On a bad day, the HSE department’s name is everywhere. It is in the investigation report, the audit finding, the management review and the questions from the board. In a quiet year it is almost nowhere. Nobody writes to thank the department for the fire that did not start, the fall that did not happen, or the near miss that was caught and quietly fixed.
That asymmetry is not only unfair. In a long quiet period it becomes risky, because people start to ask what the department actually does, whether it needs its current size, or whether the budget could be better used. This piece looks at why that happens, why a quiet year is not the same as a safe one, and why quiet times are exactly when the guard should stay up. These are practitioner observations, supported by the sources listed at the end.
Safety is a dynamic non-event
The organisational theorist Karl Weick described the problem in a phrase: “reliability is a dynamic non-event”. James Reason quotes it in The Human Contribution. It is dynamic because the people running a system keep it within acceptable limits through continual adjustment, and it is a non-event because when those adjustments work, nothing happens. Nothing is exactly what safety work is meant to produce.
Erik Hollnagel and his colleagues spell out the consequence. If safety is defined as the absence of adverse outcomes, then a perfect level of safety leaves nothing to measure. That makes it very difficult to demonstrate that safety efforts have worked, and so very difficult to argue for continued resources. They illustrate the imbalance with a simple example: if something fails once in 10,000 times, it goes right 9,999 times, yet almost all of our attention goes to the one. Their white paper was written for health care, but the logic does not depend on the industry.
The uneventful passage
Think of a long ocean passage that ends exactly as planned. The ship stayed clear of the shoals, avoided the worst of the weather, crossed the traffic safely and arrived on time. Nobody writes a report on it. Yet none of that happened by itself. It happened because someone made the passage plan, kept the lookout, fixed the position, watched the weather and adjusted when conditions changed. An uneventful passage is the product of constant, skilled work, and its success looks like nothing.
HSE work is the same kind of work. Audits, inspections, risk assessments, drills, reviews of procedures and follow-up on near misses are all things done so that something does not happen. When they succeed, the visible result is a quiet year. An HSE department that looks as if it is doing nothing may be the planned, uneventful passage: the work is going on, and the proof is that nothing is going wrong.
The danger comes when the quiet lasts. A successful voyage becomes the argument that the watch was unnecessary. Nobody would remove the lookout because the last passage was uneventful, but the same logic gets applied to departments: what do these people do all day, and why do we need so many of them? That is when resources are cut, attention drifts and the guard comes down.
Why the blame lands on HSE
The reverse happens when something goes wrong, and outcomes are visible where decisions are not. Research on outcome bias shows how strongly the result colours our judgement of the decision. In Baron and Hershey’s 1988 experiments, people were given descriptions of decisions made under uncertainty, and they rated the thinking behind them as better, and the decision maker as more competent, when the outcome was favourable than when it was not.
After an incident, everything around it is re-read with hindsight, and the controls that were meant to prevent it look inadequate. After a quiet year, nobody re-reads anything. There is also a practical reason. The HSE department usually writes the investigation, tracks the corrective actions and presents the statistics, so it is easy for the department that reports the incident to become, in people’s minds, the department that had it. That last point is an observation from experience, not a research finding.
A quiet year is not the same as a safe one
It would be comfortable to conclude that if nothing is going wrong, the controls must be working. They may be. But a quiet record has more than one explanation. The company may have been lucky. Exposure may have been low. Or people may have stopped reporting. The UK Health and Safety Executive’s guidance on process safety indicators states the risk plainly: too many organisations rely heavily on failure data, and often the difference between a minor failure and a catastrophic one is purely down to chance.
The clearest example is the 2005 explosion at BP’s Texas City refinery, which killed 15 people and injured more than 170. The independent panel chaired by James Baker found that BP had relied on personal injury rate data as a process safety indicator, which created a false sense of confidence that process safety risks were being addressed. Good injury statistics had been read as proof of a safety they could not show.
That is why a quiet year is a reason to stay alert, not to stand down. It is also why the reverse holds: one bad event does not prove that the safety function failed. A quiet year and a bad year both say less than they seem to.
It is already measured. That is not the problem
Shipping measures a great deal. Tanker operators assess themselves against OCIMF’s TMSA, which scores management practices against key performance indicators across a set of elements. The ISM Code requires internal audits and a periodic evaluation of the safety management system. Companies hold management reviews and track their own indicators. So the question is not whether HSE is measured. It is what those measures can and cannot show.
Most of them capture compliance, activity and failure. They can show that audits were done, actions were closed and incidents were few. What they cannot show is the incident that did not happen because of a finding closed two years ago. And when the numbers are good, they invite the wrong question: if it is this quiet, why are we paying for so much?
One discipline from the UK HSE guidance helps here. It calls it dual assurance: for each critical risk control, track a leading indicator, a routine check that the key activity is being done as intended, and a lagging indicator, which shows when the control has failed, so that assurance does not rest on failure data alone. The Baker Panel recommended the same, calling for an integrated set of leading and lagging indicators. The guide was written for major hazard industries, but it says its model can be applied to any enterprise that needs high assurance that its systems continue to operate as intended.
Some rules for quiet times
These are suggestions, not a standard:
- Do not tie HSE resources to incident counts. If falling incidents justify cuts, the department is penalised for succeeding.
- Judge readiness, not visible activity. Are drills held, are audit findings closed, are critical controls tested? A quiet department should be busy on prevention: audits, inspections, hazard reviews and drills.
- Ask what the department prevented, not only what it handled. Record the good catches, the permits refused and the drills that exposed a gap before it mattered.
- Treat a long run without incidents as a reason to look harder. Check that reporting is still healthy and that near misses are still arriving. Reason describes collectively mindful organisations as preoccupied with the possibility of failure, and says they work to build a reporting culture by commending, even rewarding, people for reporting errors and close calls.
Make the invisible visible
Hollnagel’s Safety-II turns the usual question around. Instead of only asking why things go wrong, ask why they usually go right. His argument is that things go right not because people behave exactly as procedures say, but because people adjust what they do to match the conditions of work, and that understanding those adjustments is the basis for safety management. Share those stories across the fleet, and open the management review with them as well as with the incident list.
None of this lets the HSE department off the hook. The ISM Code requires the designated person ashore to have direct access to the highest levels of management, and makes that person responsible for monitoring the safety and pollution-prevention aspects of each ship’s operation and for ensuring that adequate resources and shore-based support are applied. In many companies that role sits within the HSE or QHSE function. An HSE department that tells the story of what it prevents is much easier to protect when the budget is under discussion. Internal audits make a similar point about the value of finding problems early; see Accept every finding, however small.
A better question for a quiet year
So when a year passes without a serious incident, resist both easy conclusions. Do not decide the HSE department is surplus, and do not decide the risk has gone. Ask what the controls are telling you, which near misses were reported and acted on, which drills found gaps, and whether people still trust the reporting system enough to use it.
A quiet passage is not evidence that the watch was unnecessary. It is the evidence that the watch was kept. The same goes for an HSE department. If everything is working fine, the most likely explanation is that someone is doing their job properly, and quite possibly the HSE department. Keep the guard up, thank them, and then go and check.
Sources
A note on the sources: the Hollnagel white paper was written for health care, the HSE guidance is aimed at major hazard industries, and the Baker Panel’s findings concern US refineries. None is a study of shipping. They are used here for the logic of measuring and protecting safety, which applies at sea as well.
- Weick, K.E. (1987), “Organizational culture as a source of high reliability”, California Management Review 29(2): 112-127. Journal page.
- Reason, J. (2008), The Human Contribution: Unsafe Acts, Accidents and Heroic Recoveries, chapter 13, “Individual and collective mindfulness”. Farnham: Ashgate.
- Hollnagel, E., Wears, R.L. and Braithwaite, J. (2015), From Safety-I to Safety-II: A White Paper.
- Baron, J. and Hershey, J.C. (1988), “Outcome bias in decision evaluation”, Journal of Personality and Social Psychology 54(4): 569-579.
- Health and Safety Executive (2006), Developing process safety indicators (HSG254), first edition.
- US Department of Energy (2007), Safety Advisory 2007-02, summarising the findings of the BP U.S. Refineries Independent Safety Review Panel (the Baker Panel).
- International Maritime Organization, International Safety Management (ISM) Code, section 4 (Designated Person) and section 12 (Company verification, review and evaluation).
- Oil Companies International Marine Forum (OCIMF), Tanker Management and Self-Assessment (TMSA).
Capt. Gaurav Khanna is a Master Mariner, the founder of VragaMarine and the editor of Maritime Dossier. He spent 18 years at sea on product tankers and crude carriers, trading the Persian Gulf, the North Sea and the Baltic, before coming ashore in 2013. He then spent 13 years ashore with a Japanese ship management company, rising to Senior Deputy General Manager…
Views expressed are the author's own and do not represent those of their employer.
LinkedIn profile
Its good to see someone acknowledging the work of a department that works in the background. This is more like the support staff that work tirelessly for the success of a team but never comes into the limelight. A very well written and practical article. A noteworthy observation here is that most of the accomplished companies today have a very strong HSEQ department and that speaks for itself.
Not only the HSE dept, the crew as well is victim to this. Nobody thinks about what went right and why. We focus on incidents as isolated events wherein it is series of small degradation in culture ( for the want of a better word) , where whatever is tolerated becomes a new normal.