GestioneRischi HSE Inglese

Eni S.p.A.
E&P Division
HSE Risk Management
1.3.0.03
Page 2 of 52
INDEX EXECUTIVE SUMMARY ACRONYMS, ABBREVIATIONS 1. 2. SCOPE AND APPLICATION RISK AND CATEGORIES OF RISK 2.1 2.2 2.3 2.4 2.5 2.6 3. EVENT R ISK R ISKS TO P EOPLE (H EALTH AND SAFETY ) R ISKS TO C RITICAL EQUIPMENT AND FACILITIES ENVIRONMENTAL R ISK ASSET R ISK R EPUTATION R ISK 4 4 12 13 13 13 13 14 14 14 15 16 16 16 17 17 17 18 19 20 21 21 21 24 25 26
RISK MANAGEMENT PROCESS 3.1 3.2 3.3 3.4 IDENTIFICATION OF HAZARDS AND EFFECTS R ISK EVALUATION (R EF. HSE IMS B-1.3) ASSESSMENT OF R ISK TOLERABILITY (R EF HSE IMS B-1.2/4) IDENTIFICATION OF R ISK R EDUCTION M EASURES (R EF HSE IMS B -1.5)
4.
RISK IDENTIFICATION AND EVALUATION 4.1 4.2 4.3 4.4 HAZARD IDENTIFICATION CONSEQUENCE EVALUATION FREQUENCY EVALUATION MEASUREMENT OF R ISK
5.
RISK TOLERABILITY CRITERIA 5.1 5.2 EVENT R ISK S CREENING MATRIX R ISK MATRICES AND CRITERIA
6.
RISK REDUCTION MEASURES 6.1 6.2 R ISK MANAGEMENT O PTIONS IDENTIFICATION, D EVELOPMENT AND IMPLEMENTATION OF C ONTROLS
Eni S.p.A. E&P Division

1.3.0.03
HSE Risk Management
Page 3 of 52
6.3 7.
R ISK R EGISTERS
27 28 33 39 40 41 42 43 44 45 46 47 50
RESPONSIBILITY / ACCOUNTABILITY / OWNERSHIP

APPENDIX A.
MEASUREMENT OF R ISK TO P EOPLE
B1. B2. B3. B4. B5. B6. B7. B8.
EVENT R ISK S CREENING MATRIX PERSONNEL (TASK) R ISK ASSESSMENT MATRIX RISK TO P EOPLE (O PERATIONS ) ASSESSMENT MATRIX SOCIETAL R ISK MATRIX ENVIRONMENTAL RISK MATRIX ASSET R ISK MATRIX R EPUTATION R ISK MATRIX SOCIAL RESPONSIBILITY
APPENDIX C. ALARP AND COSTS -B ENEFITS ANALYSIS APPENDIX D. R ISK R EGISTER P ROFORMAS

1.3.0.03
HSE Risk Management
Page 4 of 52
EXECUTIVE SUMMARY Risk Management is a basic requirement for the development of a Health, Safety, Environment, Quality and Radiation Protection Integrated Management System (HSE IMS). Eni E&P Division HSE Directives (Ref. 8) outline what must be done for Risk Management, whereas Application Requirements address how to implement those directives to achieve a correct management of HSE risks within the business and operations. The purpose of this document is to establish a framework for the Risk Management processes and the establishment of risk management criteria, according to Eni E&P Division HSE Directives and Application Requirements, in order to ensure that the HSE risks are managed to a consistent and acceptable level across all operations .
ACRONYMS, ABBREVIATIONS ALARP BPEO FMEA FTA HAZOP HAZID HSE IMS QRA SIL As Low As Reasonably Practicable Best Practicable Environmental Option Failure Mode and Effect Analysis Fault Tree Analysis HAZard and OPerability Analysis HAZard IDentification Health, Safety, Environment Integrated Management System (Eni E&P doc. No. 1.3.0.02) Quantitative Risk Assessment Safety Integrity Level

1.3.0.03
HSE Risk Management
Page 5 of 52
GLOSSARY Acceptable Risk / Acceptability See Tolerable Risk (ISO 17776:2000). Accident Undesired event giving rise to death, ill health, injury, damage or other loss (OHSAS 18002:2000). An alternative simpler definition: unplanned event giving rise to undesired outcome (death, ill health).
ACGIH The American Conference of Governmental Industrial Hygienists (see http://www.acgih.org/)
ALARP (As Low As Reasonably Practicable) The point at which the effort to introduce further reduction measures become unreasonably disproportionate to the additional risk reduction that will be obtained. The concept of ALARP may be qualitative or quantitative and, where necessary, guidance notes issued by the Authorities for application should be adopted.
BPEO Best Practicable Environmental Option taking into account cost.
Company An organization part of or connected to Eni E&P division such as: Geographic Unit, Affiliate, Subsidiary or Joint Venture under operational control.
Flash Fire Combustion of a flammable vapour and air mixture in which flame passes through that mixture at less than sonic velocity and for relatively short periods of time (typically less than 3 seconds), such that negligible damaging overpressure is generated.

1.3.0.03
HSE Risk Management
Page 6 of 52
Hazard Anything with the potential to cause harm, including ill health or injury, damage to property, plant, products or the environment; production losses or increased liabilities. (OGP report 6.36/210, 1994 Guidelines for the development and application of health, safety and environmental management systems).
Hazardous event A hazardous event is synonymous with a hazard.
HSE Integrated Management System (HSE IMS) Part of the overall management system that enables the management of the HSE risks associated with the business of the organisation. This includes the organisational structure, planning activities, responsibilities, practices, procedures, processes and resources for developing, implementing, achieving, reviewing and maintaining the organisations HSE Policy. To the purposes of this document, all references to HSE IMS are contained in Ref. 8.
IDLH Immediately Dangerous for Life and Health It is an airborne contaminant concentration which must ensure the ability to escape without loss of life or immediate or delayed irreversible health effects, and to prevent severe eye or respiratory irritation or other reactions that would hinder escape. IDLH values are referred to 30 minutes since this is considered as the maximum time for escape for a worker (NIOSH, May 1987).
IEC International Engineering Consortium (see http://www.iec.org/)
Incident Event that gave rise to an accident or had the potential to lead to an accident. An incident where no ill health, injury, damage, or other loss occurs is also often referred to as a near miss. The term incident includes near-misses (OHSAS 18001:1999).
ISO International Organization for Standardization (see http://www.iso.org/).

1.3.0.03
HSE Risk Management
Page 7 of 52
LC% hmn - Lethal Concentration for Humans A concentration by which a given percentage of the exposed population will be fatally injured, following a certain period of exposure.
LFL - Lower Flammability Limit The lowest concentration of the substance (vapour or gas) in air that is known to produce a flash of fire when an ignition source is present.
NORSOK Norwegian Technology Centre standards (see http://committees.api.org/standards/isotc67/links_other.html)
Occupational illness An occupational illness is any abnormal condition or disorder of an employee, other than one resulting from an occupational injury, caused by exposure to environmental factors associated with employment. (Record-keeping Guidelines for Occupational Injuries and Illnesses, Occupational Safety and Health Act, OSHA, USA, 1986). This includes both acute and chronic illnesses or diseases. They may be caused by inhalation, absorption, ingestion of or direct contact with the hazard, as well as exposure to physical, psychological and biological hazards.
Occupational injury An occupational injury (i.e. not an occupational illness) is caused by a single incident and has immediate consequences.
Occupational medicine The speciality concerned with the diagnosis, management and prevention of diseases due to, or exacerbated by, workplace factors.

1.3.0.03
HSE Risk Management
Page 8 of 52
OGP International Association of Oil & Gas Producers (see http://www.ogp.org.uk/)
OLF Oljeindustriens Landsforening (see http://www.olf.no/ )
OHSAS Occupational Health & Safety Advisory Services (see http://ohsas.org/)
OREDA Offshore Reliability DAta (see http://www.sintef.org/)
Qualitative Risk Assessment Generic term used for techniques which allow the risk associated with a particular activity to be estimated in relative terms such as high or low (ISO 17776:2000).
Quantitative Risk Assessment or QRA Generic term used for techniques which allow the risk associated with a particular activity to be estimated in absolute quantitative terms rather than in relative terms such as high or low (ISO 17776:2000).
Risk Combination of the likelihood (or probability, or frequency) and consequence(s) of a specified hazardous event occurring (OHSAS 18001:1999).
Risk Analysis Use of available information to identify hazards and to estimate risks (ISO 17776:2000). ( there is not a universally accepted distinction between risk analysis and risk assessment).
Risk Assessment 1 . Overall process of risk analysis and risk evaluation (ISO 17776:2000); 2 . The whole process of risk analysis and the evaluation of the results of the risk analysis against technological and/or economic, social and political criteria (OGP report 11.1/98, 1984 Applications and limitations of risk assessment in offshore exploration and production).

1.3.0.03
HSE Risk Management
Page 9 of 52
Risk Evaluation Judgement, on the basis of risk analysis, of whether a risk is tolerable (ISO 17776:2000). Risk Register Document proving a brief, but complete, overview of the identified hazards, the relevant screening criteria and the measures necessary to manage them. Screening Criteria Targets or standards used to judge the tolerability of an identified hazard or effect (ISO 17776:2000). For the purpose of this document, they have been developed by Eni E&P division and are intended for use where not provided by regulators.
Societal Risk The risks to society arising from operations; the term society in this context include communities, residential areas and, in general, the public domain which is not connected with those operations (the Canvey Study HSE, 1978).
TLV Threshold Limit Value The time-weighted average concentration for a conventional 8-hour workday and a 40-hour workweek, to which it is believed that nearly all workers may be repeatedly exposed, day after day, without adverse effect (TLV -TWA) (ACGIH).
Tolerable Risk / Tolerability Risk which is accepted under definition of a tolerable threshold, based upon the current state of science and technology and the general values of society (ISO 17776:2000).
UKOOA UK Offshore Operators Association (see http://www.ukooa.co.uk/)

1.3.0.03
HSE Risk Management
Page 10 of 52
INTRODUCTION Management of HSE risks is an integral part of the management of the business and requires the total concerted effort of the organisation, focused on the objective of protecting people, the environment, assets, the business and earnings from potential losses. The Eni E&P Division HSE Integrated Management System has been developed to provide the overall framework for management of HSE risks within the business and operations.
This document forms an integral part of the HSE IMS and sets out the Eni E&P Division Risk Management criteria. It is intended to ensure that HSE risks associated with operations are managed to a consistent and acceptable level across all operations.
In addition to the requirements set in the HSE IMS Directives and Application Requirements, reference is also made to ISO 17776 Petroleum and natural gas industries Offshore production installations Guidelines on tools and techniques for hazard identification and risk assessment (Ref 1). The risk management process defined in this ISO standard, together with the relevant HSE IMS requirements are summarised below: Process Activity Identification of Hazards and Effects Evaluation of Risks Identification of Risk Reduction Measures Establishment of Functional Requirements
(*) As a reference, see ISO 17776:2000 Annex (C)
HSE IMS Requirement B-1.1 B-1.2, 3 and 4 B-1.5 C-5.3 and specific procedures/documents (*)
This document provides the assessment criteria to be used in the activities of Risk Evaluation and Identification of Reduction Measures. The tolerability of risk is referred to: People the health protection and promotion and safety of people involved in Eni E&P division operations and activities or of other people who could be affected by them. Critical Equipment Protecting Personnel - damage to or loss of equipment and facilities playing a vital role in protecting personnel from hazardous events. Environment damage to the environment deriving from operational activities or from incidents.

1.3.0.03
HSE Risk Management
Page 11 of 52
Assets and Operations damage to the Companys assets and/or impacts on projects and/or production losses. Reputation damage to the business or to the License to Operate or to the overall value of the Company deriving from HSE risks; it includes, inter alia, the image.
The risk management criteria must be applied as part of a broader risk management process within the organisation. It is important to remember that most activities which carry some degree of risk, entail risk to more than one of the above areas. It is vital that all possible effects of a hazard are considered together. For example an activity entailing risk to company profits must not be considered in isolation to its effect on the HSE. It is difficult to determine a hierarchy of importance in the risk effect areas mentioned above, but by common consent the effect of a hazard on persons, including HSE effects, carries most weight and the effect on assets and profits least weight.

1.3.0.03
HSE Risk Management
Page 12 of 52
1.
SCOPE AND APPLICATION The primary scope of this document is to provide a guidance for definition of risk tolerability criteria which is applicable to all Eni E&P Division locations and operations and shall be kept into
consideration for all risk identification and assessment activities as required by the HSE IMS. The application of risk tolerability criteria as a management tool requires specific skills and expertise. Specialist advice should be sought where necessary. Where specific regulatory requirements exist in a particular location, the most stringent requirements apply. The document is also aimed at giving guidance on the practical application of risk management criteria, which shall be used only once all legislative prescriptions have been properly applied. Chapter 2 contains an overview of risk categories. Chapter 3 deals with the general concept of risk, providing an overview of the risk management process. The main steps of the Risk Management process are better detailed in Chapter 4. It includes information on tools and techniques commonly used in Risk Identification and Evaluation. Risk Tolerability Criteria are provided in Chapter 5 with explanations of assessment matrices and indications on how and when they should be applied. Chapter 6 deals with the techniques and processes for reduction of risk, balancing benefits against costs and efforts involved. Aspects concerning the management of Risk Registers are treated in Chapter 7.

1.3.0.03
HSE Risk Management
Page 13 of 52
2. 2.1
RISK AND CATEGORIES OF RISK EVENT RISK Risk is a function of the likelihood of an event and the severity of its consequences. The risk from a particular event, the Event Risk is the HSE risk associated with a specific, discrete scenario (such as helicopter crash, transport accident, oil spill, etc.) in terms of effects on people, environment, assets and reputation and is usually assessed qualitatively.
2.2
RISKS TO P EOPLE (H EALTH AND SAFETY) Hazardous activities may result in injury, fatality or diseases both to those personnel engaged in work associated with the activity or to community. Risks to people may be divided into:
a) Personnel Risk - a non-specific term covering the risk of injury, diseases or fatality to personnel from named tasks, or from routine or special operations.
b) Individual risk- the total risk of death in a fixed time period (most often one year) to which a worker or a member of the community may be exposed from all credible hazards and sources of accidents.
c) Societal Risk- the risks to society arising from operations; the term society in this context include communities, residential areas and, in general, the public domain which is not connected with those operations.
2.3
RISKS TO C RITICAL EQUIPMENT AND FACILITIES As well as direct risks to people, the risks to critical equipment protecting personnel from high hazard operations need to be addressed. Such equipment and facilities may include Temporary Refuges (TRs) and electronic control systems.

1.3.0.03
HSE Risk Management
Page 14 of 52
2.4 ENVIRONMENTAL RISK The Environmental Risk is the risk to the environment from different activities that fall under the responsibility of the Company. As a consequence, environmental risk management should take account of the exposure of the environmental resources to a variety of activities which constitute, as a whole, the sustainable development of the Company itself.
2.5 ASSET RISK The Asset Risk considers the probability of damage to Companys physical assets, impacts on projects (failure to meet project objectives) and operations in terms of production loss, deferred production and costs of replacement of damaged structures and equipment due to any incidents.
2.6 R EPUTATION RISK Reputation risk is the risk to the reputation of a Company as perceived by society at large, or sometimes more specifically its peers (other oil companies), its employees, its shareholders, the government or financial institutions. The reputation of the Company is linked and can be affected by HSE incidents or accidents of all types. Reputation consists of a combination of the characteristics, performance and behaviour of a Company and importantly for risk management, the perception of the Company. Although
reputation can be considered as an intangible asset, it is important because it can affect the ability of the Company to establish or maintain business at all stages of the development cycle. Therefore, actual or perceived HSE impacts can damage the reputation/the business of the Company and in turn tangible Company assets.

1.3.0.03
HSE Risk Management
Page 15 of 52
3.
RISK MANAGEMENT PROCESS The Risk Management Process (see Figure 1), as outlined in Eni E&P Division HSE Directives (Ref. 8), is a continuous, iterative process, which typically consists of four major tasks: 1. 2. Identification and definition of hazards and their potential effects. Evaluation of the risk arising from identified hazards in terms of evaluation of the likelihood / probability / frequency of occurrence of accident sequences and evaluation of severity of the consequences. 3. Assessment of tolerability of risk to people, environment, assets and reputation by comparing risk level with the relevant tolerability criteria. 4. Identification of r isk reduction measures needed to reduce the likelihood / probability / frequency (prevention) and/or the consequence of an accident (control and mitigation).
Identification of Hazards and Effects
Frequency Evaluation
Consequence Evaluation
Risk Reduction Measures
Risk Determination RISK EVALUATION Risk Acceptability Criteria
Risk Acceptance
No
Yes
Set Functional Requirements
Figure 1 - Risk Management Process

1.3.0.03
HSE Risk Management
Page 16 of 52
3.1
IDENTIFICATION OF HAZARDS AND EFFECTS The identification of potential HSE hazards and effects covers all phases of the Companys processes and related activities at the appropriate level of accuracy, taking also into account all phases in the life of any installation, including temporary conditions dictated by maintenance activities. For each activity, the most significant hazards are identified and the likely effects are then assessed to determine whether each hazard is significant or not in relation to health, environment, assets and Company reputation.
3.2
RISK EVALUATION (R EF. HSE IMS B-1.3) Risk evaluation requires consideration of both the severity of the consequences of a potential hazard and the likelihood of their realisation. Each risk is assessed by consideration of the following factors: how often the hazard is likely to occur; the likelihood of the hazard resulting in an accident; the severity of the consequences.
Such information can be retrieved from various sources, including: internal knowledge and experience of line / project / department managers and HSE experts; 3.3 industry frequency and failure rate databases and co-operative research programmes; relevant international, national and Eni E&P Division standards and codes of practice; industry and trade association codes of practice and other guidance.
ASSESSMENT OF RISK TOLERABILITY (R EF HSE IMS B-1.2/4) The level of risk is compared and considered against tolerability criteria, which set up the lowest thresholds defined as tolerable among those fixed by the local regulatory authorities or by the Company. Where set by the Company these shall be according to the best industry practice, the current state of science and technology and the general views of society. The tolerability criteria for risk constitute a reference for the evaluation of the need for risk reducing measures.

1.3.0.03
HSE Risk Management
Page 17 of 52
3.4
IDENTIFICATION OF RISK R EDUCTION M EASURES (R EF HSE IMS B-1.5) Risk reduction measures may prevent incidents or reduce the probability of their occurrence, control incidents (limiting the extent and duration of a hazardous event) or mitigate adverse effects (reducing the severity of consequences).
4.
RISK IDENTIFICATION AND EVALUATION A systematic approach to the identification of hazards and the evaluation of risk is a key element of effective HSE management, providing information to support decision-making on risk-reduction measures. For new installations or activities hazards shall be identified as early as possible, in order that sufficient time can be given to the most appropriate way to manage them. It is always easier to make modifications early in the design stage of a project, when changes can be made with minimal effect on cost and schedule. Hazard analysis and risk assessment shall also be applied to existing facilities, but in some cases changes that would be justified during design may not be practicable for an existing facility. As an example, improvements in layout may not be practicable for existing facilities. Also the work necessary in undertaking modifications to an existing facility itself introduces an additional risk of accident. Should such a situation occur, managerial and operational criteria (such as de-manning) may be adopted instead of technical provisions.
4.1
HAZARD IDENTIFICATION Hazard identification includes: A broad review of possible hazards and sources of accidents, with particular emphasis on ensuring that relevant hazards are not overlooked. A rough classification into critical hazards (as opposed to non- critical) for subsequent analysis. Explicit statement of the criteria used in the screening of the hazards. Explicit documentation of the evaluation made for the classification of the non-critical hazards.
Hazards can be identified and assessed in different ways using one of the following tools and techniques:

1.3.0.03
HSE Risk Management
Page 18 of 52
Experience from previous analyses, safety inspections and audits This is particularly useful where the activity under consideration is similar to activities undertaken previously in other locations. The approach is not suitable when dealing with innovative systems or where local conditions invalidate previous experiences.
Use of checklists and accident statistics Checklists are normally drawn up from standards and operational experience and ensure that known hazards have all been identified and assessed. They are easy to apply and can be used at any phase in the project life cycle. Examples of Hazard checklists are provided in ISO 17776 (Ref.1).
Codes and standards Codes and standards reflect collective knowledge and experience, accumulated on the basis of Company, national or international operations. These documents incorporate the lessons learned from previous design, from hazard and risk assessment and from accident and incident investigation. The compliance with prescriptive standards ensures the reduction of risks to a tolerable level. The use of checklists based on requirements laid out in codes and standards is an effective technique in identifying compliance with standard practice and highlighting aspects which require further investigations.
Structured review techniques (HAZID, HAZOP). These techniques can be used to identify and evaluate known and unforeseen hazards and unintended events that are not adequately addressed by the previous methods. More details about these techniques can be found in ISO 17776.
The selection of the appropriate hazard identification and risk evaluation tools and techniques depends upon the nature and scale of the installation, the information available, the phase of the project and experience of similar installations. 4.2 CONSEQUENCE EVALUATION Consequence analysis includes consequence modelling, for example estimation of accidental loads, such as intensity of fires, modelling of escalation and estimation of response to accidental loads. Consequence analysis can be applied to assess HSE aspects for a range of consequence scenarios and involves the use of predictive models. Consequence scenarios may be developed in

1.3.0.03
HSE Risk Management
Page 19 of 52
simple narrative form, using multiple branch event trees and utilising more or less complex computerised modelling techniques. Since the majority of models provides only an approximation of what might happen, models should only be used when they are validated in a particular application and their predictive capability is generally accepted. Successful application requires use by personnel with adequate training and experience. As far as possible, consequence analysis should also assess the contribution to failure from human and organisational factors, together with the contribution from such failures to dependent failures (escalation). The following analysis methods may be used for the escalation analysis: Event Tree Analysis (ETA) Simulation/ probabilistic analysis
More details about these techniques can be found in ISO 17776. 4.3 FREQUENCY EVALUATION Frequency information may be obtained from Experience Company data and source including accident and incident data Published data sources such as WOAD and OREDA.
Where data does not exist, it may be possible to derive it from more fundamental data using the following methods: Fault Tree Analysis (FTA) Failure Mode and Effect Analysis (FMEA)
These are expected to provide estimates that may not be homogeneous with those coming from experience, therefore, where possible, estimated frequency data for initiating events should include an allowance for human and/or operational factors. Frequency is usually expressed in occurrencies per year.

1.3.0.03
HSE Risk Management
Page 20 of 52
4.4
MEASUREMENT OF RISK In order to interpret risk to people, reputation etc. some means of measurement of risk is required. Since risk is in its simplest terms consequences times frequency, obvious types of measure may be: Fatalities / occupational illness per year ( risk to people) Spills per transfer operation (risk to the environment) Financial losses per year (asset losses)
Apart from financial loss which is relatively easy to measure in risk terms, all other areas present problems. Environmental risk is particularly difficult to define except in terms of specific items such as spills as detailed above. Some of the problems with the measurement of environmental risk are described below: Some environmental discharges are continuous but have indeterminate effects Some environmental hazards are short term in duration but have long term effects changing over time Some environmental hazards may have quite different effects on for example, air quality, water quality and ecology, making a global measure of environmental risk difficult to define.
These problems make the use of matrices discussed later, particularly helpful for environmental risk measurement. Risk to reputation is also very difficult to measure, as reputation is an intangible concept. The normal approach is to define the effect of a reputation hazard in terms of significance to the news media and to assess its impact geographically (e.g very local, national or international). Given the difficulty of expressing this in quantitative terms, a qualitative approach is always used in this area.
Risk to people can be measured in various ways according to the types of individuals at risk and their exposure. A discussion of the ways of measuring risk to people is given in Appendix A.
All estimates of risk for people are based on either qualitative or quantitative approaches.

1.3.0.03
HSE Risk Management
Page 21 of 52
5.
RISK TOLERABILITY CRITERIA Measurement of risk is the preliminary phase of assessing its acceptability (tolerability). It is necessary to compare risk figures with acceptability/tolerability thresholds in order to determine whether the risk is fully acceptable, completely intolerable or somewhere in between.
5.1
EVENT RISK SCREENING MATRIX A preliminary measure in the global assessment of risk is the Event Risk Screening Matrix reported in Appendix B1. This provides definition of consequences and a range of qualitative criteria to estimate probability or frequency for risks to people, the environment, etc. The meaning of the terms in the matrix, such as continuous improvement, etc is explained below in section 5.2. This matrix is mandatory in the identification of high level HSE Risks during risk screening (Major Hazard Analysis, Environmental Impact Assessment etc.). This matrix provides the basis to identify significant risks or areas of risk and prioritise further assessment and management efforts. Risk screening matrices are suitable to be linked with other means of assessing tolerability, especially when assessing human risk in high hazard scenarios, usually connected with safety accidents. Risk Acceptability for these scenarios is discussed in Appendix A.
5.2 RISK MATRICES AND CRITERIA Risk matrices also provide a means of assessing risk in single areas of concern such as to the environment. The risk matrix is a tool, inspired to the ISO standard 17776, which shall be used as a background for setting risk tolerability criteria. When used as a qualitative matrix, it considers events that have been experienced by the Company or the Company may expect in case of deterioration of such events. In case Company history/experience is considered not consolidated (in terms of No. of plants / operations), reference shall be made to E&P industry in the same geographical area. The matrix axes, consistent with the definition of risk, are Consequences and Likelihood / Probability or Frequency. The vertical axis represents the measure of the potential consequences of credible scenarios. A scale of consequences from 1 to 5 is used to indicate increasing severity. The potential consequences of credible scenarios are considered as consequences that could have resulted from the released hazard if circumstances had been less favourable.

1.3.0.03
HSE Risk Management
Page 22 of 52
The horizontal axis represents the measure of likelihood / probability / frequency of the occurrence of a hazardous event. Such a scale is defined in general terms from 0 to E on the basis of historical evidence or experience that such consequences have materialised within E&P industry or the Company. The risk matrices included in Appendices, are separated in three regions that identify the limit of risk tolerability; such regions are:
1.
Continuous improvement
The level of risk is broadly acceptable and generic control measures are required aimed at avoiding deterioration.
2.
Risk reduction measure
The level of risk can be tolerable only once a structured review of risk-reduction measures has been carried out (where necessary, the relevant guidance from the local Authorities should be adopted for application of ALARP). ALARP is a concept that applies well only to personnel risk. For environmental risk the concept of BPEO is more frequently applied. Asset risk is often most easily judged on a basis of costs and benefits alone. A discussion of ALARP and cost-benefits analysis is given in.Appendix C. The level of risk is not acceptable and risk control measures are required to move the risk figure to the previous regions.
3.
Intolerable risk
Depending on the position of the intersection of a column with a row in the Risk Matrix, it is possible to classify the risk. For the same scenario (grouping all hazardous events which have the same severity of consequences), a resulting likelihood / probability / frequency is assigned or calculated, such that the risk can be classified. The classification is repeated for all the risk areas (People, Environment, Assets and Reputation). The overall risk of a hazard is classified according to which among consequences has the highest rating.
5.2.1. Event Screening The Event Risk Screening Matrix is reported in Appendix B.1 and provides definition of consequences and a range of qualitative criteria to estimate likelihood / probability or frequency. This shall be used in the identification of high level HSE Risk during risk screening (Major Hazard Analysis, Environmental Impact Assessment, etc.). This matrix provides the basis to identify

1.3.0.03
HSE Risk Management
Page 23 of 52
significant risks or areas of risk (for example, transportation risk) and prioritise further assessment and management efforts. Should the qualitative risk figure be intolerable, either a quantitative risk analysis (QRA) or the adoption of fit-for-purpose and more effective risk -reduction measures shall be required.
5.2.2. Personnel Risk (Tasks) When considering Occupational Health and Safety Risk Assessment related to specific tasks, a qualitative approach is preferred, since it is usually based on past experience. The Personnel (Task) Risk Assessment Matrix is based on the document Task Risk Assessment Guide - A step change in safety (Ref 2) and is reported in Appendix B2 The occupational health risk (occupational illness or injury) is usually based on exposure to hazardous agents (physical, chemical, etc.); this is covered by specific Minimum Health Standards (Ref. 9).
5.2.3. Risk to People (E&P Operations) Risk to People induced by E&P operations can be assessed both qualitatively and quantitatively. When performing Quantitative Risk Assessment (QRA) as a forecast of possible, future events, fatalities have to be considered with care, avoiding a deterministic approach; in this context, for example, to evaluate the risk of fatality, it is necessary to consider not only the frequency (or probability) of the accidental load (in terms of radiation from a fire, overpressure from an explosion, toxicity from a toxic release etc.) but also the vulnerability of humans to this load (Ref. 3). The Risk to People (E&P Operations) Assessment Matrix is reported in Appendix B3.
5.2.4. Environmental Risk The environmental risk matrix has been derived from a document prepared by the OLFs environmental committee for oil spill to sea (Ref 6) and has been extended to onshore activities too; it is reported in Appendix B5. This matrix essentially provides an expansion of the definitions of environmental consequences included in the Event Screening matrix.

1.3.0.03
HSE Risk Management
Page 24 of 52
As far as consequences are concerned, a list of options is shown; they are intended not to be used contemporarily; for example, in sensitive areas, the option based on amount of spilled oil is not suitable, and is preferable to adopt options related to protection of fauna and flora. 5.2.5. Asset Risk The asset risk matrix is reported in Appendix B6. Even in this case, different options are shown to describe consequences, based on times and costs for repair. As far as probability / frequency is concerned, both quantitative and qualitative criteria are shown, where the latter is based on reliability of technical / operational protection systems, such as
temporary refuges, control systems etc. (see also 2.3). The reliability is expressed in terms of minimum number of failures needed for the hazard to be realized (higher the number of failures, higher the number of barriers against the hazardous event).
5.2.6. Reputation Risk Reputation is essentially an intangible asset. However, HSE risks can have a significant impact on reputation with serious consequences to the Company. It is therefore advisable that the reputation aspect of any risk is properly evaluated against the criteria in Appendix B7. 5.2.7. Social Responsibility Risks Social Responsibility factors should be treated as a possible cause of concurrent impact to safety and health to people, asset, reputation and environment. As a consequence, no separate specific criteria matrices are specified (see Appendix B8).
6.
RISK REDUCTION MEASURES Risks are generally classified according to the controls that either are put in place or must be implemented to reduce/control the risk (see Section 5.4 of the ISO standard 17776:2000). The risk reduction measures should be identified through a Quantitative Risk Assessment (QRA) based on the following steps:

1.3.0.03
HSE Risk Management
Page 25 of 52
1) Identify hazardous events, considering techniques such as Event Trees (see 4.2 and 4.3); 2) Consider the accidental loads (e.g. radiation from fires) and, hence, the damage/harm deriving from the hazardous event to: an employee, a man of the public (risk to people), a plant section (asset risk) etc; 3) Sum up frequencies of all hazardous events of the same nature (all gas releases, all fires, all explosions etc.) with same consequences (harm to an employee, a man of the public, a group of people, an area with a given occupancy see Ref. 7 - etc.); 4) Enter the suitable risk matrix and verify tolerability; 5) If unacceptable, assess what controls are viable; 6) Determine if the risk, which is residual after controls, will be manageable; 7) If still unacceptable, consider further mitigating factors (reduction of % of manning, chance of sheltered escape, favourable wind directions, extra controls etc.) to re-conduct the event in the acceptable area; 8) If still unacceptable, consider the zero option (terminate the risk see 6.1).
6.1
RISK MANAGEMENT OPTIONS For any given risk there are four basic management approaches:
Take/Accept
the risk is tolerated in its basic state with no active controls being applied
Terminate
the factors which create the risk are eliminated (e.g. replacement of dangerous chemicals)
Treat/Manage
apply controls in the form of hardware, software, procedures with the effect of reducing the frequency or consequences of the event
Transfer
Insure (only in case of risk for assets).

1.3.0.03
HSE Risk Management
Page 26 of 52
6.2
IDENTIFICATION, D EVELOPMENT AND IMPLEMENTATION OF CONTROLS Risk reduction measures include preventative measures (reduction of likelihood / probability / frequency) and mitigating measures (reduction of severity of consequences). Mitigation measures include steps to prevent escalation of developing abnormal situations and to lessen adverse effects on Health, Safety and the Environment. Risk reduction measures also include recovery preparedness measures, which address emergency procedures as well as restoration and Company procedures to recover. In identifying control measures, consideration should be given to: The activity The people involved What tools, equipment and materials are to be used The working environment
The remedial measures needed to control each of the intolerable risks should be based on good safe working practice in order to reduce the residual risks to a level which is practicable. The hierarchy principle shall be adopted, with the following priority list: 1. 2. 3. 4. 5. Avoid the risk Replace hazardous devices/operations with less hazardous ones Prefer collective safety measures to individual ones Adopt alternative design/operations Increase No./effectiveness of controls, supported by the best available practices (HSE IMS) and technologies (Ref. 4). The process stops when efforts to introduce further reduction measures become unreasonably disproportionate to the additional risk reduction that will be obtained.
An approach widely used is to evaluate the effort and cost involved in a number of different riskreducing measures and to estimate the risk-reducing effect of each. By evaluating the cost or effort necessary to arrive at a common level of risk reduction it is often possible to identify those measures which are clearly more effective in risk reduction. In case of asset risk, the following formula can be adopted for comparison:

1.3.0.03
HSE Risk Management
Page 27 of 52
(probability of the hazard) x (costs if it realizes) = expected cost from the risk Evaluation of risk-reducing measures should always be based on sound engineering principles and common sense. The following aspects should also be observed: local conditions and circumstances, the state of scientific and technical knowledge relating to the particular situation, and the estimated costs and benefits. See Appendix C for further information on Costs-Benefits analyses. It must be clear in any case that no level of risk of fatality for anyone person is acceptable.
6.3
RISK R EGISTERS From the risk identification process a list of significant risks should be identified and transferred to Risk Registers for that particular project / operating unit. The Risk Registers should demonstrate that: all hazards, effects and threats have been identified the likelihood / probability / frequency and consequences of a hazardous event have been assessed controls to manage potential causes (threatened barriers) are in place recovery preparedness measures to mitigate potential consequences have been taken.
The Risk Register is a live document and is passed from phase to phase of a development through to abandonment. The purpose of the Risk Registers is to provide an assurance process that demonstrate appropriate and effective controls are in place. A Risk Register Proforma is included in Appendix D. The Risk Register must be owned by Company senior management and include the necessary actions which will ensure effective management. The Risk Register must be maintained and updated to reflect significant changes in operations and the business, as shown in Figure 2.

1.3.0.03
HSE Risk Management
Page 28 of 52
Figure 2 - Risk Register Management
7.
RESPONSIBILITY / ACCOUNTABILITY / OWNERSHIP
As previously said, the primary scope of this document is to provide a guidance for definition of risk tolerability criteria which is applicable to all Companies (see Glossary) worldwide in the internal Risk Management process. The Risk Management process involves the whole Company organization and relies on specific tools, such as the Risk Register. As a minimum, the Risk Register shall cover each individual (exploration/development) project / operating site and the project / operating site Manager (Function, Line or Project Manager) is expected to be: (a) the official Owner of the project/site Risk Register; (b) in charge to ensure that all risks related to the activities under his responsibility are properly terminated or, at least, kept to a minimum. The HSE Dept. Manager is accountable for the application of the Company tolerability criteria into the Risk Management process of the whole Company and for the updating of the Company-level

1.3.0.03
HSE Risk Management
Page 29 of 52
Risk Screening Matrix (which includes risks related to the Company HQ) for executive management perusal. The Company will submit to the BU and E&P Division HSE Function the Risk Screening Matrix with the relevant Action Plan aimed at implementing suitable risk reduction measures and demonstrating the sustainability of residual risks. The BUs will consolidate the Risk Matrix es in agreement with the E&P Division HSE Function and will communicate a summary to the Eni Corporate HSE Function (Ref. 0).

1.3.0.03
HSE Risk Management
Page 30 of 52
REFERENCE DOCUMENTS Ref.0 Eni DIHSE: Modello di Sistema di Gestione per la tutela della salute, della sicurezza, dellambiente e dellincolumit pubblica doc. 1.1/3 19/12/03 Ref.1 EN ISO 17776: 2000 "Petroleum and natural gas industries - Offshore production installations - Guidelines on tools and techniques for hazard identification and risk assessment ". Ref.2 "Task Risk Assessment Guide A Step Change in Safety" UKOOA, IMCA, IADC, IAGC OPITO, (August 2000) Ref.3 Ref.4 E&P Forum QRA Data Sheet Directory 15/10/96 IEC 61508 "Functional safety of electrical / electronic / programmable electronic safety related system (all parts) IEC 61511 "Functional safety instrumented systems for the process industry sector (all parts) Ref.5 Ref.6 Ref.7 UKOOA 95 OLF (1999) "OLF recommended method for environmental risk analysis " Italian Decree 9/05/2001 "Requisiti minimi di sicurezza in materia di pianificazione urbanistica e territoriale per le zone interessate da stabilimenti a rischio di incidente rilevante" - Ministero dei Lavori Pubblici Ref.8 "Integrated HSE Management System Organization and HSE Guidelines", Doc. N 1.3.0.2; Ref. 9 MHS: Eni-E&P Division Document Doc. N.1.3.2.11 Minimum Health Standards Main document and 8 attachments: MHS 1 Development of a Health Programme MHS 2 Health Risk Assessment MHS 3 Health Impact Assessment MHS 4 Fitness to Work MHS 5 First Aid and Medical Emergency Response MHS 6 Monitoring of Health Performance MHS 7 Product Stewardship

1.3.0.03
HSE Risk Management
Page 31 of 52
MHS 8 Human Factors Engineering in New Projects
BACKGROUND REFERENCES: Ref. 10 UK HSE - (1989) "Quantified Risk Assessment an Input to Decision Making" ISBN 0 11 885499 2 Ref. 11 Ref. 12 UK Health and Safety Executive R2P2 NORSOK Standard Z-013 Rev.2 - (2002) "Risk and emergency preparedness analysis"

1.3.0.03
HSE Risk Management
Page 32 of 52
APPENDICES

1.3.0.03
HSE Risk Management
Page 33 of 52
APPENDIX A
MEASUREMENT OF RISK TO PEOPLE

1.3.0.03
HSE Risk Management
Page 34 of 52
Risk Risk to people (usually, personnel or, generally speaking, workers) can be measured in terms of risk of exposure (Ref. 9) , risk of injury or risk of fatality. Normally in quantitative risk assessments the fatality risk is considered, while for the other risks a qualitative approach is adopted. Risk can be measured in a generalised way such as high, medium and low where these terms refer to comparative indications of risk for the industry or activity under review. Alternatively it can be measured in specific terms where an attempt is made to calculate the average probability of injury or death in a specific time period either to an individual or to a group of people.
General Measurement of Risk To measure risk in general terms, risk matrices have becoming increasingly used. These give a framework for both measuring risk and assessing its acceptability. Risk matrices are discussed in detail elsewhere in the main text of this document and examples are given in Appendix B. Risk matrices are useful to determine risk to personnel or workers in (but not limited to) the following situations: 1. Screening 2. Where options need to be compared and all information are not available for a detailed Quantitative Risk Analysis 3. Where quantification is difficult or impossible, such as in short term tasks where the main risk is personnel injury.

1.3.0.03
HSE Risk Management
Page 35 of 52
Specific Measurement of Risk Risk to Individuals The method of measurement, which has become increasingly used in recent years, is individual risk (IR). This is the risk of fatality to any person exposed to a hazard normally averaged over a year. Individual risk can be specific to a particular individual, averaged over those individuals in a high risk group, or averaged across all persons in a potentially high risk location (e.g. where high H2S levels are expected in the reservoir). In measuring individual risk the changes in exposure of persons, for example by moving away from or closer to the hazard over a period of time is taken into account. Individual risk may also be assigned to specific locations.
Calculation of Individual Risk Consider a particular location at risk from a hazardous event nearby. The individual risk from the event following realisation of the hazard is calculated as follows. To a specific individual whether a worker or external member of the public IR = zp1p 2 where p1 = fatality probability z = event frequency and p2 = proportion of time for which the person is present in the location
If there are several locations where the individual could be present and still be at risk from the hazardous event then the total risk from the event can be summed from the risk at each location. Should other information (such as % of success of escape or evacuation; % of favourable winds etc.) become available, the overall IR figure can be progressively refined to keep account of these parameters. In summary, it is possible to calculate a coarse IR and a refined IR, with due regards to availability and reliability of data.
To the average individual (normally this would be used for a typical worker on a specified site such as an offshore platform)

1.3.0.03
HSE Risk Management
Page 36 of 52
IR = z(n/N)p1 p 3 where p1 = fatality probability z = event frequency n = the average number of persons present at the affected location N = the total workforce on site (all assumed to work for similar number of hours per week) and p3 = proportion of time for which the person is present on site
Should other information (such as % of success of escape or evacuation; % of favourable winds etc.) become available, the overall IR figure can be progressively refined to keep account of these parameters. In summary, it is possible to calculate a coarse IR and a refined IR, with due regards to reliability of available data.
Tolerability of Individual Risk The tolerability of the Individual Risk deriving from above mentioned calculations (both coarse and refined ) is evaluated against the risk matrices in Appendix B. In particular, it is compared with risk figures shown in the row 4 (single fatality) of Matrix B3; such figures are different when considering a worker or a third party (member of the public). Should the IR figure fall within either the red or the yellow region of the matrix, it is necessary to move it away or to reduce it respectively, by adopting risk reduction measures (e.g. introducing new barriers, improving the integrity of existing barriers, etc.).

1.3.0.03
HSE Risk Management
Page 37 of 52
Risk to Groups Individual risk to specific persons may be low in particular situations but due to the large number of persons exposed, the possibility of fatality may be significant. In these situations it may be appropriate to determine the Potential Loss of Life (PLL). This is a measure of how many persons would become fatalities from a particular site or event, normally expressed over a period of time. Calculation of PLL Consider a particular location at risk from a hazardous event nearby. The potential loss of life (PLL) from the event following realisation of the hazard is calculated as follows. The event frequency is z. PLL = zp1n where p1 = fatality probability z = event frequency and n = the average number of persons present at the affected location
Tolerability of Risk to Groups When using a consequence figure which implies more than a single fatality, the row 5 (multiple fatalities) of Matrix B3 can be used as a reference for tolerability of the group risk. Societal Risk Societal risk expresses the risk to persons not employed or present at a workplace. The Societal Risk is usually taken into account once the Individual Risk and the Group Risk have been evaluated and suitably re-conducted into the tolerability area. Once the Individual Risk figure is found to be tolerable in Matrix B3, the Societal Risk can be assessed against occupancy levels of the area surrounding plants/assets. This is achievable by utilising the Matrix B4, based on Ref.7.

1.3.0.03
HSE Risk Management
Page 38 of 52
APPENDIX B RISK MATRICES
HSE Risk Management

1.3.0.03 Page 39 of 51
B1. EVENT RISK SCREENING MATRIX
Consequence 0 Reputation Severity Environ. Assets People

Practically noncredible occurrence Could happen in E&P industry
Increasing Annual Frequency A

Rare occurrence Reported for E&P industry
B
Unlikely occurrence Has occurred at least once in Company
C
Credible occurrence Has occurred several times in Company
D
Probable occurrence Happens several times/y in Company
E
Likely/Frequent occurrence Happens several times/y in one location
Slight health effect / injury
Slight effect
Slight damage
Slight impact
Continuous Improvement
Minor health effect / injury
Minor effect
Minor damage
Minor impact
Major health effect / injury
Local effect
Local damage
Local impact
4 5
PTD(*) or 1 fatality
Major effect
Major damage
National impact
Intolerable Risk
Multiple fatalities
Extensive effect
Extensive damage
International impact
(*) Permanent Total Disability
HSE Risk Management

1.3.0.03 Page 40 of 52
B2. P ERSONNEL (TASK) RISK ASSESSMENT MATRIX
0
Not Applicable
A
Not Applicable
B
Could occur, when additional factors are present; otherwise unlikely. Has occurred at least once in Company
C
Not certain to happen but an additional factor may result in an accident/ exposure. Has occurred several times in Company
D
Almost inevitable than an accident/ exposure would result Happens several times a year in Company
E
Almost inevitable that more than one accident/ exposure would result Happens several times/y in one location
Severity
Personnel (Task) Risk
N/A
N/A
1 2
(NOT APPLICABLE) Minor health effect / injury:

offsite medical treatment or LTA; up to 10 days off. Agents have reversible effects to health.
Major health effect / injury:
more than 1 LTA; up to 30 days off. Agents have irreversible effects to health: noise, manual handling, toxics, etc.
Risk Reduction Measure
PTD (*) or 1 fatality:

agents are capable of serious disability or death
Multiple fatalities
from an accident or occupational illness (e.g. chemical asphyxiation or cancer or epidemic diseases)
Intolerable Risk
(*) Permanent Total Disability
HSE Risk Management

1.3.0.03 Page 41 of 52
B3. RISK TO P EOPLE (OPERATIONS ) ASSESSMENT MATRIX
0
Severity Risk for People (E&P Operations)
<10-6 occ /y (1)
A
10-6 to 10-4 occ/y (1)
B
10-4 to 10-3 occ/y (1)
C
10-3 to 10-1 occ/y (1)
D
10-1 to 1 occ/y (1)
E
>1 occ/y (1)
Could happen Reported for Has occurred Has occurred Happens Happens in E&P E&P industry at least once in several times several times/y several times/y industry Company in Company in Company in one location
Slight health effect / injury
Minor health effect / injury

Compulsory reduction measures for 3rd parties onshore Intolerable for rd 3 parties onshore
Major health effect / injury
Permanent Total Disability or 1 fatality (small exposed population)
Multiple fatalities (exposed groups)
Intolerable Risk
(1) frequency expressed in occurrencies per year
HSE Risk Management

1.3.0.03 Page 42 of 52
B4. SOCIETAL RISK MATRIX
Societal Risk Severity

Radiation Flash Fire Overpressure (kW/m 2) (mbar) (assuming
unobstructed escape to repair)
0
Toxicity (ppm)
(based on 30 min event duration)
A
10-6 to 10-4 occurrencies per year
B
<10-6 occurrencies per year
N. A.
N. A.
N. A.
1 2 3 4 5
<3
< 30
Up to TLV
No more than 500 people in the open or 100 if mobility is reduced. (*) No more than 500 people in the open or 100 if mobility is reduced. (*) Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*) Inhabited volumes up 3 2 to1m /m of residential area. None in the open unless on monthly basis. (*) Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*) Inhabited volumes up 3 2 to1m /m of residential area. None in the open unless on monthly basis. (*)
30
TLV
Compulsory Risk Reduction Measures
70
IDLH
LFL
140
LC 1% hmn
12.5
LFL
300
LC 50% hmn
Up to 500 people in enclosures, 100 at open, 1000 people/day max. at railway stations (*) Inhabited volumes up 3 2 to1m /m of residential 3 2 Up to 0.5m /m in area. None in the open unless on residential area. (*) monthly basis. (*)
Intolerable risk
(*) Industrial, agricultural, artesan areas admitted.

1.3.0.03
HSE Risk Management
Page 43 of 52
B5. ENVIRONMENTAL RISK MANAGEMENT
Severity
0 Environmental Risk
<10-6 occurrencies per year
A
B
C
D
10-1 to 1 occurrencies per year
E
>1 occ/urrencies per year
Slight effect
a) No stakeholder impact b) temporary impact on the area 2 c) Involved area < 0.1 sq mile (0.26 km ) 3 d) Onshore spill (1)< 1 m e) No sensitive impact on ground.
Minor effect
a) Some local stakeholder concern b) 1 year for natural recovery c) Impact on small no. of not compromised species. 2 d) Involved area < 1 sq mile (2.6 km ) 3 e) Onshore spill (1)< 10 m f) Impact on localised ground.
Risk reduction measures
Local effect
a) Regional stakeholder concern b) 1-2 years for natural recovery c)1 week for clean-up d) Threatening to some species - e) Impact on protected natural areas. 2 f) Involved area < 10 sq miles (26 km ) g) Onshore spill (1)< 3 100 m .
Major effect
a) National stakeholder concern b) Impact on licences c) 2-5 years for natural recovery d) Up to 5 months for clean-up e)Threatening to biodiversity f) impact on interesting areas for 2 science g) Involved area < 100 sq miles (260 km ) h) 3 Onshore spill (1)< 1000 m .
Extensive effect
a) International stakeholder concern b) Impact on licences / acquisitions c) > 5 years for natural recovery d) > 5 months for clean-up e) Reduction of biodiversity f) Impact on special 2 conservation areas - g) Involved area > 100 sq miles (260 km ) 3 h) Onshore spill (1)> 1000 m .
Intolerable risk
(1) to be reduced of a factor 10 for offshore spill and a factor 100 for sensitive areas
HSE Risk Management

1.3.0.03 Page 44 of 52
B6. ASSET RISK MATRIX
0 Severity Risks to Assets/Project Objectives

costs in USD figures below shall not be combined for deriving the value of a human life!
<10-6 occ/y
A
10-6 to 10-4 occ/y Usually outcome of 2 concurrent failures (*) (Very Low Probability)
B
10-4 to 10-3 occ/y Likely outcome of 2 concurrent failures (*) (Low Probability)
C
10-3 to 10-1 occ/y Could be outcome of 2 concurrent failures (*) (High Probability)
D
10-1 to 1 occ/y Could be outcome of a single failure
E
>1 occ/y
Always outcome of 2 or more concurrent failures (*)
Is outcome of a single failure
1 2 3 4 5
Slight damage
No disruption to operations/business.
Minor damage
Possible short disruption of operations/business: repair cost < 200000; production downtime < 1 day.
Local damage
The unit has been repaired/replaced to resume operations: repair cost < 2500000; production downtime < 1 week.
Major damage
Long time/Major change to resume operations/business: repair cost < 25000000; production downtime < 3 months. Major inquiry for the damage cost.
Extensive damage
Total loss of operations/business. Revamping necessary to resume the process: repair cost > 25000000; production downtime > 3 months. Extensive inquiry for the damage cost.
Intolerable risk
(*) failures of Critical Systems protecting people (escapeways to temporary refuges, control systems, emergency systems etc.)

1.3.0.03
HSE Risk Management
Page 45 of 52
B7. R EPUTATION RISK MATRIX
0
Severity
Could happen in
A
Reported for E&P industry
B
Has occurred at least once in Company
C
Has occurred several times in Company Credible Occurrence
D
Happens several times/y in Company
E
Happens several times/y in one location
Reputation Risk
E&P industry
Noncredible occurrence
Rare occurrence
Unlikely occurrence
Probable occurrence
Likely/ Frequent Occurrence
1 2 3 4
Slight impact
Minor and short lived impact in the locality
Minor impact
Some loss of reputation in the area, which should be recovered
Local impact
Significant potential damage to the regional reputation .
Major national impact

Serious/permanent damage to the ability of the Company to sustain business position in the location, some broader implications for the Company
Major international impact
Potential loss of future business position in the location/region and or lasting significant damage to broader Eni image
Intolerable risk
Note: The reputation of the Company is linked and can be affected by HSE incidents or accidents of all types. Reputation consists of a combination of the characteristics, performance and behaviour of a Company and importantly for risk management, the perception of the Company. Although
reputation can be considered as an intangible asset, it is important because it can affect the ability of the Company to establish or maintain business at all stages of the development cycle. Therefore, actual or perceived HSE impacts can damage the reputation/the business of the Company and in turn tangible Company assets.

1.3.0.03
HSE Risk Management
Page 46 of 52
B8.
SOCIAL RESPONSIBILITY
This aspect covers a range of subject areas including inter alia: business ethics, communities, workforce/labour, human rights, land and indigenous rights and security forces. Consequences of poor management, breaches of legislation or standards or incidents in this respect will essentially result in loss to people, assets or reputation of one form or another. Where it is necessary to make an assessment of risk the risks/scenario in question should be compared against the appropriate matrix and criteria.

1.3.0.03
HSE Risk Management
Page 47 of 52
APPENDIX C ALARP AND COSTS-BENEFITS ANALYSIS

1.3.0.03
HSE Risk Management
Page 48 of 52
ALARP Where risks are very low whether to personnel, the environment, assets or reputation then the situation may be considered acceptable. On the other hand where risks are high, good operating practices a nd often the law, requires that they be reduced. Where risk exists in the region in between, normally called the ALARP region especially where the risks are safety risks, a more structured approach is required. In the ALARP region a reduction in risk is justified unless it is grossly disproportionate to the benefits gained. In practice many risks fall in this region and so what is often known as an ALARP case should be made for each of these. Sometimes this is possible by discussion alone. For example, where hazardous activity is not known to have any safer alternative and where personnel exposure cannot be further reduced, an ALARP case may be presented in such terms without recourse to more detailed analysis. However where a range of protective measures exists each entailing some cost, unless the cost can be accepted, further analysis is required. This analysis is usually based on a cost-benefits analysis described below. Costs-Benefits Analyses A costs-benefits analysis requires a comparison between the total costs of carrying out an improvement to reduce or eliminate the risk, and the benefits gained. The costs and benefits are normally considered over the lifetime of the development/operating unit, or sometimes over the period for which the costs of the improvement can be written off. The costs of an improvement can normally be estimated with some accuracy. The simplest way of doing this is to take the total cost as it is. This works well if the development has a limited operating life. If the operating life is longer the true cost of the improvement may include the effective cost of borrowing the money over the relevant time period.
Benefits are effectively the losses that are, on average, avoided by implementing the improvement. Benefits are harder to estimate than costs. For risks to assets, the benefits may be easiest to judge. The losses that are avoided include the capital losses of the damaged/destroyed facilities, reconstruction costs and the loss of operating

1.3.0.03
HSE Risk Management
Page 49 of 52
profits. For risks to personnel the easiest approach is to place a monetary value on technical and operational efforts made to save human life. It is implicit to this approach that low-cost measures are implemented in any case. Costs-benefits analyses are very difficult to perform where the principal risks are to the environment or to reputation due to the difficulties in estimating the benefits obtained from improvements in these areas. Limitations of Costs-Benefits Analyses ALARP type arguments cannot and must not be made as a means of avoiding basic levels of protection to personnel. It is a requirement of many laws and codes and standards that some means are available to allow personnel who may be exposed to a reasonably foreseeable hazard, of saving their life. Examples are lifejackets, lifeboats and liferafts on boats and offshore installations, lifejackets and breathing masks on a irplanes, and fire alarm systems, and escape stairs in buildings. In particular, ALARP type arguments cannot be used to avoid providing systems such as these or to reduce the number of such systems/equipment items.

1.3.0.03
HSE Risk Management
Page 50 of 52
APPENDIX D
RISK R EGISTER PROFORMAS A High Level Risk Register (Management Summary)

Likelihd Category (0-E) Biodiversity & Environmental Sensitivity All activities and developments will impact and interact with the surrounding environment in some way. Key considerations: Conseq Category (1-5) 3 L Risk Category (H M L)
Risk/Issue
Controls in place
Metrics
Risk Reducing Measures
Emerging issues
monitoring/briefing
Numbers of people
receiving environ. training
Ensure awareness of biodiversity issue with Senior management Ensure EIAs are conducted to a high standard for all activities Baseline land use GIS for key operations Rig sites/process facilities footprint design Implement HSE IMS and seek environmental certification Develop basic environmental awareness training programme Consider footprint reduction targets for new projects Consider ENI R&D projects
Effective environmental
management system
Landuse Mapping No. of EIAs for all

activities
Landuse/Footprint Ecology Habitats Physical impact Knowledge of hydrology/ hydrogeology/geology
Proper project design Environment training Environmental/strategic

impact assessments
Environmental
certification
Habitat management Site clean-up /

rehabilitation
Contractor controls
Facilities Safety Major accident in impacting people (workforce and/or community), environment, production etc.
Corporate Audits Safety training/

competence
No. of equipment
failures causing downtime
Ensure project HSE reviews are part of project management process

1.3.0.03
HSE Risk Management
Page 51 of 52
Risk/Issue
Controls in place
Likelihd Category (0-E)
Conseq Category (1-5)
Risk Category (H M L)
Metrics
Risk Reducing Measures
Project design
Project management/
design standards
No. inspections % outstanding

maintenance
planning construction commissioning decommissioning

Plant integrity Plant age Maintenance Leaks and releases Pipelines Contractors
Maintenance standards Containment integrity Technology Operating procedures Audits/inspections Preventative/ predictive
maintenance
Develop criteria in the HSE IMS for project design for new facilities, major modification and existing operations (HSEQ Plan).
Identification of safety
critical equipment
Contractor controls

1.3.0.03
HSE Risk Management
Page 52 of 52
B -
G.U./Subsidiary/Site Risk Register

Risk/Issue Controls in place Likelihd Category (0-E) Conseq Category (1-5) 2 3 L M Risk Category (H M L) Metrics Risk Reduction Measures
Activity Exploration Project X Biodiversity & Environmental Sensitivity The X area contains many untouched areas some with National Park status and a wide range of fragile flora and fauna. There is little baseline information, as well as actual damage to the environment. In this respect there is also the potential for significant reputation issues. (A) Seismic activities have the potential to impact significantly through physical disturbance and presence of personnel (B) In the event of a good prospect and field development there exists significant potential for permanent local impact (water extraction, footprint, noise) Activity Production FacilityY Facility Integrity There are several key issues with facility Y:
EIA and baseline studies

for seismic Proper project design
C C
Numbers of people
receiving environment training
Ensure awareness of biodiversity issue with Senior Management Identify management objectives Include the issue in certification controls Develop basic environmental awareness training programme for this development Establish links and relationships with nature conservation groups
Habitat management Site clean-up /

rehabilitation
Leaks and releases There is an increasing risk of facility integrity issues and loss of containment with potential for extended loss of production and safety of workers and public.
Plant integrity Plant age Maintenance
Safety training Operating procedures Audits/inspections Maintenance
Near miss reporting No. of Equipment

failures causing production losses Planned/completed inspections ratio
Full condition survey underway Detailed plant reliability analysis to be performed Enhance maintenance programmes to a predictive/preventative approach Identification of safety critical equipment
Maintenance
targets

GestioneRischi HSE Inglese

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

GestioneRischi HSE Inglese

Transféré par

Droits d'auteur :

Formats disponibles

Eni S.p.A.

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

RESPONSIBILITY / ACCOUNTABILITY / OWNERSHIP

MEASUREMENT OF R ISK TO P EOPLE

B1. B2. B3. B4. B5. B6. B7. B8.

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

ACGIH The American Conference of Governmental Industrial Hygienists (see http://www.acgih.org/)

BPEO Best Practicable Environmental Option taking into account cost.

Eni S.p.A. E&P Division

HSE Risk Management

Hazardous event A hazardous event is synonymous with a hazard.

IEC International Engineering Consortium (see http://www.iec.org/)

ISO International Organization for Standardization (see http://www.iso.org/).

Eni S.p.A. E&P Division

HSE Risk Management

NORSOK Norwegian Technology Centre standards (see http://committees.api.org/standards/isotc67/links_other.html)

Eni S.p.A. E&P Division

HSE Risk Management

OGP International Association of Oil & Gas Producers (see http://www.ogp.org.uk/)

OLF Oljeindustriens Landsforening (see http://www.olf.no/ )

OHSAS Occupational Health & Safety Advisory Services (see http://ohsas.org/)

OREDA Offshore Reliability DAta (see http://www.sintef.org/)

Eni S.p.A. E&P Division

HSE Risk Management

UKOOA UK Offshore Operators Association (see http://www.ukooa.co.uk/)

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Risk Reduction Measures

Risk Determination RISK EVALUATION Risk Acceptability Criteria

Set Functional Requirements

Figure 1 - Risk Management Process

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division

HSE Risk Management

Risk reduction measure

Eni S.p.A. E&P Division

HSE Risk Management

Eni S.p.A. E&P Division