You are on page 1of 44

Risk Assessment Matrix

March 2006
Health, Safety and Environment HSE
Shell Health, Safety and Environment Panel
Policy and strategic objectives
Hazards and Effects Management
Planning and procedures
Implementation
Organisation, responsibilities
resources, standards, documents
Audit
Management review
Corrective action
Monitoring
Corrective action and improvement
Corrective action and improvement
S
e
v
e
r
i
t
y
CONSEQUENCES INCREASING LIKELIHOOD
P
e
o
p
l
e
A
s
s
e
t
s

E
n
v
i
r
o
n
m
e
n
t
R
e
p
u
t
a
t
i
o
n
A B C D E
Never heard
of in the
Industry
Heard of in
the Industry
Has
happened
in the
Organisation
or more than
onece per
year in the
Industry
Has
happened at
the Location
or more than
once per
year in the
Organisation
Has
happened
more than
once per
year at the
Location
0
No injury or
health effect
No damage No effect No impact
1
Slight injury
or health
effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury
or health
effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury
or health
effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up to
3 fatalities
Major
damage
Major
effect
Major
impact
5
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
Risk Assessment Matrix, Issue 3.0, March 2006 c
Risk Assessment Matrix
The companies in which Royal Dutch Shell plc directly and indirectly owns investments are
separate entities. In this guide, the expressions Shell, Group and Shell Group are sometimes
used for convenience where references are made to Group companies in general. Likewise, the
words we, us and our are also used to refer to Group companies in general or those who
work for them. These expressions are also used where there is no purpose in identifying specic
companies.
This document is prepared by Shell International B.V. (SI) as a service under arrangements in
existence with companies of The Shell Group; it is issued for the guidance of these companies
and they may wish to consider using it in their operations. Other interested parties may receive
a copy of this document for their information. SI is not aware of any inaccuracy or omission from
this document and no responsibility is accepted by SI or by any person or company concerned
with furnishing information or data used in these guidelines, for the accuracy of any information
or advise given in the guidelines or for any omission from the guidelines or for any consequences
whatsoever resulting directly or indirectly from compliance with or adoption of guidance
contained in the guideline even if caused by a failure to exercise reasonable care.
HEALTH, SAFETY AND ENVIRONMENT ADVISERS PANEL
The copyright of this document is vested in Shell International B.V., The Hague, Netherlands.
All rights reserved.
March 2006
Risk Assessment Matrix, Issue 3.0, March 2006
Document History
Date Issue Reason for change Author
April 1996 1.0 First Issue
April 1999 2.0 Second Issue OGNL
March 2006 3.0 Third Issue GSUK / SIEP
The electronic version of this document published on the Group HSE website is the
controlled version.
Superseded issues of this document should be destroyed.
Risk Assessment Matrix, Issue 3.0, March 2006
Table of Contents
Important Introductory Note on Interpretation and Use of the RAM 1
1 Background and Purpose 3
2 Scope and Application 4
3 Description of the RAM 5
4 Instructions for Use of the RAM 7
5 Applications of the RAM 9
5.1 HEMP General 9
5.2 HEMP Projects 10
5.3 HEMP Documented Demonstration of Reduction of Risks to ALARP 10
5.4 HEMP Workplace Hazard Control 11
5.5 HEMP Chronic Effects 11
5.6 Incident Classication and Reporting 12
5.7 Incident Investigation 13
5.8 Classication of Audit Findings 13

6 References 15
Appendix 1 Consequence Categories And Severities 17
Appendix 2 Likelihood Scale 20
Appendix 3 Frequently Asked Questions 21
Appendix 4 Examples 26
Appendix 5 Glossary 34
Risk Assessment Matrix, Issue 3.0, March 2006
Table of Contents
Risk Assessment Matrix, Issue 3.0, March 2006
Risk Assessment Matrix, Issue 3.0, March 2006 1
Important Introductory Note on Interpretation
and Use of the RAM
The Risk Assessment Matrix (RAM) is a tool designed to enable a consistent approach to qualitative
risk assessment. It also establishes a common terminology to support communication about Risk
throughout the Shell Group. To achieve this, the RAM shall be interpreted and used in accordance
with certain fundamental principles:
Some of the terms used in this document may have special or specic meanings in some
countries or contexts, but a different meaning in this document. In order to understand and
use the RAM properly, it is essential that you read the Glossary carefully to make sure you
understand what the specied terms mean here.
As Royal Dutch Shell plc is an English company, some concepts in the RAM are based on English
law. In case of doubt this document should be interpreted in accordance with English law.
RAM assessment refers only to the analysis of specic risks to determine how to categorise them
in RAM terms. A RAM assessment does not generate a decision about the action that should be
taken in respect of any Risk or any nancial or asset management issues. Consequently, a RAM
assessment will always be only one step in a wider process of identication, control, mitigation
or communication of Risk. Section 5 of this document mentions some of these processes to
illustrate where the RAM may be used in practice. It is essential to follow the specic guidance
for each such process.
Important Introductory Note on Interpretation and Use of the RAM
2 Risk Assessment Matrix, Issue 3.0, March 2006
Risk Assessment Matrix, Issue 3.0, March 2006 3
Background and Purpose
Applications of the Risk Assessment Matrix (RAM) have grown signicantly in the six years since the
previous version of this guide was issued. The RAM is now used in a wide range of HSE management
processes either to support judgments about the signicance of risks or to prioritise activities and
allocate resources. It is particularly useful in enabling users to visualise and communicate the level
of risks.
A risk based approach is now applied to the management of issues, activities and resources at all
levels in all Group Businesses and, as a result, the RAM is nding increasing application both in and
outside the HSE eld. It has become a key tool of the Shell Group.
The objectives of the new RAM Guide are:
To enable users to understand the concepts of qualitative risk assessment and the RAM.
To achieve a consistent approach in the application of the RAM to HSE management processes.
To support the application of the RAM in the assessment of HSE risks and prioritisation of
HSE issues.
1 Background and Purpose
1
4 Risk Assessment Matrix, Issue 3.0, March 2006
Scope and Application
This guide describes the RAM and the assessment process. It illustrates the application of the RAM
in a range of HSE management processes with a number of examples and FAQs.
The RAM is also applied in business strategy to assess and prioritise business risks. It is used in the
asset integrity eld where a number of derivative forms of the standard RAM have been developed.
Non-HSE applications such as these are outside the scope of this guide.
This guide replaces the previous version: Risk Assessment Matrix (1999).
2 Scope and Application
2
Risk Assessment Matrix, Issue 3.0, March 2006 5
Description of the RAM
The RAM is a 6 by 5 matrix that is used for qualitative assessments of Risk and for prioritisation of
activities and resources. It is based on the concept of applying experience of events or incidents in
the past to predict risks in the future.
The vertical axis represents increasing Consequences (Severity levels 0 to 5) in terms of
harm to people, damage to assets, effect on the environment and impact on reputation
(PAER categories).
The horizontal axis represents increasing likelihood (levels A to E) of the Consequence
under consideration.
Boxes in the matrix represent levels of Risk, increasing from top left to bottom right corners
of the matrix.
The matrix is divided into blue, yellow and red areas to illustrate the increasing level of Risk.
S
e
v
e
r
i
t
y
CONSEQUENCES INCREASING LIKELIHOOD
P
e
o
p
l
e
A
s
s
e
t
s

E
n
v
i
r
o
n
m
e
n
t
R
e
p
u
t
a
t
i
o
n
A B C D E
Never heard
of in the
Industry
Heard of in
the Industry
Has happened
in the
Organisation
or more than
onece per
year in the
Industry
Has
happened at
the Location
or more than
once per
year in the
Organisation
Has happened
more than
once per
year at the
Location
0
No injury or
health effect
No damage No effect No impact
1
Slight injury or
health effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury or
health effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury or
health effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up to
3 fatalities
Major
damage
Major
effect
Major
impact
5
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
Figure 1: Risk Assessment Matrix
The meaning of blue, yellow and red is described in the sections on the specic applications of the
RAM. In other Group HSE documents, such as the Health Risk Assessment Guide and the Incident
Classication, Investigation and Reporting Guide, the blue, yellow and red areas are labelled Low,
Medium and High to illustrate increasing level of Risk.
The Consequence Severity (0-5) scales in the PAER categories - people, assets, environment and
reputation - are dened in Appendix 1. These severities are consistent with the Group HSE Standard
and related standards.
3 Description of the RAM
3
6 Risk Assessment Matrix, Issue 3.0, March 2006
The Consequence Severities (0-5) scales for each PAER category are not to be inferred as equal. In
particular, they are not to be used to infer the value of a life.
The likelihood levels A to E are dened in Appendix 2, which also includes guidelines on how to
apply them to varying size and complexity of organisation.
3 Description of the RAM
Risk Assessment Matrix, Issue 3.0, March 2006 7
Instructions for Use of the RAM
The starting point for a RAM assessment is an understanding of the Hazard in its context (activity,
location etc.), or an understanding of the particular incident being considered. An assessment
consists of the following steps.
Step 1 Identify potential consequences
Identify the consequences that could develop from a release of the Hazard under the prevailing
conditions. Ask the question: What could happen if the controls dont work or they fail?
For example, the operation of a pump in crude oil service involves the potential for a release of
crude oil in the event of a pump seal failure. Some of the consequences that could result are:
a) Leak of crude oil into the drain system and then into the sea.
b) Ignition of the crude oil resulting in a small re around the pump.
c) Inadequate re ghting and escalation of the re to the point where other process equipment
fails and a major re and explosion occurs.
Refer to Appendix 3, FAQ 1 for further guidance on deciding potential consequences.
Consequences identied in this step are equivalent to the several consequences in a bow-tie
diagram that arise from a hazard release top event.
Step 2 Estimate the Severity of each potential Consequence
For each of the identied consequences assess the Severity (0 - 5) in the four Consequence
categories - people, assets, environment and reputation (PAER). The severities for the PAER
categories are dened in Appendix 1.
In the crude oil pump example above, for the consequence in which crude oil leaks from the pump
seal and ows through the drain system into the sea, there could be impacts in 3 Consequence
categories - asset, environment and reputation.
Step 3 Estimate the Likelihood
For each of the potential consequences make an estimate of the Likelihood of the Consequence in
terms of the Likelihood levels A to E.
The Likelihood level should be judged from past experience, by asking the question: How often in
the past has a hazard release resulted in a Consequence similar to the one that we are considering?
The approach is one of applying history to predict the future.
4 Instructions for Use of the RAM
4
8 Risk Assessment Matrix, Issue 3.0, March 2006
The estimate of Likelihood should be based on the Likelihood of the particular Consequence under
consideration, not on the Likelihood of the Hazard being realised or incident occurring.
In the example above an estimate should be made of the likelihood of the crude oil pump seal leak
resulting in oil into the sea, not the likelihood that the pump seal will leak.
Refer to Appendix 3, FAQ 2 for another example of the correct way of estimating Likelihood.
The reliability of the Likelihood estimate, and therefore of the RAM assessment, depends to a large
extent on the availability of data on previous incidents and on the knowledge and experience of
the assessors. It is therefore important to maintain databases of previous incidents and make them
available to everyone who will be making RAM assessments.
The hazard release scenario or the incident under consideration will often not be identical to the
previous incidents that are being used to predict likelihood. Also, detailed information on previous
incidents outside the Organisation, or even outside the Location, may not be readily available
in some companies. Therefore, a combination of available information and judgment from
experience has to be applied to make a best estimate of the Likelihood level A to E.
Refer to Appendix 3, FAQ 3, 4 and 5 for more detailed guidance on estimating Likelihood and the
applicability of previous incidents.
Step 4 Estimate the risk rating
For each potential Consequence determine the risk rating for each of the applicable PAER
categories in terms of the product of the Consequence Severity and the Likelihood. The risk
ratings (up to 4 for each potential Consequence) can be plotted on the matrix to provide a
visual representation of the risk prole of the hazard release scenario under consideration.
Refer to Appendix 3, FAQ 6 for further explanation and to Appendix 4 examples 1 and 4 for the
visual representation.
The recommended convention for expressing risk ratings is in the form People 2B or
Reputation 4C.
Risk ratings derived in this way reect the controls that have typically been applied in the Location
or Organisation over the period for which previous incidents were used to estimate Likelihood.
There is normally insufcient data on these previous incidents to allow the Likelihood estimates,
and therefore the RAM ratings, to be re-estimated for the situation with additional controls in
place. It is therefore recommended not to use the RAM to assess the effect of additional controls
on the level of Risk. The residual risk after applying additional controls should be judged against the
applicable Tolerability Criteria.
4 Instructions for Use of the RAM
Risk Assessment Matrix, Issue 3.0, March 2006 9
Applications of the RAM
Risk assessment is an important step in a number of processes used in the Group. Each of these
processes is governed by its own detailed protocols, which specify how the RAM is to be used in
that context. This section outlines some of these processes, and describes how the RAM ts into
them. It also indicates where to nd detailed guidance on these processes. It is essential to consult
the detailed guidance and not to rely on the following descriptions.
HEMP - General
The Hazards and Effects Management Process (HEMP) involves the three fundamental steps
of identifying the hazards inherent in an activity, assessing the risks and implementing control
measures. The RAM is used for the assessment step as it has proven to be an effective means of
visualising the factors that determine Risk and of communicating the outcome of the assessment.
When the RAM is applied in major projects or companies or at the site/facility level to assist in
evaluating risks in light of the agreed risk Tolerability Criteria, the blue, yellow and red areas are
normally described as follows:
Blue - Manage for continuous improvement.
Yellow - Incorporate risk reduction measures. Control to ALARP.
Red - Incorporate risk reduction measures. Control to ALARP. Tolerability of Risk to be endorsed
by the line manager directly accountable for the Location or Organisation.

Businesses may wish to show an area of lower Risk and a lower priority for actions and resources
in the top left hand corner of the RAM (boxes 0(A-E), 1A, 2A and 1B). This area could be described
Manage in-line with business needs.
It is important to remember that a Risk assessed in the red area does not automatically mean that
the Risk is intolerable. Nor does a Risk in the yellow area mean that the Risk is acceptable. It is still
necessary for Management to be satised that all risks have been reduced to ALARP. Use of the
boundary between red and yellow areas as a hard decision criterion should be avoided. Experience
has shown that such use can lead to manipulation of data and decisions with a negative impact,
e.g. on asset integrity. Appendix 3 and FAQ 7, 8 and 9 illustrate application of the RAM in risk-based
decision making.
A Risk assessed in the bottom left-hand corner of the RAM implies a) there are potentially major
consequences and b) there is little history to guide us in judging the likelihood of these potential
consequences. This situation can occur when applying novel technology or new substances. If
insufcient knowledge and experience is available from similar processes it will be necessary to
conduct a more detailed consequence analysis and risk assessment than can be achieved with the
RAM. It is also necessary to adopt a conservative approach to the risk assessment, to recognise
uncertainty in the level of Risk associated with new technology or new substances. Refer to
Appendix 3,FAQ 10 for more detailed guidance.
5 Applications of the RAM
5
5.1
10 Risk Assessment Matrix, Issue 3.0, March 2006
Refer to Appendix 4, Example 1, which illustrates the application of the RAM in HSE risk
management.
The requirements for HEMP are detailed in the HEMP standards and guidance issued by the
Group Businesses.
HEMP - Projects
The RAM is applied during all phases of the life cycle of an oil production facility, renery, chemical
plant or other operation. During the design phases the focus is on the hazards inherent in the
process or facility and in evaluating the adequacy of proposed designs and options available to
the designers. In the early stages of design the risk of hazard release scenarios can be assessed
using the RAM, with Consequence and Likelihood estimates that reect Industry experience with
standard controls in place. This assessment enables project managers to prioritise the design
issues and to decide whether additional controls, over and above standard industry practice, are
reasonably practicable and should be adopted.
At the end of the design phase the risks are reassessed using the RAM with the additional design
measures and controls in place. Where there is no historical incident data for the situation with
additional controls, the estimated reduction in Consequence and/or Likelihood is based largely on
the experience and judgment of the assessors supported by the quantitative and qualitative risk
assessments performed during the design process. This assessment demonstrates the reduction in
risks during the design process and provides an assessment of the residual risks in the design that can
be passed on to the plant operator and managed through the operational HSE-MS and procedures.
Refer to Appendix 4, Example 2, which illustrates the application of the RAM in projects.
The application of HEMP to projects is detailed in guidance issued by the Group Businesses.
HEMP - Documented Demonstration of Reduction of Risks to ALARP
The Group HSE-MS Procedure requires a documented demonstration that HSE risks in the red and
yellow areas of the RAM have been reduced to ALARP. When the RAM is used for this purpose the
three areas are typically described as follows:
Blue - Apply controls that are specied in the HSE-MS.
Yellow - Demonstrate control through the HSE-MS and hazard control sheets.
Red - Demonstrate control through an HSE Case.

The requirements for a documented demonstration of reduction of risks to ALARP are described in
the Group Procedure for an HSE Management System.
5 Applications of the RAM
5.2
5.3
Risk Assessment Matrix, Issue 3.0, March 2006 11
HEMP - Workplace Hazard Control
The RAM is applied in the planning of non-routine operations, maintenance, shutdown and
construction activities, to assess the risks of the proposed work as input to deciding the extent of
analysis of the Hazards.
After identifying the hazards of the proposed work the associated risks are assessed on the RAM.
The resultant planning and control actions are typically as follows:
Blue Apply the Location controls, such as work instructions, permit to work, supervision and
daily work team discussions.
Yellow Conduct a job hazard analysis (JHA). To be done by the supervisors and work team, to
identify any controls needed in addition to the Location controls. The resulting controls
and instructions are communicated to the work team before the work starts.
Red Conduct a detailed job hazard analysis. To be done by the supervisor controlling the
work, supported by engineers and/or HSE specialists and endorsed by management.
The resulting controls and instructions are communicated to the work team before the
work starts.

Any relevant health hazards, which have been identied and assessed through the Health Risk
Assessment process, should be included in the JHA and resultant controls.
The need and extent of hazard analysis will be determined not only by the RAM assessment but
also by how non-routine and complex the work is and by whether procedures or an existing job
hazard analysis are available for the proposed work.
The application of HEMP to workplace hazard control is detailed in the EP guidance on Job Hazard
Analysis and other Group Business guidance.
HEMP - Chronic Effects
Many health and environmental Hazards have chronic effects. Evidence of actual harm to people
or actual effect on the environment may not appear for many years after the exposure. For such
Hazards the estimated Likelihood based on events or incidents in the past 2, 5, 10 years may not
adequately reect the Likelihood of harm or impacts in future. A precautionary approach is needed
when assessing the Risk on the RAM.
The process for assessing the chronic effects of health and environment Hazards comprises the
following steps:
1 Dene the hazard release scenario or incident in terms of exceeding a threshold above which
there is the potential for adverse consequences. Examples are:
Occupational exposure limit (OEL) for health hazards.
Predicted No Effect Concentration (PNEC) for environmental hazards.
5.5
5 Applications of the RAM
5.4
12 Risk Assessment Matrix, Issue 3.0, March 2006
Prescribed limits for environmental hazards. PNEC is usually related to the environmental
receptor but is often reected in a prescribed limit at a discharge point. The prescribed limit
can then be taken as the threshold and the starting point for a RAM assessment. For example,
the water outfall from a site may have an oil in water limit prescribed so as to prevent the
PNEC for oil in the open sea being exceeded.
2. Estimate the potential consequences of exceeding the threshold in terms of the PAER Severity
categories. For chronic health hazards the potential consequences can be estimated from an
existing health risk assessment. For chronic environmental hazards the potential consequences
can be estimated from either:
An existing environmental impact assessment, or
The extent, frequency or duration of exceeding the threshold, assuming that exceedances
will or may lead to environmental damage.
3. Estimate the Likelihood of these potential consequences from historical evidence of the effects.
Where necessary support the estimate by professional assessments based on literature and/or
experimental data.

Appendix 4, Example 3 illustrates the application of the RAM to the assessment of chronic hazards.
The application of HEMP to chronic health and environmental hazards is detailed in the Group HSE
guidance on Health Risk Assessment and Impact Assessment.
Incident Classication and Reporting
The actual Consequence Severity on the RAM is used to determine the requirements for
notication and reporting of incidents to Group Businesses. Refer to the Group HSE publication
Incident Classication, Investigation and Reporting for the applicable Group standard and
guidelines (Currently incidents with an HSE Consequences Severity 4 or 5 have to be reported to
the Group business).
Actual RAM ratings of incidents should be expressed in the form Assets 3 or Environment 4. Note
that incidents may have Consequences in more than one PAER category. When using the RAM
diagram to display the actual RAM rating of an incident, it is recommended to show the ratings as
boxes on the Consequence scale as shown in Appendix 4, Example 4.
For the example in Section 3 involving a leak of crude oil via the drain system into the sea the
consequences might be the nancial loss of crude oil not recovered and vaporised, environmental
damage to the beach and adverse attention by the national media. The consequences might also
extend to harm to the people clearing up the spill should they inhale vapours or come in contact
with the crude oil. The RAM Consequence Severity might be People 3, Assets 2, Environment 3 and
Reputation 4.
5 Applications of the RAM
5.6
Risk Assessment Matrix, Issue 3.0, March 2006 13
Incident Investigation
The Risk rating of an incident is one of the factors that decide the level of investigation. The
intention is to investigate thoroughly and maximise the learning from incidents where there was
a risk of a much more serious consequence, by focusing more resources on the investigation and
follow-up of higher risk incidents.
Businesses should implement procedures that detail the extent of investigation and analysis, the
methods to be used and the responsibilities for both investigation and follow-up for the three areas
of the RAM. Typical criteria are as follows:
Blue - Investigation to identify the causes and necessary corrective actions. The investigation
method should allow for classication and trend analysis of causes. Follow-up is within the
plant or area.
Yellow - Full investigation to identify the underlying causes and any weaknesses in HSE
management. Follow up is by Location or Organisation management.
Red - Full investigation and root cause analysis to establish the weaknesses in HSE management,
including latent failures. Organisation management both sponsors the investigation and
endorses the follow-up actions.

The Risk rating of an incident is determined from Consequence and Likelihood, applying the
normal RAM method described in Section 4. The incident that is being assessed should be counted
in the Likelihood of the Consequence that happened in this particular incident.
Appendix 3, FAQ 11 and 12 illustrate correct use of the RAM when assessing incidents.
Risk ratings of incidents should be expressed in the form Assets 3 D or Environment 4 B. When
using the RAM diagram to display the Risk rating of an incident, it is recommended to show the
ratings as boxes on the full matrix as shown in Appendix 4, Example 4.
Refer to the Group HSE publication Incident Classication, Investigation and Reporting for the
recommended investigation and root cause analysis methods and follow-up.
Classication of Audit Findings
The ndings of HSE audits, including independent HSE-MS audits, are normally classied into
four Severity levels Serious, High, Medium and Low - using the normal RAM method with the
following variations:
Consequence - potential consequences should an incident occur as a result of the control failure.
Likelihood - previous occurrence of this consequence due to this type of control failure.
Risk - resultant risk if the failure or weakness is allowed to continue.

Appendix 4, Example 6 illustrates application of these variations when assessing an audit nding.
5 Applications of the RAM
5.7
5.8
14 Risk Assessment Matrix, Issue 3.0, March 2006
The resultant risk rating of the nding is plotted on the standard three area RAM and then classied
as follows:
Boxes 0(A-E), 1A, 2A and 1B - Low
Blue except boxes 0(A-E), 1A, 2A and 1B - Medium
Yellow - High
Red - Serious

Businesses may wish to show an area for Low ndings in the top left hand corner of the RAM (boxes
0(A-E), 1A, 2A and 1B) shaded pale blue.
Classication of audit ndings in this way provides the basis for prioritisation of the resultant
remedial and improvement actions. The requirements and guidance are described in detail in the
Group HSE Auditing Guidelines.
5 Applications of the RAM
Risk Assessment Matrix, Issue 3.0, March 2006 15
References
1. Group HSE publications:
1.1 Group Procedure for an HSE Management System, 1997
1.2 Group HSE Management System, HSE Advisers Panel, 2002
1.3 Health Risk Assessment, HSE Advisers Panel, 2001
1.4 Incident Classication, Investigation and Reporting, HSE Advisers Panel, 2002
1.5 Group HSE Auditing Guidelines, HSE Advisers Panel, 2001
http://sww05.europe.shell.com/hse/group/hse/hse_publications/publications.htm
2. EP 95000 and EP 2005 standards and guidance:
2.1 Job hazard analysis, EP95-0311
2.2 Standard: HSE HEMP and ALARP, EP 2005-0100
http://sww.shell.com/ep/corporate_support/eps_hsse/HSE Framework/ep business hse
control framework.html
3. Project Guide 1, SGSI, 2003
4. Good Practice and Pitfalls in Risk Assessment, UK HSE, 2003
6 References
6
16 Risk Assessment Matrix, Issue 3.0, March 2006
Risk Assessment Matrix, Issue 3.0, March 2006 17
Appendix 1 Consequence Categories and Severities
The following tables contain the description and denition of the Severity levels in each of the PAER
categories, followed by examples as bullet points.
Harm to People
Level Denition
0 No injury or health effect
1 Slight injury or health effect Not affecting work performance and not affecting Daily Life Activities. Examples:
First aid cases and medical treatment cases.
Exposure to health hazards that give rise to noticeable discomfort, minor irritation or transient effects
reversible after exposure stops.
2 Minor injury or health effect Affecting work performance, such as restriction to work activities or need to
take up to 5 days to fully recover. Or affecting Daily Life Activities for up to 5 days. Or reversible health effects.
Examples:
Restricted work day cases or lost work day cases resulting in up to 5 calendar days away from work.
Illnesses such as skin irritation or food poisoning.
3 Major injury or health effect Affecting work performance in the longer term, such as absence from work
for more than 5 days. Or affecting Daily Life Activities for more than 5 days. Or irreversible damage to health.
Examples:
Long term disabilities (previously called Permanent Partial Disabilities).
Illnesses such as sensitisation, noise induced hearing loss, chronic back injury, repetitive strain injury or
stress.
4 Permanent total disability or up to three fatalities resulting from injury or occupational illness. Examples:
Illnesses such as corrosive burns, asbestosis, silicosis, cancer and serious work related depression.
Car accident resulting in 1, 2 or 3 fatalities.
5 More than three fatalities resulting from injury or occupational illness. Examples:
Multiple asbestosis cases traced to a single exposure situation.
Cancer to a large exposed population.
Major re or explosion resulting in more than 3 fatalities.
Asset Damage and other Consequential Business Loss
Level Denition
0 No damage
1 Slight damage - Costs less than 10,000 US$. Example:
No disruption to operation.
2 Minor damage - Costs between 10,000 and 100,000 US$. Example:
Brief disruption to operation.
3 Moderate damage - Costs between 100,000 and 1 million US$. Example:
Partial shutdown.
4 Major damage - Costs between 1 and 10 million US$. Example:
Up to two weeks shutdown.
5 Massive damage - Costs in excess of 10 million US$. Example:
Substantial or total loss of operation.
Appendix 1 Consequence Categories and Severities
18 Risk Assessment Matrix, Issue 3.0, March 2006
Environmental Effect
The bullet points in the environmental effect table are a mixture of:
Effects, e.g. groundwater contamination.
Events with the potential for environmental effect, e.g. exceeding a limit.
Indicators of potential effects, e.g. complaints.
Level Denition
0 No effect.
1 Slight effect
Slight environmental damage contained within the premises. Example:
Small spill in process area or tank farm area that readily evaporates.
2 Minor effect
Minor environmental damage, but no lasting effect. Examples:
Small spill off-site that seeps into the ground.
On-site groundwater contamination.
Complaints from up to 10 individuals.
Single exceedance of statutory or other prescribed limit.
3 Moderate effect
Limited environmental damage that will persist or require cleaning up. Examples:
Spill from a pipeline into soil/sand that requires removal and disposal of a large quantity of soil/sand.
Observed off-site effects or damage, e.g. sh kill or damaged vegetation.
Off-site groundwater contamination.
Complaints from community organisations (or more than 10 complaints from individuals).
Frequent exceedance of statutory or other prescribed limit, with potential long term effect.
4 Major effect
Severe environmental damage that will require extensive measures to restore benecial uses of the
environment. Examples:
Oil spill at a jetty during tanker (off) loading that ends up on local beaches, requiring clean-up operations.
Off-site groundwater contamination over an extensive area.
Many complaints from community organisations or local authorities.
Extended exceedances of statutory or other prescribed limits, with potential long term effects.
5 Massive effect
Persistent severe environmental damage that will lead to loss of commercial, recreational use or loss of natural
resources over a wide area. Example:
Crude oil spillage resulting in pollution of a large part of a river estuary and extensive clean-up and
remediation measures.
Appendix 1 Consequence Categories and Severities
Risk Assessment Matrix, Issue 3.0, March 2006 19
Impact On Reputation
Level Denition
0 No impact
1 Slight impact
Local public awareness but no discernible concern.
No media coverage.
2 Minor impact
Local public concern.
Local media coverage.
3 Moderate impact - Signicant impact in region or country
Regional public concern.
Local stakeholders, e.g. community, NGO, industry and government, are aware.
Extensive attention in local media. Some regional or national media coverage.
4 Major impact - Likely to escalate and affect Group reputation
National public concern.
Impact on local and national stakeholder relations. National government and NGO involvement with
potential for international NGO action.
Extensive attention in national media. Some international coverage.
Potential for regulatory action leading to restricted operations or impact on operating licences.
5 Massive impact - Severe impact on Group reputation
International public concern.
High level of concern amongst governments and action by international NGOs.
International media attention.
Signicant potential for effect on national/international standards with impact on access to new areas,
grants of licences and/or tax legislation.

Appendix 1 Consequence Categories and Severities
20 Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 2 Likelihood Scale
The scale of increasing Likelihood is intended to represent a range from highly unlikely to frequent.
It is expressed in terms of frequency of events per period per Industry, Organisation or Location.
These descriptions should be used in every application of the RAM so as to promote consistent
assessment of risk.
Increasing Likelihood
A B C D E
Never heard of in the
Industry
Heard of in the
Industry
Has happened in the
Organisation or more
than once per year in
the Industry
Has happened at the
Location or more
than once per year in
the Organisation
Has happened more
than once per year in
the Location
The terms Industry, Organisation and Location are dened in the Glossary. Group Businesses will
provide detailed guidance on the application of these terms to their organisations. They should
update the guidance as the organisation changes.
For most applications of the RAM it is recommended not to express Likelihood in terms of
decimal or percentages, as this cannot be supported by the quality of the input data. For the
few applications where historical incident or failure data is available to calculate Likelihood, e.g.
quantied risk assessment (QRA) and layer of protection analysis (LOPA), caution must be exercised
in using numerical Likelihood scales, for the following reasons:
Quantied risk assessments, and semi-quantitative risk determinations using the RAM can
inform a decision, but it is still necessary to judge the acceptability of Risks against all the
applicable Tolerability Criteria.
If the RAM is used for quantitative assessments ensure that the Likelihood ranges selected for
each column are consistent with the Likelihood scale descriptions of the standard RAM and
guidance from the Group Business on their application.

Appendix 2 Likelihood Scale
Risk Assessment Matrix, Issue 3.0, March 2006 21
Appendix 3 Frequently Asked Questions
FAQ 1
Q. When we are assessing the potential consequences of an incident and trying to decide what
could have happened, how much imagination should we use?
A. You should ask the question: What if? For example:
What if the gas had ignited?
What if the scaffolder had not been clipped on when he slipped?
What if it was raining or the wind was in a different direction?

Wherever possible you should refer to incident reports and databases to nd out what has
happened previously in similar circumstance. You need to recognise that the circumstances of
two incidents are never exactly the same; therefore experience and imagination also play a part.
However, dont be too imaginative:
Avoid what ifs that could not occur under the circumstances of the particular incident.
For example: if a person tripped and fell to the ground at the same level should this be
considered as a potential fatality? It all depends. If it was possible to strike the head against a
valve stem or concrete curb when falling, the answer is probably yes. (Although not common
fatalities have resulted from falls at the same level) If there was no realistic possibility of a
severe blow to the head when falling, the answer is probably no.
Avoid highly unlikely what ifs such as amputation resulting from infection of a cut.
Avoid stringing too many what ifs together to produce an incredible consequence. If two
or more what ifs are needed for a consequence to be realised, each should be challenged to
establish that when they are combined, the overall consequence is credible.
FAQ 2
Q. People ride bicycles every day (Likelihood E). Falling off a bike could result in a broken arm
(Severity 3). Does this mean that bike riding should be assessed as People 3E (red area of the
RAM)?
A. No. You need to nd out or estimate how often in the past falls from a bike have resulted in
broken arms. If the answer is that there have been no broken arms in our business but it must
have happened somewhere in Industry, then the Likelihood should be B. The assessed Risk of
riding a bike should therefore be People 3B (blue area of the RAM).
The potential worst-case Consequence and potential worst-case Likelihood should not be
combined when using the RAM because it will lead to an overestimate of the Risk.
Appendix 3 Frequently Asked Questions
22 Risk Assessment Matrix, Issue 3.0, March 2006
FAQ 3
Q. How do we know if something has happened before in Industry? Our incident databases are not
very comprehensive when it comes to incidents outside our Organisation.
A. Virtually all the possible task (workplace) related consequences have happened somewhere at
some time. They may not have happened in our Organisation or even in the oil/petrochemical
industry. But when we are looking at a common industry-wide situation such as working at
height, an incident in a biscuit factory is just as relevant as an incident on an oil renery. We
can often apply our experience and judgment to conclude that it must have happened and is
therefore in column B. We may even nd Industry data that indicates that similar incidents have
happened more than once per year, in which case the Likelihood should be placed in column C.
With process related hazards, which are generally high consequence and low likelihood, you
cannot make the same assumption. It is essential to search incident databases or talk to HSE and
technical specialists for data on previous incidents. You also have to decide if these are similar
incidents in similar situations to the hazard release scenario under consideration and therefore
valid precedents. If there is no evidence of previous incidents the scenario may be assessed
theoretical and put in column A.

FAQ 4
Q. We have suffered several serious spill incidents in the past but in recent years there have been
none. Should we now estimate Likelihood on the basis of numbers of incidents in the recent
years?
A. No. The fact that there have been no spill incidents in the last few years does not mean that the
Likelihood is now lower than it was previously. It could be pure chance or it could be that the
controls have been applied more rigorously in the last few years. If it is the latter, the situation
could easily reverse in the next few years. Dont forget that controls corrode faster than steel
and the hazard release potential is still there. By retaining a Likelihood estimate based on the
longer-term history, you keep the pressure on to maintain adequate and effective controls in
future.
Another example: 10 years ago we set a requirement for window cleaners to work from
scaffolds or with fall arrestors and have applied it rigorously ever since. As a result we have had
no further falls. In the previous 10 years there were two falls in our Organisation. We should
not conclude that the Risk of falling during window cleaning is now People 4B. The Risk is still
People 4C.
Appendix 3 Risk Assessment Matrix Application Examples
Risk Assessment Matrix, Issue 3.0, March 2006 23
FAQ 5
Q. We used to transfer personnel to an offshore platform by helicopter. Following a number of
helicopter incidents over the past 15 years, we have decided to make the transfers by ship in
future. When we reassess the risks of personnel transfer should we take account of the earlier
incidents?
A. Probably not. If the previous incidents all related to the operation of helicopters they are not
valid precedents for the new situation. The hazard release scenario has changed. You should
seek data on incidents involving transfer of personnel by ship as basis for a Likelihood estimate
of incidents in future.
That was a clear-cut example. Now consider the window-cleaning example in FAQ 4. Suppose
that 10 years ago we took the additional step of redesigning the windows so that they could be
rotated though 180 deg. and washed from inside. But it is still necessary to lean out from the
windowsill to reach some parts of the outside of the windowpane. Now it is less clear whether
the inherent risk of falling is still 4C, or has reduced to 4B. A judgment has to be made whether
the hazard release scenario is still essentially the same or has fundamentally changed.

FAQ 6
Q. When we look at several potential consequences from an incident or a hazard release scenario,
will the Consequence with the highest Severity also have the highest RAM rating?
A. Not necessarily. A Consequence that is assessed 3E will be in the red area whereas a
Consequence assessed 5B will be in the yellow area.
In general the high severity consequences tend to be infrequent and the lower severity
consequences tend to happen more often. This means that if there are several possible
consequences from an incident or hazard release scenario their respective Risk ratings will
tend to be distributed across an equi-risk diagonal of the RAM, i.e. bottom left to top right. It is
good practice to check out and document at least one high severity Consequence and one high
frequency Consequence, to be sure that the Risk is properly characterised.

FAQ 7
Q. A risk assessment of all activities in our business unit (part of HEMP) has concluded that there are
two major risks in the red area of the RAM:
Transfer of staff by road between the various plants.
Operation of one particular plant, which under certain operating conditions releases
hydrogen sulphide to atmosphere.

Over the past 5 years we have implemented a programme of improvements to the hydrogen
sulphide containing plant. This included both additional instrument safeguarding systems
and improvements to the shutdown procedures and emergency response. The possibility of
Appendix 3 Risk Assessment Matrix Application Examples
24 Risk Assessment Matrix, Issue 3.0, March 2006
hydrogen sulphide being released has not been eliminated but the Risk of plant operators and
contractors being affected has been signicantly reduced. During the same period we have
undertaken a couple of defensive driving campaigns but the driving standards are still not
acceptable and there have been two more fatalities.
In the RAM screening of potential activities for next years HSE Plan we show the hydrogen
sulphide containing plant in the yellow. This emphasises that road transport is the top priority. Is
this a correct use of the RAM?
A. No. The potential for the plant to release hydrogen sulphide is still there and correct application
of the RAM requires that the RAM rating remain in the red area. However, in an exercise to rank
and prioritise a number of activities that are competing for the same resource, it is appropriate
to use the RAM to visualise the alternatives. In this case you could show the plant operations Risk
moving towards the top left hand corner of the RAM.
You should not conclude from this movement that the plant operations Risk is now acceptable
and that nothing further needs to be done. It is still necessary to assess whether the residual
risks are ALARP.

FAQ 8
Q. There are many fatal road transport incidents each year in our Organisation. The Risks of
transporting products by road is assessed People 4D. Does this mean that road transport of
products is an intolerable risk and should be stopped?
A. No. The RAM is a tool to help prioritise the risks and issues that need to be addressed as input
to the decision on how to allocate resources. Road transport of products is in the red area and
should therefore be a top priority for senior management. The RAM should not be used to
decide if the Risk is acceptable. The applicable Tolerability Criteria and the ALARP process should
be used to decide the acceptability of risks.

FAQ 9
Q. One of the scenarios we assessed in a HEMP study was the seal failure on a crude oil transfer
pump and the associated Risk of the crude oil leak igniting and escalating to a major re
(Consequence Severity Assets 4). Our incident database revealed that there have been 2
incidents in our Organisation in the past 5 years in which crude oil pumps failed and the
incidents escalated to major res. Neither of these incidents was caused by pump seal failure. Is
it correct to conclude that the Likelihood of this failure scenario is B?
A. No. If you assess the Risk of failure of an individual component on the RAM, you are guilty of
salami-slicing, which means cutting up the Risk into small components so that the assessed
Risk of each component is lower. This practice commonly leads to an underestimate of the
overall risks and too low a priority for the resulting actions.
Appendix 3 Risk Assessment Matrix Application Examples
Risk Assessment Matrix, Issue 3.0, March 2006 25
The intended use of the RAM is to assess the risks of failure of a whole system. In this example
the scenario that should be assessed is failure of the crude oil pump escalating to a major re,
which is Likelihood C.

FAQ 10
Q. How should we assess the risks associated with a new business or a new plant design? We have
no history as a guide to the future. What about the application of novel technology?
A. A Likelihood estimate in columns C, D or E is not possible. We should therefore draw on
the experience of all those involved in the design and operation of the new plant and their
knowledge of incidents in similar situations. We may be able to look at similar operations in
other companies. The idea is to create a synthetic history for the new plant.
In the case of novel technology there may be no industry experience to draw on. For high hazard
processes (lower left corner of the RAM) it is probably not appropriate to use the RAM to assess
the Risk. It may be necessary to conduct detailed consequence or impact analysis and quantied
risk assessments.

FAQ 11
Q. We suffered a serious injury incident (severity 3) yesterday but before that we have never had
such an incident. Can we say that the Risk is People 3B because that was the rating before
yesterday and the Risk has not changed as a result of the incident?
A. The Risk has not changed but it may have been underestimated before the incident yesterday.
There may have been near misses that luckily did not lead to serious injuries. Anyway, the
correct use of the RAM is to include the incident yesterday in the Likelihood estimate. The RAM
rating should be People 3D.

FAQ 12
Q. We have just had a serious incident that could have been a fatality but in fact was a minor injury
requiring restricted work (Severity 2). We assessed it People 4C because we had an almost
identical incident previously, which also could have been a fatality. Is this correct?
A. No. As neither incident resulted in a fatality the RAM rating should be People 2D. If the two
incidents happened in the same year the rating would be 2E. If a fatality is something that must
have happened in Industry then an alternative rating would be 4B.
The purpose of the RAM assessment of the latest incident is to decide the level of investigation
and follow-up. Management will also take into account other factors such as the complexity of
the incident and how similar it is to the previous one when deciding how thorough an analysis
is needed. It is clearly inappropriate to consider how effective the controls were in deciding the
RAM rating, as this will not be known until the investigation has been carried out.
Appendix 3 Risk Assessment Matrix Application Examples
26 Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 4 Examples
The following are hypothetical examples intended to illustrate and explain the RAM assessment
process. They do not reect actual experience or incidents in Shell Group Businesses.
Example 1 Hazard and Effect Management
A hazard identication exercise on a gas stabilisation unit establishes that one of the hazard release
scenarios (top events) is a seal blow out on a gasoline pump. A serious leak of gasoline could ignite
and, if the resulting re is not controlled, it could escalate to an explosion in the plant area. A
further possibility is that the gasoline could run off via the drain system into the plant interceptor. If
the gasoline is not contained in the interceptor it could lead to pollution of the estuary.
Assess the Risk of this hazardous release scenario. Make use of the following information
about earlier incidents.
There was a similar incident 2 months ago and another 11 months ago. In both these incidents
oil passed through the interceptor and polluted the estuary. Both incidents were reported to the
Environmental Agency as a breach of consent. The estuary is an environmentally sensitive area and
the incident 2 months ago was reported in the national media.
The Organisation suffered an incident at another site 2 years ago in which a spill of gasoil in the
tank area ignited. The re was restricted to the one tank bund, but it resulted in US $ 3.5 M of
equipment damage. No one was injured.
There was an incident 7 years ago at another of the Organisations sites in which a similar spill of
gasoline resulting from a pump failure in the stabilisation unit was allowed to get out of control. In
this case re damaged the stabiliser column, which eventually ruptured. The resulting explosion
led to 2 operators being seriously injured (internal injuries and broken bones; off work for several
months), US$ 50 M of equipment damage and the plant shutdown for 3 months.
Answer
Asking the question: What if? reveals 3 distinct potential consequences oil in the estuary, re
damage and escalation to a major explosion. Applying the knowledge of previous similar incidents
at this Location and elsewhere in the Organisation we come to the following RAM ratings.
Potential Consequence People Assets Environment Reputation
Fire damage 4C
Major explosion 3C 5C
Oil in the estuary 3E 4D
Appendix 4 Examples
Risk Assessment Matrix, Issue 3.0, March 2006 27
S
e
v
e
r
i
t
y
CONSEQUENCES INCREASING LIKELIHOOD
P
e
o
p
l
e
A
s
s
e
t
s

E
n
v
i
r
o
n
m
e
n
t
R
e
p
u
t
a
t
i
o
n
A B C D E
Never heard of
in the Industry
Heard of in the
Industry
Has happened
in the
Organisation
or more than
onece per year
in the Industry
Has happened
at the Location
or more than
once per
year in the
Organisation
Has happened
more than once
per year at the
Location
0
No injury or
health effect
No damage No effect No impact
1
Slight injury or
health effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury or
health effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury or
health effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up to
3 fatalities
Major
damage
Major
effect
Major
impact
5
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact



Comment:
Fire damage. This previous incident was a spill of gasoil rather than gasoline, and it resulted from
a pipe rupture in a tank bund rather than a pump seal blow out in the process area. Although
the Consequence of a re is credibly what could happen in the situation we are considering,
the initiating incident was quite different. It is questionable whether this should be taken as a
precedent for assessing the present situation. However, in this example a major explosion is the
risk-determining scenario.
Example 2 Project Hazard and Effect Management
A project needs to transport 3300 pipe joints from the port of entry to the construction
contractors coating facility. The distance is about 200km and the options are:
Transport by road on public highways 5 joints per load.
Transport by barge through inland waterways.

The region has signicant security concerns with theft, piracy, hijacking and hostage taking
commonplace within the oil eld operations. The roads are generally single carriageway, of poor
quality and can become very overcrowded in the vicinity of built up areas.
Assess the risks associated with the two transport options.
Pollution of
estuary
National media
attention
Major explosion
damage
Fire damage Serious injury
Appendix 4 Examples
28 Risk Assessment Matrix, Issue 3.0, March 2006
Road Transport
The most signicant hazard release potential is a road trafc accident. The potential consequences
of this option are:
Injury to contractor personnel and third parties, including fatalities.
Community and environmental impact of substantial road transport operation.

The Risk associated with a road trafc accident is assessed as People 4D, because there have been
several fatal road accidents per year in this Organisation, although none on this project.
Road transport of the pipe joints will have a considerable impact on third parties, primarily the
local communities who live along the main roads, but also other road users. This Risk is assessed as
Environment 2E, as 2-3 loads per day is considered to be continuous impact.
Marine Transport
The most signicant hazard release potential is seizing of a barge by pirates and subsequent
hostage taking. The potential consequences of this option are:
Injury and possible fatalities to contractor personnel.
Damage or loss of barge and pipe joints with impact on project schedule.

The Risk of fatalities is assessed as People 4D as there have been several marine incidents per year
in the Organisation in which hostages were taken. At least one per year resulted in fatalities.
The estimated cost of losses in these marine incidents has been in the range US$ 2-500,000. The
asset damage Risk is assessed as Assets 3D.
Overall assessment
The initial RAM assessment of both options is Red. The HSE objectives for the Project and the HSE
standards of the Organisation require that additional measures have to be put in place to reduce
high Risks to ALARP.
Risk reduction
The road proposed for the road transport option is a busy main thoroughfare crossing the
region. In parts it is narrow and in need of repair, and it cuts through many towns and villages.
It is impractical to improve the standard of road or to take other measures over and above the
normal controls on vehicle standards, defensive driving and journey management. There are no
alternative routes.
The waterways between the port of entry and the construction contractors coating facility are
prone to piracy and attacks from armed groups intent on stealing equipment or taking personnel
hostage. The marine transport would therefore require comprehensive security protection in the
form of escorts to mitigate this risk. The Organisation security adviser has conrmed that such
measures would signicantly reduce the risk. The risk of drowning also needs to be controlled by
appropriate measures, such as certied vessels and equipment, no night sailing, route planning
and life vests.
Appendix 4 Examples
Risk Assessment Matrix, Issue 3.0, March 2006 29
Residual Risk
A reassessment of the two options with additional measures taken into account shows that the
road transport option remains a signicant risk, whereas the marine transport option can be been
reduced by the additional security measures. The RAM can be used to visualise the change in Risk
for the two options.
Example 3 Incident with potential chronic health effect
A spill of benzene on an Aromatics plant went into the normal plant drain system, instead of the
closed benzene collection system. The total spill was 800kg, which was contained within the
Aromatics plant and then pumped to the benzene collection system. Operations and emergency
personnel involved in the clear-up wore suitable protective clothing and subsequent medical
surveillance conrmed that no-one had received an excessive dose of benzene. Benzene in air
measurements were in the range 10-20 ppm during the incident. (The OEL of benzene is 1ppm)
Make use of available information from previous incidents to assess this latest incident on
the RAM.
As the atmospheric concentration of benzene was above the OEL for benzene this should be
treated as an incident and assessed on the RAM. There have been similar incidents previously
approximately one each year on this plant. In an incident 3 years ago two remen involved in
similar clear-up activities did not wear the correct protective equipment. Medical surveillance
results indicated that they were exposed to benzene levels above the occupational exposure limit.
There have been no cases in the Organisation concerned of benzene exposure leading to cancer,
but there are known cases in the Industry.
Answer
There was no exposure to benzene in this latest incident therefore the actual RAM rating is
People 0.
As there have been no incidents in the Organisation in which benzene contamination has led to
cancer, the potential of this incident should formally be rated People 4B. However, a check should
be made with health specialists how frequently incidents of cancer due to benzene have occurred
in Industry. If there has been more than one case per year the rating would be People 4C. The
incident still rates in the Yellow area of the RAM.
Appendix 4 Examples
30 Risk Assessment Matrix, Issue 3.0, March 2006
Example 4 Incident: fall from access platform
A section of grating approximately 1 metre x 1 metre was removed from the top platform of a
plant to allow maintenance work to be done. It was not replaced afterwards. An operator on his
rounds on the night shift did not see the hole because the lighting was poor. He stepped into the
hole but was able to hold onto the edge of the grating and stop himself from falling to the next
platform four metres below. He climbed out and had only minor grazes and bruising.
Classify the actual Consequence and the Risk rating of this incident on the RAM.
There have been several reports in the last year of grating not being replaced after maintenance
work. There have been no cases in the Organisation of people falling from platforms at height, but
there was a case last year in another plant in the Organisation where a technician fell one metre
from a platform because a section of handrail was missing. This handrail had been removed to
enable a heat exchange tube bundle to be removed and had not been replaced. The technician
broke a leg and suffered concussion.
Answer
The actual injury is classied People 2 (Note that Likelihood is not used for actual Consequence)
There are two potential consequences:
Fatal fall People 4B
Missing gratings People 0E

S
e
v
e
r
i
t
y
CONSEQUENCES INCREASING LIKELIHOOD
P
e
o
p
l
e
A
s
s
e
t
s

E
n
v
i
r
o
n
m
e
n
t
R
e
p
u
t
a
t
i
o
n
A B C D E
Never heard of
in the Industry
Heard of in the
Industry
Has happened
in the
Organisation
or more than
onece per year
in the Industry
Has happened
at the Location
or more than
once per
year in the
Organisation
Has happened
more than once
per year at the
Location
0
No injury or
health effect
No damage No effect No impact
1
Slight injury or
health effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury or
health effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury or
health effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up to
3 fatalities
Major
damage
Major
effect
Major
impact
5
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
Fatal fall
Missing
gratings
- no injury
Actual injury
Appendix 4 Examples
Risk Assessment Matrix, Issue 3.0, March 2006 31
Comment:
Although there have been no incidents in our Organisation where a worker fell through a grating
resulting in a fatality, falls of this type must have happened in the Industry (falls are one of the most
frequent causes of industrial fatalities). This leads to an assessment of People 4B for the worst-
case scenario.
When looking for previous incidents to estimate Likelihood you have to decide if for the identied
previous incidents are similar enough to the facts of the incident under consideration. It is
questionable whether the incident in which a section of handrail was missing and a technician fell 1
metre is similar enough. It was a fall from height but it resulted from a different equipment failure,
on the other hand the basic cause of both incidents was a failure of Maintenance to complete the
job. If included this incident would result in a RAM rating of 3C (yellow area on the RAM), which
does not affect the overall RAM rating of the present incident.
Example 5 Incident: Road Transport
1 A road tanker contracted to the Organisation was on its way to deliver 30,000 litres of gas oil
to a mining customer. The tanker rolled over after swerving to miss a pedestrian, who suddenly
moved into the path of the vehicle. One tank compartment split and 8,000 litres was spilt to
ground. Two further compartments leaked from the manhole covers due to poor seal integrity.
In total 12,000 litres went to ground. The driver, who was wearing his seatbelt, cut his head
above the right eye and received 6 stitches. He returned to work two weeks after the incident
after receiving counselling and refresher training. The tanker was scrapped (replacement cost
$US 70K) and repairs to the prime mover cost $US 20K. Total clean up costs were $US 20K and
loss of product was $US 10K.
2 This was the second rollover in the past 12 months for the Organisation in this country. An
incident occurred 6 months previously in another part of the country when a driver approached
a corner at high speed, lost control and crashed into a barrier before rolling over. The tanker
full of motor gasoline caught re and the drivers mate died at the scene. The driver was able
to get out of the cabin and into a safe area. He received minor bruising to his chest. The prime
mover and tanker (replacement value $US 300K) were completely destroyed and the full load
of 35,000 litres of gasoline was lost (value $US 30K). Being an unpopulated area there was no
impact on any other people. An area of vegetation caught re. The incident was covered in the
evening news and in the daily papers on the following day but there was no reference to the
company as the tanker was unbranded.
3 There have been at least 10 tanker rollovers in the past 12 months in the oil industry in this
country. Several of these incidents resulted in res and multiple deaths. In one incident, oil ran
into a local water supply affecting a village with a population of 100.
4 Another oil company had a major tanker rollover incident in a neighbouring country two
months previously when a tanker carrying gasoline rolled over in a village area just after
Appendix 4 Examples
32 Risk Assessment Matrix, Issue 3.0, March 2006
midnight. Product leaked from the tanker and local villagers gathered around and began
lling containers with product. A re broke out in which 42 people lost their lives and 20 more
suffered injuries ranging from major to minor burns. The re was thought to be caused by
a man carrying a kerosene lamp. The standard of equipment, the transport infrastructure
and the driving behaviour in this neighbouring country is very similar to the country under
consideration.

What is the RAM rating of this incident?
Answer
The actual classication of the incident was People 3 (one Lost Workday Case more than 5 days)
and Assets 3 (total cost greater than US$ 100K).
For the purpose of assessing the potential of this incident the oil product distribution operation in
this country is considered as a Location.
There are a number of potential consequences and RAM ratings for this incident. Applying the
information from recent incidents we come to the following RAM ratings.
Major Fire
People 5B A rollover in another oil company that resulted in a major re where there were
multiple fatalities is the basis for this Risk rating. (In the Industry, More than three
fatalities; paragraph 4)
People 4C Multiple incidents that have occurred in the Industry are the basis for this Risk rating.
(More than once in the Industry per year with up to 3 fatalities; paragraph 3)
People 4D A fatality that occurred six months ago in our company in this country (Location) is
the basis for this Risk rating. (In this Location, up to 3 fatalities; paragraph 2)

Product to Ground / Water
Enviro. 4B An incident in another oil company with an impact to the village drinking water is the
basis for this Risk rating (In the Industry, major impact to the environment offsite
groundwater contamination; paragraph 3).

Damage to Tanker and loss of Product
Assets 3D This Risk rating is based on the $300K US loss to replace the tanker plus $US 30K loss
of product in an incident at the Location. (In the Location, $100K - $1M US nancial
impact, paragraph 2)

The highest risk Consequence was the fatal incident experienced by our company in
this country (Location). Therefore, the Risk rating is People 4D (red area on the RAM).
Appendix 4 Examples
Risk Assessment Matrix, Issue 3.0, March 2006 33
Example 6 Audit nding
A renery HSE audit found that the water deluge systems on the propane and butane storage
spheres are not regularly inspected and tested. A live test established that the deluge system on
one of the butane spheres did not work.
Classify this nding on the RAM
Answer
Without a proper deluge system it is predictable that a re around a sphere will escalate to a
BLEVE before emergency response personnel can respond. A BLEVE would probably lead to
multiple fatalities and asset damage over $10MM and to public concern that the facilities were
being operated without proper re protection. There have been several incidents in the oil
and petrochemical industry over the years where a BLEVE has occurred because of inadequate
re ghting and has resulted in multiple fatalities. There have been no such incidents in
our Organisation.
The consequence severities should be assessed as People 5 and Asset Damage 5. The
Environmental Severity would be lower and the Reputation Severity would be in the range 4 to 5.
The absence of previous incidents in the Organisation with this worst-case Consequence leads to
a Likelihood of B. This audit nding should be classied as People/Assets 5B. (High in audit nding
classication)
S
e
v
e
r
i
t
y
CONSEQUENCES INCREASING LIKELIHOOD
P
e
o
p
l
e
A
s
s
e
t
s

E
n
v
i
r
o
n
m
e
n
t
R
e
p
u
t
a
t
i
o
n
A B C D E
Never heard of
in the Industry
Heard of in the
Industry
Has happened
in the
Organisation
or more than
onece per year
in the Industry
Has happened
at the Location
or more than
once per
year in the
Organisation
Has happened
more than once
per year at the
Location
0
No injury or
health effect
No damage No effect No impact
1
Slight injury or
health effect
Slight
damage
Slight
effect
Slight
impact
2
Minor injury or
health effect
Minor
damage
Minor
effect
Minor
impact
3
Major injury or
health effect
Moderate
damage
Moderate
effect
Moderate
impact
4
PTD or up to
3 fatalities
Major
damage
Major
effect
Major
impact
5
More than
3 fatalities
Massive
damage
Massive
effect
Massive
impact
Finding - deluge
system not working
Appendix 4 Examples
34 Risk Assessment Matrix, Issue 3.0, March 2006
Appendix 5 Glossary
ALARP
ALARP is short for As Low As Reasonably Practicable. Reducing Risks to ALARP means reducing the
Risks to a level at which the cost and effort (time and trouble) of further Risk reduction are grossly
disproportionate to the Risk reduction achieved.
Consequence
Impact on People, Assets, Environment and Reputation if a Hazard is released. In this guide
the term Potential Consequence is used when looking at what might happen or what might
have happened.
Consequential Business Loss (CBL)
The indirect loss associated with incidents that result in harm to people, asset damage,
environmental impact or impact on reputation. Consequential Business Loss comprises elements
such as loss of production, process unit downtime, product quality costs, cost of environmental
clean up, cost of recovery/disposal of waste, cost of reprocessing off-grade material and nes. It
may also include losses associated with customer impact and loss of market share.
Refer to Group HSE publication Incident Classication, Investigation and Reporting for
more detail.
Daily Life Activities
Performance of basic self-care activities during rehabilitation. These include dressing, bathing,
going to the toilet, ambulation and eating.
Group Business
An organisation denominated a Group Business in the Group Control Framework. Currently there
are six Group Businesses: Exploration & Production, Downstream, Gas and Power, Renewables and
Hydrogen, Shell Trading, and Shell Global Solutions.
Hazard
The potential to cause harm to people, damage to assets, business loss and impact on the
environment or reputation.
Industry
This usually means the oil, gas and petrochemical industry. However in some instances the
comparable industry may be based on the Hazard being assessed. For example, if a site is assessing
the Risk associated with electrical work on power lines it is reasonable to consider Industry as the
electrical distribution or power industry.
Likelihood
Chance that a specied Consequence will happen. In this guide Likelihood is expressed qualitatively
in terms of events that have happened in the particular Industry, Organisation or Location.
Appendix 5 Glossary
Risk Assessment Matrix, Issue 3.0, March 2006 35
Location
The smallest organisational unit that is used in the Likelihood scale of the RAM. Examples in the
Group Businesses are:
Exploration and Production offshore production platform, onshore ow station, drilling rig,
seismic unit.
Gas and Power - gas processing plant, LNG plant, LNG import terminal, GTL plants, pipeline
companies, local distribution companies, power stations, coal gasication plants.
Downstream renery, chemical plant, distribution terminal, road transport operation, pipeline
system, bitumen plant, luboil/grease blending plant, crude oil, rened product or chemicals
carrier (ship).
For smaller or less hazardous units, e.g. retail stations or road tankers, the Group Business should
dene the aggregation of units that is equivalent to a Location for the purpose of RAM assessment.
Organisation
In this Guide Organisation means an organisational unit 5 to 10 times smaller than the larger Group
Businesses (currently Exploration & Production and Downstream). An Organisation is either a
Group Business (in the case of smaller Group Businesses) or an organisational unit smaller than a
Group Business, e.g. a Class of Business in Downstream or a Region in Exploration and Production.
Organisation is used in the description of Likelihood levels on the RAM.
Each Group Business should provide detailed guidance on what the term Organisation means for
its organisation.
Permanent Total Disability (PTD)
Any work related injury that permanently incapacitates an employee and results in the termination
of employment.
Risk
Risk is the Likelihood that a specic undesired event will occur within a specied period.
Risk is therefore a function of both the Likelihood and the Consequence of a specic Hazard
being released.
When applying the RAM to assess the Risk rating (RAM rating) of a specic Hazard release scenario,
Risk is a function of the Likelihood of Consequence and Severity of Consequence.
A Risk Rating is normally expressed in the form People 3B or Reputation 4C.
Risk Assessment (UK HSE terminology)
The process of estimating the Likelihood of occurrence of specic undesirable events, and the
Severity of harm or damage caused, together with a value judgment concerning the signicance
of the results. Risk assessment therefore has two distinct elements - risk estimation and
risk evaluation.
Appendix 5 Glossary
36 Risk Assessment Matrix, Issue 3.0, March 2006
Risk Assessment Matrix (RAM)
A practical tool that is used to qualitatively assess HSE and other business risks. The result is
referred to as a Risk rating or RAM rating.

Severity
Level of Consequence on a scale 0 to 5.
Tolerability criteria
Tolerability criteria include laws and regulations, company standards, and the HSE premises for
projects. They may also include stakeholder expectations.
Appendix 5 Glossary
H S & E Publications Issued under the Auspices of the Shell HSE Committee/HSE Advisers Panel
Royal Dutch/Shell Group Health, Safety and the Environment Commitment and Policy (1997), reviewed 2000
Royal Dutch/Shell Group Procedure for HSE Management Systems (1997)
Competence Assurance of HSSE Critical Positions (2004)
Group Health, Safety and Environmental (HSE) Auditing Guidelines (2001)
Group HSE Management System (2002)
Group HSE Performance Monitoring and Reporting (2004) only elec.
HSE Management System, Integrating HSE into the Business (1994) only elec.
Impact Assessment (2004)
Risk Assessment Matrix (1999)
Occupational Health Guidelines
Asbestos (1986)
Chemical Hazards: Health Risk Assessment and Exposure Evaluation (1995)
Fitness to Work Management Process (2003)
Health Guidelines for Catering (1995)
Health Risk Assessment (2001)
Human Factors Engineering (HFE) in New Facilities Projects (2003)
An Introduction to Health Risk Assessment: Training Package (2002), available through Open University,
see: http://sww-openuniversity.shell.com/scripts/dlmisapi.dll/GET?le=frameset.jsm&rshost=sww-openuniversity.shell.com&rsport=1564
Go to e-learning and then HSE and S
Legionella Management Process (2004)
Management Guide to Thermal Stress (1991)
Management Guidelines for Hearing Conservation (1991)
Man Made Vitreous Fibres (2002)
Medical Emergency Guidelines for Management (2001)
Noise Guide (1991)
Personal Protective Equipment Guide (1989)
Repetitive Strain Injury (RSI) in the Ofce Environment (2002)
The Use of Contact Lenses in Industry (1984) leaet
Safety Guidelines
Company-Organised or Supported Social Events - Safety Considerations (1990) leaet
Conned Space Entry (2004)
Contractor Safety (1987)
Electrical Safety (1986)
Enhanced Safety Management (1985)
Enhanced Safety Management Checklist (1989)
Gas-freeing and Cleaning of Storage Tanks (2003)
Guidelines for Laboratory Safety (1989)
Hand Tools and Sparking Hazards (1982) leaet
Hotel Fires, Plan for Survival (1988) leaet
Hydrogen Sulphide (1986)
Incident Classication, Investigation and Reporting (2002)
Ionising Radiation Safety Guide (1993)
Ofce Safety (1987)
Oxygen - A Hazard (1982) leaet
Permit to Work Systems (2003)
Personal Protection of Helicopter Passengers in the Event of Ditching (1995)
Road Transportation of Goods, Equipment and Product (2003)
Safety Features of Light Vehicles and Mini Buses (1997)
Safety Signs and Colour Coding (1981) leaet
Scaffolding Safety (1987)
The Secondary Use of Containers (1978) leaet
Tripod-BETA (Incident Analysis EP 95-0321, to be ordered through Library, Library, Rijswijk SIEP-EPT-CSG)
Underwater Operations Management Guidelines (2004)
Unsafe Act Auditing (1987)
The Use of Small Marine Craft by Group Companies (1992)
Welding and Cutting (1976)
Environmental Guidelines
Guide for the Risk-Based Management of Potentially Contaminated Land (2000)
Recommendations for Alternatives to Fire Fighting Halons (1994)
Safe Handling and Disposal of PCBs (1985)
Technical Guide for the Investigation of Potentially Contaminated Land (2004)
Volatile Organic Compounds (1996)
Waste Management Guide (1996)
These publications can be ordered from SI The Hague; CAE Division via E-mail: GUIDES,
Internet address: Guides-Yellow@shell.com
March 2006

H S & E Publications Issued under the Auspices of the Shell HSE Committee/HSE Advisers Panel
Graphic Media & Publications, Rijswijk, Netherlands
P03821