The Nimrod Review - Official Documents

White Booklet
9.67
Chapter 9 – Background to Safety Cases
This description arguably does not do the White Booklet (2002) justice, for it in fact included a number of highly
pertinent observations from which it is clear that its authors fully recognised and appreciated the fundamental
requirements of an effective safety system, as expounded by Lord Cullen. These observations included the
following:
9.67.1 Accidents are indications of failure on the part of management and that, whilst individuals are
responsible for their own actions, only managers have the authority to correct the attitude, resource
and organisational deficiencies which commonly cause accidents. 96
9.67.2 The user must be involved in safety throughout the lifecycle, from setting appropriate safety requirements
through to managing residual risk and feeding back information on shortfalls experienced in service
use. 97
9.67.3 The definition of a Safety Culture is “that assembly of characteristics and attitudes in organisations and
individuals which establishes, as an overriding priority, that safety issues receive the attention warranted
by their significance” (as per the International Nuclear Safety Advisory Group). 98
9.67.4 Safety assessment must not be viewed as a one-off exercise: people should be continuously trying to
make things safer. A strong safety culture with the necessary simulation from audits, incidents and
suggestions will ensure that safety improves. 99
9.67.5 The non-occurrence of system accidents or incidents is no guarantee of a safe system. Safety monitoring
and safety audit are the methods used to ensure that the safety system does not die but is continually
stimulated to improve the methods of risk control and safety management. To maintain safety integrity
across large and/or high risk projects, it is advisable that an Independent Safety Auditor be appointed to
ensure that MOD contracted safety requirements are being met by the Contractor. 100
9.67.6 “Like a case in law, the Safety Case is a body of evidence presented as a reasoned argument. Unlike
most areas of the law, the activities are not presumed innocent until proven guilty: the Safety Case must
prove that a system is safe” (emphasis added). In this context, the MOD is the ‘operator’, but also the
‘regulator’. The regulator function must be organisationally distinct within the MOD, so that one area is
not responsible both for preparing the safety case argument and declaring it adequate. The MOD may
contract out the production of the Safety Case, but it is still owned by the MOD. 101
9.67.7 “A Safety Case can be defined as a structured and documented body of evidence that provides a
convincing and valid argument that a system is adequately safe for a given application in a given
environment. A simple way of understanding the Safety Case is to consider four basic questions:
What could go wrong? (hazard identification and analysis)
How bad could it be? (risk assessment)
What has been done about it? (hazard control, supporting evidence)
What if it happens? (emergency and contingency arrangements)
The Safety Case should answer these questions for the whole system under consideration
for the uses defined.” 102
96 White Booklet, 2002, page 1.
97 Ibid, Page 6.
98 This is my favoured definition of Safety Culture (see Chapter 27).
99 Ibid, page 10.
100 Ibid, pages 12 – 13.
101 Ibid, page 16.
102 Ibid, page 16.
181