1

Quantified Risk Assessment (QRA) the HSE offshore experience

A personal perspective prepared by Ian Whewell former Director of Offshore Division

of The UK Health and Safety Executive for the US Chemical Safety Board

Background 

QRA has been used extensively for many years by the UK Health and Safety Executive (HSE) 

and considerable work has been done on its appropriate use in regulating safety. It has been 

used particularly in the ‘major hazard’ types of industry such as chemical, offshore oil and gas 

and nuclear. In such industries the consequences of an incident are such that some means of 

enabling the levels of risk to be quantified and relative risks to be evaluated is essential when 

making regulatory decisions. 

For onshore sites the safety (as opposed to environmental) risks extend to the broader off-site 

‘societal’ area in addition to the population employed on the major hazard site. For this reason 

the first extensive use of QRA by HSE was in the nuclear industry where the need to have some 

means of identifying the relative levels of off-site risks was essential to enable regulatory 

decisions to be made on levels of risk control. The nuclear model introduced the concept of 

‘tolerable’ and ‘intolerable’ risk levels based on numerical analysis using QRA. The approach 

was subsequently extended to other industries where the off-site risks were considered such 

that the levels of risk to the surrounding population needed to be evaluated to reduce exposure 

or to provide criteria for encroachment. HSE published guidance on levels of societal risk to 

facilitate decisions on land use planning, and for many years this guidance represented a 

definitive view on acceptable risk levels and influenced thinking on what did or did not represent 

legal compliance in high risk industries. 

The incidence of events such as Flixborough in the UK in 1974, Seveso in Italy in 1976, Bhopal 

in India in 1984 reinforced the need to evaluate offsite risks and to control societal risks adjacent 

to major hazard plants. During the 1970s and 1980s QRA became increasingly popular as a tool 

not only for evaluating off-site risks but for evaluating on-site risks, i.e. risks to the working 

population on the site. Indeed as the levels of sophistication developed QRA increasingly 

became the method of choice for judging whether risks were being effectively controlled and 

whether measures had been taken to reduce risks as low as reasonably practicable (ALARP). It 

was in this environment that the Piper Alpha offshore disaster occurred, resulting in 167 deaths 

in what is still the world’s worst offshore accident. 

The Cullen Report and the Safety Case Regulations 

The Lord Cullen judicial inquiry into the Piper Alpha disaster revealed a number of catastrophic 

failures in the management and control of risk on the installation, and the subsequent report 

made 106 recommendations intended to prevent the reoccurrence of such an event. At the time 

of the inquiry there was considerable evidence presented to indicate that the hazards and risks 

on the Piper Alpha installation were neither understood nor had they been properly evaluated. 

The failure to properly manage risk was a critical factor contributing to the incident. It was clear 
2

that major hazard risks (i.e. those which posed a risk of multiple fatalities) were not being 

effectively managed and controlled because the assessment of those risks and hazards had 

been inadequate. A number of experts in QRA methodology gave evidence to the inquiry with 

the result that much of the emphasis was on its use as a primary tool for evaluating and 

controlling risk. 

To address the failures identified the Cullen recommendations proposed new regulations to 

replace the existing prescriptive regulations. In particular these regulations were to contain 

requirements to identify major accident hazards, to evaluate risks and to implement measures to 

reduce those risks to the lowest level that is reasonably practicable. Given the extensive use of 

QRA at the time of the Cullen inquiry and the evidence presented there was an implicit 

understanding that QRA should be used as the primary tool to demonstrate to the regulator that 

risks were being effectively controlled but, most importantly, controlled to as low a level as is 

reasonably practicable. This was reinforced by a specific legal requirement to carry out suitable 

and sufficient QRA with respect to certain measures to protect persons on the installation. 

Indeed the first edition guidance to the Safety Case Regulations specified a maximum 

‘temporary refuge impairment frequency’ an output which could only be determined by QRA. 

Early experience of QRA in Safety Case demonstrations 

Thus in the early days of the implementation of the Safety Case Regulations many of the 

regulatory discussions were characterised by complex arguments involving QRA ‘experts’ in the 

industry and in HSE. Many risk management and control demonstrations contained in Safety 

Cases were extensively numerical and often prepared by specialist consultant companies 

detached from the day to day management and control of installations. Increasingly QRA was 

being used to justify not only the adequacy of risk controls but reasons why additional risk 

control measures need not be implemented. In other words rather than QRA being used as a 

tool to progressively improve safety standards, it was being used to hold back the 

implementation of innovative improvements. This was exactly the opposite outcome to that 

which the ‘goal setting’ legislation intended. 

At the same time it became increasingly apparent that as a tool for accurately quantifying 

absolute levels of risk there were serious deficiencies. Variables and assumptions in the 

methodology meant that any two QRA ‘experts’ using the same basic data could arrive at 

different conclusions. The results therefore could be manipulated to achieve the desired 

outcome if required. The concern in HSE was that the numerical outputs from consultants 

rather than from the companies managing the installations became increasingly detached from 

the real world as the inputs did not fully take into account differing conditions on individual 

installations. 

The methodology was also frequently too theoretical to inform management risk control 

decision- making and there was often too broad an approach to enable effective risk control 

improvements to be identified. Indeed the identification of an overarching QRA ‘acceptable risk’ 

figure for an installation militated against any risk control improvements being willingly accepted 

by duty holders. There was an increasing belief that QRA alone could demonstrate ‘safe 

operation’ with aspects of risk control such as qualitative assessment and good engineering 

judgement relegated to minor contributions or not really featuring at all. QRA almost became a 
3

one stop ‘go, no go’ tool for deciding what was ‘safe’ and what was not. In short what was a 

valuable tool for assessing levels of risk in appropriate circumstances was being inappropriately 

applied, frequently to the exclusion of other risk assessment and evaluation techniques. 

The dawning reality 

As experience with the submission of safety cases built up the early doubts and concerns about 

the value of complex QRA within the safety case as, in most cases, the primary methodology for 

demonstrating ‘safe’ operations were confirmed. In addition it was apparent that the use of QRA 

to demonstrate legal compliance to show major hazard risks were ALARP, was consuming 

considerable resources both by companies submitting safety cases, and within HSE as the 

regulator. As the initial concerns about the value of such complex calculations within the safety 

cases were not reducing Offshore Division (OSD) of HSE began to consider options to address 

these concerns. 

Ironically the offshore industry also began to question the way that QRA was being used in 

safety cases. Because the legislation clearly mandated the use of QRA to demonstrate certain 

aspects of the safety case, the industry had initially decided to adopt the approach across the 

board and to use QRA as previously described to determine overall risks on the installation to 

establish ‘tolerable risk’. This, in itself, would not necessarily have been detrimental, but the use 

of specialist consultants and the high degree of complexity associated with a document which 

was intended to be accessible to, and to have a contribution from, the workforce, meant that the 

value of the safety case as a working practical document was undermined 

Discussions with the offshore industry and presentations at conferences by OSD sought to 

change the overly- heavy emphasis on QRA in safety cases, and to develop instead 

demonstrations of risk management and control based on good engineering practice and 

qualitative risk assessment. The reference to impairment frequency of the temporary refuge 

contained in the guidance to the Safety Case regulations was removed to help to clarify the 

intentions of the legislation. Nonetheless the legislation still contained a specific requirement for 

‘suitable and sufficient’ QRA with respect to certain demonstrations in the safety case. Despite 

an attempt in the guidance to clarify the extent to which it was necessary to use QRA many 

offshore companies continued to use the full rigour of QRA. 

At the same time it was clear that the requirement to demonstrate in the Safety Case that major 

hazard risks were ALARP was also pushing many offshore companies to prepare (or have 

prepared for them) complex QRA demonstrations. The HSE recognised that there was a lack of 

guidance and practical advice on the question of ‘so far as is reasonably practicable’ and its 

equivalent ALARP. This again was contributing to duty holders using full QRA as a fall-back to 

ensure compliance. 

The new approach to QRA 

As a first step, to clarify the requirements to demonstrate ALARP and to clearly indicate that 

QRA should not be the primary tool for such demonstrations, HSE published a suite of guidance 

for HSE inspectors which was simultaneously made available to the industry. The current 

version last updated in 20031,2,3 attempted to clarify the legal requirements to demonstrate 

ALARP. A key change to the approach was the specific emphasis on the role of good practice 
4

in establishing that risks had been reduced as low as reasonably practicable. Indeed QRA was 

not specifically mentioned in the guidance to emphasise that the ALARP demonstrations may 

be effectively made without the need for QRA to be used as the primary tool. 

In 2005 HSE took the opportunity to revise the Safety Case Regulations and in doing so to 

clarify the role of QRA within the safety case. The specific requirement to use ‘suitable and 

sufficient’ QRA within the safety case was removed and the demonstration requirements 

focussed not simply on ALARP but on the broader regulatory requirements which were then 

fully in place to support the Safety Case requirements. In effect, rather than an abstract 

requirement simply to demonstrate major hazard risks are ALARP, the duty holder is now 

required to demonstrate how the law is being complied with. The supporting legislation contains 

all the necessary requirements which, if fully complied with, will ensure the installation is being 

operated safely. 

The nature of the safety Case, therefore, is intended to change from what had become a very 

complex numerical analysis to a much more practical and user- friendly document giving 

increased accessibility to the workforce in particular. Equally important, the nature of the 

demonstrations should both enable input from the workforce and provide a much more focussed 

view of the situation and circumstances on each individual installation. 

It is important, however, to clarify that whilst the emphasis with respect to QRA has changed (in 

particular the way it is used in safety cases) it still represents a valuable tool in establishing 

levels of risk. However because of the variables, and at times its misuse, HSE’s view was that it 

should be integrated into the broader risk assessment approach and used more sparingly and 

with the appropriate caution. As an absolute measure of risk there are a number of issues, but it 

still represents a very useful tool for measuring comparative risk and to assist judgements in 

deciding options. OSD has published guidance4

 intended to clarify the role and status of QRA. 

The document contains the following statement: 

SCR92 tended to focus the attention of a duty holder on the extensive use of detailed QRA, 

frequently prepared by a specialist contractor on their behalf. This approach has been useful for 

advancing the understanding of risk on offshore installations, or from activities in connection 

with them. However, now that this understanding is more mature, it is suggested that risk 

assessment should now become increasingly focused on where it can add value (e.g. in 

evaluation of risk reduction options) rather than provided as “off the-shelf” assessment. Thus 

any risk assessment should answer the fundamental question of whether there is anything more 

that can be done to reduce the risk, while adding value. There is also a shift in focus from 

contractor-owned risk assessment back to management ownership. 

The document goes on to outline the staged approach to risk assessment and demonstrations 

of compliance, starting with a qualitative approach and moving where necessary and 

appropriate through semi quantitative to full quantitative techniques. This approach has been 

welcomed by the offshore industry as a more pragmatic methodology and has reduced the 

frequency of complex theoretical discussions based entirely on complex numerical analysis. 

This adds to the regulatory efficiency as well as being more cost effective for the offshore 

industry. In the UK QRA has, therefore, found its rightful place in the toolkit for risk control and 

reduction. It still has a key role to play, but no longer dominates as before. 
5

References

1. Principles and guidelines to assist HSE in its judgements that duty-holders have reduced 

risk as low as reasonably practicable. http://www.hse.gov.uk/risk/theory/alarp1.htm

2. Assessing compliance with the law in individual cases and the use of good practice. 

http://www.hse.gov.uk/risk/theory/alarp2.htm

3. Policy and guidance on reducing risks as low as reasonably practicable in Design. 

http://www.hse.gov.uk/risk/theory/alarp3.htm

4. Guidance on Risk Assessment for Offshore Installations. Offshore Information Sheet No. 

3/2006. http://www.hse.gov.uk/offshore/sheet32006.pdf