1

National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling

Industry’s Role in Supporting Health, Safety, and Environmental Standards: 

Options and Models for the Offshore Oil and Gas Sector

Staff Working Paper No. 9

Staff working papers are written by the staff of the National Commission on the BP 

Deepwater Horizon Oil Spill and Offshore Drilling for the use of members of the 

Commission. They do not necessarily reflect the views of the Commission or any of 

its members. In addition, they may be based in part on confidential interviews with 

government and non-government personnel.

That government needs to strengthen its regulatory oversight of the offshore oil and gas 

industry has been one of the more obvious and least disputed lessons of the BP 

Deepwater Horizon spill. But the disaster has also prompted many stakeholders to 

conclude that the oil and gas industry itself needs to do a better job—not only in 

developing, disseminating, and implementing best practices, but in working proactively 

with government authorities to ensure that health, safety, and environmental protection 

requirements and guidelines are being rigorously followed throughout the sector. 

Precedents for a significant private-sector role in maintaining high standards are not 

hard to find, especially in industries where complex technology and specialized expertise

are critical to regular operations and where a significant mishap or breech of sound 

practices could have major adverse impacts—not only on the individual company (or 

companies) that are directly involved, but on the sector as whole. At the Commission’s 

August hearing, for example, Commissioners were introduced to the Institute of Nuclear 

Power Operations (INPO) as one model or example of how government regulation could 

be enhanced and supported by industry-led efforts, not only to improve compliance with 

health and safety regulations, but also to bring about a deeper cultural shift that 

emphasizes excellence in systems safety.

This paper expands on some of the ideas and concepts introduced at the August

meeting and takes a closer look at the role played by INPO and similar institutions or 

organizations in other industries. We also look at existing examples of self-organization 

within the oil and gas sector, most notably the American Petroleum Institute (API), and 

review the thinking behind a recent proposal—put forward by the oil industry’s Joint 

Industry Task Force—for a new industry-led safety organization. The aim is to provide 

Commissioners with objective information that will be useful in deciding how the oil and 

gas industry itself could play a more proactive role—alongside rigorous government 

oversight—in minimizing the risk that a disaster like the BP Deepwater Horizon spill 

could happen again. 
2

Industry Role and Self-Interest in Supporting Effective Regulation 

One of the key responsibilities of government is to regulate, or direct according to rules. 

Many businesses and business groups are involved in various forms of internal 

standard-setting, self-policing and evaluation, and other activities that together can 

greatly enhance the effectiveness of government regulation. A number of industries have 

established private entities that receive funding from individual companies to advance 

their collective interests. In some industries these entities also play a role in helping to 

ensure that safe and environmentally responsible practices are being followed sector 

wide. Often, support for these activities is grounded in the recognition that a misstep by 

any one member could have significant repercussions for them all. 

In the academic literature and in policy discussions, such private-sector initiatives are 

sometimes grouped under the umbrella terms “self-regulation” or “co-regulation” (in the 

sense that industry is seen to be exercising a regulatory function alongside that of 

government).1

This discussion, by contrast, proceeds from the premise that government’s sovereign 

authority to set and enforce regulations is—and necessarily must remain—

uncompromised by and independent of industry’s voluntary efforts. Thus, even in 

industries with a strong culture of enforcing high standards on the part of individual 

companies, government must also be present. Industry-led efforts, in other words, are 

properly viewed as complements to government regulation rather than substitutes or 

stand-ins, and they should serve to promote improved and safer operations overall.

 We do not employ these terms in this paper for two reasons. First, 

neither is well-defined and thus can be used to cover a very wide range of activities, 

some of which may provide only weak support (if any) for effective regulation. Second, 

and more importantly, both terms are too easily misunderstood as implying that 

government and the private sector have equal—or even substitutable—roles and 

obligations with respect to the protection of public health and welfare. Taken to an 

extreme, the notion of self-regulation or co-regulation may be used to argue for a 

reduced role for government generally or to suggest that the public can rely on industry’s 

good faith efforts to police itself in lieu of rigorous oversight by public-sector institutions. 

Industry-led efforts to advance common standards or norms of operation and facilitate 

compliance with government-imposed safety, health, and environmental performance 

requirements are widespread in the United States, especially in cases where 

government is overseeing industrial operations that combine a high degree of technical 

complexity with a high potential for significant adverse consequences in the event of 

error or failure. Examples include the chemical, nuclear power, civil aviation, and oil and 

gas industries. The reasons are simple. First, as a practical matter, the pool of 

individuals who possess the expertise and experience needed to exercise adequate 

oversight is relatively small. This makes it difficult for government agencies to rely solely 

on in-house staff, especially when government cannot compete with private-sector 

salaries for the most talented experts. Second, these are also industries that are well 

aware of their interdependence and enjoy significant revenues. Because the missteps of 

one can adversely affect the profits of others, each has an ample economic incentive to 

ensure such missteps do not happen. 

For example, airlines are well aware that their industry as a whole is vulnerable to a 

rapid loss of public trust in the safety of air travel if one company’s actions result in one 

or more catastrophic accidents. The Federal Aviation Administration (FAA) is 

responsible for the safety of civil aviation,2 and the airline industry lends resources to 

bolster government oversight.3

 The government enhances its oversight abilities by 
3

relying heavily on private Designated Engineering Representatives—either consultants 

or employees of aircraft manufacturers such as Boeing.4 These engineers work for their 

employers and may approve, or recommend approval of, technical data provided to the 

FAA for the company.5 It is a good example of industry and government “sharing” 

experts.6

Boeing itself has worked closely with the FAA to improve aircraft safety.

 Provided it does not result in agency “capture,” this approach has obvious 

potential to improve the quality of government oversight. 

7 In the 1950s, 

only 20 percent of Americans were willing to fly, and there were 14 to 15 major accidents 

a year.8 Boeing had a strong incentive to improve performance, and attitudes toward 

aviation, if it were to grow its commercial business. Today the accident rate for the civil 

aviation industry is roughly one-fourth what it was in the 1950s, despite a 10- to 20-fold 

increase in airline passenger-miles traveled between 1951 and 1991.9

The U.S. Navy’s SUBSAFE program provides an example of an organization, the U.S.

nuclear Navy, effectively regulating itself in terms of the safety of nuclear submarines. 

SUBSAFE was instituted after the loss of the USS Thresher in 1963,

 

10 and since then 

not a single SUBSAFE-certified sub has been lost.11 Much of SUBSAFE’s success is 

due to a dynamic tension between the Platform Program Managers (who are responsible 

for the costs, schedules, and quality of the vessels under their control), the Independent 

Technical Authority, and the Independent Safety and Quality Assurance Authority.12 The 

Platform Managers must select from a limited set of acceptable design options to ensure 

that safety is not traded off for performance.13 The Technical Authority approves these 

acceptable options.14 The Safety Authority is responsible for administering SUBSAFE 

and enforcing compliance.15 This example is offered because it demonstrates the 

potential efficacy of a system of checks and balances, even in a program that is fully 

implemented within a single organization (in this case the U.S. Navy).16

Industry self-policing is not a substitute for government but serves as an important 

supplement to government oversight. And the cost of forgetting that essential premise 

can be calamitous. In the financial sector, for example, the Securities and Exchange 

Commission’s Consolidated Supervised Entities Program had, in 2004, delegated 

regulatory risk assessment of global investment bank conglomerates to the banks 

themselves.

(It may be of 

interest in the context of this example to note that many of the private companies 

providing services to the Navy’s nuclear fleet also serve the offshore oil and gas 

industry.)

17 The program was designed to cover a regulatory gap left by Congress 

amid changes in global finance, but it was entirely voluntary.18 Four years later, 

Securities and Exchange Commission Chairman Christopher Cox ended the program, 

declaring it a failure—indeed “fundamentally flawed”— after companies like Bear Sterns 

failed to adequately assess the risk of a sharp downturn in housing prices on their large, 

leveraged investments in mortgage-backed securities.19

A second cautionary tale involves an environmental disaster. When political opposition 

stymied federal and state regulation of toxic coal ash and other residues from power 

generation, the electric utilities that had opposed regulations deferred to the Utilities 

Solid Wastes Activities Group’s voluntary “Action Plan” to manage such wastes.20 The 

United States Environmental Protection Agency stepped back from regulating such 

hazards.21 And, in 2008, an earthen dam containing coal ash gave way in eastern 

Tennessee, releasing more than a billion gallons of coal ash across a large portion of 

Roane County and polluting rivers that carried the hazardous wastes farther afield.22
4

Government-industry interactions in the arena of oil and gas regulation have led to 

similarly troubling outcomes—including some outcomes that very likely helped set the 

stage for the Macondo well disaster. In recent decades, federal agencies charged with 

regulating the industry, such as the former Minerals Management Service (MMS), based 

many of their regulatory requirements on “recommended practices” and “industrial 

standards” developed by API.23 Because API’s member companies possess 

tremendous relevant expertise on a wide range of technically complex activities 

associated with oil and gas drilling, considering API’s recommendations when 

developing regulatory requirements clearly made sense. The risk, of course, was that 

government would defer excessively to industry recommendations—to the point where it 

failed to meet its independent obligation to protect the public. Arguably, this is just what 

happened in the oil and gas sector. Agencies like MMS reflexively adopted API’s 

recommendations, even where those recommendations were based on the industry’s 

“consensus” position and thus reflected not “best” practices, but rather “least common 

denominator” practices.24

The lesson to be drawn from these and many other examples is that there is no 

substitute for effective, independent government regulation. Regulation can be 

supplemented or strengthened by relying on private-sector expertise and on industry’s 

own self-interest in upholding high standards of safety and environmental performance. 

Indeed, a recent report by the Tobin Project—an alliance of the nation’s leading 

academics that aims to make the latest academic work on regulation and other critical 

areas of policy research available to lawmakers and their constituents—concluded that 

“there are circumstances in which the state has delegated regulatory responsibilities to 

corporations, or to organizations affiliated with trade associations, with beneficial results. 

The problem often is not self-regulation per se, but the failure to integrate structures of 

private governance effectively within a larger institutional setting—to embed those 

structures within a broader framework of public oversight.”

 

25 The same report goes on to 

note that “The state must furnish regulators with clear missions, and then maintain a 

close watch over those quasi-public or private regulators.”26 Clearly, however, voluntary 

industry efforts alone— without that “broader framework of public oversight”—cannot be 

relied upon to provide an adequate regulatory safety net. As the economist Joseph 

Stiglitz observed in a commentary on the causes of the recent financial crisis, counting 

on forms of “self-regulation” such as the Consolidated Supervised Entities Program to 

manage risks in the banking sector was, in hindsight, nothing short of “preposterous.”27

The next two sections of this paper review lessons learned from regulatory experience 

with the forestry, fisheries, and chemicals industries and the nuclear power industry. 

Examples from the forestry, fisheries, and chemicals industries

Regulatory models in the forestry, fisheries, and chemicals industries run the gamut from 

little government involvement to models where the relevant government agency sets 

ground rules and then relies to a large extent on private interests to regulate themselves. 

In some cases, heavy reliance on self-policing by industry and watchdog efforts by nongovernmental organizations (NGOs) occurs in areas where government has largely 

failed to regulate. For example, the Forest Stewardship Council (FSC) is an NGO that 

establishes norms for the sustainable harvesting of timber by forestry companies. 

Companies volunteer to have their forestry operations inspected by FSC personnel; if 

they pass, they become FSC-certified, and their products are labeled as such.28

Similarly, the Marine Stewardship Council was founded in 1997 by the World Wildlife 
5

Fund and Unilever to recognize the use of sustainable fishing practices. The Council 

awards a blue label to certify compliance with its sustainability standards, and 

companies are motivated to participate because the label is seen as adding value to 

Council-certified products.29

The chemical industry’s Responsible Care initiative was developed in Canada and 

launched in 1985 after the disastrous 1984 chemical leak in Bhopal, India.30 It operates 

in 53 countries and describes itself as “the chemical industry's global voluntary initiative 

under which companies, through their national associations, work together to 

continuously improve their health, safety and environmental performance, and 

communicate with stakeholders about their products and processes in the manufacture 

and supply of safe and affordable goods that bring real benefits to society.”31 The 

American Chemistry Council can expel member firms for non-compliance with 

Responsible Care.32 Subsequent analysis, however, suggests that the program’s 

success has turned less on the availability of such formal sanctions and more on 

informal disciplinary mechanisms such as peer pressure and institutional norms of 

compliance: “Executives from leading firms pressure their non-compliant counterparts at 

industry meetings to adopt and adhere to the industrial codes.”33 Despite Responsible 

Care, the U.S. chemicals industry remains highly regulated by various government 

agencies.

Sometimes, efforts to promote a more active role for the private sector originate with 

government itself. Under the California Cooperative Compliance Program (CCCP), for 

example, the Occupational Health and Safety Administration (OSHA) allows unions and 

management at certain sites to negotiate on ways to improve safety. In fact, under this 

program OSHA is moving away from setting and monitoring standards itself—instead it 

is letting a labor-management safety committee perform both inspection and 

enforcement functions. The agency watches, but does not intervene as long as safety 

improves. And so far, safety has improved. Thus, this program seems to have been 

successful in taking advantage of on-site expertise to find and implement innovative 

approaches to safety. Moreover, it appears the program has improved efficiency: Both 

the firms involved and OSHA were able to save money by abandoning the traditional 

OSHA inspection system.34

Example from the Nuclear Power Industry

The risk-management challenges presented by nuclear power are in some respects 

analogous to those presented by deepwater drilling: the dependence on highly 

sophisticated and complex technologies, the low probability/catastrophic consequences 

nature of the risks generated, and the related tendency for a culture of complacency to 

develop over time in the absence of major accidents. For the nuclear power industry, it 

took a crisis—the partial meltdown in 1979 of the radioactive core in Unit Two at the 

Three Mile Island Nuclear Generating Station—to prompt a transformation of its safety 

culture.35 But that is what industry accomplished and reportedly with significant, positive 

results.36 For that reason, the nuclear power industry’s method of transforming businessas-usual practices offers a useful analogue as the oil and gas industry now seeks to do 

the same more than 30 years later. 
6

The first recommendation of the President’s Commission that investigated the root 

causes of the Three Mile Island accident was directed to industry, and made clear the 

extent to which the industry need to transform its safety culture:

[T]he nuclear industry must dramatically change its attitudes toward safety and 

regulations. The Commission has recommended that the new regulatory agency 

prescribe strict standards. At the same time...the industry must also set and 

police its own standards of excellence to ensure the effective management and 

safe operation of nuclear power plants.37

Two months later, in December 1979, the nuclear power industry created the Institute of 

Nuclear Power Operations (INPO), a nonprofit organization with the ambitious mission 

“to promote the highest levels of safety and reliability—to promote excellence—in the 

operation of commercial nuclear power plants.”38 

INPO’s structure more closely resembles the utilities it “regulates” than it does the 

Nuclear Regulatory Commission (NRC), the federal regulatory agency whose work INPO 

is designed to complement. INPO’s president answers to a board of directors, consisting 

of senior industry executives—mainly CEOs.39 A few years after its founding, INPO 

established its own inspection process, based on its studies of what needed inspecting 

and how to do so.40 Today, nuclear power plant inspections are thorough, but not 

adversarial. Because many INPO inspectors are nuclear employees drawn from other 

power plants, a great deal of cross-fertilization of knowledge occurs, and strong peer 

relationships are created.41 INPO’s normative system establishes a structured way of 

thinking about plant operations by translating these matters into the language of 

responsibility as it spells out what it means to occupy a particular role and what it means 

to behave in a manner appropriate to that position.42

INPO inspection teams usually number about 20 people: one-third are permanent, fulltime inspectors; one-third are on loan from the industry for 18 to 24 months; and the 

remainder are peer evaluators on loan just for that particular inspection (but these 

cannot be from the utility being inspected).43

Each of the 66 nuclear sites (encompassing 104 reactors, operated by 26 utilities) is 

inspected every 24 months.44 Inspectors rotate through assignments; each inspector 

averages 4 to 5 inspections per year. (Besides the major inspection of each site every 

two years, INPO performs a series of other evaluations and provides other safetyoriented services throughout the year. For example, utilities’ training programs are

evaluated and accredited every 24 months.)45 Importantly, INPO is not the sole source 

of plant inspections, but instead serves as an significant supplement. Nuclear insurers, 

the Occupational Safety and Health Administration, and the NRC also conduct 

inspections; INPO coordinates with the NRC and other inspectors to avoid schedule 

conflicts.46

Nor is there anything casual about an INPO inspection. It is thorough and careful, 

extending for five to six weeks: two weeks of preparation and analysis of pre-delivered 

data from the site, two weeks on the site, a week of internal review by functional and 

cross-functional sub-teams and report writing, and perhaps another week reviewing with 

the INPO president.47 Any lessons learned that are deemed valuable to the rest of the 

industry are posted on INPO’s private online portal, but the name of the site is scrubbed 

from the text.48 All plants respond to INPO’s assessment reports by documenting 
7

actions planned. A poor performing plant will receive higher attention from INPO to see if 

their actions are on track. INPO also will work to give them help or coordinate help from 

other stations.49 Furthermore, assessment results are never revealed to anyone other 

than the utility CEOs and site managers, but INPO formally meets with the NRC four 

times a year to discuss trends and information of “mutual interest.” And if INPO has 

discovered serious problems associated with specific plants, it notifies the NRC.50

INPO considers at each plant such metrics as consistency of operations, safety-system 

performance, and workers’ collective radiation exposure.51 But its Plant Performance 

Assessments are the real backbone of its work. These exercises figuratively deconstruct 

and reconstruct the plants, looking into all aspects of operations, maintenance, and 

engineering. The inspection teams evaluate processes and behaviors that cross 

organizational boundaries such as safety culture, self-assessment, corrective action, 

operating experience, human performance, and training. The performance of operations 

and training personnel during simulator exercises is included in each evaluation. Where 

possible, observations of plant startups, shutdowns, and major planned changes are 

also included.52

INPO strongly discourages a rule-bound, compliance-oriented approach that would 

encourage a mentality of ticking boxes—and in fact its reports are not in checklist form.53 

Many of the risk factors that nuclear companies must deal with are beyond their control. 

“One issue that is clearly within the industry’s control is standardization: standardization 

of design requirements, standardization of resulting advanced designs, and 

standardization of operations. The industry has devoted significant time and resources 

over this issue over the past few decades.”54 “Good practice” documents are written with 

an eye toward processes that are applicable across the industry.55

INPO directly connects those responsible for the day-to-day operations of nuclear plants 

with senior management.56 Two INPO Industry Review Groups, which act in an advisory 

capacity to senior management, enable lower-level employees involved in plant 

operations to communicate with vice presidents and division directors.57 Review groups 

also assess INPO programs and evaluate INPO’s performance itself.58 The existence of 

these groups reflects INPO’s commitment to tie together senior management and lowerlevel, operational employees. 

In addition to its individual site evaluations, INPO hosts an industry “CEO Conference,” 

usually each November, which includes numerous speakers from nuclear organizations 

and also some non-nuclear companies, with a focus on nuclear safety.59 During this 

conference, the INPO president gathers only the 26 utility CEOs in a private room to 

reveal to all the executives the grades for each site, based on the assessments.60 These 

grades range from one (most favorable) to five. Approximately 40 percent of the grades 

are INPO 1, 40 to 50 percent are INPO 2, and 10 to 15 percent are INPO 3 or 4. (The 

last time any site was given a grade of 5 was in the late 1980s.)61 An INPO 5 indicates a 

site with significant operational problems, triggering a shutdown. And a grade of INPO 4 

requires a verbal explanation by the affected CEO on the spot.62 This meeting is not 

intended to shame or punish, but to put the facts on the table. CEOs with low-rated 

plants typically will describe to their peers what comprehensive actions they are 

undertaking to address the causes of the problems. All CEOs recognize that it is 

everybody’s interest to help lower performers operate better. At the larger dinner, with all 

conference attendees present, INPO announces and congratulates only the INPO 1 
8

plants.63 A former Chief Nuclear Officer of a major utility described INPO 1 as like getting 

an Academy Award.64 

Presentation of relative standings before the rest of the industry produces a high level of 

peer pressure; as one CEO put it, “You get the whole top level of the utility industry 

focused on the poor performer.”65 It also gives the industry the ability to “clean out” poor 

management. Since INPO’s directors are industry peers, CEOs may become aware of a 

company’s taking too much risk and offer to loan people to help the “underperformer” 

come up to speed.66

Although the Price-Anderson Act limits the liability of those who operate nuclear power 

plants in the case of an accident, owners of nuclear plants insure through Nuclear 

Electric Insurance Limited, an industry mutual insurance company, against losses 

associated with on-site problems such as power interruptions, decontamination, and 

physical property damage.67 NEIL is allowed to visit INPO’s office at least once a year to 

view the assessment ratings. They are not given copies.68 And, like any other insurance 

company, Nuclear Electric Insurance Limited sets insurance premiums based on its 

assessment of risk. Sites with top INPO ratings are charged lower premiums than 

stations with lower ratings.69 NEIL requires that license holders be an active member of 

INPO or that they notify NEIL formally and promptly if they stop being a member – and 

they must show NEIL how they will accomplish the equivalent level of oversight as what 

INPO does. This has never occurred. In reality, NEIL's board quickly would be 

discussing removal of insurance coverage should a member choose to drop out of INPO 

activities.70 “So, utilities have a tremendous financial incentive to carry out INPO's 

recommendations.”71

INPO has about 400 employees, including about 60 on long-term loan from its member 

utilities. Of the total staff and management cadre, 250 are nuclear technical personnel.72

INPO can only do its job if its employees possess technical expertise at least equal to 

that possessed by those in the industry INPO is charged with overseeing. To a certain 

extent, INPO achieves that standard by relying on experts on loan from industry for 

extended periods of time.73 But to ensure that INPO’s own full-time personnel possess 

the requisite qualifications, industry salaries are benchmarked, and INPO provides its 

employees comparable compensation.74 INPO has therefore not suffered from the 

expertise gap too often evident with government inspectors (witness the issue raised at 

the founding of the Minerals Management Service, as discussed in chapter 3 of the 

Commission’s final report). INPO can pay these higher salaries because it is not subject 

to the same budgetary constraints faced by a public agency. Each utility contributes to 

INPO’s budget based on the number of reactors it owns. Budgets are approved by 

INPO’s board each autumn. (INPO’s fiscal year 2010 budget was $99 million, with more 

than $100 million budgeted for 2011.)75

INPO ‘s ability to achieve widespread acceptance within the nuclear power industry was 

not pre-ordained. The new self-policing enterprise had to earn the necessary reputation 

for fairness and integrity over time.76 A formative moment in gaining the necessary 

stature occurred in 1988, when INPO helped bring about the firing of a utility’s corporate 

leadership following a plant shutdown.77 Beginning in December 1984, INPO inspectors 

reported pervasive safety problems at Philadelphia Electric’s Peach Bottom nuclear 

plant— including incidents of employees literally sleeping on the job. When INPO was 

dissatisfied with the plant’s response to these concerns, it scheduled more inspections 

and meetings with Philadelphia Electric officials, and sent letters further detailing the 
9

depth of its concerns. These concerns prompted the NRC to order a shutdown of the 

plant, and when Philadelphia Electric submitted a recovery plan to the Commission to 

restart the plant, an INPO-convened industry panel sharply condemned the plan as 

seriously flawed. INPO and the NRC worked closely and cooperatively, with INPO so 

harshly criticizing Philadelphia Electric’s management that several top executives 

ultimately lost their jobs. From then on, the message within the industry was clear: 

“’INPO has a great deal of clout’” and Peach Bottom became a symbol of INPO’s new 

power. 78

Although INPO has its detractors,79 it does appear to have helped the nuclear power 

industry improve and maintain performance and safety during the past three decades. 

INPO has helped the industry measure its progress in improving safety standards and 

has served as a vehicle for making advances in control-room design, plant and 

personnel performance, training and qualification, self-regulation, emergency response, 

maintenance, and radiation protection, among other areas.

80 During the past 30 years, 

the nuclear industry has improved plant efficiency, significantly reduced the number of 

automatic emergency reactor shutdowns per year, and reduced collective radiation by a 

factor of six compared to the 1980s.81 The industry has achieved these milestones, in 

part, through INPO’s role in promoting a strong nuclear safety culture and presenting 

performance objectives and criteria to help the industry strive for and surpass safety 

goals. 82

An INPO for the Oil and Gas Industry? 

As part of an effort to develop options for guarding against future oil spills from offshore 

drilling, an industry task force is looking into whether and how to develop a new Industry 

Safety Program for Deepwater Drilling and Completion. API recently wrote to the 

Commission to indicate that the industry is considering establishing a separate 

organization “to provide leadership and direction for the new Safety Program.” 

According to the letter, API envisions that participation would be open to all API 

members, but is still evaluating the governance of this organization and its relationship to 

API. (The letter also said that the new safety program would involve “supporting the 

development and enhancement of a high-performing industry safety culture,” suggesting 

that such a culture does not exist at present.)83

INPO was one of the organizations investigated as a possible model by the industry task 

force but there is resistance to the notion of forming an INPO-like organization for the oil 

and gas sector—both within the industry and among regulators. This ambivalence is 

perhaps not surprising, given the power that INPO wields in its own industry. 

Rex Tillerson, Chairman and CEO of Exxon Mobil, told the Commission at its November 

9 hearing that his company, through the task force, had looked at INPO, Responsible 

Care, and a number of similar efforts: “I think there are elements of all of those that are 

useful for us as an industry to consider. There are distinct differences between the 

nature of the nuclear power industry and the oil and gas industry, and in particular 

deepwater.”84 Mr. Tillerson pointed out that the nuclear power industry involves fixed 

sites and well-known technology with no proprietary interests involved, “as opposed to 

our industry, which is moving to different locations, different environments, evolving, all 

kinds of technologies being introduced. And so I think we look at the principles around 

INPO in terms of how do you share best practices, how do you assess where the 
10

companies are operating at certain levels of competency. And we like the elements of 

that.”85

At the same hearing, Marvin Odum, president of Shell Oil Company and director of 

Shell’s Upstream Americas business, praised the experience as well as the standardsetting and design abilities of API and said that both must play a role in any safety 

organization that emerged from the work of the industry task force.86

Asked at that hearing his views about the creation of an INPO-like organization for the oil 

industry, Michael Bromwich, director of the Interior Department’s Bureau of Ocean 

Energy Management, Regulation and Enforcement said “I don't think it can be an 

immediate substitute for the current system we have now. But is there the possibility and 

the potential for a self-regulating mechanism to exist that would enhance the regulatory 

system that we currently have and to increase oversight? I think there is that possibility, 

and I would look forward to exploring it.”87

Mr. Bromwich also added a cautionary note, however: “my sense is that the kind of 

information that would be handled in the oil and gas industry if one company inspected 

another or participated in inspections of another, there would be issues about technical 

and proprietary and confidential information that companies may be reluctant to share 

with one another.”88

This concern about oil companies’ willingness to share information and engage in joint 

safety efforts is not misplaced, since the industry has long-settled reasons to be wary of 

running afoul of national antitrust laws.89 Historically, the federal government has not 

shied away from prosecuting the oil and gas industry for anti-competitive activity. In 

1911, the Supreme Court upheld the federal government’s prosecution of Standard Oil 

under the Sherman Act and ordered a dismantling of the company into several 

competing firms.90 Because of this history, any effort to enlist the oil and gas industry in 

policing its members would likely require assurances by the federal government—and 

perhaps even legislation—to give companies confidence that these activities would not 

expose them to antitrust violations.91

Whatever differences exist between the nuclear power industry and the offshore 

petroleum industry, they should not prevent the latter from achieving the safety 

improvements recorded over the last several decades by the former. As Mr. Tillerson 

also told the Commission at its November 9 hearing: “Safety is not proprietary. And for 

this reason ExxonMobil shares its best practices within our industry and across other 

industries. We seek to learn from others.”

 

92

In fact, there have been many past instances of oil and gas industry cooperation on 

issues such as safety and spill cleanup, the proposed Marine Well Containment 

Corporation being the latest such example. In 1963, Shell ran a famous “School for 

Industry” to bring other companies up to speed. Oil companies also established the 

Response Corporation after the Exxon Valdez spill in 1989, and the “Deep Star 

consortium in 1992 to meet technological and environmental challenges. As offshore oil 

and gas companies push deeper into ever more challenging geological environments, a 

strong industry-led safety organization could help them operate more safely, just as 

INPO can be expected to play an important role in managing innovation as the nuclear 

industry prepares to launch a new generation of reactor technology.

 Other industry insiders have told the 

Commission that competition between oil and gas companies is mostly about finding 

deposits and dealing effectively with the geology to harvest those deposits. This leaves a 

great deal of scope for companies to cooperate in the pursuit of systems safety, 

especially in areas like rig design and use and best practices in rig operations. 
11

As in the nuclear business, an INPO-like organization could also help address the 

shortage of individuals with a high level of relevant technical expertise. This is a serious 

issue for the oil and gas industry and its regulators.93 Mr. Bromwich told the 

Commission on November 9 that he had gone on a recruitment tour among the 

petroleum engineering departments of southwestern universities and the chairs of these 

departments “expressed great concern about the level of R&D in the private sector into 

drilling and drilling safety. So I think we're really talking about two different but important 

things. One is to make sure that drilling safety R&D goes on at an adequate level within 

the industry, but then also that that knowledge in R&D gets shared with the government 

so that the regulator is better equipped to do its job.”94

In sum (and notwithstanding concerns about antitrust law, willingness to share 

information, and the exposure of poor performance by individual companies), the 

experience of the oil and gas industry and other industries over the last several decades 

suggests that an autonomous, INPO-like safety organization could usefully complement 

government regulation of offshore drilling and improve industry practices. Such an 

organization should be narrowly focused on the core mission of process safety; 

accordingly it should not and could not be allowed to lobby. Nor should it displace 

government’s regulatory functions and obligations—rather the aim of the organization 

should be to supplement and reinforce regulatory efforts to assure high standards of 

safety and environmental performance. As the experience of the nuclear power industry 

demonstrates, the best outcomes are achieved when government and the private sector 

are both present and play strong, complementary roles—neither the NRC nor INPO 

could have been as effective at promoting safety and protecting the public interest had 

either one existed in a vacuum, absent the other.

Following the INPO model, oil and gas company CEOs should establish and provide 

board leadership for a new industry-wide safety organization. This would help ensure 

buy-in for the new organization’s operations at the highest levels of management at 

individual companies and down through the ranks. The board of the new organization 

would have to find and create incentives to ensure that safety stays a top motivator. Its 

overarching goal would be to promote continuous learning and the adoption of excellent 

practices by all companies operating on outer continental shelf, so as to significantly 

improve the industry’s overall safety and environmental performance.

Conducting audits would likely be among the most important functions of a new industryled safety organization. This function should be internal to the new organization—not 

contracted out to third party companies—and it should be led by a professional auditing 

team that would be joined by staff seconded from operating companies and other 

professionals in the industry. Audits could be used to monitor and measure the process 

performance of individual companies, and to hold them accountable— to each other and 

to certain business counterparts (such as joint venture partners, suppliers, insurers, or 

investors)—for upholding high standards of safety. This would be accomplished, in part, 

by designing audits so that they assess individual companies’ operations against plans 

and hazard assessments. Job training, certification, and other key metrics that have 

material relevance to process safety would also be audited and reported. Audit results 

could be used for multiple purposes: to provide feedback to individual companies at 

various levels, to prepare case studies for shared learning, and to contribute data that 

could be aggregated for trends analysis.

As with INPO, an oil and gas safety organization could promote accountability within the 

industry through annual meetings where safety records, approaches, and best practices 

could be compared. Top performers could be recognized through awards, while help 
12

could be offered to poor performers. To further promote accountability, companies could 

be required to report their safety scores to their boards of directors and possibly to 

insurance companies and regulators, particularly if they are in the bottom two-thirds of 

the rankings. 

Another function of such an organization would be to continually improve standards and 

best practices for the industry by soliciting and incorporating meaningful industry and 

regulator input concerning international technology and policy developments. In addition, 

the new organization should review the new Safety and Environmental Management 

Systems rule by the U.S. Department of the Interior (DOI) to make it more specific, 

comprehensive, and effective.95

The safety organization envisioned here would be of, by, and for the private sector. It 

would need to be created by the CEOs of leading companies and led by someone with 

unimpeachable integrity, a record of success in implementing industrial process safety, 

and the ability to command the respect of peers throughout the industry. Participating 

companies should provide sufficient resources to support a well-funded, well-staffed, 

highly professional team that would be capable of (a) taking a systems approach to risk 

management and process safety and (b) assessing cross-cutting risk factors at 

individual companies, including leadership, ethics, behavior, engineering, contracting, 

supply chain management, and logistics. The cost and resources to support a robust, 

highly effective safety organization will not be trivial; nevertheless they are likely to 

represent only a tiny fraction of the costs associated with the BP spill. 

 The industry safety organization should ensure that all 

its constituents are early adopters. 

Factors for success 

The offshore oil and gas industry has long been subject to both government oversight 

and industry self-policing, but the Deepwater Horizon disaster suggests that the system 

was not working as well as it needed to. While strengthened oversight and regulation is 

one obvious remedy, there is also widespread agreement that government action alone 

is unlikely to be able to address the shortage of experience with and expertise in 

deepwater drilling that currently exists in the industry, at DOI, and in academia. Though 

DOI recognizes that it very much needs additional expert staff and has pledged to 

increase hiring, it seems naïve to think that the Department can outbid industry to enlist 

the best talent. When expertise is in short supply for industries that are both dangerous 

and highly technical, an active industry role in providing resources, disseminating 

information, and self-auditing or self-policing can serve as an important complement to 

government regulation. 

The discussion in this paper has drawn heavily on recent work by the Tobin Project, 

much of which could also usefully inform the design and organization of a new industryled organization to promote safety in offshore oil and gas exploration and development. 

Research published by the Tobin Project in 2009, for example, provides helpful 

assessments of past industry initiatives and their interaction with government institutions 

and regulations. 96

For example, the Tobin Project researchers conclude that five factors are particularly 

important to the effectiveness of regulatory frameworks that combine government 

oversight with industry self-policing : (1) the depth of concern for their reputation among 

regulated businesses; (2) the relevance of flexibility in regulatory detail; (3) the existence 

of sufficient bureaucratic capacity and autonomy on the part of non-governmental 
13

regulators;( 4) the degree of transparency in regulatory processes; and (5) the 

seriousness of accountability.97

With regard to the first of these factors, concern for reputation, one might expect this 

would be an important issue for the oil and gas industry since it could affect companies’ 

ability to expand into other, even more challenging exploration and production regions 

going forward. Other impacts of a safety failure might be even more direct: The 

Deepwater Horizon disaster stopped all drilling in the Gulf for a period of time and cost 

virtually all oil and gas companies involved in that region a great deal of money. Whether 

corporate memories of the disaster will prove sufficiently compelling and durable to 

motivate a lasting change in business-as-usual, however, remains to be seen. 

Flexibility, the second factor highlighted in the Tobin Project’s findings, will be important 

to the oil and gas industry’s response as the industry is very heterogeneous generally 

and encompasses numerous different types of rigs, drilling approaches, geologies, and 

operating practices. However, there are only a limited number of rigs at any given 

moment in situations that pose the safety challenges of the Deepwater Horizon. 

As for the third factor, autonomy, the industry’s safety organization could build 

bureaucratic capacity, but maintaining real independence from API and its member 

companies will be trickier. The Navy had to build autonomy into the SUBSAFE system 

by setting up “independent” bodies. INPO is successful in part because it has no links to 

a lobbying or PR organization and does not engage in these activities itself. API not only 

engages in lobbying and PR, but it feels a responsibility to operate by consensus, which 

means that it has opposed regulations that some companies objected to. API is guided 

by its members; INPO is not guided by the utilities and has no members.

The oil and gas industry’s new safety organization must be autonomous—from API and 

from any other industry organization—to be credible, and it must focus only on safety. 

However, an API task force may well have trouble recommending that the safety 

organization be independent of API. 

The fourth factor has to do with transparency. From the public’s point of view, INPO is 

not transparent, and indeed it is reluctant to share information with the government. 

However, it is very transparent among nuclear power plant operators, since the teams 

that audit a facility include personnel from other companies. This approach strongly 

facilitates cross learning, as does the annual meeting where scores are read out loud. 

The industry task force has stressed the need for increased auditing, but the recent API 

letter to the Commission indicates that “member companies, including contractor 

members, will choose a certified third party auditor and contract for their specific audits.” 

Using third-party auditors, however, would rob the industry of the chance to demonstrate 

that it is leading toward safety rather than being pushed by others; it would also tend to 

impede rather than facilitate effective peer learning and peer pressure. Issues of 

competitiveness would have to be managed, but process safety should be an issue that 

unites companies rather than being an issue on which they compete. 

The fifth factor for success identified by the Tobin Project has to do with accountability. 

As described in foregoing sections, INPO benefits from a rigorous process of 

accountability, which makes each CEO accountable to all the rest. 

Whatever the final parameters of a new safety organization for the oil and gas industry, 

CEOs should provide board leadership, as only they can obtain buy-in for a new ethos of 

safety and a new focus on improved operations at the highest levels of company 

management and down through the ranks. Since the culture of safety is always set at 
14

the top, only an organization led by company CEOs will send the signal that safety has 

become a top priority in a new way. 

 

1 Edward Balleisen and Marc Eisner, “The Promise and Pitfalls of Co-Regulation: How Governments Can 

Draw on Private Governance for Public Purpose,” in New Perspectives on Regulation, David Moss and John 

Cisternino, eds., New Perspectives on Regulation (Cambridge University Press, Cambridge, UK, 2009).

2 “Mission,” Federal Aviation Administration, http://www.faa.gov/about/mission/. 3 “Delegation and Designee Background,” Federal Aviation Administration, 

http://www.faa.gov/about/history/deldes_background/

4 “Designees and Delegations: Designated Engineering Representative (DER),” Federal Aviation 

Administration, http://www.faa.gov/other_visit/aviation_industry/designees_delegations/designee_types/der/; 

Nancy Leveson (MIT), interview with Commission staff, October 20, 2010. 5 “Delegation and Designee Background,” http://www.faa.gov/about/history/deldes_background/ 6 Leveson interview. 7 Leveson interview. 8 Nancy Leveson, Safeware: System Safety and Computers (Boston: Addison-Wesley, 1995), 556. 9 Leveson, Safeware: System Safety and Computers, 556. 10 Nancy Leveson, Engineering A Safer World: Systems Thinking Applied To Safety (to be published by MIT 

Press in 2011), 375, http://sunnyday.mit.edu/safer-world. 11 Leveson, Engineering a Safer World, 375-6. 12 Leveson, Engineering a Safer World, 380-381. 13 Leveson, Engineering a Safer World, 380. 14 Leveson, Engineering a Safer World, 380. 15 Leveson, Engineering a Safer World, 380. 16 Leveson, Engineering a Safer World, 373-388. 17 “Chairman Cox Announces End of Consolidated Supervised Entities Program,” Press Release, Securities 

and Exchange Commission, September 26, 2008; Stephen Labaton, “Agency’s ’04 Rule Let Banks Pile Up 

New Debt,” New York Times, October 3, 2008. 18 “Chairman Cox Announces End of Consolidated Supervised Entities Program,” Press Release, Securities 

and Exchange Commission.

19 Balleisen and Eisner, “The Promise and Pitfalls of Co-Regulation: How Governments Can Draw on Private 

Governance for Public Purpose,” 31. 20 Ibid., 130. 21 Ibid. 22 Ibid. 23 The Deepwater Horizon Incident: Are The Minerals Management Service Regulations Doing The Job?”: 

Hearing Before the Subcomm. On Energy and Mineral Resources of the H. Comm. on Natural Resources, 

111th Cong. 2 (2010) (statement of Eric Milito, Updtream Director, American Petroleum Institute) (“Seventyeight of these standards are referenced in Minerals Management Service regulations.”); For MMS 

rulemakings that incorporate industry standards into regulations over time, see “Oil and Gas and Sulphur 

Operations in the Outer Continental Shelf,”61 Fed. Reg.60,019 (November 26, 1996); “Oil and Gas and 

Sulphur Operations in the Outer Continental Shelf—Pipelines and Pipeline Rights-of-Way,” 72 Fed. 

Reg.56,442 (October 3, 2007); see also, Press Release, Minerals Management Service, “Minerals 

Management Service to Adopt the Latest Edition of Industry Standard on Fixed Offshore Production 

Platforms” (April 21, 2003), http://www.boemre.gov/ooc/press/2003/press4-21.htm. 24 Interviews with industry representatives. 25 Edward Balleisen and Marc Eisner, “The Promise and Pitfalls of Co-Regulation: How Governments Can 

Draw on Private Governance for Public Purpose,” 131.

26 Ibid. 131. 27 Joseph Stiglitz, “Capatilist Fools”, Vanity Fair, January, 2009. 28 “What is “certification”?,” Forest Stewardship Council-United States,

www.fscus.org/faqs/what_is_certification.php

29 “About Us,” Marine Stewardship Council, http://www.msc.org/about-us. 30 “Who We Are,” Responsible Care, http://www.responsiblecare.org/page.asp?p=6406 31Ibid.. 32 Jody Freeman, "Private Parties, Public Functions and the New Administrative Law" in Recrafting the Rule 

of Law: The Limits of Legal Order, ed. David Dyzenhaus (Toronto: Hart Publishing, 1999), 21. 33 Freeman, "Private Parties, Public Functions and the New Administrative Law," 33. 
15

 

35 Three Mile Island – Looking Back on Thirty Years of Lessons Learned, Before the Subcomm. on Clean Air 

and Nuclear Safety, 111th Cong. (2009) (Statement of Marvin Fertel, President and CEO of Nuclear Energy 

Institute). 

36 Testimony of James Ellis, Institute of Nuclear Power Operations, Hearing before the National 

Commission, August 25, 2010.

37 John G. Kemeny, Report of The President's Commission on the Accident at Three Mile Island: The Need 

for Change: The Legacy of TMI (1979), 68. The full subsection of the recommendation reads, “The industry 

should establish a program that specifies appropriate safety standards including those for management, 

quality assurance, and operating procedures and practices, and that conducts independent evaluations. The 

recently created Institute of Nuclear Power Operations, or some similar organization, may be an appropriate 

vehicle for establishing and implementing this program.” 38 “About Us,” INPO, http://www.inpo.info/AboutUs.htm. 39 Joseph V. Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island

(Chicago: University of Chicago Press, 1996), 50-51. 40 Lee Gard, interview with Commission staff, November 8, 2010. 41 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 57-58. 42 Ibid. 143. 43 Gard, interview. 44 Gard, interview. 45 Gard, interview. 46 Gard, interview. 47 Gard, interview. 48 Gard, interview.. 49 Lee Gard, e-mail message to Commission Staff, December 6, 2010. 50 Gard, interview. 51 National Energy Policy: Nuclear Energy, Before the Subcomm. on Energy and Air Quality, 107th Congr. 

(2001) (statement of A. C. Tollison Jr., Executive Vice President, Institute of Nuclear Power Operations).

52 Ibid. 53 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 76. 54 Alice Camp, “Nuclear: In Pursuit of a Renaissance,” EPRI Journal (Summer 2007): 20. 55 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 81. 56 Ibid. 53. 57 Ibid. 53 58 Ibid. 53-54. 59 Lee Gard, e-mail message to Commission Staff, December 1, 2010. 60 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 104. 61 Gard, interview. 62 Michael Golay, MIT, interview with Commission Staff, October 27, 2010. 63 Lee Gard, e-mail message to Commission Staff, December 1, 2010. 64 Michael Rencheck, AREVA Inc., interview with Commission staff, November 1, 2010. 65 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 104. 66 Golay, interview. 67 33 U.S.C. § 2210, 68 Lee Gard, e-mail message to Commission Staff, December 1, 2010. 69 Lee Gard, e-mail message to Commission Staff, November 15, 2010. 70 Lee Gard, e-mail message to Commission Staff, December 13, 2010. 71 “Oil Industry Needs Self-Regulation, Says Alternate Energy Holdings Inc. CEO,” Forbes Magazine, August 

26, 2010. 

72 Gard, interview. 73 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 57. 74 Gard, interview. 75 Gard, interview. 76 Rees, Hostages of Each Other: The Transformation of Nuclear Safety Since Three Mile Island, 96-97. 77 Ibid. 116. 78 Ibid. 111-117. 79 The Union of Concerned Scientists has on occasion faulted INPO (and the Nuclear Regulatory 

Commission) for not inspecting some plants with sufficient rigor and skepticism, and pointedly raised the 

issue whether the fact that industry pays for INPO’s services presents a conflict of interest that compromises 

its essential impartiality.
16

 

80 Testimony of James Ellis, Institute of Nuclear Power Operations, Hearing before the National 

Commission, August 25, 2010; INPO, 2009 Annual Report; INPO, 1994 Annual Report. 81 Testimony of James Ellis, Institute of Nuclear Power Operations, Hearing before the National 

Commission, August 25, 2010.

82 INPO, Performance Objectives and Criteria (May 2005); INPO, Principles for Nuclear Safety Culture 

(November 2004). 83 Jack Gerard, President and CEO, American Petroleum Institute, letter to the National Commission, 

October 29, 2010.

84 Testimony of Rex Tillerson, Chairman and CEO, Exxon Mobile, Hearing before the National Commission, 

November 9, 2010, 271.

85 Testimony of Rex Tillerson, 271-272. 86 Testimony of Marvin Odum, President, Shell Oil Company, Hearing before the National Commission, 

November 9, 2010, 299-301. 87 Testimony of Michael Bromwich, Director, Bureau of Ocean Energy Management, Regulation and 

Enforcement, Department of the Interior, Hearing before the National Commission, November 9, 2010, 227. 88 Testimony of Michael Bromwich, 228. 89 See, e.g., Federal Trade Commission, Report of the Federal Trade Commission on Activities in the Oil 

and Natural Gas Industries (June 2010), http://www.ftc.gov/os/2010/07/P082108oilgasreport.pdf. 90 Standard Oil v. United States, 221 U.S. 1 (1911). 91 Identifying what precise measures would be necessary, if any, to ensure that industry-wide efforts to 

promote safety do not violate antitrust laws is beyond the scope of this paper. 

92 Testimony of Rex Tillerson, 259. 93 U.S. Department of the Interior, Outer Continental Shelf Safety Oversight Board, Report to the Secretary 

of the Interior (September 1, 2010). 94 Testimony of Michael Bromwich, 232-233. 95 Oil and Gas and Sulphur Operations in the Outer Continental Shelf – Safety and Environmental 

Management Systems, 75 Fed. Reg. 63610 (October 15, 2010). 96 Edward Balleisen and David Moss, eds., Government and Markets: Toward a New Theory of Regulation

(Cambridge University Press, Cambridge, UK, 2009); David Moss and John Cisternino, New Perspectives 

on Regulation (Cambridge University Press, Cambridge, UK, 2009). 97 Edward J. Balleisen and Marc Eisner, “The Promise and Pitfalls of Co-Regulation: How Governments 

Can Draw on Private Governance for Public Purpose,” 131.