3.2. Audit process
The ARAMIS audit follows the traditional steps of an
audit—i.e. first contact with plant management, audit contract,
site-familiarisation, audit, feedback, draft report and
final report. However, because of the particular focus of
the audit on scenarios and barriers an investigation aimed
at defining scenarios for a particular plant or installation
and identifying the barrier functions that have been installed
should be carried out well in advance of the on-site audit.
Based on these results, the audit team agrees on a manageable
number of scenarios (generally, two or more) and a representative
sample of barriers (usually with a maximum of 20–30)
to be used as focal points during the audit. The choice of scenarios
and the sample of barriers are both determined by the
purpose of the audit and through guidelines provided with
the audit and described below.
The set of barriers is first classified using Table 1 above.
Again, depending on both the plant or installation and the purpose
of the audit, one, two or more categories can be emphasized
in the audit. For the moment, a rather bold assumption
is being made that final assessments of barrier types generalize
to all barrier tokens classified under these, i.e. all barriers
classified within each category.
For each barrier type, primary delivery systems have been
defined that have a substantial bearing on the functioning
of a barrier of that type. For instance, barrier type1–a
permanent control barrier that needs no activation to be effective
– is presumed to be significantly influenced only by the
quality of management of the original installation, based on
the specifications (delivery system for barrier hardware) and
by the way it is inspected and maintained (delivery system
for inspection and maintenance). This allocation of primary
delivery systems is still based on hypothesis and not on process
empiricism, which still needs to be carried out. In the
ARAMIS project a preliminary expert judgement exercise
will provide the first test of which systems affect which
barriers.4
The audit process itself is rather straightforward. Barrier
types and specific barrier tokens are used as concrete
examples during the interviews. The life cycle of barriers
remains the Leitmotiv but if deeper auditing of any barrier
is required, its primary delivery system(s) can be involved to
assess whether all life cycle steps are performed up to par. Performing
this routine with multiple barrier types and various
informed people the auditors gain insight into the workings
of the nine delivery systems, differentiated by barrier type if
necessary. It should be pointed out, however, that this is only
a partial assessment of the full safety management system.
During the audit the ‘risk analysis and barrier selection’
and ‘learning and change management’ delivery systems are
assessed but they are excluded from the subsequent quantifi-
cation phase (see next paragraph). The technical risk analysis
starts from the actually chosen barriers and so double counting
of this effect is not desirable. The learning delivery system
does not affect current barrier effectiveness but indicates
whether it will get better or deteriorates.