MANUAL

RISK ASSESSMENT MATRIX

PTS 60.133
MARCH 1996
 PREFACE

PETRONAS Technical Standards (PTS) publications reflect the views, at the time of publication,
of PETRONAS OPUs/Divisions.

They are based on the experience acquired during the involvement with the design, construction,
operation and maintenance of processing units and facilities. Where appropriate they are based
on, or reference is made to, national and international standards and codes of practice.

The objective is to set the recommended standard for good technical practice to be applied by
PETRONAS' OPUs in oil and gas production facilities, refineries, gas processing plants, chemical
plants, marketing facilities or any other such facility, and thereby to achieve maximum technical
and economic benefit from standardisation.

The information set forth in these publications is provided to users for their consideration and
decision to implement. This is of particular importance where PTS may not cover every
requirement or diversity of condition at each locality. The system of PTS is expected to be
sufficiently flexible to allow individual operating units to adapt the information set forth in PTS to
their own environment and requirements.

When Contractors or Manufacturers/Suppliers use PTS they shall be solely responsible for the
quality of work and the attainment of the required design and engineering standards. In
particular, for those requirements not specifically covered, the Principal will expect them to follow
those design and engineering practices which will achieve the same level of integrity as reflected
in the PTS. If in doubt, the Contractor or Manufacturer/Supplier shall, without detracting from his
own responsibility, consult the Principal or its technical advisor.

The right to use PTS rests with three categories of users :

1) PETRONAS and its affiliates.

2) Other parties who are authorised to use PTS subject to appropriate contractual
arrangements.
3) Contractors/subcontractors and Manufacturers/Suppliers under a contract with
users referred to under 1) and 2) which requires that tenders for projects,
materials supplied or - generally - work performed on behalf of the said users
comply with the relevant standards.

Subject to any particular terms and conditions as may be set forth in specific agreements with
users, PETRONAS disclaims any liability of whatsoever nature for any damage (including injury
or death) suffered by any company or person whomsoever as a result of or in connection with the
use, application or implementation of any PTS, combination of PTS or any part thereof. The
benefit of this disclaimer shall inure in all respects to PETRONAS and/or any company affiliated
to PETRONAS that may issue PTS or require the use of PTS.

Without prejudice to any specific terms in respect of confidentiality under relevant contractual
arrangements, PTS shall not, without the prior written consent of PETRONAS, be disclosed by
users to any company or person whomsoever and the PTS shall be used exclusively for the
purpose they have been provided to the user. They shall be returned after use, including any
copies which shall only be made by users with the express prior written consent of PETRONAS.
The copyright of PTS vests in PETRONAS. Users shall arrange for PTS to be held in safe
custody and PETRONAS may at any time require information satisfactory to PETRONAS in order
to ascertain how users implement this requirement.
AMENDMENT RECORD SHEET

Chapter Section Correction/ Reference

Description Date Initials
No. No. Update Indicator

All All Original paper issue Oct 91

All All Conversion for CD-ROM Conversion Feb 95 NPC SMAD/23

All All New issue Update Mar 96 GvdG EPS/HE

TABLE OF CONTENTS

1. INTRODUCTION

2. THE RISK ASSESSMENT MATRIX

3. THE APPLICATION IN HSE RISK MANAGEMENT

4. THE APPLICATION IN INCIDENT INVESTIGATION

APPENDIX 1 CONSEQUENCE CATEGORY DEFINITION

APPENDIX 2 RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

1. INTRODUCTION
Management of HSE involves an assessment of the risks posed by incidents* that can develop
from the release of a hazard. A qualitative assessment of the risk, rather than a quantitative one,
is in many cases adequate to identify an appropriate course of action for managing the risk. The
potential risk of an incident can be classified by the use of the Risk Assessment Matrix which is
intended to replace the Risk Matrix and the Incident Potential Matrix.
Historically the Risk Matrix and the Incident Potential Matrix were developed separately. The
Incident Potential Matrix was developed first on the basis of earlier Operating Unit initiatives and
published in 1991 as a Shell Safety and Health Committee guide. It introduced the concept of
"potential consequences", i.e. "what could have gone wrong" in slightly different circumstances,
and was used together with a measure of exposure to assess the relative importance of
incidents. The vertical "potential consequence" axis of the Incident Potential Matrix has been
widely adopted, whereas the horizontal axis has been variously interpreted by the Operating
Units with some using a measure of probability or likelihood of occurrence, while others have
used some measure of exposure. In some Operating Units, it is considered that only the potential
consequence should determine the depth of investigation, without taking the likelihood of
occurrence or exposure into consideration.
The Risk Matrix was developed later in conjunction with the development of the Hazards and
Effects Management Process (HEMP) of the HSE Management System, as a tool to visibly
express company policy and to demonstrate compliance with the risk tolerability criteria and the
ALARP principle. The vertical axis of the Risk Matrix was identical to that of the Incident Potential
Matrix. For the horizontal axis, a qualitative description of probability was used.
In order to promote a consistent approach, it is now recommended to use this horizontal
probability axis for all assessment of risks from incidents as it makes risk classification easier and
takes into account all the elements used in various Operating Units (frequency of activity, number
of people exposed to a hazard, likelihood of release of the hazard and functioning of barriers,
and other circumstances that may impact on the development of an incident).This guideline
describes the Risk Assessment Matrix (defining the horizontal and vertical axes), and gives
examples of its use.

2. THE RISK ASSESSMENT MATRIX

Description
The Risk Assessment Matrix (Figure 1) is a tool that standardises qualitative risk assessment
and facilitates the categorisation of all threats to health, safety, environment and reputation. The
matrix axes, consistent with the definition of risk, are Consequences and Probability (or
Likelihood).
Figure 1 : Risk Assessment Matrix

C o nse q u e n c e Inc re a sing Probability

A B C D E
Never heard Heard of Incident has Happens Happens
of in --- incident in -- occurred in several times several times
Rating People Assets Environment Reputation industry industry our company per year in co. per year in
locn.

No
0 No damage No effect No impact
injury
Slight
1 Slight injury Slight effect Slight impact
damage
Minor
2 Minor injury Minor effect Limited impact
damage
Localised Localised Considerable
3 Major injury
damage effect impact
Single Major
4 Major effect Major national
fatality damage
Mutiple Extensive Major
5 Massive effect
fatalities damage international
A scale of consequences from "0" to "5" is used to indicate increasing severity. The
consequences are those of credible scenarios (taking the prevailing circumstances into
consideration) that can develop from the release of a hazard. The potential consequences, rather
than the actual ones, are used. These are defined as the consequences that could have resulted
from the released hazard if circumstances had been less favourable.

The probability on the horizontal axis is estimated on the basis of historical evidence or
experience that the identified consequences have materialised within the industry, the company
or a smaller unit. Note that this should not be confused with the probability that the hazard is
released: it is the probability of the estimated potential consequences occurring.

Classification of Potential Consequences

The consequences of the release of a hazard or effect are identified in each of the four
categories (harm to people, asset damage, environmental effect and potential impact on the
reputation of the company) by selecting an appropriate row description on the vertical axis of the
matrix. The definition of the categories is given in Appendix 1.

Risk is described, not only in terms of risk to health, safety and the environment, but also in
terms of risk to reputation. Reputation is driven by perceptions and by societal issues. Risk in
scientific terms may be reduced to the level reasonably practicable (ALARP), yet the overall risk
to reputation may still remain high. Risk to reputation cannot be ignored and advice may be
sought from Public Affairs experts.

Consequences should be estimated on the basis of what might have resulted under slightly
different circumstances. Examples are:
Scenario Actual outcome Potential consequence
A crane drops a load one meter Damage to load. Fatal injury if a person had
besides a person. been standing under the
load.
Car rolls over on a desert road. Damage to car, no injury (seat Serious injury.
belt was worn).
Operator opens wrong valve: Minor pollution Major effect if the spill had
diesel fuel polluting river; quickly not been noticed so quickly.
spotted by someone else.
Exposure to H2S: quickly 2 days observation in Fatal or permanent
rescued and resuscitated hospital: minor injury. total/partial disability.
Exposure to benzene exceeding None. Cancer (leukemia).
current occupational exposure
limits
Flare carries over some crude. Sooting flare. Oil in flare pit. Pit on fire.
Heavy smoke. Soot on
nearby houses and cars.
Complaints. Media publicity.
Damage claims.

Assessment of Probability
The horizontal axis represents the probability or the measure of likelihood of the occurrence of an
undesired event following the release of a hazard. The scale of the horizontal axis is indicatively
defined :
"A - never heard of in the __ industry",
"B - heard of in the __ industry",
"C - has occurred in our company",
"D - happens several times per year in company", and
"E - happens several times per year in location".
This assessment is based on experience and is indicative of the likelihood of undesired
consequences materialising. Note again that this should not be confused with the probability that
the hazard is released: it is the probability of the estimated potential consequences occuring.
 In smaller Operating Units or new ventures where experience is limited, it is recommended that
the probability is assessed on the basis of knowledge from similar operations in other Operating
Units. In new ventures, the potential consequence scale only can be used and investigations
carried out for all incidents with potential higher than 3. By doing so, every opportunity is used for
learning from the potentially serious incidents, no matter how unlikely their occurence may be.

Risk Classification

Using the Risk Assessment Matrix, risk is classified by three characters made up as follows:
− the first character is a measure of the likelihood of an undesired event: A-E
− the second character is the consequence severity that could occur with
that event: 1-5, and
− the third character shows to which consequence category the assessment
pertains - People (P), Asset (A), Environmental (E) nature or Reputation (R).

The intersection of the chosen column with the chosen row is the risk classification. For the same
scenario, different classifications may apply to P, A, E, and R. Some examples of incident
classification are given in Appendix 2.

3. THE APPLICATION IN HSE RISK MANAGEMENT

A suitable overlay for using the Risk Assessment Matrix as an element of the HSE management
system to identify actions to reduce risk to ALARP is shown in Figure 2 below.

Figure 2 : Risk Management Overlay

(for expressing Company policy and strategic objectives)

Increasing Probability

A B C D E
Never heard Heard of incident Incident has Happens Happens several
of in --- in -- industry occurred in our several times per times per year in
Rating industry company year in co. locn.

1
Manage for continuous
improvement
2
Incorporate Risk
3
Reduction Measures
4
Intolerable

Objective setting is at the heart of the HSE Management System and the Risk Assessment
Matrix overlay format shown above is a useful tool that can help management in the
interpretation of risk (expressed in the policy and strategic objectives of the company) and also
help the line in understanding how this policy and these objectives are to be regarded (in terms
of tolerable risk) in their day to day operations.

The definition of tolerable risk should be derived from the policy and strategic objectives of the
company and can be indicated on the Risk Assessment Matrix by company management by
shading-in the appropriate areas. The shading indicated in the matrix is recommended practice;
deviations can be considered for small operating entities. The focus provided by using the Risk
Assessment Matrix in this way enables company management to determine whether the risk
levels inherent in the company's operations are tolerable and whether they fit with current
corporate policies and objectives. For example, if an operation would result in scenarios which lie
 in an area on the Risk Assessment Matrix that the company would normally regard as
"intolerable" in policy terms, then alternative ways of carrying out the operation should be
investigated. If there are no alternative ways, then management must decide whether the
operation should proceed or not. If it has to proceed then special treatment in regard to the level
of control must be implemented before the operation takes place.

The Risk Assessment Matrix overlay may also be used on a scenario by scenario basis to
prioritise risk reduction efforts. It is adaptable to varying levels of information and depths of
evaluation. It has a built-in presentation format that lends itself to review. Because it is qualitative
and the scales relative, instead of absolute, exact knowledge is not required and thus risk
understanding can be reached fairly easily. Examples of risk determination using the Risk
Assessment Matrix are included in Appendix 2.

A company should consider using the Risk Assessment Matrix as a part of its implementation of
the HSE Management System and of HSE Cases (HSE Reports). The use of the Risk
Assessment Matrix will:
− enhance the appreciation of HSE risk tolerability and ALARP at all levels in the company,
− assist in making the PETRONAS Group policy and standards and local company HSE
policies relevant to day to day operations via the setting of clear risk based objectives
that can be cascaded into the setting of individual tasks and targets, and
− provide the basis for the implementation of the risk-based HSE Management System in
accordance with PETRONAS Group Guidelines.

4. THE APPLICATION IN INCIDENT INVESTIGATION

For use in incident follow-up, the matrix can be used with an overlay as shown in Figure 3 to
decide on depth of investigation, investigation team composition, reporting level, etc

Figure 3 : Incident Follow-up Overlay

Increasing Probability

A B C D E
Never heard Heard of incident Incident has Happens Happens several
of in --- in -- industry occurred in our several times per times per year in
Rating industry company year in co. locn.

1
to be investigated
and discussed
2
in depth analysis
3 and discussion at
management
4 in depth analysis,
level
management involvement, voluntary
5
reporting to service companies

Suggestions for team composition, reporting and feedback to management are shown below.
Company managements are encouraged to review and customise the table.

Risk Rating Investigation team composition Reporting/discussion

Low risk (unshaded area) local supervisor + HSE focal reporting to department
point head

Medium Risk asset holder + other line staff reporting to OU

(lightly shaded area) as required + HSE advisor management

High Risk Member of Management Team

(heavily shaded area) + asset holder + HSE advisor + reporting to CEO and
independent person e.g. from voluntary reporting to
corporate organisation + Service Companies
specialists as required
 The Incident Follow-up Overlay is intended for use by location personnel after an incident
occurrence to:
− assess the significance of an incident in terms of its ultimate potential for injury, damage,
environmental and reputation effects,
− provide guidance in determining the depth or extent of an incident investigation and its
follow-up, and
− increase the awareness of Health, Safety and Environmental implications of any incident.

Application of the tool is expected to:

− promote near-miss reporting, improve knowledge of potentially serious incidents,
− enhance the direction of safety efforts and make more efficient use of investigation time,
− improve management of risk reduction efforts, and focus on where the greatest benefits
can be achieved,
− provide a broad incident occurrence indicator, and
− assist in media handling by the Public Affairs staff due to an improved insight into the
potential severity of an incident.

APPENDIX 1 CONSEQUENCE CATEGORY DEFINITION

Harm to People

No. Description

0 No injury or damage to health.

1 Slight injury or health effects (including first aid case and medical treatment case) -
Not affecting work performance or causing disability.

2 Minor injury or health effects (Lost Time Injury) - Affecting work performance, such
as restriction to activities (Restricted Work Case) or a need to take a few days to fully
recover (Lost Workday Case). Limited health effects which are reversible, e.g. skin
irritation, food poisoning.

3 Major injury or health effects (including Permanent Partial Disability) - Affecting work
performance in the longer term, such as a prolonged absence from work. Irreversible
health damage without loss of life, e.g. noise induced hearing loss, chronic back
injuries.

4 Single fatality - From an accident or occupational illness (poisoning , cancer).

5 Multiple fatalities - From an accident or occupational illness (poisoning, cancer).

Asset Damage

No. Description (100% costs, USD)

0 Zero damage

1 Slight damage - No disruption to operation (costs less than 10,000)

2 Minor damage - Brief disruption (costs less than 100,000)

3 Local damage - Partial shutdown (can be restarted but costs up to 500,000)

4 Major damage - Partial operation loss (2 weeks shutdown costs up to 10,000,000)

Extensive damage - Substantial or total loss of operation (costs in excess of

5
10,000,000)
Environmental Effect

No. Description

0 Zero effect - No environmental damage. No change in the environment. No financial

consequences.

1 Slight effect - Local environmental damage. Within the fence and within systems.
Negligible financial consequences.

2 Minor effect - Contamination. Damage sufficiently large to attack the environment.

Single exceedance of statutory or prescribed criterion. Single complaint. No permanent
effect on the environment.

3 Localised effect - Limited loss of discharges of known toxicity. Repeated exceedance

of statutory or prescribed limit. Affecting neighbourhood.

4 Major effect - Severe environmental damage. The company is required to take

extensive measures to restore the contaminated environment to its original state.
Extended exceedance of statutory or prescribed limits.

5 Massive effect - Persistent severe environmental damage or severe nuisance

extending over a large area. In terms of commercial or recreational use or nature
conservancy, a major economic loss for the company. Constant, high exceedance of
statutory or prescribed limits.

Impact On Reputation

No. Description

0 No impact - No public awareness

1 Slight impact - Public awareness may exist, but there is no public concern.

2 Limited impact - Some local public concern. Some local media and/or local political
attention with potentially adverse aspects for company operations.

3 Considerable impact - Regional public concern. Extensive adverse attention in local

media. Slight national media and / or local / regional political attention. Adverse stance
of local government and/or action groups.

4 National impact - National public concern. Extensive adverse attention in the national
media. Regional / national policies with potentially restrictive measures and/or impact
on grant of licences. Mobilisation of action groups.

5 International impact - International public attention. Extensive adverse attention in

international media. National / international policies with potentially severe impact on
access to new areas, grants of licences and/or tax legislation.
APPENDIX 2 RISK ASSESSMENT MATRIX APPLICATION EXAMPLES

Examples In HSE Risk Management

1. Risk Scenario: All the tanks in a terminal are within bunds. One of the tanks is receiving gasoline
from a tanker. The operation is started at night. The storage tank is overfilled and a large vapour
cloud is formed by vaporising gasoline. The vapour cloud is ignited by a passing vehicle. A major
explosion and fire develop which destroy 10 of the 15 tanks at the terminal, cause extensive
damage, and result in multiple fatalities. Such an accident has not occurred previously in the
Operating Unit.

C o n se q u e n c e Inc re a sing Pro b a b ility

A B C D E
Never heard Heard of Incident has Happens Happens several
of in --- incident in occurred in several times times per year in
Rating People Assets Environment Reputation industry -- industry our company per year in locn.
co.

No
0 injury
No damage No effect No impact

Slight
1 Slight injury
damage
Slight effect Slight impact

Minor
2 Minor injury
damage
Minor effect Limited impact Demonstrate ALARP

Localised Considerable E
3 Major injury
damage
Localised effect
impact
Single Major
4 fatality damage
Major effect Major national R

Mutiple Extensive Major P

5 Massive effect A INTOLERABLE
fatalities damage international

Using the Risk Assessment Matrix (see the figure above), this scenario for people, assets and
company reputation plots in the region categorised as Demonstrate ALARP by company
management. This means that for this type of loss of containment event a cost benefit analysis
should be undertaken to determine if there are additional cost effective measures that could be put
in place to further reduce the risks to people, assets and company reputation. The risk to the
environment should be managed for continuous improvement.

2. A proposal for a new installation has two product movement scenarios: transport by truck or the
installation of a pipeline.

For the trucking scenario (indicated by a O on the matrix shown below), the following risk
classifications were identified: C5(P), C2(A), D1(E), C1(R). The risk to people is categorised as
"intolerable". For this scenario to be undertaken special treatment in regard to protecting people
must be implemented. Cost effective measures to reduce the risk to people should be undertaken.

For the pipeline scenario (indicated by a • on the matrix), the following risk classifications were
identified: B2(P), B3(A), B3(E), B1(R). The risks to people, assets, environment and reputation are
categorised as tolerable, and if the pipeline scenario is implemented, should be managed for
continuous improvement in HSE performance.

Consequence Increasing Probability

A B C D E
Never heard Heard of Incident has Happens Happens
of in --- incident in occurred in our several times several times
Rating People Assets Environment Reputation industry -- industry company per year in co. per year in locn.

0 No injury No damage No effect No impact

1 Slight injury Slight damage Slight effect Slight impact R R E

2 Minor injury Minor damage Minor effect Limited impact A Demonstrate ALARP
P
Localised Considerable
3 Major injury
damage
Localised effect
impact AE

4 Single fatality Major damage Major effect Major national

Extensive INTOLERABLE
5 Mutiple fatalities
damage
Massive effect Major international P
Examples of Incident Classification

1. During a weekly off loading operation from a supply vessel, a roof section of a container became
detached and fell into the sea striking the vessel on the port side. Containers containing chemicals
are delivered once a month.

The potential consequence to people from this incident is a single fatality. This corresponds to a
severity rating code of 4. A similar incident with fatal consequences occurred 3 years ago. Several
times per year local damage occurs as a result of loose items falling during off loading. The
Incident Potentials determined are:
− C4(P) - fatality if a person was below falling roof.
− D3(A) - equipment damage causes partial shutdown.
− C1(E) - slight environmental effect.

2. Bus carrying contract cleaning staff fails to stop at security check and hits the security gate. There
were no injuries. There have been previous occasions in company when sudden stops from hitting
obstacles resulted in fractures or bruises.
The following classifications are appropriate:
− D3(P) - injuries from sudden stop.
− D2(A) - damage to vehicle or obstacles

3. Mechanical digger severed a live 415 Volt underground cable to a laboratory while excavating to
lay water pipes. There were no injuries.
− B4(P) - possible electrocution of driver (one person).
− C2(A) - loss of ongoing experiment and equipment.

4. Radioactive contamination found on work bench during routine monitoring.

This incident would be classified:-
− B4(P) - internal contamination can lead to cancer; cases are known in industry
− E3(E) - repeated breach of statutory rules.

5. While trying to jump start a car (12V) with a crane battery (24V) the car battery exploded, spraying
acid on operator. Actual consequences : damage to clothing and car.
− C3(P) - possible severe eye injury.
− C2(A) - damage to car.

6. Filing cabinet drawers are opened adjacent to a busy access route in an office. The cabinet
overbalances and falls over, nobody is hurt but people could have been passing. It has occurred
once before in the Operating Unit that someone was seriously hurt by such an accident.
− D3(P) - major injury to person passing.

7. During "start-up" an exchanger joint fails releasing an estimated 5-tonne cloud of propane. The
operator jumped away and sprained his ankle.
− B5(P) - possible multiple fatalities if the gas cloud had been ignited.
− B3(A) - damage in case of gas cloud explosion.
8. During the loading of diesel from a tank, the ship's hose sprung a leak and the river was
contaminated. The contamination was noted within minutes by an outsider who warned the loading
master. The damage could have been much worse if it had not been spotted so quickly. Small
leaks have occurred earlier in the company, but not a major one.
− B3 (E) or D2 (E) - spills with minor effects have occurred, more serious local effect has not
occurred previously in this company
− D2 (R) - local population gets worried about frequent minor spills