This 2011 paper from Andrew Hopkins discusses the function of management walkarounds, and their role in the genesis of major accidents, using the Macondo blowout accident.
*** Note: This type of description is replete with counterfactuals and the clarity of hindsight, so keep that in mind.
Overall, Hopkins argues that despite the best intentions of management walkarounds, managers can fall into the trap of routine OHS issues, like slips and trips, rather than major hazards.
At Macondo, seven hours before the blowout, four company VIPs helicoptered onto the drilling rig for a ‘management visibility tour’. Despite their focus on safety, their prior experience working as rig managers or drilling engineers, and the efforts of rig personnel, indicators of impending disaster were missed or misinterpreted.
Hopkins argues that while the visit was to emphasise the importance of safety, the VIPs “paid almost no attention to the safety critical activities that were occurring during their visit”. This was driven by the total of seven years without an LTI—something the VIPs wished to congratulate the crew for. Also, a recent slip injury elsewhere prompted an analysis of how this rig was managing that slip hazard.
Critical well testing was being undertaken on the day of the visit, with rig personnel engaged in discussions about how to do the test and the meaning of the results. The VIPs were made aware of these challenges, but the VIPs “asked no more questions about this and moved onto a social conversation about the history of the company”.
One of the VIPs later in the day asked the rig manager if the test had gone well, and after having received the thumbs up, his question “clearly invited the response he got. It was more a conversational question than a serious inquiry. He did not probe for evidence and simply accepted the reassurance he was given”.
The VIPs later informed that, as experienced in drilling and rig management, would have provided advice if they were asked, but they weren’t. Here, Hopkins says “There was no recognition that this was an opportunity to do some auditing, to check on competence of the people involved and to verify that they were complying with procedures that were critical to the safety of the well and the rig”.
Also relating to the well test and mud flows, made it “virtually impossible” to know how well the outflow from the well matched the inflow. But there were other opportunities to probe into the potential warning signs; with Hopkins arguing that had any of the VIPs asked how the rig personnel were actually monitoring flow, they would have realised that no effective monitoring was in place [** I think that’s a pretty big assumption, but whatever].
Further, Hopkins stresses that the VIP team were aware that the rig was in the process of removing one of the last safeguards against blowouts that afternoon, but still kept their engagement questions as more social and non-interventional, rather than probing into how safety was being managed.
He believes that there was good reasons why the VIP team should have been probing more deeply into the well processes. 1For one a near disastrous blowout had occurred in Transocean mere months before; so this could, or should, have been a pressing item for the VIPs to inquire about.
Explaining the behaviour of the VIPs
Next Hopkins takes a stab at explaining the behaviour of the VIPs, e.g. why it made sense for them to do what they did (or didn’t…)
These included:
1) “The VIPs appeared to focus their informal auditing activities on checking that certain conditions were as they should be, rather than checking on behaviours”. That is, they checked whether harnesses were inspected instead of observing and inquiring into the actions and decisions of staff in the critical well processes. This is explained via the ease of inspecting states or conditions—completed inspection records—compared to actions and decisions
2) VIPs were concerned with interfering with the activities. Also because rigs involve groups of professionals with clear responsibilities and hierarchies, they didn’t want to interject, or go around hierarchies by directly asking the workers about their understanding, competencies, decisions etc.
Here, Hopkins draws comparison to President Obama’s proclamation that government agencies should “trust but verify”, and that maybe senior executives should do the same.
3) The VIPs would really only directly intervene or stop work if they saw something extremely critical or dangerous – e.g. if they saw something dangerous “we might take the opportunity to have a conversation with them. But otherwise we don’t cross any barrier tapes and we don’t interfere’’.
[*** On #3, I think there’s a point here about the seemingly innocuous or banal looking dangers that blend into everyday work]
Differences between personal safety and process safety
Next Hopkins discusses the differences between personal safety and process safety. I’ve skipped a lot of this, but broadly occupational/personal safety are the generally higher frequency, but lower consequence hazards that result in slips and trips and other minor incidents [**but can also result in fatal and traumatic injury].
Process safety, often involving major hazard risks, more typically give rise to low frequency but high consequence events, and more typically major damage and multiple fatalities.
Drawing a distinction is important for several reasons – but a notable one is process accidents are rare and don’t contribute to workforce injury statistics.
One of the VIPs in the resulting inquiries said that his focus was on occupational safety, not process safety; “for him was about whether the job of pushing the button or turning the wrench had risks specifically for the person carrying out this action …. By implication, whether pushing the button or turning the wrench was the right thing to do in the circumstances, whether it might lead to an explosion, was not his concern”.
The VIPS shared this mindset – for them, the informal safety inspection/walkaround activity was focused on things that might result in personal injury – and “were not at all focused on major hazard risk and made no efforts to ascertain how well it was being managed”.
This “one-sided concentration on occupational safety … has been identified as a contributor to many previous process safety accidents, including the BP Texas City refinery disaster”.
Stopping the job
Next Hopkins discussed the false safety of stop work authorities. For one, previous examples where workers had stopped the work due to safety had stopped because there was a perceived risk to an individual. In contrast, “Witnesses at the inquiry were not aware of instances where drilling or other well-operations had been stopped for [major hazard] safety reasons”.
One of the operators had even felt uncomfortable about the simultaneous operations happening on the rig at the time, which made it difficult, if not impossible, for him to monitor the mud flows prior to the blowout. Nevertheless, this uncomfortableness wasn’t perceived as a reason for him to stop work, even though he knew about the stop work rule.
[** Again, because he didn’t conceptualise the uncomfortableness and poor mud readings as something requiring a stop work – it didn’t have a direct individual safety threat assigned to it.]
Explaining this point, Hopkins says there’s several reasons why the stop work policy doesn’t work in practice for major hazards. But relating to the rig that day, the “behaviour of the VIPs unwittingly reinforced this interpretation”. This is argued to be because, since the VIPs believed that stopping the work for them to inquire about safety and work practices was too important, the “subliminal message was that one would need a very good reason indeed to justify stopping the job”.
Hence, by the VIPs actively avoiding disrupting the work at all, and not interjecting with probing questions and the like, “the concern of the VIPs not to disrupt rig activities undermined the stop the job policy in the case of major hazard risks”.
A more effective senior executive safety inspection process
Next Hopkins proposes some ways that a walkaround may be more effective:
1) Prior to the visit, leaders should be aware of the major accident events that are plausible on the rig. If they’re not experts, then they should be briefed by an expert prior to attending – including some potential matters to discuss
2) Be across the controls that are supposed to be in place to prevent major accidents, and where possible, “seek to verify that one or more of these controls was working as intended”
3) When aware of major accidents and/or prior accidents, seek to learn how previous lessons have been transferred by probing safety decisions, designs and activities on the day
4) Given the criticality of some processes, like mud monitoring in well integrity, one of the VIPs should “have dedicated himself to observing this process. He would have discovered that it was not happening, and would have raised the matter immediately with the installation manager”
5) VIPs could inquire about what was happening on the rig before they arrived, to be able to take advantage of auditing/inspection opportunities. If they had done this, they would have learnt that well pressure testing was being completed while they were there.
As per #4, one of the VIPs could “have decided to monitor closely this testing process” and “would have asked people to explain at every step along the way what they were doing”.
While Hopkins appreciates that this is an “interventionist approach”, and it may slow down some work, “it may be a necessary price to pay if managers are to assure themselves that all is in order”.
In sum, it’s argued:
· “ Management-by-wandering-around is a widely recognised and advocated activity”
· These walkarounds aren’t always focused on safety, and even when they are, they need to be carefully planned in order to focus on the ‘right’ issues
· They also need to be calibrated to seeking input and feedback from workers, since “Very often they are the ones who know best that something is amiss”
· And finally, while the VIPs were asking questions and sampling details, “it was a biased sample – biased towards conditions rather than behaviours, and biased towards occupational safety”.
Author: Hopkins, A. (2011). Management walk-arounds: Lessons from the Gulf of Mexico oil well blowout. Safety Science, 49(10), 1421-1425.
My site with more reviews: https://safety177496371.wordpress.com
LinkedIn post: https://www.linkedin.com/pulse/management-walk-arounds-lessons-from-gulf-mexico-oil-well-hutchinson-yn7jc
SafetyInsights.org 
One thought on “Management walk-arounds: Lessons from the Gulf of Mexico oil well blowout”