The Baker Panel Report - ABSA

The Panel also identified some deficiencies in the guidance that BP provided on root cause analysis. In discussing the Five Whys, for example,the process description and example from the Cherry Point safety and health manual’s section on incident investigation suggests that there willbe only one root cause and only one linear path to an event. The Panel believes that rarely only one root cause or path exists and that thisguidance may lead the investigation team to omit important systemic causes. Other BP documents provide insufficient guidance forconducting root cause analyses. A 2003 version of the procedures for incident investigation at the Texas City refinery includes only two verygeneral sentences on root cause analysis (essentially saying that it should be performed) although great detail is provided about the gatheringand recording of data during the investigation.> Comprehensive list of causesFor most of its incident investigations, BP uses a list of causal factors to analyze root causes. BP refers to this method as the ComprehensiveList of Causes (CLC). Unlike the “Five Whys,” the CLC approach promotes identification of multiple causes.Analysis using the CLC begins with an incident investigation that the incident investigation team conducts. In its investigation, the teamgathers evidence about the incident, creates a timeline of events, and drafts a list of critical factors. BP considers critical factors to be thosekey factors that precipitated the incident.BP’s CLC is divided into two major categories: “immediate causes” and “system causes.” Immediate causes are subdivided into unsafe actionsand unsafe conditions. System causes are subdivided into personal factors and job factors. Each of the four quadrants contains a detailed listof causes. BP individually defines the causes within the subcategories in an effort to enable the incident investigation team to differentiateamong causes and to properly match critical factors with causes.The incident investigation team works through the entire CLC in a systematic manner for each critical factor, beginning with immediate causes.BP’s instructions for the CLC approach provide that the investigation team should identify all potential causes before proceeding with the nextcritical factor. The team also provides a reason for each cause. However, it does not appear that BP provides an analytical process forperforming this identification.After identifying all of the specific causes of an incident, the incident investigation team prepares a proposal for corrective action. The proposalshould contain a description of the corrective actions for each cause identified during the CLC process. BP’s instructions note that thecorrective action plans are to be shared throughout the BP system to prevent similar occurrences at other sites.To enhance the root cause analysis, BP uses a worksheet that provides root cause investigators with an additional list of human factors to beused in conjunction with the CLC. The human error analysis worksheet contains a guide to analyzing human behaviors, beginning with adetermination of whether the identified behavior leading to a cause was intentional or unintentional and leading to the identification ofexternal and internal influences and other conditions under which personnel are likely to make mistakes.A major concern associated with a checklist approach like the CLC is that users likely will not identify any factors other than those on the list. Inthe Panel’s experience, investigations typically use a checklist as a complete list of potential causes instead of a starting point for discussion ofthe deeper root causes and usually will not identify factors that are not on the list. Labeling the list as “comprehensive” likely exacerbates thisproblem. The Panel also believes that BP’s list of systemic factors related to engineering problems (e.g., “inadequate technical design”)appears somewhat superficial. While inadequate technical design is a valid factor, BP should use it to invite more extensive inquiry: What is thedesign inadequacy? Why was it present? Why was it not discovered prior to the incident under investigation?Performance Evaluation, Corrective Action, and Corporate Oversight C 199