Link to .pdf (short report)
Link to .pdf (long report)
Link to Seveso Inspection Series Home Page

MJV Good Practice Report (Short Report)

Learning Lessons from Accidents

Investigation and analysis - Investigation and analysis models - Who conducts the investigation - The role of the Seveso inspector- The investigation report - Mechanisms for disseminating lessons learned - Facilitating application of lessons learned  -  Integrating lessons learned in Seveso inspections - A proposed learning cycle model - Suggestions for investigation reports and findings - Inspecting the site’s lessons learning culture - Questionnaire for the incident learning cycle

This report aims to provide guidance for European Union (EU) Seveso inspectors on learning lessons from chemical accidents and incidents. It describes how the learning process starts with investigation and analysis and can ultimately lead to implementation of targeted improvements. The document also provides advice to inspectors and inspectorates on influencing the quality of the investigation and investigation report and on promoting the use of lessons learned in hazardous sites.

It is undisputed that learning from accidents is an essential and important part of major accident control.  It is in particular an essential component in preventing future accidents, as new, hidden or underestimated potential causes are revealed, not only for those with first-hand experience.  Provided that lessons learned are disseminated properly, all concerned should in theory be able to avoid similar accidents. Learning from past incidents has thus become a crucial part of the implementation of the Seveso III Directive.  The Seveso III Directive (2012/18/EU) that came into force on 1 June 2015, placed increased emphasis on this aspect by including a new requirement, where operators are more specifically obliged to review past accidents and incidents with the same substances and processes used, consider lessons learned from these, explain specific measures taken to prevent such accidents and finally compile this information in their safety report.

To better understand the lessons learning cycle and the inspector’s role, how inspectors play a role, representatives from Seveso inspectorates gathered in Gothenburg, Sweden, for three days in September 2013 to gain knowledge about learning from incidents, to exchange experience from inspecting the learning cycle at Seveso sites, and to learn more about finding,  analysing and disseminating lessons learned.  This good practice report presents the highlights from those exchanges.

The Rasmussen/Svedung hierarchical model, as shown in Figure 1, describes the learning process on all levels from the individual to the society at large, where each level is tied to adjacent levels through nested loops of steering signals and feedback signals.  The learning of lessons involves several steps starting with the investigation and the summarisation of lessons learned,  If these first steps are achieved, the next phase consists of spreading the information by making the information available through databases, lessons learned exchanges, safety meetings, case study  reports, and other similar mechanisms.  Application so that the lessons learned become a living part of the organisation is the final phase.  This report provides an overview of good practice derived from the workshop exchanges.

1.     The investigation and analysis

The investigation is the starting point for collecting data to enable learning lessons from an incident.  The 

incident investigation process is sometimes divided into five steps:

• Planning
• Data collection
• Accident analysis
• Development of improvement actions
• Conclusions and reporting

It is important that the purpose and scope of the investigation are clearly defined in the planning stage and serve to guide decision making throughout the investigation process. Outlining the structure of the final investigation report can also help to determine the type of data and evidence that should be collected during the investigation. This process can assist brainstorming on people that should be interviewed in the investigation, background research needs, and the types of data and evidence that would be useful to the investigation.  The output from the investigation should be divided in two parts, one about causes, and one about lessons learned.

The results of any investigation are only as good as the investigation process. Quality is most assured when the investigation objectives are systematically followed in an unbroken chain from purpose through data collection, analysis, conclusions and recommendations. Criteria to establish a certain confidence level in the trustworthiness of conclusions is determined by the degree to which the following are respected:

The purpose of the investigation is reflected in the composition and competence of the investigation team

• Objectivity in the data collection
• Logical framework of analysis
• Adequate use of appropriate methodologies
• Recommended actions are related to the accident causes 
• The report is tailored to the audience with a clear and logical structure
• There is an appropriate strategy for dissemination of results

1.1    Investigation and analysis models

In the analysis phase questions are asked about the data collected. Systematic accident methodologies help to ask the right questions.  There are at least 100 different methods for accident analysis that have been published, of which around 30 are actively used.  In general, they are all simplified representations of accidents but each model emphasizes different aspects of the event and its causes and contributing factors.

Systematic analysis can provide a strong basis for seeking data, quality control and communication of the results. The purpose, characteristics of the accident and resources available should guide the choice of method.   Notably, it is not always the case that investigations will use systematic investigative techniques, even in high profile investigations where lessons learned are a primary focus.  Still, these investigations produce considerable data allowing other experts to apply systematic analyses if the data are made publicly available.

Accident analysis models are often divided into three categories:

• Sequential models (e.g., Domino Model [2], STEP [3])
• Epidemiological  models (e.g.,Swiss Cheese Model [4], Tripod Beta [5], Deviation Analysis )
• Systemic models (e.g., Accimap [1], STAMP [6], MTO [7])

Research has shown that no one analytical method provide full support for all phases of an investigation. [8] One recommendation is to combine methods so that all steps in the investigation are well-supported.

1.2 Who conducts the investigation

In the majority of cases, the company investigation is the only investigation that takes place.  The operator is

almost always supposed to carry out an investigation on its own or in co-operation with the authorities, even if the authorities carry out one themselves. In most cases inspection authorities do not make recommendations or place a demand on the operator on what investigation methods to use.  As noted in Figure 2, depending on the country and the circumstances, entities with investigating roles may be operators (69%) and other government agency or agencies (52%), such as the fire brigade, the public health office, or a national safety investigation body. 

Inspectors can play an important role in the outcome of the investigation even when they are not directly investigating the incident. 

1.3 The role of the Seveso inspector

Inspectors can play a role in influencing the quality of an accident investigation. Although inspector’s roles may vary depending on the authority and accident circumstances, it is relatively common that inspectors have some involvement in the immediate accident aftermath.  For this purpose, the inspector should go to the site as soon as the emergency phase has ended and the site is safe to visit.  Some typical immediate actions on-site could be, depending on the role:

• Demanding an investigation and a preliminary report
• Gathering basic information in order to understand what has happened and be able to inform the public and other authorities
• Giving advice on limiting the consequences of the accident
• Initiating or supporting a criminal investigation and securing evidence

Inspectors should be trained for accident follow-up if given this assignment, and if not, he or she should be accompanied by a colleague with this training.  An inspector charged with performing an investigation should have specific training on this topic in advance, to maximise chances of obtaining accurate and complete information. 

The decision to intervene or not to intervene in the investigation has certain implications for the government. On the one hand, if the inspection authority intervenes at any level, it must assume some 

responsibility for the outcome of the investigation.  Intervention also requires the inspectorate to have adequate expertise and confidence to make a judgement in this regard.  On the other hand, by not intervening, the inspector has few alternatives for improving a flawed or incomplete investigation results after the investigation is completed.

Even if the Seveso inspector is not conducting an investigation, there are many ways that they can add value to the investigation, including:

• Overseeing the quality of the investigation by providing guidance on the investigation process to the investigation team, especially to small operators
• Evaluating the quality of the investigation report
• Engaging in dialogue with the operator to reach agreement on what corrective measures should be taken to restore safe operation and avoid a similar accident in future
• Coordinating and communicating between different stakeholders and authorities involved in the investigation

1.4 The investigation report

Outlining the structure of the final investigation report can help to determine the type of data and evidence that should be collected during the investigation. This process can assist brainstorming on people that should be interviewed in the investigation, background research needs, and the types of data and evidence that would be useful to the investigation.

Typical headings in an investigation report are:

•  Purpose and scope
• Information on the site, including ownership and management, site character, (e.g., age, size, historical uses), current business activities, accident history, dangerous substances, etc.
• Accident description, that is, the sequence of events up to and including emergency response
• Human, environmental, economic, and social consequences of the accident
• Description of site operations relevant to the accident, including manufacturing, storage or handling processes at the source of the accident, as well as other relevant operational functions (e.g., maintenance, control room)
• Accident analysis methodologies used
• Identification of direct causes and underlying causes,  supported by an analysis of the time line and presentation of evidence
• Violations of regulations and/or standards relevant to the accident
• Recommendations and how their implementation could prevent a re-occurrence

2. Disseminating lessons learned

Having knowledge about which accidents have occurred and the measures taken as a consequence are fundamental to the assessment of the safety report. Emergency planning is carried out on the basis of scenarios.  Therefore, awareness of which accidents have already occurred in similar establishments may give an indication of which scenarios are relevant for the development of both the on-site and the off-site emergency plans.

Some techniques that can create conditions for active lessons learning include:

Presence of an open “no-blame culture”.  The leadership can have a tremendous influence on whether a site has a learning culture, by actively promoting neutral exchanges on failures and potential failure scenarios. Such a trust environment is often recognisable from certain attributes, such as ample communication about past failures, co-operation on all levels to prevent failure, and extensive exchange of competence and experiences across the organisation about risks and risk management associated with known hazards.                

Promoting reporting and exchange by the company.  Allocation of adequate resources and time for maintaining high safety awareness is also important.  For example, companies can promote reporting through simplification of the process, and routinely giving training on the importance of prompt investigation of incidents and implementation of improvements. Regular discussion and distribution of information, such as safety alerts, lessons learned and key performance indicators, is another way of promoting reporting and exchange of information. 

Making good quality narratives available. Lessons learned is often about telling stories in a way that both the lessons are memorable and can be easily generalised for application in other contexts.  Making good quality narratives available from investigation reports and in databases online may help spread a selection of stories and important lessons learned                                                                                                   

Making databases more readable and searchable. The use of an efficient search engine and keywords can help promote use of the database. An additional technique is to present the accidents in a list or as a result of a search as short summaries, so that the user can filter the selected accidents quickly, and only click on links to the full report of those that fit the user’s criteria. Where there are language differences in the work place, a translation function may be necessary, for example, in multinational corporations or on sites where many line workers are not native speakers of the national language.

Reinforcing the relevance of lessons learned through action.  There is nothing more powerful than demonstrating the importance of lessons learned by applying them when they are relevant.  Companies have several opportunities to incorporate lessons learned into routine activities, through process hazard and job analyses, in audit and control functions, review of processes and procedures, change management, discussion in safety meetings, and various other functions.

Promoting reporting and exchange by the authority.  Authorities may review, as part of inspections, the site’s previous incidents over a period of time and check if all notifiable incidents, including incidents that are interesting for lessons learned, have been reported.  This practice allows for a good discussion with the operator about the selection criteria and how to decide when to report border-line cases. Authorities may also advise operators to have an automatic prompt in their investigation procedure when external reporting requirements might be relevant. In general the authority should also seek to refrain from using punishment to stimulate reporting.

Suggestions for investigation reports and findings Some important things to look for in an accident investigation report are: The quality of the investigation team and its diversity of skils are aligned with the needs and purpose of the investigation The purpose of the investigation is well-defined All areas of investigation are identified and be included in the investigation strategy The investigation is of sufficient depth that potential underlying causes associated with organizational and management system failures are examined and discussed Recommendations are clearly linked to all causes identified in the investigation Recommendations include lessons learned in the safety management system and other parts of the organizational memory There is no strong evidence of bias, such as blaming individuals for the accident or the reports arguments consistently reflect the perspective of one stakeholder A credible and thorough accident investigation includes proper planning and an investigation team with adequate skills, authority, objectivity and, most importantly, independence.

 2.1 Mechanisms for disseminating lessons learned

Many opportunities exist for making relevant lessons learned from accidents easily and continually available to site management and employees, and to inspectors that oversee and enforce on hazardous sites.   The first and essential step is to make conclusions and lessons learned from incidents publicly available.  The second step is to increase the likelihood that relevant lessons learned are taken on board by those sites and inspectors who need them.

• Some mechanisms that can faciliatate the active use of lessons learned include:
• Bulletins and reports of accident case studies
• Presentation at conferences, providing a motivation to analyse and present cases
• Inspection campaigns based on a lessons learned
• Leaflets on specific lessons learned topics
• Joint workshops including lessons learned exchanges between different Seveso authorities, nationally and internationally
• Industry-specific workshops exchanging lessons learned on relevant accident cases
• Videos and interactive tools describing an accident event with powerful lessons about what went wrong
• Teaching packages based on lessons learned themes from specific accidents
• Professional development and training courses on specific process safety topics using examples from past accidents

2.2 Facilitating application of lessons learned

Transferring lessons learned into implementation is a responsibility shared by both authorities and industry.  All incidents should be investigated, but the methods, level of depth and resources should differ depending on the actual and potential consequences of the incident. There is always something new to learn. Incidents that have major similarities may still have different root causes.

In relation to the vast majority of risk management topics, the role of the inspector falls strictly in the camp of oversight and enforcement role.  However, the inspector has a direct role, as opposed to oversight role, in at least one risk management function, learning lessons from accidents.  The Seveso inspector is often required to play three distinct roles associated with lessons learned:

• Reviewing lessons learned to support oversight obligations, in particular, so that the inspector maintains and improves his/her ability to recognise situations that do not conform to good management practice
• Analysing and generating lessons learned as part of an accident investigation team, or to critically review the company’s accident report
• Disseminating lessons learned, by summarising investigation results for reporting to the national authority and the European Commission, and also communicating them to national stakeholders

2.3 Integrating lessons learned in Seveso inspections

Matching lessons learned sources to hazards and risk management problems associated with specific sites is also a significant challenge. Most often one needs to generalise lessons learned or transfer them into a slightly different context. This requires time, experience and knowledge.  The Seveso Directive explicitly promotes the use of lessons learned.  Through its various requirements, e.g., the safety report, the safety management system, accident investigation and reporting, the Directive gives opportunities for the authorities to intervene with operators regarding investigation, reporting, consultation and application of lessons learned.  There are a number of ways information can be applied in inspections:

• Planning resources in the inspectorate and making available or assigning certain staff to be specialists on topics, e.g., corrosion, reactive hazards, etc., with up-to-date knowledge on the lessons learned available for that topic.
• Assigning lessons learned as a specialist task of one inspector or group of inspectors in the inspector.
• Basing inspection themes on a specific lessons learned topic and building awareness of lessons learned on this topic among operators
• Checking scenarios in safety reports against past accidents both at the operator and elsewhere

Inspecting the site’s lessons learning culture and its role in safety management Asking operators how they broadcast and apply own lessons learned, including checking the dissemination within a company, for example by interviewing maintenance personnel. For sites belonging to multi-nationals, verifying whether the site is drawing experience from incidents on sites in other countries or other divisions of the company.   Checking, as part of inspections, implementation of measures and how well lessons learned are embedded in the organisational memory. Checking that safety report updates are part of measures where relevant. Verifying whether relevant incidents occurred at the operator or elsewhere are covered by the scenarios and risks presented in the safety report. Identifying a lessons learned theme relevant to safety management, e.g., management of change, and checking that lessons learned on this topic are reflected in the safety management systems during an SMS inspection Reviewing whether the operator has consulted its industry sources for lessons learned relevant to site operations and substances used.

3.  A proposed learning cycle model

Based on a doctoral thesis by Anders Jacobsson [9] and other research, a model for learning lessons that can be applied to learning lessons for chemical disasters was proposed.  The model is based on a learning cycle of 5 steps, which all are necessary for optimal learning:

• Step 1 – reporting
• Step 2 – investigation and analysis
• Step 3 – decision on measures
• Step 4 – implementation of measures
• Step 5 – follow-up of measures

The learning cycle                                                              

The investigation of individual incidents is called the first loop in the learning cycle. There is also a second loop in the learning cycle, where a number of incidents are analysed together. This allows extraction of significantly more knowledge. Are there similarities or patterns in terms of location where incidents happened, time of day, who was involved, type of injuries, equipment or process concerned? Are some causes more common than others? If for instance new employees are more often involved in incidents it may point to general deficiencies in the introduction or training of new employees. The second loop involves more or less the same five steps as the first loop.

Single loop learning leads only to minor modifications often related to the specific circumstances of the incident, such as correcting a procedure or repairing a piece of equipment.

Double loop learning affects the governing variables of the organisation and leads to profound changes in ways of working or to the technical solution, for example,  an accident can reveal that the site nees an ageing management programme.

To make sure that knowledge is actually gained learning agents are needed at the different steps of the learning cycle. Learning agents are persons who are responsible for the efficiency of one or more steps of the learning cycle. They are visible and respected in the organisation and have the ability to encourage people to contribute.

Text Box 5 contains a short checklist for evaluating the efficiency of the learning cycle, in conjunction with inspections, supervision and policy work, following the principles outlined below. A company can also use it in order to evaluate its own organisation.

Step 1 – Reporting

The challenge is to get even minor incidents reported in order to get a clear, truthful picture of what goes on in the organisation. If employees fear blame and punishment, incidents will not be reported. The safety culture and the behaviour of individual leaders in the organisation are crucial.

The incident management system should also be easy to use, especially at the first step of reporting, and be possible to adapt to the needs of the specific organisation. 

Step 2 – Investigation and analysis

Useful analysis of individual incidents requires time and resources. The person in charge of the analysis must be well informed of the situation but also respected within the organisation. He or she may need support from management as well as from specialists. As much information about the incident as possible, should be gathered as soon as possible in order to understand what has happened. This is done by studying the initial incident report, inspecting the location, interviewing those involved and reviewing written documentation like logbooks.

When enough information has been gathered the next step is to derive every possible cause of the incident back to its root. This can be done just by asking the question “why” over and over again, until no explanation within the authority of the organisation can be found. This method is the simplest form of a group of methods called causal trees. An alternative is to use more rigorous forms of logic trees or predetermined causal trees, where different causes are already suggested.

One can also apply different analytical models in order to visualize the causal relationships.

Questionnaire for the incident learning cycle Is there a formal incident management system? Are the 5 steps of the learning cycle present? Remember: Reporting, Analysis, Decision on measures, Implementation of measures and Follow up of measures Do all steps work? Are there weaknesses? Are there any employees who can work as learning agents? If yes, do they have the right competence? Are they given enough resources? Is there a second loop? Remember the first loop when you analyse one incident and the second loop when you look at the bigger picture and compare several accident investigation reports. What is the threshold for reporting? Is it reasonable? Is it well-known to the employees? Are there a lot of hidden statistics? Compare to the rule of thumb of 1 incident worth reporting per employee and year. What form do the procedures for analysis take? Do the analyses have enough depth? Are any accident models used? Causal trees? How well are lessons transmitted to the organisational memory? Does information really reach all employees? Are there enough resources allocated to every step of the learning cycle?

Step 3 – Decision on measures

Based on the facts collected and the analysis of the causes in Step 2, flaws in the safety system can be pinpointed and corrective actions proposed. Measures should correspond to lessons learned in the analysis phase, and root causes should be addressed. It is important to remember that the same lesson learned should be spread geographically, for example to a similar operation, at another department, in another part of the company or even to customers or competitors.

Step 4 – Implementation

When decisions have been made the corrective actions should be implemented. This requires that the decisions have been made on the right management level, so that leaders have authority and resources to implement them. Information about necessary changes needs to reach everyone, and not to stay within the safety department. This suggests that the incident management system should have a direct line to the internal network for all co-workers.

Step 5 – Follow-up

This step is intended to make sure that the corrective actions are fully implemented within the stipulated time frame. Normally this should be executed at management team level, with support from the person in charge of the incident handling system.

References

1. Rasmussen, J. and I. Svedung, 2006, Proactive Risk Management in a Dynamic Society, NOC 2006:7. Swedish Civil Contingencies Agency, https://www.msb.se/RibData/Filer/pdf/16252.pdf
2. Heinrich, H. W., 1931, Industrial accident prevention: A scientific approach, New York, McGraw-Hill.
3. Hendrick, K., and Benner, L. 1987, Investigating Accidents with STEP, Marcel Dekker Inc, New York.
4. Reason, J., 1997, Managing the risks of organizational accidents, Aldershot: Ashgate. ISBN 1840141042
5. Energy Institute, 2008, Guidance on investigating and analysing human and organizational factors aspects of incident and accidents, London, http://www.energyinst.org.uk/content/files/guidancemay08.pdf
6. Leveson, N., 2004, A new accident model for engineering safer systems, Safety Science Volume 42 (4), 237–270.
7. Sklet, S., 2002, Methods for accident investigation, Trondheim: ROSS (Reliability, Safety, and Security Studies at NTNU), NTNU - Norwegian University of Science and Technology.
   http://frigg.ivt.ntnu.no/ross/reports/accident.pdf    
8. Strömgren, M., Bergqvist, A., Andersson, R., and Harms-Ringdal, L., 2015, A process-oriented evaluation of nine accident investigation methods,Safety Science Monitor, Vol. 19. no 1. Article ID 2. ISSN 1443-8844
9. Jacobsson, A., 2011. Methodology for Assessing Learning from Incidents – A process Industry Perspective, Doctoral Thesis at Lund University,
   http://www.lu.se/search/publikationer?query=Assessing%20learning%20from%20incidents.
10. Fredstrom, C., A proposed learning cycle model,  Mutual Joint Visit Workshop, 11-13 September 2013, Organised by the European Commission and the Swedish Civil Contingencies Agency, Gothenburg, Sweden.