1) PETRONAS and its affiliates.

2) Other parties who are authorised to use PTS subject to appropriate contractual arrangements.

3) Contractors/subcontractors and Manufacturers/Suppliers under a contract with users referred to under

1) and 2) which requires that tenders for projects, materials supplied or - generally - work performed
on behalf of the said users comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with users,
PETRONAS disclaims any liability of whatsoever nature for any damage (including injury or death) suffered
by any company or person whomsoever as a result of or in connection with the use, application or
implementation of any PTS, combination of PTS or any part thereof. The benefit of this disclaimer shall inure
in all respects to PETRONAS and/or any company affiliated to PETRONAS that may issue PTS or require the
use of PTS.

Without prejudice to any specific terms in respect of confidentiality under relevant contractual arrangements,
PTS shall not, without the prior written consent of PETRONAS, be disclosed by users to any company or
person whomsoever and the PTS shall be used exclusively for the purpose they have been provided to the user.
They shall be returned after use, including any copies which shall only be made by users with the express prior
written consent of PETRONAS. The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be
held in safe custody and PETRONAS may at any time require information satisfactory to PETRONAS in order
to ascertain how users implement this requirement.

PTS 60.0501
JUNE 2006
 3

AMENDMENT RECORD SHEET

Chap. Sect Description Issue Date Rev Date Appr’d

No. No. No. No. by:
(initial)
All All PTS 60.0502 Incident 1 June 0 0 IGA
Investigation 05
Chap. Sect Description Issue Date Rev Date Appr’d
No. No. No. No. by:
(initial)
All All PTS 60.0501 Incident 2 June 1 0 IGA
Investigation 06

PTS 60.0501
JUNE 2006
 4

TABLE OF CONTENTS

1. INTRODUCTION 6
1.1 Objectives 6
1.2 Structure of the Guide 7
1.3 Link with other Document 7
1.4 Written Policy and Procedures 7

2. IMMEDIATE ACTION AND NOTIFICATION 10

2.1 Immediate Action 10
2.2 Notification from the Incident Location 10
2.3 Notification for Group Service Companies and/or Authorities 11

3. THE INVESTIGATION PROCESS 11

3.1 Determination of Level of Investigation 11
3.1.1 General 11
3.1.2 Incident Classification 11
3.2 Appointment of Investigators 12
3.2.1 General 12
3.2.2 Line Responsibility for Investigation 12
3.2.3 Contractor Incidents 12
3.2.4 Investigation by Local or National Authorities 13
3.3 The Investigation 13
3.3.1 Scope and Aims 13
3.3.2 Timing 14
3.3.3 Background Information 14
3.3.4 The Investigation Method 14
3.3.4.1 Fact Finding 15
3.3.4.2 Inspecting the Location 17
3.3.4.3 Preserving Physical Evidence 18
3.3.4.4 Conducting Interviews 18
3.3.4.5 Records and Procedures 18
3.3.4.6 Conducting Special Studies 19
3.3.4.7 Conflicting Evidence 19
3.3.4.8 Identifying Missing Information 19
3.3.4.9 Underlying Causes and Human Factors 19
3.4 Establishing the Sequence of Events 19
3.4.1 General 19
3.4.2 Incident Investigation Trees 19
3.5 Analysis of Findings 20
3.6 Identification of Recommendations 21
3.7 Investigation Report 21
3.7.1 Compilation 21
3.7.2 Legal Assistance 21
3.7.3 Management Review and Endorsement 21
3.8 Data Recording 21

4. FOLLOW-UP 22
4.1 Communication of Investigation Findings 22
PTS 60.0501
JUNE 2006
 5

4.2 Implementation of Recommendations 22

4.3 Monitoring of Implementation 22
4.4 Statistical Analysis 23

PTS 60.0501
JUNE 2006
 6

Appendix 1 DEFINITIONS 24
Appendix 2 - INCIDENT INVESTIGATION TREES 26
Appendix 3 INCIDENT INVESTIGATION REPORTS 30

PTS 60.0501
JUNE 2006
 7

1. INTRODUCTION
This document provides guidelines on procedures for effective incident investigation
and analysis

There has been a tendency in incident investigation to address only specific

occurrences which had actual outcomes and/or large consequences. The new
approach presented in this guide puts emphasis on those incidents with the potential
for serious injury, illness, damage or loss. Every incident should be investigated,
although the seniority of investigators and the degree of detail of the investigation
may vary and should depend on the actual and potential consequences of the incident.
The primary purpose of incident investigation is to prevent recurrence of similar
incidents by identifying deficiencies and recommending remedial actions. Follow-up
should ensure that those actions are implemented. Statistical analysis of the results of
incident reports can enhance the learning effect of each individual case by deriving
trends. These can be used to identify and correct Health, Safety and Environmental
(HSE) management weaknesses, as well as activity and hardware deficiencies in a
Company's operations.
Studies have shown that incidents can have many causal factors and that underlying
causes often exist away from the site of the incident. Proper identification of such
causes requires timely and methodical investigation, going beyond the immediate
evidence and looking for underlying conditions which may cause future incidents.
Incident investigation should therefore be seen as a means to identify not only
immediate causes leading to, but also failures / omissions in the management of the
operation.
Management must support, be involved in investigations and prepared to act on
investigation findings.
Lessons learned from incidents that is potentially of benefit to others should be
communicated throughout the Company and within PETRONAS Group.
Consideration should be given to communicate such lessons to other interested
parties as appropriate.

1.1 Objectives
The objectives of this Guide are:

• to provide line managers, HSE advisors and contractor managers with a

consistent approach to incident investigation in order to achieve a high quality of
reporting and analysis,

• to explain the incident investigation process and the relationship between the
available techniques and methodologies for analysis and recording,

• to provide a basis for developing Company specific investigation procedures and

guidelines.

PTS 60.0501
JUNE 2006
 8

1.2 Structure of the Guide

The main text of the Guide describes all the steps to be taken after an Incident has
occurred. These are summarised in Figure 1.
Further details of the investigation process, techniques and methodologies, as
relevant for the investigator or investigation team are presented in Appendix 2 and 4.
A list of definitions is given in Appendix 1.

1.3 Link with other Documents

This document describes incident investigation and analysis. For definitions of
incident types and reporting requirements reference is made to PTS 60.0504
“Incident Classification and Reporting”.

1.4 Written Policy and Procedures

An essential requirement for management of HSE is to have a written policy and
procedures for incident investigation. These should be available to all employees and
should require reporting, recording and investigation of all incidents which result in
the following:

• Work Injuries

• Occupational illnesses

• Environmental damage

• Property damage

• Near Misses

• Security Breach

The procedure should specify the actions required at each stage in the investigation
process and indicate the action parties, routing of communications and reports, and
related deadlines. The procedures should be supplemented by guidelines on a number
of issues, including the following:

• preservation of evidence including condition and position of equipment,

supervisory instructions, work permits, recording charts, etc.

• formation of investigation teams

• assessment of incident potential

• HSE, drugs and alcohol policy

• evaluation of emergency response, rescue activities and damage control

PTS 60.0501
JUNE 2006
 9

measures

• training in incident investigation

• awareness that reports may be required by third parties such as national

authorities, legal bodies, etc.

PTS 60.0501
JUNE 2006
 10

Figure 1 Incident Investigation and Analysis Procedure

PTS 60.0501
JUNE 2006
 11

2. IMMEDIATE ACTION AND NOTIFICATION

2.1 IMMEDIATE ACTION

When an incident occurs the first action to be taken is to prevent further injury and
arrange for any necessary medical treatment as well as taking measures to prevent the
situation from escalating and causing further damage. Where possible, the site should
be left unchanged until the investigation team has inspected it. Where this is not
possible, photographs should be taken or sketches be made of the scene.
A preliminary assessment of the incident should be made to identify the extent of
injury or damage, and any potential for escalation.

2.2 NOTIFICATION FROM THE INCIDENT LOCATION

After arranging any necessary first aid and medical treatment and taking measures to
prevent consequential losses and injuries, notification from the location of an incident
is made in order to:

• advise operations control (so that adjustment can be made to the plan of
operations)

• facilitate notification of other parties as required

• initiate the investigation process.

Notification should be made via the senior person at the location or plant.
Notification should be routed to the line function and to other departments from
which assistance is sought and also to the HSE organisation. Routing should be
specified in the Company's Incident Investigation Procedures.
The notification should contain details of:

• time, place and nature of the Incident

• persons injured/equipment damaged

• nature of injury/damage and estimate of severity

• immediate corrective action being taken

• assistance required

• operation in progress at the time.

The notification report should be factual and avoid hearsay, assumptions and
preliminary conclusions. If the notification is made verbally via mobile phones, it
should be followed up by a written email, faxed or telexed confirmation.
Operating companies should set stringent, fast, but achievable deadlines for

PTS 60.0501
JUNE 2006
 12

notification to allow prompt initiation of the investigation process. (Suggest define

what this is, including the team leader, here by PETRONAS Corporate)

PTS 60.0501
JUNE 2006
 13

2.3 NOTIFICATION FOR PETRONAS GROUP SERVICE COMPANIES AND/OR

AUTHORITIES
PETRONAS PTS 60.0504 “Incident Classification and Reporting” describes the
classes of incident which are to be reported to the Service Companies and the
procedures for their notification.
In addition, there may be a requirement for local or national authorities to be notified
of all incidents in certain categories (e.g. in Malaysia, fatalities will involve both the
local Police and Occupational Safety and Health Department (DOSH), occupational
illnesses and those accidents involving lifting appliances, pressure vessels requires
notification to DOSH or motor vehicles to the local Police ).

3. THE INVESTIGATION PROCESS

3.1 DETERMINATION OF LEVEL OF INVESTIGATION

3.1.1 General
The notification of an incident triggers the start of the investigation process, which
comprises the consecutive stages as indicated in Figure 1.

3.1.2 Incident Classification

An incident may result in serious injuries, illness, damage, environmental impact or
alternatively have only minor consequences. Lessons to avoid re-occurrence can be
gained from all incidents. For incidents with minor consequences the potential
severity can still be very high. Investigation of those cases may reveal as much about
the deficiencies in HSE management as cases in which major injury resulted. In
isolation, incidents with minor consequences and minor potential severity may
provide little learning, but the collection and analysis of data from many such
incidents show trends which may be used to identify measures for improvement in
the overall HSE performance.
When assessing the potential severity of an incident two parameters are combined:
1. potential injury/damage/environmental impact

2. level of exposure/frequency of occurrence. The investigation effort in terms of

team composition and depth of investigation should be based on actual and
potential severity.

PTS 60.0501
JUNE 2006
 14

3.2 APPOINTMENT OF INVESTIGATORS

3.2.1 General
The size and composition of an investigation team will depend on one or all of the
following factors:

• extent of injury or damage

• potential for injury or damage

• potential for repetition

• departments involved

• requirements for specialist knowledge

• legal requirements

For many incidents the investigative skill and effort required may be within the
capability of one person, who, for minor incidents, could be the line supervisor.

3.2.2 Line Responsibility for Investigation

Following the concept of line responsibility, the line function should take the lead in
incident investigation. A rapid response from the appropriate level of line
management demonstrates management commitment.
First-line supervisors bring their technical skills and familiarity to the task, the
process and the operation, together with their knowledge of the individuals involved.
In some investigations however, the immediate supervisor may have more value as a
witness than as a member of the investigating team. Senior line supervisors and line
managers provide their experience and view events from a perspective based on an
overview of a broad area of activity. They are in a better position to detect
weaknesses in management systems and can assist in expediting the investigation
process.
HSE personnel can also make a valuable contribution to an investigation. Beside
their contribution of HSE know-how, they can provide comparison with similar
situations in other departments and companies. In addition their independent
viewpoint can be useful when examining established work practices. It may also be
valuable to include other technical specialists and HSE representatives on the team.

3.2.3 Contractor Incidents

The responsibility for investigating contractor incidents lies with the relevant
Contractor. It is recommended that:

• Contractor's arrangements for carrying out incident investigation should be

established at the pre- qualification stage

PTS 60.0501
JUNE 2006
 15

• Company should monitor such investigations and follow-up

• findings and recommendations from the investigation should be discussed

between the managements of the Company and Contractors

• an investigation should be conducted by the Company, either separately from

or jointly with the Contractor, when a Contractor incident occurs on Company
premises or involves Company property or interests.

Irrespective of the contractual obligations of the Contractor, the contract holder

remains responsible for ensuring that reportable incidents are treated in accordance
with the PETRONAS Group Guidelines with respect to timing and completeness of
reporting.

3.2.4 Investigation by Local or National Authorities

In the event that the local authority wishes to investigate, the Company should
nominate a focal point to liaise with the authorities and to assist them in assembling
the information they require.
Notwithstanding the involvement of the authorities and other bodies, the Company
should carry out its own investigation.
It is likely that the (local) authority investigating the incident may require a copy of
the company’s investigation report. However, as it may serve as a basis for, or even
as evidence in, civil or criminal proceedings possibly brought against the Company,
its directors or employees, consultation with the Company’s legal advisor is essential
before handing over any such document.

3.3 THE INVESTIGATION

3.3.1 Scope and Aims
The scope of the investigation should be such as to achieve the following primary
aims:

• to identify the root causes of the incident such that actions can be taken to
prevent recurrence of future incidents

• to review the application of management practices and their impact on HSE

• to establish the facts surrounding the incident for use in relation to potential
insurance claims or litigation

• to meet relevant statutory and PETRONAS Group requirements on incident

reporting.

PTS 60.0501
JUNE 2006
 16

This may necessitate review of aspects remote from the location and time of the
Incident.

3.3.2 Timing
An investigation should be carried out as soon as possible after an incident,
preferably within 24 hours as the quality of evidence can deteriorate rapidly with
time, and delayed investigations only add to the “uncertainties” surrounding the
investigation.

3.3.3 Background Information

Appropriate background information should be obtained before visiting the incident
location. Such information could include:

• procedures for the type of operation involved

• records of instructions/briefings given on the particular job being investigated

• location plans

• command structure and persons involved

• contractual requirements

• aspects of the HSE Case as in Activity Specification Sheet and Hazard

Register HSE MS requirements as appropriate

• messages, directions etc., given from base/head office concerning the work.

Before proceeding out to the scene of the accident, the team leader will brief the team
the information available thus far relating to the incident in terms of the harm done
and actions taken. The team will draw up the preliminary Hazard – Event – Target
(HET) diagram as a guide for gathering information. Where the barriers and controls
can be identified they should be reflected to produce the preliminary “core” diagram
in the investigation process

3.3.4 The Investigation Method

The method of conducting an investigation consists of the following activities:

• fact finding / information gathering

• inspecting the location

• gathering or recording physical evidence

• interviewing witnesses

• reviewing documents, procedures and records

PTS 60.0501
JUNE 2006
 17

• conducting specialist studies (as required)

• resolving conflicts in evidence

• identifying missing information

• recording additional factors and possible underlying causes including human

factors.

During the initial stages of every investigation, investigators should aim to gather and
record all the information which may be of interest in determining causes.
Investigators should keep an open mind and considering the full range of
possibilities.
Checklists can be very useful in the early stages to keep the full range of enquiry in
mind, but they cannot cover all possible aspects of an investigation, neither can they
follow all individual leads back to basic causal factors. When checklists are used,
their limitations should be clearly understood. Make use of the core diagram to act as
prompters on areas to look at, effectiveness of which could have prevented the
accident.

3.3.4.1 Fact Finding – information gathering

The objective of this stage of the investigation is to collect as much information as
possible. Figure 1 provides an overview of the investigation and analysis process.
The scope of an investigation can be divided into five areas:

• people

• environment

• equipment

• procedures

• organisation

Conditions, actions or omissions for each of these may be identified, which could be
factors contributing to the incident or to subsequent injury, damage or loss.
A factor to consider during an investigation is recent change. In many cases it has
been found that some change occurred prior to an incident which, combining with
other causal factors already present, served to initiate the incident. Changes in
personnel, organisation, procedures, processes and equipment should be investigated,
particularly the hand-over of control and instructions, and the communication of
information about the change to those who needed to know.

PTS 60.0501
JUNE 2006
 18

The effect of work cycles and work related stress could have an impact on
individuals' performance prior to an incident.
The impact of social and domestic pressures related to individuals' behaviour should
not be overlooked.
The initial stages of an investigation normally focus on conditions and activities close
to the incident and only immediate causes are usually identified at this stage.
However, the conditions underlying these causes may also need investigating.
Information should be verified wherever possible. Statements made by different
witnesses may conflict and supporting evidence may be needed.
To ensure that all the facts are uncovered, the broad questions of "who?, what?,
when?, where?, why? and how?" should be asked.
After fact finding / information gathering it should be possible to:

• I give a precise description of the incident, its background, timing, and

the events leading to it

• I describe the weather conditions

• I describe the operations

• I identify the equipment in use, its capabilities and any failures

• I describe the locations of key personnel and their actions immediately

before, during and immediately after the incident

• I describe all pertinent instructions

• I identify energy flows that were not controlled

• identify operational deviations, other defects or inappropriate use of resources

and equipment

• identify changes of staff, procedures, equipment or processes that could have

contributed to the accident

• identify shortfalls in relevant personnel skill levels

• identify whether alcohol or drugs were contributory

• identify what barriers in place did not work or should be in place but missing

• identify the effectiveness of safety programmes

• comment on response to an accident (first aid, rescue, shut-down, fire-

fighting, etc.)

PTS 60.0501
JUNE 2006
 19

• identify damage control and medical treatment actions taken to prevent

worsening of the situation and the condition of injured parties, particularly if
disabling injuries or death ensued

• make an inventory of all the consequences of the incident (injury, damage and
loss).

What constitute as a “fact”? A fact is defined as:

- written document as in work instruction, contract document, permit to work

etc.,

- physical evidence that can be felt, touched or seen

- photographs – untampered whether paper or digital

- a statement that is supported by another. Where there is a difference, it is the

role of the investigation to reconcile the information one way or the other.
There is no right or wrong in an investigation!!

3.3.4.2 Inspecting the Location

Important evidence can be gained from observations made at the scene of the
incident, particularly if equipment remains as it was at the time of the incident.
Similarly, witnesses' statements can usually be better understood and verified if
discussed at site. Witnesses should be readily available to the investigation team. It is
not possible to set rules on "immobilising" equipment at a location, but as far as
possible the site should be kept "as is" until at least a preliminary investigation has
taken place. However, rescue operations or the presence of residual hazards and/or
congestion may justify moving some of the equipment.
Local legislation may prescribe that for certain classes of incident, e.g. fatality or
motor vehicle accident, nothing may be moved without prior permission from the
relevant authorities.
Photographs – paper or digital and/or video film will assist the investigation.
However, local authorities may restrict site access or impound equipment and in such
circumstances it may not always be possible to obtain photographic records. In these
situations sketches should be made.
The investigators should be looking for any conditions in the immediate environment
which could have contributed to the incident. Items to check include:

• position of all equipment in relation to other equipment/facilities

• the position of valves, spades, set points, recorders, override switches, etc.

• the condition of the load-bearing surface

PTS 60.0501
JUNE 2006
 20

• accessibility/evidence of congestion

• illumination/visibility and audibility at the location/site

• state of house-keeping

• the condition of all equipment/facilities

• effects of weather

• presence of witnesses

• evidence of spills or release

• odours, discolouration

• presence of unauthorised people

• evidence of excessive forces

• presence/absence of warning signs/notices

• results of statutory and other inspections.

3.3.4.3 Preserving Physical Evidence

In many incidents components or equipment may be damaged, or have failed. In
these cases, it is best to lodge this equipment in a secure place pending more detailed
analysis.

3.3.4.4 Conducting Interviews

People should be interviewed singly and be asked to go step-by-step through the
events surrounding the incident, describing both their own actions and the actions of
others. An interview is best conducted in an environment / surrounding comfortable
to the witness. This is often the place of work or area where breaks are taken.
The value of a witness's statement can be greatly influenced by the style of the
interviewer, whose main task is to listen to the witness's story and not to influence
him/her by making comments or asking leading questions. This requires patience and
understanding. If the investigation is a team effort, great care should be taken not to
make a witness feel intimidated by too many interviewers. Experience has shown that
interviews can be effectively conducted by a pair of interviewers with one listening
and asking questions while the other listens and takes notes, interjecting on “new”
information offerred and if appropriate, the witness could be accompanied by an
independent "friend".
It should be remembered that an investigation team is often seen in a prosecuting
role, and there may be a reluctance to talk freely if people think they may incriminate

PTS 60.0501
JUNE 2006
 21

themselves or their colleagues. An investigator is not in a position to give immunity

in return for evidence, but must try to convince interviewees of the purpose of the
investigation which is to understand what went wrong and why, not who is to be
blamed and the need for frankness.
At the end of an interview the discussion should be summarised to make sure that no
misunderstandings exist. A written record should be made of the interview and this
should be discussed with the witness to clarify any anomalies. Any anomalyin the
statement or conflicts with other evidence must be clarified.

3.3.4.5 Records and Procedures

Documentation such as "as-built" drawings, inspection records, instrument and
tachograph records, print-outs, log sheets/books, maintenance records, work permits
and load/time sheets may provide information relevant to the investigation.
Written instructions and procedures provide evidence of pre-planning and individual
responsibilities. The investigation should try to establish the extent to which these
procedures and instructions were understood and acted upon, as these can indicate
the effectiveness of training and supervision. The relevance and extent of application
of procedures should be assessed during the investigation.

3.3.4.6 Conducting Special Studies

Incidents of an involved or complex nature often require the analysis of specialists to
determine causes of failure. Aircraft crashes, crane failures and explosions are
examples of such incidents, where specialist advice may be required. This should be
rapidly identified and the specialists be involved early in the site assessment.

3.3.4.7 Conflicting Evidence

It is not unusual for different witnesses to give different accounts of an incident.
Human memory can be unreliable and, even if not motivated by self-protection or
other subjective argument, one person's recollection of an incident can differ from
another's in quite important details. Investigators should note any significant
differences in accounts of an event. Faced with conflicting witnesses' statements,
investigators should look for the similarities between the statements and
commonality with other evidence. The objective is to use the evidence to understand
the incident and not to prove the accuracy of individual statements, nor to apportion
blame.

3.3.4.8 Identifying Missing Information

As the investigation progresses, the investigator(s) should begin to identify the
sequence of events – the core diagram and concentrate efforts on Identifying the
failed barriers / controls and the causal chain of events leading to the latent
conditions that initiate it.

3.3.4.9 Underlying Causes and Human Factors

As the extent of physical factors involved in an incident becomes clear, the

PTS 60.0501
JUNE 2006
 22

investigator(s) should shift the emphasis of their investigation and questioning to the
underlying causes and to the reasons for peoples' actions. This will allow for ease of
assessment when analysing the incident.

3.4 ESTABLISHING THE SEQUENCE OF EVENTS

In the fact finding / information gathering stage of an incident investigation, it is
crucial to obtain all information and (confirmed) facts essential to the understanding
of the incident. This implies back tracking from the initial information found, to
discover the reasons behind them.
Gaps that are left in the event sequence should be reviewed to identify alternative
scenarios to complete the sequence. In doing this it may be helpful to consider the
human factors sequence
(See Appendix 3).

3.4.1 General
The approach of tabulating events and then ordering them by date, time and place is
an essential stage in establishing the sequence of events towards the Hazard – Event
– Target (HET) diagram for the accident. Identifying the respective failed barriers /
controls result in the establishment of the “core” diagram.

3.4.2 Incident Investigation Trees

The construction of a diagram showing the connections between the various events
and conditions leading up to the incident - a TRIPOD Investigation Tree - has proved
to be a useful technique in the investigation process, especially for more complex
incidents (see Appendix 2).
Construction of a diagram of factors may not be necessary for less complex incidents,
but the technique of enquiry is still valid: "What prior events or conditions were
necessary for this to happen?"

3.5 ANALYSIS OF FINDINGS

The purpose of analysis is to establish the critical events and the underlying causes of
the incident such that corrective measures can be taken to prevent future incidents.
This requires investigators to have a clear understanding of the cause and sequence of
activities and why one event or situation progressed to the next.
Incident causation studies, particularly the Tripod research, clearly identify that an
incident the end result of a chain of events. These can be identified at differing stages
in the incident causation sequence.
The incident investigation should not be restricted to the unsafe acts or active failures
as this will only conclude that human failures (driver, operator, drilling crew) caused
the incident ("human error"). The Tripod theory has shown that unsafe acts do not
occur in isolation but are influenced by existing preconditions, which may originate
from failures in the top level of the organisation and line management. Such activities
and decisions are removed in time and place from the end-of-the-line operations,
where the incidents occur. The so-called latent failures may lie dormant within the
PTS 60.0501
JUNE 2006
 23

system for a long time, and their adverse consequences may only become evident
when they combine with other factors to breach the system defences. Detailed case
studies reveal that latent rather than active failures are the precursors of incidents.
Tripod classifies these latent failures into General Failure Types (GFTs) / Basic Risk
Factors (BRFs).
Identifying and correcting these latent failures rather than merely correcting the
active failures induced by them (symptoms), is more effective in meeting the ultimate
objective of the investigation, namely to improve the overall HSE performance.
Identification of underlying causes and latent failures need not necessarily involve
application of the full Tripod methodology, but should apply the causation theory as
proposed by Tripod (See Fig. 2), involving a brief consideration of the GFT/BRFs.
See Appendix 3 for a summary of the Tripod methodology.
Figure 2 Tripod Incident Causation Sequence

3.6 IDENTIFICATION OF RECOMMENDATIONS

The investigation process should identify actions to prevent recurrence. This can best
be achieved by addressing the unsafe acts and unsafe conditions, and by identifying
and correcting the latent failures.
Not all causes can be completely eliminated, and some may be eliminated only at
prohibitive cost. Some recommendations will therefore be aimed at reducing the risk
to a tolerable level, while others will be aimed at improving protective systems (the
defences) to limit the consequences.
All recommendations should be in the form of measurable action items with clearly
defined action parties and a time scale for implementation.

3.7 INVESTIGATION REPORT

3.7.1 Compilation
The investigation report is a presentation of the findings and recommendations of the
investigation team. The report may be in a standard form or free format. For more
complex incidents diagrams of the Incident Investigation Trees should be attached to
give an overview of the causation sequence (see Appendix 2).

PTS 60.0501
JUNE 2006
 24

Appendix 4 provides an outline of an investigation report.

3.7.2 Legal Assistance

When incident reports are being compiled that may be required by authorities outside
the company, it is strongly recommended that legal advice is sought in the
preparation of the report. Legal advice should also be considered if third parties,
including other authorities than those directly competent in respect of the incident,
request to be provided with copies of the report. Each such request should be
considered on a case by case basis taking into consideration the potential risks and
exposures for the Company, its directors and employees for possible criminal or civil
liability.

3.7.3 Management Review and Endorsement

Before completion, the investigation report should be reviewed at the appropriate
management level as a check on the completeness and quality of the investigation
and to obtain endorsement of the recommended actions.

3.8 DATA RECORDING

Key data from all incidents should be registered in a database to facilitate
I preparation of performance reporting requirements to PETRONAS Group
Companies and/or local authorities

I statistical analysis of incident data

I causal/trend analysis.

For this purpose a database such as the Group common system to be defined can be
used. AN OTHER is a computer-based system for use by Operating Units, which
can also be used to transfer data to the PETRONAS Group Companies.
Notification to PETRONAS Group Companies can be done by document transmittal
or, for some Operating Units, by diskette or direct computer data transfer.

4. FOLLOW-UP

4.1 COMMUNICATION OF INVESTIGATION FINDINGS

To maximise the lessons learnt, relevant findings and conclusions of incident

investigations should be given as wide a distribution as practicable.
Discussions at, and feedback from, HSE meetings and team briefings should be used
to maximise the benefits from the learning points of the incident investigation and
help achieve the objective of preventing of similar incidents.
Learning points which may have a wider industry value may be exchanged with
industry contacts, safety institutes, etc.

PTS 60.0501
JUNE 2006
 25

4.2 IMPLEMENTATION OF RECOMMENDATIONS

Recommendations should be discussed on a formal basis with action parties for
agreement on the action required and the time-schedule for implementation. This
should be reviewed and endorsed by OPU/JV management.

4.3 MONITORING OF IMPLEMENTATION

Much of the value of incident investigation will be lost if the implementation of
agreed recommendations is not achieved. Where recommendations cannot be fully
implemented immediately, a formal follow-up monitoring system is required to
ensure that agreed actions are implemented and/or non-conformances are known to
management and formally endorsed.

Hardware related items are normally easy to identify as having been completed, e.g.
when the modification has been effected or when the new equipment has been
received or installed. This is not always the case with items such as training, changes
to procedures or supervision and particularly when action is described as "ongoing".
A precise description of the action item is essential if it is to be effective.
It is suggested that a procedural action point is considered to have been completed
when:
I written instructions have been issued and circulated to all staff
concerned

I changes in procedures have been monitored and found to be effective.

It will be necessary to set a deadline to ensure implementation of recommendations.

The schedule for implementation should take both the above points into account.
Items involving training or changes in supervision should be handled in a way similar
to procedures. The changes must be planned, circulated as necessary, and monitored
until they are seen to have taken effect.
The quality of incident investigation and the effectiveness of the solutions
implemented should be audited on a routine basis. If there are shortcomings they
should be tackled by training programmes or other techniques.

PTS 60.0501
JUNE 2006
 26

4.4 STATISTICAL ANALYSIS

Before the introduction of computer databases for incident analysis data, statistical
analysis of incidents was focused mainly on trend monitoring of injury and incident
frequencies in terms of actual consequences. Identified trends were used to set future
targets.
With the introduction of systems such as AN OTHER, the scope, range and quality of
statistical analyses can be increased e.g. by incident classification and recording in
terms of:
. I potential severity
.
I underlying causes (by use of the 11 Tripod General Failure Types /
Basic Risk Factors).

This analysis allows for better identification of the lessons learnt from individual
incidents and improves the ability to identify and correct weaknesses in HSE
management. In addition, the computer system can facilitate performance monitoring
of individual units, contractors, etc.
Statistical analysis of incidents is only able to reflect what has happened and is
therefore a reflection of past policies and their implementation. For statistical
analysis to be meaningful a significant number of entries is required in order to be
able to detect trends. As a company's safety performance improves, complete
recording and analysis of all incidents becomes increasingly more important.

PTS 60.0501
JUNE 2006
 27

APPENDIX 1 - DEFINITIONS
ACCIDENT
An Accident is an Incident which has resulted in actual Injury or Illness and/or
Damage (Loss) to Assets, the Environment or Third Party(ies).

EMPLOYMENT
Employment means all work or activity performed in carrying out an assignment or
request of a Reporting Company or Reportable Contractor, including related
activities not specifically covered by the assignment or request.
Employment also includes activities, even outside working hours, where the
Reporting Company has the Prevailing Influence. Under certain circumstances
travel to and from work is also considered as being in the course of Employment.

INCIDENT
An Incident is an unplanned event or chain of events, which has or could have
caused Injury or Illness and/or Damage (Loss) to Assets, the Environment or Third
Party(ies).

OCCUPATIONAL ILLNESS
An Occupational Illness is any work-related abnormal condition or disorder, other
than one resulting from a Work Injury, caused by or mainly caused by exposures at
work.
The basic difference between an Injury and Illness is the single event concept. If the
event resulted from something that happened in one instant, it is an injury. If it
resulted from prolonged or multiple exposure to a hazardous substance or
environmental factor, it is an Illness.

REPORTABLE INCIDENT
A Reportable Incident is one that is required to be reported to the Regional Focal
Point for Safety and the Functional Safety Advisor in accordance with the special
reporting procedures that have been established in Section 3 of the Guide for Safety
Performance Reporting.

REPORTABLE WORK INJURY

A Reportable Work Injury is any Work Injury which results in:

i) fatality
ii) permanent total disability
iii) permanent partial disability
iv) lost work days
v) restricted work days

PTS 60.0501
JUNE 2006
 28

vi) medical treatment

Any injury which progresses from one category to a category higher on the above list
shall be recorded in the higher category only.
SECURITY INCIDENT
A Security Incident is one which involves purposeful or deliberate attempts to
defraud, cheat or steal property or possessions of the Reporting Company or to
wilfuLly injure an employee of a Reporting Company or Reportable Contractor.

WORK INJURY
A Work Injury is an injury or illness, regardless of severity, which arises from a
single event (or a number of events close together in time) in the course of
Employment.
In cases where this definition gives reasons for doubt, an injury should be treated as a
Work Injury.
Injuries in the course of Employment which are caused by wilful acts are, in general,
treated as Work Injuries.
Injuries caused by the deficiencies in equipment or management controls for which
the Reporting Company is responsible are treated as Work Injuries, even when they
occur outside working hours.
Occupational illnesses and death from natural causes are not considered as Work
Injuries for the purpose of this Guide.

PTS 60.0501
JUNE 2006
 29

APPENDIX 2 - INCIDENT INVESTIGATION TREES (Also refer to PTS

60.0504)
The Incident Investigation Tree arranges the facts in a logical and sequential fashion.
As far as is possible these facts will consist of "date and time stamped" events and
conditions known to exist at the times and places involved. The process assists in
identifying which facts are missing and necessary to explain the causal sequence. The
analysis identifies the critical events in the process to discover the underlying causes.
Investigation establishes the facts, analysis interprets them with a view to prevention.
Analysis may result in posing questions about events which require further
investigation.
An "event" is something which happened in the period being described, such as:
. I a decision made to act in a certain way

I component failure
.
. I a rain squall.

An "event" may also be considered as a change of state.

A "condition" is a state which was present over a period of time, such as:
. I a wet road surface
.
I a flammable atmosphere.

An "event" could be the start of a condition, e.g. a joint failure having created a
flammable atmosphere.
Not all of the events and the conditions described are faults. The full description of
the circumstances of an incident must include all normal factors so that decisions
made and actions taken can be seen in their correct context.

1. CONSTRUCTION OF TREES
The incident event is the starting-point for constructing an investigation tree. Starting
with the incident itself, identify the prior events or conditions which were necessary
for the incident to happen (essential factors). Each factor can then be traced back in a
similar way, identifying further essential factors. The process of tracing back should
be continued for each chain of events to a point where it is considered to be outside
the control or prevailing influence of the Company.
Validation should establish that only factors which had any bearing on the incident
are included in the tree diagram. "Factors A, B (and C) were all necessary for event
D to happen". These should be joined by an 'and' gate. If removal of a factor is seen
not to affect the outcome it cannot be considered an essential factor.
If several alternative factors could have contributed to the next event, then these
should be combined through an "or" gate and may highlight an area where further
investigation is required.

PTS 60.0501
JUNE 2006
 30

An ongoing condition can appear more than once in an investigation tree, as a

contributory factor to events separate in time.
Care should be taken to describe facts correctly. For example, "failure to wear
protective equipment" may imply that there was a rule which was broken. Leads to
follow from this fact would be in the areas of supervision and motivation. The
statement "no rule for wearing protective equipment" would lead to areas of policy
and procedures.
From the finished tree it should be possible to see where the operation deviated from
its desired course, and identify not only the specific actions of people involved but
also areas of weakness in a company's safety management.
The example below shows an investigation tree identifying remaining leads to be
followed.

2. EXAMPLE OF INCIDENT INVESTIGATION TREE

Drowning Accident
Summary
Four men, working on construction of a drilling location, were returning to their all
men got into difficulties. Three managed to reach the opposite bank, but the fourth
failed and drowned. His body was recovered 24 hours later.

Background
Four men had been assigned to clear a track for a water line between a new drilling
location and a nearby creek. The new location was across the creek from the
engineering base camp. To get to the worksite from base, crews could either cross the
creek by canoe or walk around via an upstream bridge, which would take them about
an hour and a half.
On the day of the accident, the four men had been able to get a local canoe to ferry
them across in the morning. At about 11.30, being hungry, they decided to return to
the camp for lunch. They waited a short while for a canoe to pass, but none came.
Their supervisor was not there, and they did not want to lose time by waiting, so they
decided to swim across the creek. The water was flowing quite fast, but the creek was
only six metres wide and they all had life-jackets.
Due to the current, they all experienced difficulty in swimming. Three men managed
to make it to the other bank, exhausted, but they could not locate their companion
(Mr. X). The creek was muddy and full of debris.
Mr.X's body was recovered by villagers some 24 hours later. It was found at the
bottom of the creek, some 50 metres downstream of the crossing point. His life-
jacket was still attached.

Result of the Investigation

. I The civil engineering contract specified that the Contractor was responsible
for accommodation, feeding and transport of field crews.

PTS 60.0501
JUNE 2006
 31

.
. I The labour subcontractor was given a daily allowance to cover transport. He
did not provide a canoe on stand-by, but there were usually enough local
canoes passing for his crews to obtain lifts across the creek.
.
. I Life-jackets of local manufacture had been issued for use when working by
water. Due to recent rains, rivers and creeks were high. Instructions had been
given to wear life-jackets "at all times".
.
. I Life-jackets had been in use for about three months, but many were in poor
condition, with securing tapes broken or missing and polystyrene floatation
blocks broken/compressed.
.
. I Neither the Company nor the Contractors had prepared a river crossing
procedure.
.
. I There was no rule forbidding swimming; contractor management considered
that some swimming was unavoidable.
.
. I It was the understanding that all men could swim, but no swimming tests
had been held, so individual competence had not been verified.
.
. I The subcontractor's labour were paid on a piece-work basis.
.
. I Construction crews were split up into groups of 3 to 4 men, one supervisor
looking after 5 or 6 groups.

Further Investigation Leads

Further leads to follow in order to complete the investigation tree (refer to the
numbers on Figure 3).
1. Controls in piece work contract to make sure that safe working practices were
maintained.

2. Feeding arrangements for crews at worksites.

3. Transport safety provisions:

.
Ithe main contract
.
. Ithe labour subcontract.

4. Monitoring of transport adequacy and safe operations:

.
. I by main Contractor
.
. I by the Company.
.

PTS 60.0501
JUNE 2006
 32

5. (a) Identification of hazardous tasks in the Company safety plan

. (b) Operating and safety procedures for the project.

.
6. Discussion of the hazards of swimming in safety meetings/briefings.

7. (a) Contractor supervisor levels

.
. (b) Supervisor's safety training
.
. (c) Audits of Contractor supervisory effectiveness.

8. Dissemination of information on effect of heavy rainfall.

9. Verification of swimming skills.

10. Life-jacket inspection and maintenance.

11. Approval of life-jacket design as work vest or life-saving appliance.

12. Suitability of life-jacket materials and fabric for daily rough usage.

Figure 3 - Incident Investigation Tree

PTS 60.0501
JUNE 2006
 33

APPENDIX 3 - INCIDENT INVESTIGATION REPORTS

(Also refer to PTS 60.0501 Section on Report Writing)

This appendix contains a brief description of the key elements of a written investigation
report. General recommendations to consider in preparing the report are:

. I the report should be factual, concise and conclusive

I interpretations of findings should be based on the facts as identified in the

investigation

. I unsubstantiated speculation should be avoided at all times

.
I assessment of underlying causes should be made, based on an analysis of the
findings

. I where events or conditions are listed, that are not critical for the incident to
have occurred, this should be clearly indicated
.
. I the report should be readable as a stand alone document, references to other
documents not open to inspection by others i.e. the public, should be avoided

. I previous drafts of the report should be destroyed

.
. I a papertrail of the documents relevant to the incident and the report should be
established.

SPECIFICATION OF AN INCIDENT INVESTIGATION REPORT

Summary
A brief summary of the report, giving the background of the Incident, a description of the
Incident, description of injuries, damage and loss, and outlining the main facts, principal
causes identified, and remedial measures taken.

Time, Place and Date of Incident

Details of Persons Injured, Including as Appropriate

. I status, i.e. company employee, contractor employee, or third party (specified)

.
. I name, age, whether employee or contractor, position held, time in that
position
.
. I length of service (company and area)
.
. I nationality and family status
.
. I details of injuries, in a form understandable to non-medical readers (medical

PTS 60.0501
JUNE 2006
 34

reports can be attached as appendices).

PTS 60.0501
JUNE 2006
 35

Details of Damage
. I description of the extent of direct damage
.
. I estimate of loss value
.
. I estimate of consequential losses.

Events Leading up to the Incident

A short narrative which sets the scene of the Incident:

I description of the operation in progress

I preparations made for the work (work procedures, instructions, permits,

supervision)

I personnel and equipment involved

I environmental conditions

I activities taking place at the scene of the incident

I activities of key persons prior to the day of the incident that could have
affected their actions.

Description of the Incident

A statement of the facts immediately surrounding the incident, covering the period from the
initiating events until the situation was under control and identifying, where possible, the
sequence of events. In this context photographs, maps or drawings should be used as
illustrations to support the narrative.

Results of the Investigation of the Incident

This section should demonstrate that the investigation was carried out in sufficient depth to
support the conclusions that follow. It should include, where relevant, references to:
I environmental conditions

I condition of equipment and facilities, known deficiencies, positioning,

operating mode, etc

I procedures relating to the operation

I pertinent information concerning the principal operators and supervisors (e.g.

training, experience,

I hours into shift and days into tour)

I work instructions and communications

PTS 60.0501
JUNE 2006
 36

I records and documentation

I information derived from the nature of the damage I
I witnesses' statements
I medical information (state of health)

I factors affecting alertness or judgement (e.g. fatigue, social pressures, alcohol,

medication or drugs)

I working conditions

I survival aspects

I results of special investigations and tests

I rescue and damage containment activities

I emergency response and recovery activities.

Conclusions
This section should include the results of the analysis of the findings, identifying the
immediate and underlying causes and commenting on the effectiveness of rescue and
damage containment activities where appropriate.
Conclusions based on circumstantial evidence should be highlighted as such.

Recommendations to avoid Recurrence

Recommendations should identify corrective measures for as many of the listed causes as
possible and may be related to:

• eliminating the causes

• minimising possible consequences

• improving rescue or damage containment measures

• emphasising that all causes identified should be eliminated.

• Action parties and time schedules for implementation should be identified.

Appendices
Any other pertinent information considered necessary for the understanding of the report.
This should include photographs, maps and drawings to supplement and clarify the written
report.

Use of standard report forms

PTS 60.0501
JUNE 2006
 37

Many companies have a standard incident report form. A standard form is not essential but
can have the advantage of setting out the minimum reporting needs in a logical order.
However, standard forms can have disadvantages, some of them caused by form design. A
review of the way in which forms are completed may highlight areas where they are
deficient. It must also be borne in mind that in the case of complex incidents, a standard
form will seldom be adequate.
Many standard incident report forms do not differentiate sufficiently between the elements of
incident notification, investigation findings and recommendations. These elements could
well be completed by different people, and should be kept clearly segregated.
One approach is to have a short basic Accident Notification form, and a longer Investigation
Report containing detailed results of the investigation.
Not all forms are self-explanatory, and there should be clear guidelines available to ensure
common understanding of information requirements, e.g. clear differentiation between
"description of event" and "incident cause".
Allocation of space is a very critical part of form design, and insufficient space may lead to
lack of detail being recorded.
Whether a standard form is used or not, the investigation report with appropriate appendices
should "stand alone", i.e. it should contain all relevant information necessary for reviewing
the incident.

PTS 60.0501
JUNE 2006