1 How ORR applies a risk based rather than rule based process in their criteria for safety certification Name Simon d’Albertanson, HM Inspector of Railways, Office of Rail Regulation, United Kingdom NSA Date 14 th November 2014

2 First Principles What is a Safety Certificate? Why is it needed ? Unlocks Barriers to Trade Most Importantly…….. A demonstration that a European Regulator is satisfied that the safety management system of the company granted one controls risk to an acceptable level.

3 George Eliot, Silas Marner, 1865 “The sense of security more frequently springs from habit than from conviction, and for this reason it often subsists after such a change in the conditions as might have been expected to suggest alarm. The lapse of time during which a given event has not happened, is, in this logic of habit, constantly alleged as a reason why the event should never happen, even when the lapse of time is precisely the added condition which makes the event imminent. A man will tell you that he has worked in a mine for forty years unhurt by an accident as a reason why he should apprehend no danger, though the roof is beginning to sink; and it is often observable, that the older a man gets the more difficult it is to him to retain a conception of his own death”.

4 Accident Causation

5 Safety Management Is about creating barriers to prevent events happening Equipment – management Process – management People – management Over Time

6 What is a Safety Management System in the Railway Context? A demonstration of the management capability of an applicant to operate safely. Clear Coherent Reflects and Covers the Risks A Guide to the Safety Culture of the Applicant An acceptance of responsibility A living document It’s about the people as well as the process

7 What a Safety Management System is not It’s not a list of standards or a lot of paper It’s not set in stone It’s not something to hide behind A means of blaming others outside or inside the company for failings.

8 Risk Management Taking Responsibility Having processes in place to identify and mitigate risks Having processes in place to share findings within Departments with interfacing organisations and with Contractors. Focuses on outcomes not processes Drives Safety Improvement Influences Safety Culture

9 UK Process Early engagement with the Applicant Guidance on what we require is freely available on line for the applicant to read and use t_auth_criteria_mainline.pdf

10 Mainline Transport Undertakings and Mainline Infrastructure Managers Structure The criterion; A brief description of its purpose, where this is not self-evident; and A list of items of evidence that the applicant is generally expected to cover in a narrative summary

11 Evidence Against Each Criteria The evidence that ORR expects applicants to submit to fulfill each criteria should comprise a short description that provides a summary overview of the subject, and describes how the applicant manages that aspect of its operation. The evidence should refer by name to company procedures and specific parts of the SMS where further detail can be found, and to relevant industry standards. Applicants should not provide copies of these documents.

12 Evidence Continued UK NSA ORR expects an applicant to have a developed safety management system and associated procedures in place to underpin the high-level information provided in an application. It also expects an applicant to refer to these extensively in their application. It is the responsibility of the applicant to make sure it puts this in place.

13 Too Much Evidence Demonstration that an organisation can’t separate what is important from what is not. Attempt to confuse/’blind with science’? Inadequate preparation Poor Safety Culture

14 Level Of Assessment ORR operates a policy of proportionality The Level of the Assessment is Directly Related to the Type and Extent of the Operation and the Risks that the Safety Management System Will Need to Manage

15 Example Criteria MTU Criteria A: Risk control measures for all risks associated with the activity of the railway undertaking A.1 There are procedures put in place to identify risks associated with railway operations, including those directly arising from work activities, job design or workload and the activities of other organisations/persons. A.2 There are procedures in place to develop and put in place risk control measures. A.3 There are procedures in place to monitor the effectiveness of risk control arrangements and to implement changes when required.

16 Example Criteria Continued A.4 There are procedures in place to recognise the need to work together with other entities (such as the infrastructure manager, railway undertakings, manufacturer, maintenance supplier, entity in charge of maintenance, railway vehicle keeper, service provider and procurement entity), where appropriate, on issues where they have shared interfaces that are likely to affect the putting in place of adequate risk control measures in accordance with Article 4(3) of the Railway Safety Directive. A.5 There are procedures for agreed documentation and communication with the relevant entities including the identification of roles and responsibilities of each participating organisation and the specifications for information exchanges. A.6 There are procedures to monitor the effectiveness of these arrangements and to implement changes when required.

17 Purpose The applicant has to demonstrate that it has the ability to identify, assess and control risks which arise both from its own activities and those caused by others. This does not require a list of all risks or categories of risk relevant to the applicant, but requires the applicant to show how its systems and procedures are designed and organised to facilitate the assessment of risks and their subsequent control.

18 Evidence A summary of: How the applicant identifies risks associated with its operations; (A1 part) How it identifies risks arising from the activities of ‘other persons’ where appropriate and reasonable; (A1 part) How it goes about controlling risk in terms of selecting appropriate risk mitigation measures; (A2) Systems for monitoring the effectiveness of risk management arrangements (including procedures to identify and report risks arising from defects and construction non-conformities and malfunctions) and how changes are implemented when required;(A3) (A6)

19 Evidence Continued Particular arrangements and procedures for controlling risk from (i) the supply of maintenance and material (ii) the use of contractors(including how safety responsibilities and tasks are known and allocated with them) and (iii) verifying safety performance complies with contract requirements; and (A5 part) (A4) Procedures to verify the competence of contractors (including subcontractors) and suppliers at the time of their selection. (A5 part) For ‘significant’ changes, the common safety method on risk assessment and evaluation will need to be applied.

20 Assessors Look For Gaps Inconsistencies Incomplete Documentation Very New Documentation Lack of understanding of Internal Processes

21 Assessors look for Lack of clarity in interface arrangements Accessibility of the documents that are part of the SMS and used by the people

22 Ongoing Supervision Targeted at Areas of Risk An examination of whether the SMS delivers the intended outcome on the railway Opportunity to follow up areas of concern raised in the initial assessment but closed out Opportunity to test the real safety culture of the organisation Links back to future assessment activity

23 The Endgame A Safety Certificate is the piece of paper you get if your Safety Management System is good enough. A Good Safety Management System shows that you understand the risks you face and pro-actively seek to manage them. Rules and standards may play a part in this but they are not the sole answer. The Good Safety Management System must take account of the people who will operate it. It delivers sustained safety performance and improvement

24 Any Questions?