Knowledge / Risk analysis methods

Closing HAZOP actions: evidence, residual risk and unresolved assumptions

Connect a HAZOP recommendation to implementation, verification and residual-risk evidence while preserving the original scenario and configuration assumptions.

On this page

A HAZOP action is useful only if its resolution answers the question that created it. A purchased component, revised drawing or completed training session may be necessary, but none automatically demonstrates that the identified consequence is controlled. Technical closure follows the original scenario through the chosen response, its implementation and the evidence of effectiveness. It also records assumptions that remain unresolved and the conditions under which an earlier conclusion would need to be revisited.

Retain the scenario behind the action

IEC 61882’s public scope includes documentation and follow-up within the HAZOP process. Preserve the node, operating mode, deviation, credible cause, consequence and relevant safeguard assumptions with each action. Without that context, a later reader may verify that work was completed while being unable to determine whether it addresses the original concern.

For example, an action arising from unavailable flow confirmation is not necessarily resolved by adding another pump-running indication. The original question concerns whether the required flow is established at a defined location. A running signal may leave that question open. The action should therefore state the required function and evidence, while allowing the responsible engineering process to select an appropriate solution.

Separate implemented, verified and assessed

Implementation establishes that the intended change exists in the identified configuration. Verification checks that the change meets its specified requirements. Assessment returns to the hazard scenario and asks whether the resulting arrangement supports the claimed control of the consequence. These are related decisions, but a document or test that answers one may not answer the others.

An updated drawing can show design intent without proving the installed state. A factory test can demonstrate a component’s response without including the installed sensing path or support services. An installed functional test can still leave the consequence assessment incomplete if its acceptance criterion was unrelated to the hazard. Identify the question answered by each piece of evidence instead of counting documents as interchangeable proof.

Set a closure criterion that can fail

HSE’s modification guidance describes changes being inspected, tested and shown to achieve their design intent. A useful criterion must therefore permit an adverse result. “Improve reliability” does not specify what would count as sufficient evidence. A bounded requirement might instead name the function, operating conditions, response limit, supported failure cases and evidence needed to demonstrate it.

The criterion should be established from the system assessment before interpreting the test outcome. Moving the requirement after a disappointing test can hide the unresolved hazard. If the initial criterion is found to be technically wrong, revise it through the responsible assessment and retain the reason. The relevant decision is whether the new criterion still controls the identified consequence, not whether it makes the result easier to pass.

Include uncertainty when evaluating a response test

Assume an invented requirement says a specified function must complete within 8.0 s under a defined test condition. A test reports 7.6 s with a simple bounded measurement error of ±0.7 s. The supported interval is 6.9–8.3 s, so that result alone does not establish completion within 8.0 s. The measured centre is below the limit, but the stated uncertainty extends above it.

This example is not a universal acceptance rule or a real protective-function timing requirement. It uses a worst-case error bound rather than a statistical confidence interval. A defensible closure decision needs the applicable acceptance method, measurement uncertainty and representativeness of the test conditions. Repeating a test without addressing a systematic timing bias does not necessarily reduce that uncertainty.

The invented test result 7.6 seconds has a bounded error±.7, creating an interval 6.9–8.3 seconds. A vertical 8-second requirement line intersects the interval. The central observation is below the requirement, but its upper bound exceeds it by.3 seconds.
Original interval plot at 145 drawing units per second, with a truncated 6.5–8.5 s axis explicitly labelled. The dot is the reported centre, the capped segment a simple assumed worst-case measurement-error bound, and the shaded region exceeds the hypothetical 8 s criterion. No probability density or confidence level is implied. The result alone cannot establish this bounded timing requirement; a real closure also needs the applicable decision rule and representative test conditions.

Trace substitutions to the original hazard

A recommendation may be resolved by a different solution when the original proposal is unsuitable, but the alternative needs a technical argument. Compare the failure mechanism, required function, response time, dependencies and operating modes covered by the two approaches. A cheaper or easier item with a similar name does not establish equivalent control.

Suppose an automatic function is replaced in the proposal by an alarm and human action. The new arrangement adds detection, interpretation, availability, workload and execution assumptions. Those assumptions need assessment; they cannot be hidden inside the word equivalent. Conversely, a redesign that removes the hazardous condition may make the original protective-device recommendation unnecessary. Record why the underlying scenario has changed and which new scenarios the redesign introduces.

Record dispositions and unresolved prerequisites explicitly

As a jurisdiction-specific example, US OSHA1910.119(e)(5) requires covered process-hazard-analysis findings to be resolved and documented with an action schedule and communication. Its pre-startup provision also addresses resolution or implementation of recommendations for new facilities. These are requirements for the US processes within that rule’s scope, not a universal maritime closure law. They illustrate why disposition and timing need an explicit record.

A rejected or superseded recommendation should retain its reason, supporting assessment and responsible authorization. A deferred action remains dependent on its documented conditions; it is not technically complete merely because a later date has been entered. If a prerequisite cannot be demonstrated, the record must show the unresolved assumption and the effect on any decision that relies on it.

Avoid mistaking action counts for risk reduction

If 18 of 20 actions are marked complete, the administrative completion fraction is 90%. It does not establish a 90% reduction in risk or 90% readiness to operate. The remaining two actions may concern functions essential to the assessed scenario, while some completed actions may improve documentation. Counting each item equally discards its role and consequence.

Nor can the conclusion be repaired by assigning arbitrary weights and calling their sum risk. Report the actual unresolved scenarios, dependencies and evidence gaps alongside the count. A useful distinction is whether work is implemented, whether evidence is reviewed against its criterion and whether the affected scenario has a documented disposition. Those parallel views are more informative than one percentage.

Keep closure bound to the configuration tested

HSE’s commissioning discussion links installed configuration and instrument-function checks with demonstrating fitness for the intended purpose. A closure record should identify the drawing revision, relevant software or setting version, component identity and test conditions needed to reproduce its conclusion. These details matter when a later maintenance or design change alters the evidence boundary.

A test can remain historically valid while no longer establishing the current state. Replacement of a sensor, changes to a common utility, modified operating mode or altered alarm routing can invalidate a relied-upon assumption. The change assessment should identify which closed findings depend on that assumption and whether targeted re-verification or renewed hazard examination is necessary. Reopening a relevant question preserves the analysis rather than erasing its earlier result.

Make responsibility and challenge visible

HSE’s control-and-instrumentation assessment guidance connects responsibility, verification evidence and resolution of recommendations across the safety lifecycle. For a HAZOP action, distinguish who performs the work, who checks the evidence and who is authorized to accept the disposition. The required competence and degree of independent challenge should match the issue and applicable governance.

Common failures are closing a row after procurement, accepting a test that omits the installed path, changing a criterion to fit a result, losing the basis for an alternative solution and carrying acceptance across an unexamined configuration change. A strong closure statement says what changed, which scenario it addresses, what evidence meets the criterion, what remains limited and who accepted the resulting disposition. It makes the technical conclusion understandable without relying on the original meeting participants.

Sources