Andrew Hopkins Explaining “Safety Case”

1

Working Paper 87

Explaining “Safety Case”

This paper is an extended version of a talk given to the Joint Regulators Forum on the

Use of Performance-based Regulatory Models in the US Oil and Gas Industry, 

held in Texas City, Texas, September 21, 2012

Andrew Hopkins

Professor Emeritus, Australian National University, Canberra

Andrew.hopkins@anu.edu.au

April, 2012
Andrew Hopkins Explaining “Safety Case”

2

About the Centre

The National Research Centre for OHS Regulation (NRCOHSR) is a research centre within 

the Regulatory Institutions Network (RegNet) at The Australian National University

(Canberra), and operates in association with Griffith University (Queensland). The Centre 

monitors, documents and analyses Australian and international developments in work health 

and safety regulation and research, and related areas of regulation, and publishes a web-based 

series of working papers relating to work health and safety regulation. The Centre also 

conducts and facilitates high quality empirical and policy-focused research into work health 

and safety regulation, facilitates the integration of research into regulation with research 

findings in other areas of regulation, and encourages collaborating researchers to conduct 

empirical and policy-focused research into work health and safety regulation.

Address for NRCOHSR correspondence

National Research Centre for OHS Regulation

Regulatory Institutions Network

Coombs Extension, Building 8

Cnr Fellows and Garran Road

The Australian National University

Canberra, ACT, 0200

Email: nrcohsr@anu.edu.au.

Disclaimer

The views expressed in this paper are the author’s alone and do not reflect any formal opinion 

of the National Research Centre for OHS Regulation, the Regulatory Institutions Network or 

The Australian National University. They are provided for the purposes of general discussion. 

Before relying on the material in this paper, readers should carefully make their own 

assessment and check with other sources as to its accuracy, currency, completeness and 

relevance for their purposes.
Andrew Hopkins Explaining “Safety Case”

3

Introduction

The Presidential Commission of inquiry into the 2010 oil well blowout in the Gulf of Mexico 

(the Macondo blowout) dealt at length with the defects of the prescriptive regulatory regime 

operated by the MMS (Minerals Management Service).

1 The Commission heard evidence 

about goal-setting regimes that operate in other parts of the world, in particular in the UK and 

in Norway, and ended by making a strong recommendation that the US should “develop a

proactive, risk-based performance approach specific to individual facilities, operations and 

environments, similar to the “safety case” approach in the North Sea.” (p252). The safety 

case approach is quite familiar in Australia and has been adopted for hazardous industries in

many jurisdictions in this country, in particular, for the offshore petroleum industry.

Unfortunately, little progress has been made on the Presidential Commission’s 

recommendation, in part because the safety case concept is widely misunderstood in the US. 

This fact led me to think carefully about how to describe a safety case regime for US 

audiences. I have now done this twice, first in a book, Disastrous Decisions,

2

and second at a 

conference in the US organised by a combined group of regulatory agencies, wanting to

explore what might be involved in introducing the safety case approach in that country. This 

paper is an expanded version of that conference presentation. It is noteworthy that some of 

the critical contextual aspects of successful safety case regulation only become apparent 

when seeking to communicate with US audiences. This paper therefore emphasises features 

of safety case regimes that are sometimes taken for granted in the jurisdictions where they 

operate. The description draws particularly on UK and Australian offshore safety case 

regimes and sets out a model of what might be described as a mature safety case regime.

There are five basic features that will be highlighted in what follows. In laying out these 

features, I will comment on what this means for the US. The five features are:

 A risk- or hazard-management framework

 A requirement to make the case to the regulator

 A competent and independent regulator

 Workforce involvement

 A general duty of care imposed on the operator

A hazard-management framework

A safety case regime requires companies to adopt a systematic hazard management 

framework. This means they must identify all major hazards and develop plans for how these 

hazards will be managed. In particular, they must identify the controls that will be put in

place to deal with the identified hazards, and the measures that will be taken to ensure that

1 OSC (National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling), Deepwater: The Gulf

Oil Disaster and the Future of Offshore Drilling, Report to the President. January 2011. 2 Hopkins A	(2012) Disastrous Decisions: the Human and Organisational Causes of the Gulf of Mexico Blowout

(CCH: Sydney)
Andrew Hopkins Explaining “Safety Case”

4

controls continue to function as intended. This part of the safety case framework is already in 

place for many hazardous industries in the US. For instance for all process industries onshore, 

and that includes petroleum and petrochemical industries, the federal process safety 

management standard requires operators to have such a framework. The heart of the process 

management standard is the process hazard analysis, the first clause of which states:

The employer shall perform an initial process hazard analysis (hazard evaluation) on 

processes covered by this standard. The process hazard analysis shall be appropriate 

to the complexity of the process and shall identify, evaluate, and control the hazards 

involved in the process...

Any reader who examines the full text describing a process hazard analysis and who is 

familiar with safety case requirements will realise just how similar these requirements are.

One of the major changes to the offshore regulatory regime since the Macondo accident has 

been the adoption by the regulator of the API standard 75 that specifies a Safety and 

Environmental Management System or SEMS. This has a hazard analysis section similar to 

that described above, although not as detailed. In principle, therefore, the offshore petroleum 

sector now operates under the same general regulatory requirement as onshore process 

industries. Put another way, the US already has the first of the five elements of a safety case 

regime, both onshore and offshore.

Employee participation

A second feature of safety case regimes is that they provide for employee participation, in 

various ways. In particular, employers must facilitate employee participation in the 

development of safety cases, and the regulators who carry out site audits must consult with 

elected workforce representatives. These requirements are widely recognised as important, 

although there are often complaints from unions that they are not effectively implemented.

The US process safety management (PSM) standard also requires that employees be 

consulted in the process hazard analysis. The initial SEMS rule had no such requirement, but 

under SEMS II, which becomes effective on June 4, 2013, employees must be consulted in 

the development and implementation of the SEMS. Under OSHA policy, inspectors should 

consult with any employee representatives on site. To date there does not appear to be any 

such requirement for offshore inspections. In short the principles of employee participation 

are part and parcel of the onshore regime, and are developing in the new offshore regime.

A requirement to “make the case”

Although PSM and SEMS regimes have some of the features of the safety case approach, 

they fall short in important respects. A safety case is a case - an argument made to the 

regulator. Companies must demonstrate to the regulator the processes they have gone through
Andrew Hopkins Explaining “Safety Case”

5

to identify hazards, the methodology they have used to assess risks and the reasoning that has 

led them to choose one control rather than another. Finally the regulator must accept (or 

reject) the case.

While a safety case regime provides the operator with a license to operate, this is not true for 

either onshore or offshore process hazard regulation in the US. In the US, regulators do not 

evaluate and pass judgment of hazard management plans before allowing an operation to 

commence.

A safety case does not give operators a free rein in how they respond to hazards. They need 

to specify the procedures and standards they intend to adopt. Where an operator proposes to 

adopt an inadequate standard, a safety case regulator may challenge the operator to adopt a 

better standard. For instance, if an operator indicated in its safety case that it intended to rely 

on a manifestly inadequate standard, the regulator could challenge it to adopt the best 

international standards. However the success of this challenge may depend on whether or not 

the jurisdiction imposes a general duty on the operator to reduce risk as low as reasonably 

possible (see below), which would in effect mandate that operators adopt the best 

international standards.

One of the misconceptions in the US about safety case regulation is that it involves the 

abandonment of prescription. That is not so. A safety case requires that technical standards be 

specified and regulators can then enforce those standards. Moreover there remains room for 

prescriptive, government-imposed regulation. For example, regulations can specify the kinds 

of incidents that operators are required to report.

A competent, independent and well-resourced regulator

Many jurisdictions around the world have fallen into the trap of thinking that all they need to 

do to institute a safety case regime is enact the necessary legislation. This is a serious error. 

Safety case regimes have only functioned well when there is a competent, independent and 

well-resourced regulator. Importantly, the initial process of evaluating and accepting (or 

rejecting) a safety case requires a high level of expertise, if it is not to degenerate into a 

rubber stamp exercise.

A safety case regime will almost certainly fail where safety cases are not scrutinised by a 

competent regulator. A dramatic example of this is provided by the crash of a British Air 

Force Nimrod in Afghanistan in 2006.

3 The Air Force had prepared a safety case for the 

Nimrod which was totally inadequate and failed to identify the hazards that led to the crash. 

The safety case was not presented to an external regulator and was not subject to independent

challenge.

4 It was approved internally, without scrutiny, at a “customer acceptance

3 Haddon-Cave C, The Nimrod review, Her Majesty’s Stationery Office, London, 28 Oct 2009. 4 The importance of this	challenge function is discussed in Leveson, N, “The use of safety cases in 

certification and regulation”, MIT ESD technical report, 2011, website at

http://sunnyday.mit.edu/safer-world.
Andrew Hopkins Explaining “Safety Case”

6

conference”. As a result, its many errors and deficiencies went unnoticed. The accident 

review excoriated the Nimrod safety case as “a lamentable job from start to finish” and 

concluded that those responsible for it displayed “incompetence, complacency and 

cynicism”.5 The point is that without scrutiny by an independent regulator, a safety case may 

not be worth the paper it is written on.

A safety case regime also changes what it is that regulators must do when they make site 

visits. Rather than inspecting to ensure that hardware is working, or that documents are up to 

date, they must audit against the safety case, to ensure that the specified controls are 

functioning as intended. The outcome of any risk management process can be summarised in 

a bowtie diagram, or series of such diagrams. A good auditor will therefore find it useful to 

study the bowtie diagrams and check whether the controls indicated in these diagrams are 

indeed in place. Auditing in this way breathes life into safety case documents. Unless 

regulators are willing and able to do this, a safety case may be no more than a lifeless set of 

documents sitting on some inaccessible shelf, gathering dust. However, such auditing 

requires a sophisticated understanding of accident causation and prevention, which in turn 

means that safety case regulators need a high level of education. Regulators in a safety case 

regime must also be able to talk as equals to company risk managers. All of this means 

paying them much higher salaries than are traditionally paid to regulator staff. Competent 

safety case regulation therefore has very significant resource implications.

Recent comments attributed to the director of the US offshore safety regulator, James 

Watson, suggest that the agency does not intend to engage companies in the way that is 

necessary if a safety case regime is to operate successfully. According to columnist, Jennifer 

Dlouhy,

[H]e stressed that the lack of government audits [of the new Safety and 

Environmental Management Systems] is by design, to keep companies focused on 

their own safety. “We will do very few audits ourselves,” he said. “If the industry is 

relying on the government, they’re not going to be engaged in this thing. They’re just 

going to potentially let the government do some of the management.” “The last thing 

we want to do is manage these companies,” Watson added. “We want to see them 

manage themselves.”

6

A general duty of care

Most safety case regimes are supported by legislation that imposes a general duty on the 

operator to reduce risks “as low a reasonably practicable”, or words to that effect. This 

transfers the common law duty of care into legislated requirement.

This has important consequences. First, it provides leverage for regulators. If an operator 

wishes to adopt a procedure or a standard that falls short of good or best practice, the

5 Leveson, above n	4, p259 6 http://fuelfix.com/blog/2012/12/13/tougher-offshore-scrutiny-not-yet/
Andrew Hopkins Explaining “Safety Case”

7

regulator can reject it on the grounds that is does not reduce the risk as low as reasonably 

practicable. This additional leverage is the reason the fire protection standards on rigs in UK 

waters are higher than for those in the Gulf of Mexico.7

Second, the general duty is in effect a duty to do whatever is reasonably practicable to 

identify and control all hazards. An operator cannot claim to be in compliance just because it 

has gone through a hazard identification process, if that process is demonstrably inadequate 

and fails to identify and control hazards that a reasonable operator would have identified and 

controlled. This makes it relatively easy to prosecute companies for a violation of their 

general duty after a Macondo-style event.

Third, the general duty means that even if there is no directly applicable rule, operators still 

have a duty to manage risk. They must therefore maintain some reasonable level of risk 

awareness that goes beyond mere compliance. It is the general duty of care that raises a safety 

case regime above the blind compliance mentality that characterised the MMS regime.

8

The general duty of care is in theory quite imprecise, but there are numerous cases in which 

courts have had to decide whether the duty has been complied with. This case law gives fairly 

clear guidance as to what the general duty means in particular cases.

Interestingly there is a general duty under the US OSH Act. Section 5(a)(1) of the Act 

specifies that employers must provide a workplace that is ‘‘free from recognized hazards that 

are causing or are likely to cause death or serious physical harm.” This is radically different 

from the general duty to ensure safety so far as reasonably practicable. It appears to impose a 

duty on employers only when the hazard is actually causing harm or is likely to cause harm. 

For example, if workers are currently experiencing repetitive strain injuries or health 

problems, this general duty is potentially enforceable. However there are insuperable 

difficulties in applying this provision in dealing with major hazard industries. Such industries 

typically rely on defence in depth, that is, they deploy a series of controls or defences against 

the hazards of greatest concern. If one of these defences is foregone, or is not maintained, the 

risk of a major accident increases, but it may still be very slight. Therein lies the regulatory 

problem. It is only if the absence or failure of the defence makes an accident likely that the 

OSHA general duty applies. To give an example, it would be difficult to demonstrate that 

failure to live up to some good industry practice, such as the installation of automatic cutouts, 

was ‘‘likely to cause death or serious harm” (emphasis added), since with or without such 

automatic cutouts, death or serious harm is unlikely, because of all the other defences that

may be in place. However, if there is a general duty to reduce risks as low as reasonably

7 See the widely circulated paper by Bill Campbell, former Shell auditor, “Analysis of Cause of Explosion on

Deepwater Horizon, 24/6/2010”, p8 8 On this point see Hopkins (above n	2), pp140-144
Andrew Hopkins Explaining “Safety Case”

8

practicable, and if automatic cutouts are generally regarded as good industry practice, the 

regulator will have a strong case against an operator who fails to install them.

9

As if in recognition of this problem, there is a second prong of the OSH Act’s general duty 

clause, section 5(a)(2). This states that employers “shall comply with occupational safety and 

health standards promulgated under this Act.” Accordingly, OSHA has developed an 

extensive array of regulations which can be enforced under this clause. Much of OSHA’s 

enforcement activity relies on this aspect of the general duty.

The drawback of section 5(a)(2) it that it is always open to the employer to argue that the 

regulation does not apply in the particular situation. Attempts to enforce particular rules can 

therefore lead to endless legal disputes. For example, in late 2009 the US Occupational Safety 

and Health Administration proposed that BP be fined $87 million, over and above the initial

$21 million arising out of the Texas City refinery disaster. The new fines were for BP’s 

failure to implement certain risk reduction strategies at Texas City. BP’s lawyers contested 

the new fines on various grounds. One of these concerned the issue is whether existing relief 

valves should be required to meet a certain performance standard. The American Petroleum 

Institute had formulated the performance standard as ‘‘a recommended practice” (RP 520). 

BP stated that ‘‘as a recommended practice API RP 520 was not a mandatory standard in the 

refining industry”. It agreed to comply with the standard for new installations but not for 

existing ones. OSHA insisted that existing relief valves at Texas City should comply with the 

standard, on the grounds that it is ‘‘recognized and generally accepted good engineering 

practice” (RAGAGEP). BP countered that existing relief valves at most refineries across the 

US do not in fact comply and therefore this cannot constitute RAGAGEP. In short, BP 

resisted OSHA’s attempts to force Texas City to adopt the performance standard in question

on the basis that there was not a rule that unequivocally required it to do so.

10

On the other hand, where there is a general duty to reduce the risk as low as reasonably 

practicable, the ultimate issue for a court or decision-maker is no longer whether the rule 

technically applies, but whether the defendant has done all that is reasonably practicable to 

reduce the risk. In such circumstances the defendant will not be helped by arguing about a

legal technicality.

11

9 For a	more detailed and	very useful discussion see Baram, M, “Generic strategiesfor protecting worker	

health and safety: OSHA’s general duty clause and hazard communication standard”,	Occupational Medicine

11(1) 1996, pp69-77 10 For references,see Hopkins A,”Risk-management and rule-compliance: Decision-making in hazardous

industries”, Safety Science 49 (2011) 110–120, p116. 11

The Outer Continental Shelf Lands Act (OCSLA) under which the US off	shore regulator operates also

contains a	general duty provision,section 1348 (b) ,which states: “It shall be the duty of any holder of a	lease	

or permit under this subchapter to—(1) maintain all places of employment ... in compliance with occupational	

safety and health standards and, in addition, free from recognized hazards	to employees”.

This seems to combine both duties under the OSH Act, except that the requirement is to maintain the	

workplace free from recognised hazards, regardless of whether they are likely to cause harm. This would seem	

to be an absolute duty	which would make it	impossible to escape liability after an event like Macondo. There	

was no suggestion after the Macondo accident that BP be prosecuted under this provision; the Act appears to	

be a	dead letter in this respect.
Andrew Hopkins Explaining “Safety Case”

9

The meaning of ALARP

The general duty requires companies to reduce risks “as low as reasonably practicable”. This 

is inherently vague. The leading legal interpretation is that it requires adoption of effective 

precautions, unless there is a “gross disproportion” between the level of risk and the cost of 

taking particular precautions to reduce that risk. This is equally vague. In these circumstances 

courts may turn for guidance to current good industry practice or to current industry technical 

standards. Where operators have fallen short of such practices or standards, they will have 

difficulty arguing that they have reduced risks as low as reasonably practicable. On the other 

hand, compliance with industry practices and standards does not automatically guarantee that 

an operator has reduced the risk as low as reasonably practicable as it may have been 

reasonably practicable to use some other and safer method (see Martin v Boulton and Paul 

(Steel Construction) Ltd [1982] ICR 366 (QB)). Reasonably practicable is not a concept that 

can ever be given a fixed meaning, and what is reasonably practicable will vary from industry 

to industry, facility to facility, and over time as technology, standards and practices change.

There is however a school of thought that regards this approach as unacceptably arbitrary and 

subjective and has sought to introduce a more rigorous cost-benefit analysis (CBA). This 

depends on quantifying the risks, calculating the benefit of some risk reduction measure, 

usually in terms of the number of lives saved and the value of each such life saved, and then 

comparing the benefit with the cost of the risk reduction measure. If the cost outweighs the 

benefit, (or in some interpretations, is grossly disproportionate to the benefit) then risk 

reduction measure is judged to be not reasonably practicable.

This approach was championed by the regulator in the UK when offshore safety cases were 

first introduced.

12 However, there are insurmountable methodological and moral objections 

that have been raised against this kind of CBA. So much so that some commentators argue, 

not just that CBA should be treated as one among several matters to be given weight in 

decision-making, but that it should not be used at all. According to Heinzerling and

Ackerman:

Cost-benefit analysis cannot overcome its fatal flaw: it is completely reliant on the 

impossible attempt to price the priceless values of life, health, nature and the future. 

Better public policy decision can be made without cost-benefit analysis, by combining 

the successes of traditional regulation with the best of the innovative and flexible 

approaches that have gained ground in recent years.

13

One remarkable example of where this thinking can lead is provided by Harvard professor 

Kip Viscusi, who undertook a cost-benefit analysis of smoking. He concluded that states 

saved money as a result of smoking by their citizens! This was because smokers died early,

12 Health and Safety Executive, Reducing Risks, Protecting People: HSE’s decision-making process (HMSO),	

London 2001 <	www.hse.gov.uk/risk/theory/r2p2.pdf> 13 Heinzerling, Land Ackerman, F,	Pricing the Priceless: Cost-Benefit Analysis of Environmental Protection

Georgetown University Law Center, 2002.
Andrew Hopkins Explaining “Safety Case”

10

thus reducing the expense of providing nursing homes and other services for the aging. On 

the basis of this analysis he suggested that cigarette smoking should be subsidised rather than 

taxed!

14

A more pertinent illustration of the problem in the present context would be as follows. 

Economists argue that the value of life in different counties varies with the level of 

development. Viscusi calculates that around the year 2000, the value of life in Japan was

$9.7million while in Taiwan it ranged from $0.2 to 0.9million.

15 If we use the average of

these two figures for Taiwan, we conclude that the value of life in Japan is at least 17 times 

higher than the value of life in Taiwan. There were no truly impoverished countries in 

Viscusi’s list, but suppose we assume that the value of life, in a country like Nigeria is an 

order of magnitude less than in Taiwan. We conclude that the value of life in Japan is more 

than a hundred times the value of life in Nigeria. Consider now a multinational pipeline 

company trying to use cost- benefit analysis to determine how much to spend on construction 

and maintenance of high pressure gas pipe lines in populous areas. It would be justified in 

spending orders of magnitude less in Nigeria than in Japan, on the basis the value of life in 

Nigeria was orders of magnitude less than in Japan. This would surely be an ethically 

untenable conclusion.

There is no space here to lay out Heinzerling and Ackerman’s full reasoning. Suffice it to say 

it is extremely persuasive. Those who continue to advocate CBA need to be very certain that 

they can effectively counter Heinzerling and Ackerman’s arguments.

As a result of the methodological difficulties involved, the UK safety case regulator has 

retreated from CBA in more recent years and increasingly relies on good industry practice as 

a demonstration of ALARP.

16

It is important to highlight this retreat from CBA to US audiences. One of the objections that 

is sometimes made to safety case regulation in the US is that it allows employers to determine 

their own risk acceptance criteria and to impose risks on employees that might not be 

acceptable under more prescriptive arrangements. Clearly, to the extent that in the context of 

high hazard industries, ALARP has come to mean following good industry practices and 

standards, this is not an issue.

Summary

The preceding discussion identifies five elements of a safety case regime: a hazardmanagement regulatory framework; employee involvement; a requirement to make the case 

for safety to the regulator; a competent and independent regulator; and an operator general 

duty of care. The five are inter-dependent and a functioning safety case regime requires all

five. The first and second of these elements already exists in the US, but the other three are

14

References cited in Heinzerling and Ackerman ,	above n	14. 15 Viscusi, K, “The Value of Life” Discussion Paper 517, June 2005, www.law.havard.edu/programs/olin_centre/ 16 See a	more complete account of this retreat in Hopkins 2011, above	n	10
Andrew Hopkins Explaining “Safety Case”

11

missing. The US will never be able to claim that it has a safety case regime until these 

additional elements are present.

There are huge impediments standing in the way of reform in the US. The first is the political 

system, which many commentators agree is paralysed. The Congress is hopelessly divided 

and majorities have to be laboriously constructed for every controversial bill. Some of the 

elements of a safety case regime would probably require Congressional legislation, which 

vested interests would oppose, making the reform task very much more difficult than is the 

case in a Westminster system such as Australia’s.

The second problem is that the executive arm of government operates an Office of

Management and Budget which subjects all proposed new regulation to rigorous cost-benefit 

analysis and rejects proposals where it cannot be demonstrated numerically that the benefits 

outweigh the costs.

17 Quite apart from all the other arguments against CBA, it is notoriously 

difficult to provide a numerical demonstration of the benefits of a regulatory regime designed

to prevent rare events (see below). For this reason the methodology of the OMB militates 

against regulatory innovation.

The effectiveness of safety case regimes

What evidence is there of the effectiveness of safety case regimes? This is a legitimate 

question proponents of the safety case approach need to address.

There are huge difficulties in trying to assemble empirical data on the effectiveness of safety 

case regimes. One of the most significant is that that since major accident events are rare it is 

difficult to compile statistics that demonstrate trends. Probably the most serious effort to 

produce such data was made in 2006 in a report commissioned by the UK regulator – the 

Health and Safety Executive. The report addressed the effectiveness of the UK onshore safety 

case regime set up in 1999 under the Control of Major Accident Hazard (COMAH) 

Regulations. The report stated:

We found no direct evidence that COMAH is resulting in a reduction of the risk of 

major accidents. However as COMAH is designed to manage risks from rare events 

we would not expect to be able to see statistically robust evidence of an effect.

18

Given these difficulties, it goes without saying that quantitative cost-benefit analysis cannot 

be carried out. This means that where the government insists on a quantitative CBA as part of 

the justification for introducing new regulations it will be extremely difficult to overcome this

obstacle.

17 Baram, M, Chap 5	in Baram and Lindoe (eds)	Risk	Governance of Offshore Oil and Gas Operations, in press.	

OMB recognisesthat in some circumstances quantitative CBA is impossible and will listen to qualitative CBA	

arguments. But its emphasisis on quantitative CBA. 18 Fenning, N	 and Boath, M. Impact of the Control of Major Accident Hazards (COMAH) Regulations 1999.

Research Report 343. HSE 2006, p11
Andrew Hopkins Explaining “Safety Case”

12

The proponents of the safety case approach point out that we cannot wait until the evidence is 

conclusive. According to Wilkinson, a former UK safety case regulator,

It will be the historians of health and safety who will have the privilege of making 

that judgement [about the effectiveness of the safety case approach]. However, we do 

not have the luxury of time and we must make judgments as we go along.

19

In these circumstances we must fall back on the expert opinion. Wilkinson notes that “the 

near universal opinion of managers and most of the workforce at hazardous installations is 

that safety cases have been very successful.” His own experience is that safety case 

regulation has

 Improved understanding hazards and risk

 Enhanced knowledge of the technical and managerial controls required to manage 

them, and

 Improved oversight by the regulator

In a paper titled “Has the Safety Case failed?” Fitzgerald and Breen conclude, after an 

extensive discussion, that “the safety case has not failed. It is still accepted as the most 

effective way of managing major hazard industries. When properly applied it is indeed 

effective”.

20

Fitzgerald and Breen argue that criticisms can legitimately be levelled at safety case regimes, 

but these are all to do with implementation failures, and do not call into question the safety 

case fundamentals.

21

Conclusion

The US has been something of a slumbering giant when it comes to the regulation of the 

petroleum industry offshore, and to a lesser extent on shore. The UK moved to safety case 

regulation several decades ago following major accidents both on and off shore, and 

interested parties have been suggesting for decades that the US do likewise, to no avail. The 

Macondo accident therefore provided a window of opportunity for the advocates of safety 

case regulation. There has been widespread misunderstanding in the US of precisely what 

this involves and this paper is an attempt to lay out the elements of a mature safety case 

regime, with this in mind. Although there is interest among regulators in moving in this 

direction, the obstacles are great, and the window of opportunity provided by Macondo may

not remain open much longer.

19 Wilkinson, P, “Safety Cases: Success or Failure”, Presentation to the NRCOH, May 2002 p9 20 Fitzgerald, B and Breen “Has the Safety Case Failed?” Paper presented to SPE, Brisbane, October 2010, p15 21 Paterson concludesthat “while the safety case approach may remain the best option among the alternatives

(and especially detailed prescription), questions remain as to whether it	is as yet being	implemented as well as	

it might.” Paterson J, “Health and safety regulation on the UKCS: evolution and future prospects”, Chap 6	in	

Baram and Lindoe, above n	17, p	93
Andrew Hopkins Explaining “Safety Case”

13

Finally, although safety case regimes are an improvement on what went before, further 

improvement is possible. Modern accident analysis has demonstrated that an array of 

organisational factors needs to be attended to in order to reduce further the risk of major 

accidents

22. These factors are currently beyond the scope of safety case regulations. The next

iteration of safety case regulation will need to encompass such issues.

22 See Hopkins, above n	2,		pp140-151