Guidelines - Incident Investigation and Reporting

HSE PROCEDURE

Embedding HSE into our Business

Petroleum Development Oman L.L.C.

RESTRICTED Document ID: GU-612May-15 Filing Key: Business Control [Health Safety Environment & SD]Incident Investigation, Analysis and Reporting

Guideline User Note:

A controlled copy of the current version of this document is on PDO's EDMS. Before making reference to this document, it is the user's responsibility to ensure that any hard copy, or electronic copy, is current. For assistance, contact the Document Custodian or the Document Controller.

Users are encouraged to participate in the ongoing improvement of this document by providing constructive feedback.

Please familiarise yourself with the

Document Security Classification DefinitionsThey also apply to this Document!This page was intentionally left blank

i Document AuthorisationAuthorised For Issue

Document Authorisation

Document Authority(CFDH)Document CustodianDocument Controller

NAAMAN NAAMANYMSEMDate: 30/08/2008NIVEDITA RAMMSE5

Date: 30/08/2008NIVEDITA RAMMSE5Date: 30/08/2008

ii Revision History

iii Related Business Processes

CodeBusiness Process (EPBM 4.0)

iv Related Corporate Management Frame Work (CMF) Documents

The related CMF Documents can be retrieved from the Corporate Business Control Documentation Register TAXI. Contents

3iDocument Authorisation

4iiRevision History

5iiiRelated Business Processes

5ivRelated Corporate Management Frame Work (CMF) Documents

71.

91.Incident Investigation & Analysis

91.1Introduction

91.2The Initial Investigation (immediate)

101.3The Full Investigation

201.4Incident Reports

201.5Implementation of Recommendations

202:Ownership of Incidents

243: Organization and ToR for PDO Incident Review Committees

243.1 MD Incident Review Panel (MDIR)

263.2Directorate Incident Review Committees (IRCs)

284: Definitions and Explanation of Terms

365:INCIDENT REPORT TEMPLATES

36Appendix 1:High Potential Incident Reports

38Appendix 2:Non-accidental Death Reports

39Appendix 3:General Medium Potential Incident Report

48Appendix 4:Medium Potential Road Traffic Accident Report

59Appendix 5:List of Activity at time of Incident

61Appendix 6:Definitions of Incident Types

62Appendix 7:List of Immediate Causes

63Appendix 8:List of Underlying Causes

64Appendix 9:List of Facilities / Plant / Equipment

65Appendix 10:List of Injury / Occupational Illness

68Appendix 11: Examples Determining Environmental Incident Risk Potential

1.Incident Investigation & Analysis

1.1 Introduction

The purpose of conducting an Incident investigation and producing a formal report on the findings is:

To identify the direct, contributing and root cause(s) of an Incident

To prescribe and implement suitable actions to prevent recurrence of a similar Incident

To ensure that legal, PDO's and shareholder requirements on injury and Incident reporting are met

To protect against future unsubstantiated claims.The Incident investigation, reporting and follow-up process comprises a number of consecutive stages once the initial PDO Notification procedure has been completed. These stages are:

Initial investigation / information preservation

Formation of a full investigation team

The full investigation

Analysis of findings

Preparation, review and publication of the report (including recommendations for remedial action)

Implementation of action items

Follow-up to ensure remedial actions are completed.

Brief guidance is provided below on how to conduct an initial and full Incident investigation and how to complete the follow-up requirements.

1.2 The Initial Investigation (immediate)The Responsible Supervisor/ Investigation Team Leader responsible for staff or equipment involved in the Incident shall immediately take steps to preserve the site as it is immediately after the Incident and if this is not possible to make notes, take photographs or draw sketches of all relevant details.

The objectives of the initial investigation and site preservation are:

a) To ensure that the site is made safe and that action has been taken to identify the most obvious cause(s) of the Incident and protect against recurrence.

b) To collect and preserve initial information prior to the site being disturbed. This will normally include:

Identification of witnesses,

Documentation/procedures in operation at the time of the Incident,

Phase of operations, process condition, etc.,

Markings left by equipment involved,

Position of personnel and equipment,

Documentation of Emergency Response procedures immediately following the Incident,

Time of day,

Prevalent weather conditions.

Every opportunity should be taken to obtain photographs, statements, etc. during the initial investigation. Documentation such as 'Permits to Work' should also be collected and passed to the Investigation Team Leader.

Prior Planning includes the inclusion of the following

a) First Aid Kit

b) Camera

c) Journey plan

d) Fuel

e) Accommodation

f) Water

g) Charger

1.3The Full Investigation

1.3.1Determination of Investigation Level and Team Composition

Following the initial investigation, by the Responsible Supervisor, the full investigation team shall be formed. The level of investigation, reporting and team composition required for a given Incident is determined by the Potential Risk of the Incident. The Incident owner is encouraged to lead the investigation in order to demonstrate an appropriate degree of commitment.

Suggested team composition for each level of risk is included in the following table. Additionally, if specific expertise is required to adequately determine the root causes leading to the Incident, the Investigation team leader should contact the relevant Corporate (or Unit) Functional Discipline Head to participate, as advisers, in the investigation and analysis. For example, in transport and materials handling related Incidents, advice should be sought from the Corporate Functional Discipline Head for Transport TLM or MSEM/1 and for Health related Incidents, advice from MCC should be requested. Other assistance is also available from outside of PDO through various contractor organisations with experience in various types of Incident investigation. MSE department can assist in identifying suitable contractors if required. Table 3 - Investigation Team Suggested Make-up

Potential Risk ClassificationSuggested Minimum Investigation Team

LowSection Head, PDO Responsible Supervisor, Contractor Representative

MediumDepartment Head or Area Team Leader, Contract Holder, Contract Manager, Area HSE Adviser

HighDirector, Department Manager, Contractor CEO / Director, HSE Team Leader

These are suggested minimum team compositions. It is entirely up to the Incident owner to assign his investigation team based on the expertise of his personnel. The Incident owner is accountable to his Director and the Managing Director for the quality of his investigation and report. Normally a joint investigation conducted with any involved contractor is preferred; however, should a Contractor wish to conduct a separate investigation according to its own procedures and processes, then it is free to do so. In this case, it is strongly recommended that the Incident Review Committee reviews the Contractors' associated Incident report at the same time of the review of PDO's Incident review.

1.3.2 Investigation Timing

Investigations should take place as soon as possible after the Incident has occurred. The quality of evidence can deteriorate rapidly with time, and delayed investigations are never as conclusive as those performed soon after the event. Important evidence can be gained from observations made at the location, particularly if equipment remains as it was immediately after the Incident. In the case of fatal Incidents and Road Traffic Accidents, the scene must not be disturbed until permission is obtained from local ROP Senior Officers.

In this case the scene and all evidence should be preserved to prevent deterioration as much as possible.

1.3.3 Background information

Background is required on the following for most Incidents:

General Procedures and Standards for the type of activity/operation being carried out at the time. These may include departmental instructions, safety regulations, written instructions, permit to work, policies and contract scope of work.

Location plans and road maps etc.

Organisation charts showing local command structures and listing persons involved.

Responsibilities, experience and training of personnel involved.

Contingency plans / emergency response procedures.

Hazard management controls which should be in place according to the provisions of the Contract HSE Plan, applicable Safety Case(s), Hazard Control Sheets and Job Safety Plans.

1.3.4 The Investigation Process

General

In general the investigating team should consider the following points:

1. Confirmation of the potential severity and probability of the Incident happening again ( i.e. risk to PDO )2. The need to establish as many facts as possible to properly understand the events surrounding the Incident and, to establish the sequence of events.3. Where information is absolute fact this must be stated with supporting evidence. If any information is the result of supposition or a reasoned assumption then this must also be made clear. 4. The need to address the question of 'WHY' an act or condition was not recognised, or was recognised and tolerated. Keep asking 'why' until no more fundamental reasons or causes can be found. Try to establish not only the immediate causes, but also the underlying and root causes.

Immediate actions at the incident site:

Ensure the scene is safe for you to enter

The injured person needs looking after

Secure the incident scene

Isolate all machinery/equipment, make notes of status

Identify and preserve all physical evidence

Record details of the scene, photographs/video/sketches

Identify all possible witnesses

A structured checklist, in the form of a guide has been developed from various sources to help maintain the required breadth of inquiry. The scope of the investigation is divided into four areas:

Prevailing Environment

People

Organisation

Equipment

In each section a number of basic questions cover the general scope of the investigation, while the follow-on questions should be addressed where faults or unsafe conditions are found. The follow-on questions in some cases lead to one of the other general areas. The guide may also assist in identification and classification of causal factors for recording and analysis purposes.

There are at least eleven core areas of investigation:

1. The Injured person (IP)

You have to find out as much as possible about the injured person to be able to see the incident from his point of view. You have to be able to get inside his head at the time of the incident to be able to understand it.

One of the problems you may encounter is the IP is not immediately available, this results in you conducting the investigation and drawing conclusions prior to getting his version of events. Beware, the IP interview may put a whole new twist on events1. Name, age, service with the company

2. Medical condition and medical results

3. Experience in role doing at time of injury

4. What was he employed to do?

5. What activity was he doing when injured?

6. Was he authorised to do the activity?

7. Was he competent in conducting the activity?

8. Is there evidence of competency through training or instruction in the job?

9. How many hours had he worked that day?

10. How many hours had he worked that week?

11. Had he reported feeling sick or poorly?

12. Was he happy about doing the activity?

13. How many hours had he driven?

14. How many hours did he have to go in the journey?

15. Had he complained of problems relating to the activity or equipment prior to the injury being sustained?

16. What motivators were there for the employee to potentially break rules?

17. What is his character like?

18. What is his previous incident record like?

19. What is his training attitude like?

20. What is his attitude to rule breaking like and diligence?

21. Had he just changed roles recently?

22. Has he been doing the same job for many years?

23. What did he do before being employed by you?

24. Had he been inducted in health and safety and when?

25. What is the content and make up of the training received?

26. Can the company confirm through evidence the content of the training and instruction?

27. Can the company confirm through evidence the competency of the trainer or instructor?

28. Did the employee confirm he understood through testing?

2. The Equipment:

The equipment is often immediately blamed for the cause of the incident.. The equipment was faulty. the brakes failed.. the steering jammed

It is therefore essential to evaluate the equipments part in any causation of the incident itself

1. Record the serial numbers/number plates of all of the equipment involved in the incident to avoid confusion

2. Was the equipment the correct equipment for the task?

3. Visually check and record the state of the equipment at the scene

4. Record all such defects as found and make a judgement whether they occurred as a result of the incident or not Test and inspect the equipment to ensure it was in a good state of repair. Do so with someone who knows about the equipment as soon after the incident as possible

5. Was the equipment being used in the correct manner?

6. Review the servicing and maintenance records for the equipment

7. Review whether pre-shift checks had been conducted for the equipment, the results and any follow up

8. Identify the history of the equipment in relation to defects, complaints or previous incidents it was involved in.

9. Check if a cause of the incident was due to equipment not being used when it should have been

10. Check where equipment had not been used as required, that it was available to the employee11. If not available then check if employee raised it as an issue and if so what happened as a result

12. Was any PPE needed to use the equipment

13. Was the correct PPE being worn correctly

14. Identify if the correct PPE had been issued

15. What was the condition of the PPE

3. The Environment

The environment can have a significant influence on the causation of an incident. There are two types of environment

Static environment building layouts, road layouts, structures

Dynamic environment state of floors, road surfaces, spills, skid marks, lighting, heating, weather, animals, personnel, traffic etc

Static Environment1. Will change very little over time.

2. The investigation will need to record:

The workplace or road layout

Signage, road or walkway markings

Distances, to-from junctions, between machinery

Ambient conditions; machinery noise etc

Topography of surrounding area

Anything else nearby which may have a bearing on the incident; childrens play area etc

Dynamic Environment1. Dynamic environmental conditions are lost immediately after the incident. It is therefore of utmost importance to capture as much information on the immediate environment as quickly as possible.

2. For example in an RTA investigation traffic flows may be completely different at different times of day or even on different days.

The investigation will need to record:

1. Weather and lighting conditions at the time of the incident

2. Positions of related objects, bodies, debris

3. Positions of controls, status of equipments

4. Skid marks, spills, (or puddles),

5. Dust conditions

6. Ground conditions & the state of it

4. The Third Parties

Third parties are the other persons who were involved in the incident except the injured employee

Third parties are difficult to involve in our investigations as they either

1. Are dead

2. Are injured and in hospital

3. Have left the scene before our attendance

4. Are upset and do not want to talk about it

5. Are uncooperative as they do not want to incriminate themselves

6. Can not communicate in English

7. Embellish the truth to their own ends and means

In dealing with third parties remember:

1. We have no legal jurisdiction over them and can not force them to provide information

2. They may be in shock and so do not hassle them

3. Liaise with the ROP as much as possible to ascertain what they have managed to discover

4. Any information they give you is to be treated as hear-say

5. Remember the cultural differences which may be involved

5. The Other Parties

The incident could have been witnessed by other persons not directly involved in the incident

They can be useful to allow you to build up a mental picture of what has occurred and information can be collected informally

When collecting evidence from other parties be aware:

1. They may not be impartial to the persons involved in the incident (rig move staff, well engineers etc)

2. They may embellish what they have seen to make it more exciting, (who wants to relay a boring story)

3. What they think they saw may not in reality be true as it is their perceptions they are relaying to you

4. Collecting perceptions from a number of different witnesses allows you to make an informed judgement of the event5. You have no rights or jurisdiction on that person

6. They are volunteering information attempting to formalise it may make them withdraw

7. Chat with them, ask questions, be interested

8. Dont start making notes, write it down later

9. Distinguish facts from opinions

10. If using an interpreter, ask short questions, wait for the answers

11. Dont argue with them, if you or they are unclear act confused by the point, they may fill it in for you

6. The activity taking place at the time

The incident will always involve an event taking place at the specific time the injury or damage was caused

It is often very easy to identify the event which was taking place, it is more difficult to analyse the event and identify whether or not it was the correct event or was being done correctly

When identifying the activity determine the following

1. Was the activity part of the normal task conducted?

2. Would the activity appear to have been done correctly?

3. Is the activity difficult or complex?

4. Is the activity itself risky or dangerous?

5. Has the activity itself been documented and risk assessed?

6. Is there evidence of shortcuts been taken?

7. Is it an activity which is open to shortcuts?

8. Is the activity commonly conducted or a rare event?

9. Is the activity an every day occurrence in the field by other persons?

10. If so, can other persons comment on the shortcuts or problems in conducting the activity?

11. Are there any particular circumstances which might have led to the activity been done differently this time?12. Is the activity a relatively new activity or new equipment or has it taken place for many years?

13. What are the controls which should be in place as a result of the risk assessment?

14. Is there evidence that these controls were or were not in place?

15. Are the controls which are in place adequate for the level of risk posed by the activity?

7. The activity taking place before hand

Sometimes the activity taking place before the event is as crucial as the event itself

The activities prior to the event and even the day before enable you to understand more about the frame of mind of the injured person, his potential motivations and what led him to do what he did (if relevant)

The length of time analysed before the incident will depend on the nature of the event itself

1. Ask the injured person or persons with him to talk through the events of the shift from the start, clarify timings with the interviewee

2. Ask them what they had done on the previous shift and the time between shifts

3. Ask them to elaborate on anything which you feel could be of relevance to the investigation

4. Cross reference what they have described, involve other people to confirm that they have their facts correct.

5. Question any discrepancy between their account and that which you know to be fact or deviations from procedures, journey plans or other accounts.

6. Do not make them feel they are being cross examined, they will dry up.

8. Historical information

Sometimes during the investigation or interview you may find that this is not the first incident of this kind. Reviewing the findings of the previous investigation can add value to yours. Do not though assume the causation is precisely the same by default.

It may also be that discussions have been ongoing relating to a potential problem. If you can, review any minutes etc from these discussions.

1. Check with management if issues relevant to the incident have been raised before

2. Collect any evidence of such issues being raised

3. Follow the evidence trail of the issues raised in relation to who were involved, how they were involved, what actions were taken, what actions were not taken

4. Identify if, where actions were not taken, could they have prevented this specific incident if they had been

Check

1. Minutes of meetings

2. STOP cards

3. Near miss reports

4. Emails

5. Letters and memos

6. Complaints made or escalated

7. Ask people if the risk had been raised historicallyImportant note

Only raise issues in the report if they are directly linked to the causation of the particular incident you are investigating. Do not increase the scope of the investigation to other failures which are not relevant, they should be dealt with separately

Records and Procedures

1. Records such as 'as built' drawings, instrument records, computer printouts, log books, transport documentation and time sheets

2. Previous Audits and Incident investigation reports

3. What procedures exist for tasks being performed at the time of the Incident

4. Instructions and Procedures such as Permit to Work

5. If a Procedure was not followed, try to establish why it was not followed: was it not known; not fit for purpose or, was there some other reason

9. The hazard and risk equation leading to Root Cause Analysis

A risk assessment identifies the potential for an incident to occur. It identifies the hazard, something which has the ability to cause harm.

The risk is simply the likelihood that the harm will be released

An incident means the harm has actually been released Identify where a particular condition was over-riding in its impact or whether a combination of several conditions combined led to the hazardous situation arising.

Use the domino principle

Unsafe act by individual, competency, training and instruction, standards of supervision, management philosophy poor planning or design, deficient management policy, expenditure or high level decisions1. Work back from the known point of injury and identify the actual hazard which led to the injury or the damage being caused.

2. Identify the primary conditions which led to the circumstances where the person could be harmed etc

3. Identify the secondary conditions which led to the circumstances creating the primary conditions

4. Continue repeating this until such time as you hit the core conditions which enabled the chain of events to start

5. Note that several primary or secondary conditions can result which all need investigating and resolving as separate paths

6. For each condition or circumstance which contributed to the incident identify the combination of controls which could have been in place to prevent it arising

7. Identify if there was custom and practice where the official controls are ignored habitually

8. Now identify the different manner in which the controls which could have been in place can potentially fail and thus be nullified

9. Record the conditions, circumstances, possible controls and potential failures of such controls

10. Use the 5 Whys to try and find the answers and to keep digging down until you discover a root cause

10. Witness Statements

Witness statements can be vital in determining the outcome of the investigation.

Remember you are not interrogating the witness, you are trying to solicit information which will help you to piece together the chain of events.

They must be conducted in a timely and professional manner.

Try and collect statements in the following order:

a) Injured person

b) Witnesses

c) Line management

1. If the injured person is unable to be interviewed gather as much evidence as possible from witnesses.

2. If unable to interview the injured person ask him to write down whatever he remembers of the incident for you to review later.

3. Prepare for the interview, ensure you have privacy and any equipment/information you may need beforehand.

4. If the witness wishes to have someone present allow it but do not allow them to answer questions for the witness unless translating.

5. Identify the witness, make sure you have names, contact details etc correct.

6. Put them at ease, ask how they are feeling etc, explain the purpose of the investigation, (incident prevention) to them and introduce yourself, even if you know them.

7. Use a chart or sketch of the incident scene if necessary to locate the positions of all witnesses.

LISTEN to the witnesses, allow them to speak freely, be courteous and considerate. Let them put forward their version of events.

1. Try not to stop the flow, if you are unsure or the witness goes off track try to bring them back gently by asking them to explain a point in more detail.

2. Take notes and type the interview up as soon as possible, certainly before the next interview as you will not remember who said what later. Provide a copy to the witness if requested.

3. Word each question carefully and be sure the witness understands. Use a combination of open and questions.

4. Open to elicit information; what did you see?

5. Closed to clarify a point; did you see the truck?

6. Be sure to distinguish facts from opinions

7. Be sincere and do not argue with the witness.

8. Use the interview to attempt to clarify any points you are unsure of.

9. Not all people will react the same to a particular stimulus, a witness close to the event may have a completely different version to someone who saw it from a distance.

10. Stories may change with time and contact with other witnesses.

11. A traumatized witness may not be able to recall all the events

12. Witnesses may omit entire sequences for various reasons such as failure to realize their relevance, failure to observe, personal reasons, bias etc.

11. Chain of events

In any investigation it is always important to ensure that the evidence which you have gathered as part of the investigation can be relayed back to the actual incident.

All photos need to be date stamped and named and signed on the back by the person who took the photographs. Number each photo so they can be refered to in meetings by its reference number

Any notes or sketches which are made as part of the investigation should be kept in the investigation file and marked as working papers. Each page should be individually labelled, for instance WP1 or WP2 etc.

This is important as you may need this to clarify a statement you have made in the investigation report

Ensure all documents which you have collated as part of the investigation are also labelled for example E1,E2, E3 and then ensure that you label how many pages each document contains, e.g. page 1 of 2, page 2 of 2.

Keep all of your relevant documents together and order them in an investigation file so that they can be catalogued and create an index.

Create the investigation report in the required format calling on information which should be readily available from the investigation file.

1. Ensure an investigation file is created which has all of the supporting documentation from the investigation

2. Hazard and effects

3. Working papers

4. Risk assessments

5. Inspection records

6. Procedures

7. Previous incidents

8. Training records

9. Maintenance records

10. Employee records

11. Photos and sketches

12. Witness statements

13. Guidance documents

14. Health records

15. Pre-shift check records

16. Minutes of safety meetings

17. Previous complaints

18. Pass the file to HSE Dept on completion of the investigation.

Incident reporting Do not be ruled by the form ask other questions continually throughout the investigation.

Keep the purpose of the investigation in mind at all times, (prevention of re-occurrence).

Do not fall into the trap of immediately blaming the IP/employee and suggesting remedial training.

The objective of the low potential form is to carry out a simple investigation and provide meaningful corrective actions asap, as mentioned the form may be re-submitted if root causes cannot be immediately established.

Medium and high potential incidents require a more in-depth investigation.

Use the template provided for a full report, this will be going on the website in the next few weeks.

PDO require a Tripod beta analysis for all high potential and fatal reports. They will do it.

You will be being investigated by the ROP as well as investigating internally in most fatalities.

The construction of a diagram showing the connections between the various events and conditions leading up to the Incident - an Incident tree - has proved to be an essential tool in determining the underlying causes and conditions leading to an Incident.

For High Potential Incident & fatality investigations, a process known as Tripod Beta should be used to develop an Incident causation tree. Unit or Corporate HSE Advisers should be approached to assist in this. Tripod Beta uses a specific logic methodology which is extremely powerful in determining root causes of Incidents.

Preserving Physical EvidenceIn some Incidents components or equipment may be damaged or have failed. In these cases, the equipment should be lodged in a secure place pending more detailed analysis.

Conducting Interviews with Witnesses and Supervisors

Conducting Special Studies

Incidents of an involved or complex nature can require the analysis by specialists to determine causes of failure. Aircraft crashes, crane failures and explosions are examples of such Incidents. This should rapidly be identified and the specialists be involved early in the site assessment. Requests should be made to the appropriate Corporate Functional Discipline Head(s) to assist in the provision of such specialist support as required. The investigation team should ask whether the ROP or the relevant medical officer have conducted any tests to determine if alcohol or drugs may have contributed to the Incident.

'Rules of Evidence'

The investigation team leader must avoid the presentation of supposition as though it were fact. Whilst it may be appropriate, sometimes even necessary, to evaluate the most likely cause(s) of an Incident on the balance of probability, it must be avoided where the implication is that somebody specific was responsible for the Incident. In such situations, the investigation must limit itself to the facts. This is especially important if there is any possibility that criminal proceedings may result. Supposition or assumption should be clearly stated as such and not confused with fact. Remember that the main purpose of Incident investigation is not to assign blame to individuals.

Underlying causes and human factors

The initial stages in an investigation normally focus on conditions and activities close to the Incident and only Immediate Causes may be identified at this time. However, the conditions underlying these causes will themselves need to be investigated. As the extent of above physical factors surrounding an Incident become clear, the investigator(s) should shift the emphasis of their investigation and questioning to the underlying causes and to the reasons for peoples' actions. This will allow for ease of assessment when analysing the Incident. It may be necessary to take a closer look in the following areas:

Engineering design

Operating procedures and philosophies

Equipment selection

Planning methods

Job responsibilities and descriptions

Discharge of HSE responsibilities

Organisational relationships

HSE systems and Control systems

Training methods and experience criteria

Working/duty hours policies and practice

Internal safety inspections/auditing

Contract conditions and control

Maintenance procedures and records

Testing methods and records

Communication and availability of information

Abuse of alcohol or drugs

It should be noted that an investigation confined to immediate surroundings of the Incident will only be able to identify localised causes. Recommendations will therefore, only be able to deal with local problems and will not be effective in preventing similar Incidents elsewhere or involving other groups of workers carrying out different but related tasks. In all cases, systematic investigation should ensure that possible causes are considered both in the

range and depth appropriate to the Incident.

Analysis of findings and drawing conclusions

The purpose of the analysis stage is to identify critical sequences of events and to draw conclusions with respect to immediate and underlying causes.

Data may be in the form of:

Hard evidence: data which usually is not disputed such as written records, evidence of physical conditions, photographs of the undisturbed site, tests for alcohol or drugs etc. Witness statements from people present at the time of the Incident and immediately afterwards. Reports of tests carried out since the Incident. Circumstantial evidence: the logical interpretation of facts that leads to a single, but unproven conclusion.

Identification of recommendationsThe final list of recommendations for action should include AT LEAST ONE action against each identifiable cause. It should be noted that not all causes can necessarily be eliminated, and some may only be removed at prohibitive cost. Some recommendations will therefore aim at reducing a hazard to a minimum, practicable level, others at improving protective systems to limit the consequences.

Recommendations should be SMART : Specific; Measurable to the extent that it is clear when they have been implemented; Achievable, Relevant to an identified cause (immediate or underlying) and have a Target completion date assigned. Statements such as the following are expressions that DO NOT satisfy these requirements!

'Drivers should take more care......

'Supervisors should ensure that

'The rules for..... should be followed.'

'More attention should be given to......

Recommendations should be structured corresponding to the failed barriers. Description of actions should be worded in such a way as to clearly indicate how the Incident follow-up coordinator will know when the action is complete.

The wording and target due dates for each action shall be agreed with each assigned action party before the report is submitted to the relevant review committee. If agreement can not be reached then this difference in opinion must be highlighted to the appropriate review committee who shall decide if the recommended action is valid or not.

Recommendations should generally be restricted to the key issues which contributed to the Incident being investigated. They should address actions which are necessary to ensure that failed or missing controls or barriers, which would have prevented the Incident and/or reduced the consequence, are in place in the future. The reason for this is to sharpen the focus on the specific learning points from the Incident. If other areas for improvement, which did not have a significant impact on the specific Incident, become apparent during the investigation process, then these should be communicated to the relevant person for action outside of the Investigation report as part of PDO's normal business process.

1.4 Incident Reports

The degree of reporting required in the event of an Incident is determined by the potential severity of the Incident and the probability of a similar Incident re-occurring. Refer to the Incident HSE Risk Matrix

Reporting of Low Potential Incidents, is limited to a completely and accurately filled out Notification form - either a Health and Safety Incident form or an Environmental Incident form.

All other Incidents require a more formal Incident Report in addition to the Notification. Two different types of Incident Report exist for Medium Potential Incidents - one for each of the following types of Incident:

Guidance on completion and routing of general Incident Reports is also provided in Appendix 3A more comprehensive and detailed report is required in the event of a High Potential Incident. A template for such a report is also provided in Appendix 1.

A simplified report is required in the case of a non-accidental sudden death of a person employed by or on contract to PDO. A template for this special report is also included in Appendix 2.PDO's medical department can assist in the completion of this report.

1.5 Implementation of RecommendationsImplementation of action items must be formalized for effective follow-up. All actions must be tracked through FIM. In addition, it is necessary to inspect/audit at periodic intervals to ensure that improvements have been sustained.2:Ownership of IncidentsIncident ownership is a term used to designate PDO single point responsibility for ensuring that an Incident is investigated, reported and followed-up according to the requirements set out in this document. Ownership is first assigned to a PDO Responsible Supervisor and then delegated to the appropriate level within that Line for action. The organisation Line in this respect refers to PDO's reporting Line from MD to Director to Line Manager to Department Head to Section Head, etc. Within any given organisation Line, certain individuals are designated as Asset Managers, Contract Holders, Site Representatives, etc. in line with the Asset Management or Contract Holdership responsibilities.

There are two types of Asset Managers Product Flow Asset Manager and Service Provider Asset Manager. There are also Process Owners e.g. UEOD for Engineering and Operations Processes, Risk Advisors/Managers e.g. MSEM for HSE Risk and Skills Pool Managers (CFDHs). Each Manager is directly accountable to the MD for the performance and development of his/her asset including staff resources, however various assets are organisationally grouped together under a Director who is responsible for the group of Assets under his/her control.

From time to time, depending on the activity, an Asset Manager (AM), such as a product flow AM, may grant authority over a defined portion of his assets to another AM, such as a Service Provider who then becomes an Asset Custodian. The Asset Custodian then assumes full responsibility, on behalf of the Asset Manager, for all activities and assets within that defined area.

The Service Provider AMs provide common services to support primarily the product flow Asset Managers. These services include drilling, logistics, seismic, finance, telecommunications, etc. Some of these Service Provider departments are organised within the same Directorate, or Line, as the Asset Managers and others are organised into separate Lines such as the Drilling Engineering and Exploration departments.

All Incidents are required to be investigated and reported, according to this document, ultimately to MD who in turn is required to report elements of PDO's corporate performance to PDO's shareholders according to separately agreed requirements. The designation of Incident ownership within PDO is therefore a structural means by which PDO may systematically investigate, report and follow-up any HSE Incidents which occur in the course of running the business. The ultimate aim is to manage PDO's activities in line with the corporate policies.

Line Incident ownership is determined according to the following criteria which are aligned with PDO's structure of Asset Managers and Service Providers. Incident ownership should normally rest with the reporting Line which has most influence over the site or activity.

The purpose of defining clear criteria for Incident ownership is to ensure that in every event, clear rules will always lead to positive Incident ownership immediately after the Incident so that no time is lost in carrying out the investigation. It is understood that the criteria below may not always be the most fair in light of the prevailing circumstances. However if the rules are applied consistently and immediately, the benefit will outweigh any harm.

a) If the Incident, excluding transport related Incidents, occurred within one of the

following Asset Manager areas of operation, then ownership rests with the reporting Line of that designated Asset Manager: any interior operational facility, installation or Operations asset such as:

plants, pumping & compression stations,

well sites,

PDO & Contractor interior offices, camps, workshops & recreational facilities,

flowline or pipeline rights of way, etc.

any area of common use within the physically fenced coastal office and industrial area

b) If the Incident, excluding transport related Incidents, occurred within an area where holdership was temporarily transferred, in a written agreement, to an Asset Custodian, then ownership rests with the reporting Line of that Asset Custodian. This would normally apply to any:

drilling and service rig locations and associated camp sites,

seismic operational areas and associated camp sites,

supply warehouse and storage areas

green-field construction sites

fenced off or access controlled areas of existing facilities where only construction or

maintenance activities are underway

interior contractors' facilities where only one PDO Contract Holder or Service

Provider is designated as accountable for those facilities

PDO School and Ras al Hamra Recreation Centre

defined areas within the Main Office complex.

c) If none of the above criteria are definitive, still for non-transport related Incidents, then Incident ownership rests with the reporting Line responsible for supervising the activity during which the Incident occurred. This rule shall then apply unless the involved parties have a documented agreement in place which clearly defines alternative roles and responsibilities. Such a documented agreement may take any form (e.g. a corporate procedure or an agreement covering the supply of labour from one party to another) provided that it clearly states respective roles and responsibilities and, is accepted by both parties.

It is therefore important for all parties who make such agreements to keep copies of the agreements in case there is a dispute.

For all transport related Incidents (except milk run journeys without a single contract holder as described in item 5 below), PDO Line ownership rests with the reporting Line of:

the person in control of each vehicle at the time of the Incident if that person is directly employed by or seconded to PDO, or

the Contract Holder of the relevant Contract in control of each vehicle at the time of the Incident.

If more than one PDO reporting Line is involved then Line ownership rests with the PDO reporting Line which suffers the most severe injury, or the most damage if no injury is sustained, as a result of the Incident. In the remote instance that all injuries and damage are equal then MSEM shall assign Incident ownership based on his perception of which Line had most influence over the activity or site at the time of the Incident. In the absence of MSEM, the acting MSEM shall make this decision and this decision shall be final. In such an instance, the Incident should be investigated and reported jointly with participants from each of the involved Lines and with the Incident Owner leading.

d)A special procedure exists if a transport related Incident occurs during a "milk run" journey where one journey was being used to supply or service more than one site or contract, whether for PDO, a PDO active Contractor or a third party and where there is no single Contract Holder or manager accountable for that journey. For the purpose of determining Incident ownership, the journey shall be divided into discreet sections. Each section shall have a beginning or "dispatching" location and an end or "receiving" location. Each journey section shall progress from departure from the dispatching location until arrival at the next receiving location. Incident ownership for each section of such a milk run journey rests with the reporting Line of the Asset Manager or Service Provider (as described in items 1, 2 and 3 above) which has the most influence on that section of the milk run journey. To avoid debate on the significance of the degree of influence, for the purpose of determining Incident ownership, dispatchers are considered to have more influence than receivers. Therefore, Line ownership rests with the reporting Line of the dispatching location of the relevant section of the milk run journey.

Incident ownership for the first section of such a milk run journey, from the home base to the first receiving location, also rests with the reporting Line of the first receiving location. This also applies if the first location is a supply warehouse or yard such as at MAF. If the Incident occurs on a section of the journey where the last dispatching location was a third party or non-active Contractor, then for the purpose of determining Incident ownership any third party or non-active Contractor location shall be ignored and ownership shall flow through to the last PDO or active Contractor dispatching location.

An example of the above procedure is shown in the diagram below with the arrows showing the journey sections and direction of travel and with the Incident owners shown in bold italics beside their assigned sections of the journey. Where an agreement is also in place as defined in items 1, 2 or 3 above, then ownership for each section of a milk run journey would also pass to the asset custodian or service provider who required the supplies or services to be brought to their respective locations.

Figure G1 - Milk Run Journey Incident Ownership

It is important to note that this determination of Incident ownership shall not affect the well established journey management system where the journey manager is fully responsible for planning the entire journey wherever he is located.

e) Once Line Incident ownership is determined, the authority level within that Line at which Incident ownership normally rests is determined on the basis of Incident potential according to the HSE Risk Matrix reproduced in Figure G4 below. Three levels of authority exist to cover the three classes of potential risk to the Company Director level, Department Head / Area Team Leader level and Section Head Level.

Figure G1 - Incident Ownership Level of Authority

Potential SeverityLimit to Delegation Incident Owner

LowResponsible Supervisor

MediumHSE Team Leader

High (without fatality)Manager

High (single fatality)Director

High (multiple fatality)MD

Although the entire generic matrix is shown for completeness, for practical purposes columns A and B will rarely if ever be applicable for potential risk assessments. Also, a potential risk of 0 is irrelevant and therefore row 0 shall never be used in this context. Most PDO Incidents then will fall in the range between severities 1 to 4 and probabilities C to E.

The person identified as the normal Incident owner in Figure G1; however, has discretion to delegate responsibility for investigation, reporting and follow-up according to his / her assessment of the merits of the learning value for the case in question and according to the specific capabilities of his available personnel. It must be emphasized that the Incident owner is still accountable for the quality of this work. The limit to delegation is determined on the basis of Incident actual outcome, not potential outcome, as follows:

Table G2 - Limits to Delegation for Investigation

Actual SeverityLimit to Delegation

0, 1 & 2Responsible Supervisor / Section Head

3Department Head

4Manager

5 Director

Investigation and reporting of a non-accidental death may be delegated to the Section Head level provided that there are no apparent unusual circumstances surrounding the death.

Example

A driver was rushing to return to his camp at the end of a long day. At a distance of 40 km from his destination he rolled his vehicle over. He received a minor injury which subsequently received First Aid treatment. He was lucky in this respect because he wasn't wearing his seat belt and had no other passengers with him. He was found by another road user some 30 minutes after the Incident.

There is a reasonable chance that the driver could have been killed and, of a similar Incident happening again if nothing is done to prevent it. This type of Incident happens more than five times per year within PDO but less than five times per year in that area or with that rig. Using Figure 4, an Incident Potential of 'D4(People)' is proposed by the Incident Owner. Upon early review of the initial notification, the Director learns that the circumstances of the Incident closely resemble those of an Incident six weeks earlier, for which a thorough investigation had taken place and, various recommendations implemented. Little benefit would be gained by the Director leading the investigation into this Incident, so he elects to delegate. Given that the actual outcome was a First Aid Case (Severity 1), the lowest level to which the Director may delegate responsibility for leading the investigation & follow-up, is to the Responsible Supervisor level.3: Organization and ToR for PDO Incident Review Committees3.1 MD Incident Review Panel (MDIR)

3.1.1Description

The following describes the Terms of Reference and operation of the Managing Directors Incident Review Panel, as reiterated in PDO Management Circucular: Rev 1, dd 11/03/20073.1.2 Objectives

The MDIR is principally concerned with preventing the recurrence of incidents via the cascade of action items across PDO and Contractor operations, and to act as a forum that allows MDC to hear, at first hand, HSE views from the workforce. It also enables MDC and Contractor CEOs to assure first line Supervisors of their support for continuous HSE improvement and to raise the importance of effective first line supervision. 3.1.3 Participants

Table G3: MDIRC Participants

Regular AttendeesMD, DMD, OPAL Representative, MSEM, MSE5

PDO Attendees by invitationAppropriate PDO Director, Contractor Holder, Line Supervisor, Asset Managers

Contractor Attendees by InvitationContractor MD, first line Supervisor, HSE Manager

Others by InvitationPersonnel invited by Asset Manager or Contractor MD where appropriate

3.1.4 Location and Meeting Frequency

The review will take place on Monday afternoon 2 weeks of the incident happening in the Board Room, starting at 13.15hrs and lasting up to 30 minutes per item. Before coming to the MDIRC the LTI will have been reviewed with the responsible PDO director.3.1.5 Preparation

The preceding Wednesday, MSE/4212 will issue the agenda and timing for the review. Relevant Director, Line Manager, Incident Owner and Contract Holder (when applicable) will be advised.The preceding Saturday, the Incident Owner shall issue the pre-reading material to MSE/5, who will review and forward to the MSE/4212 for submission to MDIRC members.3.1.6 Agenda

The Incident Owner will be the secretary for the incident during the review. He will identify those action points with clear lateral learning value for company-wide cascade. MSE/5 will facilitate this process and ensure the learning are cascaded appropriately.Lessons learned from the review will be published on the HSE website and email sent to all Directors and HSE Team Leaders. Directors and line managers will be required to cascade these lessons within their organisation, and OPAL Representative will cascade same lessons amongst its members via copy of the weekly highlights.

3.1.7ReviewMDIRC will review all LTIs in addition to fatal and high potential incidents.

Besides MDIRC permanent members, the appropriate PDO Director, Incident Owner, Contract Holder and line supervisor are required to be present in the review. The Contractor MD will be invited by the Contract Holder, where contractor staff is involved. Line Director or Contractor MD can invite other personnel where they feel this is appropriate.

3.1.8 Meeting Format

The format of the review remains a round table, with a short presentation by Line Manager or Contractor CEO. The presentation package shall be as per the templates provided (Medium potential LTIs and High potential/fatalities), with the presentation taking no more than 5-10 minutes, allowing 20 minutes for discussion. Incident reports are not required to be submitted at this time, but should be completed within 3 weeks of the review and copied to MSE/421 who will ensure the actions and report are input into FIM.3.2 Directorate Incident Review Committees (IRCs)

Each directorate will continue to have its own Incident Review Committee (IRC), which will function in line with foregoing MDIRC scheme, as follows:

Each IRC will review LTIs and medium potential incidents that occur within its business area in the preceding week. To ensure coherence, some IRCs may be set up on the basis of Work Practitioner Groups, e.g. DOIRC, XIRC, etc. The Director will appoint a focal-point for each IRC who will be responsible for co-ordination of the IRC meetings and ensuring LTI Briefing Packs are prepared within 10 days of the review to cascade lessons across the company. LTI Briefing Packs will only be issued company-wide by MSE/43 after review to ensure quality and consistency. MSE/43 will provide standards template for the packs.

Minutes of the IRC and action items shall be copied to MSEM and MSE/5/421. The intention is to continue to hear views from the workforce, raise the importance of the first line supervision and assure supervisors of MDCs and CEO's support for their HSE tasks. Victimisation is neither allowed nor intended and the reviews will therefore be carried out in an atmosphere devoid of fear.

1.2.1Committee Establishment

The Directorate IRCs are established in PDO:

OSIRC (OSD)

ONIRC (OND)

DOIRC (TWM)

TSIRC (TSD excluding TWM)

HIRC (HD)

XIRC (XD)

FIRC (FD)

GIRC (GD)

1.2.2 Composition

Each directorate shall define the permanent members of their IRC, but they will typically be:

The unit director (chairman), who may delegate no lower than a line manager

2-3 Senior department heads (one of which will be vice chairman)

Unit HSE Advisor or Focal Point (facilitator, should have attended Tripod-B Incident Investigation Course)

Senior representative of the contractor community (optional)

MSEM representative

Other ad-hoc attendees could be invited for specific reviews (e.g.: TTO/13 for lifting operation incidents, MSEM/15 representative for review of any RTAs) In case of absence, permanent members shall ensure a suitable delegate attends the IRC to replace them.

1.2.3 Responsibilities

The IRCs prime responsibilities are:

To review the following classes of HSE incidents for which the directorate is owner, in accordance with this Procedure

High potential near misses (actual severity 0)

Actual severity 2/3 and medium potential

Actual severity 4/5 and high potential incidents which have first been reviewed by MD-IRC will have a final review and close out by the relevant Directorate IRC.

To ensure consistently high quality incident investigation by the line

To review incidents to a level of detail commensurate with incident potential severity, as determined from the Incident Potential Matrix.

To review and endorse the actual severity and potential risk rating provisionally assigned to each incident.

To endorse corrective and remedial action items to prevent reoccurrence of similar incidents. To assign appropriate action parties and deadline for close out. Note: assigned action parties outside the Directorates direct control shall formally agree to accept the action item.To define the lateral learning items that are to be communicated to others and ensure their rapid and effective promulgation.

1.2.4 Meetings

Meetings may be held weekly at a fixed day/time, and could take place in the interior where incidents occur. However, if no incidents occurred, the unit Director can decide to cancel the meeting. Directorates that, due to the nature of their operations, have relatively few incidents, a monthly or 2-weekly period is acceptable.

A typical IRC agenda could include the following items (at the discretion of the unit Director):

Review status of LTI reports and action items for the directorate

Review of new HSE Incidents

Learning from MDIR and other IRCs

An incident should be reviewed within 2-3 weeks of the incident occurring. For an incident to be reviewed by the IRC, the investigation and draft final report shall be completed and issued to all IRC members prior to the meeting.

Incidents that have first been reviewed by MDIR shall be reviewed by the Directorate IRC (from which the incident originated) within 2-3 weeks of the MDIR session. The incident investigation and report (taking the MDIR proceedings into account) shall be completed before that time.

1.2.5 Lessons Learned

Lateral lessons from each IRC session should be prepared and issued within one week of the meeting. Records should as a minimum include the following for each incident that has been reviewed:

Incident reference no.

Actual Severity

Potential

Brief incident description (including details on the consequences to People, Assets, Environment and Reputation)

Immediate and Underlying Causes

Actions to prevent recurrence (with action party and due date)

Lateral learning (Lessons Learned) to be communicated

These lessons shall be issued within each Directorate and copied to Focal Points of all IRCs, assigned action parties and MSEM (MSEM, MSEM/13/42/43).

IRC Focal-Points should ensure that the agreed lateral lessons of key incidents are issued to MSEM/13 within one week of each review as per the standard format provided. MSEM/13 will quality check and issue Lateral Learning sheets for wider dissemination.

LTI Briefing Packs shall be prepared for those incidents with particular high lateral learning value. The draft for these packs shall be made the incident owner, with assistance of IRC Focal-Point, prior to being issued to MSEM/13 for quality checks. Final Briefing Packs will be issued by MSEM by MSEM/43, but may be issued internally (within directorate or asset team) by the IRC Focal-Point

4: Definitions and Explanation of Terms

(as per ICIR Manual December 31, 2007)Asset Damage

A direct loss of or damage to plant, equipment, tools or materials resulting from an incident. (Refer to guidance and examples in Appendix 6 of the ICIR).Business

One of the global Shell businesses, i.e. Exploration and Production, Downstream or Gas and Power.Business Travel

For a PDO employee, Business Travel is any travel undertaken for the purposes of work activities in which that person is engaged in the interests of his or her employer, to the following extent:

It includes the period from the time that person leaves their residence or their normal place of work until they return or until the time they arrive at their destination and check into temporary accommodation (home away from home).

It includes, on the return trip, the period from when the person checks out of their temporary accommodation until they arrive at their residence or their normal place of work.

It includes the whole spectrum of travel, from international travel through to simple acts like crossing a public road on foot between two company buildings.

It excludes a persons normal commute to work.

It includes travel to the airport for a business trip from the time an employee leaves home even if that travel follows the same route as their normal commute. If the employee stops in the office first to work, then the period of employees business travel starts from the office and not their home.

It excludes that persons commute from their home away from home to their temporary place of work or a significant detour made for personal reasons.

Any injury or illness occurring during the business trip is considered to be work related for recording, investigation and learning purposes; but not all injuries and illnesses will be recordable for statistical purposes.Business Travel - ContractorFor a PDO contractor, Business Travel is any travel undertaken for the purposes of work activities in which the contractor is engaged in supplying Shell or one of its subsidiary companies with goods and / or services, to the following extent:

It includes day-to-day travel undertaken by a Shell contractor in the course of carrying out Shell work-related activities.

It excludes day-to-day travel undertaken by the Shell contractor when that person is not engaged in Shell work related activities (such as their normal commute, or any travel undertaken in the interest of their own employer).

It includes contractor mobilization and demobilization when performed under contract with PDO Business Unit

Activities in one of the Group businesses that are operated as a single economic entity. A business unit can coincide with a Group company or straddle part or all of several companies.Consequential Business LossThe indirect loss associated with incidents resulting in asset damage, environmental impact or impact on company reputation. It comprises elements such as loss of production (expressed as profit margin), process unit downtime, product quality costs, cost of environmental clean up, cost of recovery/disposal of waste and cost of reprocessing off-grade material.

The intention is to estimate the order of magnitude of the loss so that the incident can be assessed on the RAM and the appropriate resources put into investigation. It should not be necessary to conduct a detailed accounting of the full range of indirect costs. Consequential business loss should be estimated on a 100% equity basis.

When consequential business loss results from an incident with impact on the environment or company reputation, the consequences should be assessed under both asset damage and the environmental/reputation categories of the RAM and the highest rating used to determine the extent of investigation and follow up.CompanyCompany or Group company means a Shell company, a Joint Venture under operational control (JV-uoc), or a Joint Venture not under operational control (JV-nuoc) that has agreed to report its HSE performance and incident data to Group following the reporting methodology detailed in this guide.Contractor

All parties working for the company either as direct contractors or as subcontractors. Environmental Impact

The negative impact on the environment resulting from an incident. (Refer to guidance and examples in Appendix 7 of the ICIR).Exposure Hours

The total number of hours of employment including recorded overtime and training but excluding leave, sickness and unrecorded overtime hours. Exposure hours should be calculated separately for company and contractor personnel. Time off duty, even if this time is spent on company premises, is not included in the calculation of exposure hours, but incidents during this time should be recorded and investigated. When they meet the work related definition, they should be included in the statistics as recordable incidents. In many company sites the number of exposure hours can be calculated from computer controlled access or time keeping records. In the absence of more accurate methods exposure hours can also be calculated from a headcount and nominal working hours per person or time writing systems.

In order to meet reporting schedules, exposure hours can be estimated on the basis of the previous data. Corrections can be made at the end of the reporting year when more time is available. Fatality

A death resulting from a work related injury or occupational illness, regardless of the time intervening between the incident causing the injury or exposure or causing illness and the death.FAR

The number of fatalities per hundred million exposure hours. FIM

Fountain Incident Management (FIM) is the Group system for recording incident details, the investigation, classification and action items. It can also issue notifications and reports. Other systems can be used in the interim; but all Businesses and Functions are expected to be using FIM by end 2009. FIM should be used for all potentially work related incidents including those that occur while in home away from home status. Fires and Explosions

Normally taken to mean all fires that necessitated the use of a fire extinguisher or other extinguishing means, e.g. snuffing steam, shut off fuel or switch off electricity supply. Fires with no visible flame, e.g. oil soaked insulation, should also be included. All flammable explosions or overpressure explosions should be included, irrespective of the extent of containment.First AidAn incident is classified as a First Aid if the treatment of the resultant injury or illness is limited to one or more of the 14 specific treatments. These are:

1. Using a non-prescription medication at non-prescription strength (2);

2. Administering tetanus immunizations;

3. Cleaning, flushing or soaking wounds on the surface of the skin;

4. Using wound coverings such as bandages, Band-AidsTM, gauze pads, etc.; or using butterfly bandages or Steri-StripsTM.

5. Using hot or cold therapy;

6. Using any non-rigid means of support, such as elastic bandages, wraps, non-rigid back belts, etc;

7. Using temporary immobilization devices while transporting an accident victim (e.g., splints, slings, neck collars, back boards, etc.).

8. Drilling of a fingernail or toenail to relieve pressure, or draining fluid from a blister;

9. Using eye patches;

10. Removing foreign bodies from the eye using only irrigation or a cotton swab;

11. Removing splinters or foreign material from areas other than the eye by irrigation, tweezers, cotton swabs or other simple means;

12. Using finger guards;

13. Using massages; or

14. Drinking fluids for relief of heat stress.

Note:When determining whether a prescription medicine was used the normal practise is to apply the definitions used in the country where the incident occurred. However, when making this classification it should be remembered that the intent is to distinguish those more severe situations that require a medical practitioner to use strong antibiotics and painkillers from those that only require first aid. The definition of Prescription Medication may be used as guidance in making decisions between those that are strong antibiotics and painkillers from those that only require first aid.

(2) For medications available in both prescription and non-prescription form, a recommendation by a physician or other licensed health care professional to use a non-prescription medication at prescription strength is considered medical treatment. The definition of Prescription Medication may be used to determine when the prescription strength threshold has been crossed.First Aid Case (FAC)Any work related injury that involves neither lost workdays, restricted workdays or medical treatment but which receives First Aid treatment. (Refer to relevant definitions in Appendix 3 PR1418 Part 1).High Risk Incident (HRI)

An incident for which the combination of potential consequences and probability are assessed to be in the high risk (red shaded) area of the RAM. HRIs can be incidents that result in injuries, illnesses or damage to assets, the environment or company reputation, or they can be near misses. Incident

An unplanned event or chain of events that has, or could have, resulted in injury or illness or damage to assets, the environment or company reputation.

Incidents do not include operations, maintenance, quality or reliability incidents which had no HSE consequence or potential. Incidents do not include degradation or failure of plant or equipment resulting solely from normal wear and tear.InjuryAny injury such as a cut, fracture, sprain, amputation etc. that results from a single instantaneous exposure.Lost Time Injuries (LTI)

The sum of injuries resulting in fatalities, permanent total disabilities and lost workday cases, but excluding restricted work cases and medical treatment cases.Lost Time Injury Frequency (LTIF)

The number of lost time injuries per million exposure hours. Lost Workday Case (LWC)

Any work related injury that renders the injured person temporarily unable to perform their normal work or restricted work on any day after the day on which the injury occurred. Any day includes rest day, weekend day, scheduled holiday, public holiday or subsequent day after ceasing employment.

A single incident can give rise to several lost workday cases, depending on the number of people injured as a result of that incident.Lost Workdays (LWD)The total number of calendar days on which the injured person was temporarily unable to work as a result of a lost workday case.

In the case of a fatality or permanent total disability no lost workdays are recorded.Medical Treatment (MT)An incident is classified as Medical Treatment (MT) when the management and care of the patient to address the injury or illness is above and beyond First Aid(i).

Medical Treatment does not include: -

The conduct of diagnostic procedures, such as x-rays and blood tests, including the administration of prescription medications used solely for diagnostic purposes (e.g., eye drops to dilate pupils);

Visits to a physician or other licensed health care professional solely for observation or counselling;

The following may not involve any treatment but for purposes of severity classification, will be recorded as Medical Treatment.

Any loss of consciousness

Significant injury or illness diagnosed by a physician or other licensed health care professional for which no treatment is given or recommended at the time of diagnosis. Examples include punctured eardrums, fractured ribs or toes, byssinosis and some types of occupational cancer.

Needle stick injuries and cuts from sharp objects that are contaminated with another persons blood or other potentially infectious material.

Occupational hearing loss.

Medical removal under a government standard (use the Shell Health Guidelines where no government standard exists).

(i) Note:First Aid carries a very specific meaning for this purpose. Please refer to the definition of First Aid.The following examples are generally considered medical treatment. Work- related injuries for which this type of treatment was provided or should have been provided are almost always recordable for Group's statistics:

Treatment of infection

Application of antiseptics during second or subsequent visit to medical personnel

Treatment of second or third degree burn(s)

Application of sutures (stitches)

Application of butterfly adhesive dressing(s) or steri strip(s) in lieu of sutures

Removal of foreign bodies embedded in eye

Removal of foreign bodies from wound; if the procedure is complicated because of depth of embedment, size, or location

Use of prescription medications (except a single dose administered on the first visit for minor injury or discomfort)

Use of hot or cold soaking therapy during the second or subsequent visit to medical personnel

Application of hot or cold compress(es) during the second or subsequent visit to medical personnel

Cutting away dead skin (surgical debridement)

Application of heat therapy during the second or subsequent visit to medical personnel

Use of whirlpool bath therapy during the second or subsequent visit to medical personnel

Positive X-ray diagnosis (fractures, broken bones, etc.)

Admission to a hospital or equivalent medical facility for treatment or observation for more than 12 hours.

The following procedures by themselves are not considered medical treatment:

Administration of tetanus shot(s) or booster(s). However, these shots are often given in conjunction with more serious injuries; consequently, injuries requiring these shots may be recordable for other reasons

Diagnostic procedures, such as X-ray or laboratory analysis, unless they lead to further treatment.

Loss of Consciousness

If an employee loses consciousness as the result of a work-related injury, the case must be recorded as at least an MTC no matter what type of treatment was provided. The rationale behind this is that loss of consciousness is generally associated with the more serious injuries.Medical Treatment Case (MTC)Any work related injury that involves neither lost workdays or restricted workdays, but which receives Medical Treatment. (Refer to relevant definitions in Appendix 3).

Near Miss

An incident that could have caused illness, injury or damage to assets, the environment or company reputation, or consequential business loss, but did not.Non Accidental DeathA death from any cause other than from a work related incident. Occupational IllnessAny abnormal condition or disorder of an employee, other than one resulting from an occupational injury, caused by exposure to environmental factors associated with employment. An illness is work-related if the balance of probability is 50% or more that the case was caused by exposures at work.

Occupational illnesses include acute and chronic illness or diseases that may be caused by inhalation, absorption, ingestion or direct contact with the hazard, as well as exposure to physical and psychological hazards. (Refer to guidance and examples in Appendix 4 ICIR).

OSHA occupational illness cases will be captured for benchmarking purposes in FIM (and other systems where possible).Operational ControlSee Instructions on Determining Operational Control Appendix 5 of the PMRPermanent Total Disability (PTD)Any work related injury that permanently incapacitates an employee and results in termination of employment.Prescription Medication

1. All antibiotics, including those dispensed as prophylaxis where injury or illness has occurred to the subject individual.

Exceptions: Dermal applications of Bacitracin, Neosporin, Polysporin, Polymyxin, Iodine or similar preparation.

2. Diphenhydramine (Benadryl) greater than 50 milligrams( mg.) in a single application.

3. All analgesic and nonsteroidal anti-inflammatory medication (NSAID) including:

Ibuprofen (such as AdvilTM) - Greater than 467 mg. in a single dose.

Naproxen Sodium( such as AleveTM-) Greater than 220 mg. in a single dose.

Ketoprofen (such as Orudis KTTM) - Greater than 25mg. in a single doge.

Codeine analgesics (Cocodamol, Panadeine, etc.) Greater than 16 mg. in a single dose.

Exceptions: acetylsalicylic acid (Aspirin) and acetaminophen (paracetamol) are not considered medical treatment.

4. All dermally applied steroid applications. Exceptions: hydrocortisone preparations in strengths of 1% or less.

5. All vaccinations used for work-related exposure. Exceptions: Tetanus

6. All narcotic analgesics (except codeine as listed above)

7. All bronchodilators. Exceptions: Epinephrine aerosol 5.5 mg./ml or less

8. All muscle relaxants (e.g. benzodiazepines, methocarbamol and cyclobenzaprine).

9. All other medications (not listed above) that legally require a prescription for purchase or use in the state or country where the injury or illness occurred.

Note: Where there are apparent contradictions, advice should be sought from a Company physician and reasoning documented.Potential Incident

An unsafe practice or a hazardous situation that could result in an incident (incident has not occurred). Reputation ImpactThe negative impact on company reputation resulting from an incident. The negative impact can be in the form of adverse attention from media, politicians or action groups, or in public concern about company activities. (Refer to guidance and examples in Appendix 8).Restricted Work Any work related injury or illness that keeps the employee from performing one or more of the routine functions associated with their job or a physician recommends that the employee not perform one or more of their job's routine duties.Restricted Work Case (RWC)Any work related injury which results in Restricted Work. Restricted Workdays (RWD)The total number of calendar days counting from the day of starting restricted work (not counting the day of injury / illness) until the person returns to his normal work.

When restricted workdays follow a period of lost workdays, the restricted workdays are recorded in addition to the lost workdays, but the injury is recorded as a lost workday case only.

Risk Assessment Matrix (RAM)

A tool that standardises qualitative risk assessment and facilitates the categorisation of risk from threats to people, assets, environment and company reputation. The tool is described in detail in the Risk Assessment Matrix (2006). Road Transport Incident

An incident involving a vehicle driven by a company or contractor employee, whether on or off the road, that has resulted in injury, illness or damage to assets, the environment or the company's reputation, irrespective of the cost of repair or responsibility for cause.

A vehicle is defined as a car, van, light vehicle, heavy goods vehicle, road tanker, bus, motorcycle or any unit under tow, e.g. trailers, caravans, mobile generators.

This definition does not include:

Incidents involving vehicles operating on aprons of public airfields;

Damage as a result of normal wear and tear, e.g. minor paint scratches, stone chips, and mechanical wear and tear;

Incidents which occur when the vehicle was unattended, e.g. vandalism or other damage whilst the vehicle was parked. These would be considered as incidents rather than transport incidents.Significant Incidents

Incidents with actual consequences that rate 4 or 5 on the RAM. (people, environment, damage or reputation).Third PartiesPersons or organisations that are not employed by or contracted to a company or contractor.Total Sickness Absence

Absence from work on grounds of incapacity to work due to any sickness and injury, work related or not, expressed as percentage of total workdays available. All other cases of absence such as pregnancy, childbirth, leave, training and seminars, are not included in the definition of absence.Total Recordable Cases (TRC)The sum of injuries resulting in fatalities, permanent total disabilities, lost workday cases, restricted work cases and medical treatment cases.Total Recordable Case Frequency (TRCF)The number of Total Recordable Cases per million exposure hours. Total Recordable Occupational Illness (TROI)The sum of all recordable occupational illnesses. Cases involving no lost or restricted workdays and no medical treatment or first aid are included. A single exposure can give rise to several occupational illness cases. Contractor occupational illness cases are to be reported when known, but are not to be included in the TROIF.Total Recordable Occupational Illness Frequency (TROIF)The number of employee occupational illnesses per million exposure hours. Vehicle Kilometres DrivenThe number of vehicle kilometres travelled during work related activities whilst being driven by a company or contractor employee

Work RelatedAn injury or illness must be considered work related if an event or exposure in the work environment caused or contributed to the resulting condition or significantly aggravated a pre-existing injury or illness. Work relatedness is presumed for injuries and illnesses resulting from events or exposures occurring in the work environment unless one of the following exceptions applies in its entirety:

Occurs when an employee or contractor is present in the work environment as a member of the general public. In this case it will be included in the 3rd party statistics.

Results solely from voluntary participation in a wellness program or in a medical, fitness, or recreational activity such as blood donation, physical examination, flu shot, exercise class, racquetball, or baseball. On the other hand, if the employee was injured by a trip or fall hazard present in the employers lunchroom, the case would be considered work-related. Involves signs or symptoms that surface at work but result solely from a non-work related event or exposure.

Is solely the result of eating, drinking, or preparing food or drink for personal consumption (whether bought on the employers premises or brought in). For example, if the employee is injured by choking on a sandwich while in the employers establishment, the case would not be considered work-related. Note: If the employee is made ill by ingesting food contaminated by workplace contaminants (such as lead), or gets food poisoning from food supplied by the employer, the case would be considered work-related. Is solely the result of doing personal tasks at the establishment outside of the employees assigned working hours

Is solely the result of personal grooming, self medication for a non-work-related condition. Or is intentionally self-inflicted

Is caused by a vehicle accident and it occurs on a company owned parking lot or road while the employee is commuting

Is the common cold or flu (Note: contagious diseases such as tuberculosis, brucellosis, hepatitis A, or plague are considered work-related if the employee is infected at work).

Is not a Shell occupational stress case.

Shell uses a wider definition of stress than does OSHA.

The OSHA definition of work relatedness excludes a mental illness (unless it is post-traumatic stress syndrome where it can be tied to a specific workplace incident, or are incidents where the employee voluntary provides an opinion from a physician or other licensed health care professional stating the employees mental illness is work-related).5:INCIDENT REPORT TEMPLATES

Appendix 1 High Potential Incident Reports

Appendix 2

Non-accidental Death Reports

Appendix 3

General Medium Potential Incident Report

Appendix 4

Road Traffic Medium Potential Incident Report

Appendix 5

List of Activity at time of Incident

Appendix 6

Broad Incident Types

Appendix 7

List of Immediate Causes

Appendix 8

List of Underlying Causes

Appendix 9

List: Facilities / Plant / Equipment

Appendix 10

List of Injury / Occupational Illness

Appendix 11

Classification of Occupational Illnes

Appendix 1:High Potential Incident Reports

The contents of High Potential Incident reports should be based on the following template or alternatively the Tripod Beta report format can be printed if a complete Tripod Beta analysis has been done:

(This is the information required by PDO and SIEP.)

1.SUMMARY

2.INCIDENT DETAILS

2.1Time, Date, Place

2.2Persons involved in the Incident

2.3Vehicles / equipment involved in the Incident

2.4Events leading to the Incident

2.5The Incident

2.6Description of damage

2.7Nature of injuries

2.8Post Incident response

3.INCIDENT INVESTIGATION

3.1Investigation Team

3.2Examination of site conditions

3.3Examination of vehicles / equipment (including maintenance)

3.4Examination of the work preparation / work task analysis

3.5Experience, competence and other details of persons involved in Incident

3.6iSections to address any other issues specific to nature of Incident

3.6iie.g. Supervision, Procedures, Permit to WorkJourney Management etc.

3.6iiiExplicitly describe what action has been taken to determine if alcohol or drug use

was involved

3.7Response to the Incident

3.8Incident Tree

4.SAFETY CASE GOVERNING OPERATION / ACTIVITY

4.1Is activity addressed in Safety Case, and were hazards adequately recognised?

4.2Were recommended hazard / threat control measures implemented?

5.HSE MANAGEMENT

5.1Organisation, roles and responsibilities

5.1.1PDO

5.1.2Contractor / Contract

5.2HSE requirements for contract

5.3HSE Plans (focus on issues which are implicated in causes of Incident)

5.3.1PDO

5.3.2Contractor

5.4Monitoring implementation of HSE Plans

5.4.1PDO monitoring if PDO is fulfilling responsibilities and obligations

5.4.2PDO monitoring if Contractor is fulfilling responsibilities and obligations

5.4.3Contractor monitoring if it is fulfilling responsibilities and obligations

(above sections include monitoring, auditing, inspections, reviews etc.).

5.5HSE performance of contractor

(On contract in question and other contracts in general. Alternatively, address

PDO HSE performance if a PDO fatality)

6.CONCLUSIONS

6.1Primary or Immediate cause of the Incident

6.2Underlying or Contributory causes

6.3General conclusions and observations

7.RECOMMENDATIONS

7.1Immediate actions

7.2Follow-up actions

LIST OF ATTACHMENTS (including action Close-Out form template)

Appendix 2:Non-accidental Death Reports

Where non-accidental death occurs to a person who is currently employed by, or on contract to, the Company, records of medical pre-employment checks, periodic medical checks, information about the work and work conditions preceding the death should, if available be subject to investigation. This also applies to non-accidental deaths outside normal working hours. The objective of this investigation is to ascertain whether the cause of the fatality relates to systems and conditions which are managed by the Company and may provide the grounds for corrective action. If this is the case, suc