Buncefield teachings

Almost five years on from the December 2005 explosion that destroyed much of the Buncefi eld oil storage depot in Hertfordshire, England – and which injured 43 people and led to an estimated £1bn (€1.2bn) in claims for loss and damage – the end result is slowly becoming clear.

On 16 July, fi nes and costs totalling more than £9m were imposed by St Albans Crown Court on fi ve of the companies involved in the disaster, with oil giant Total bearing the brunt of the punishment. The question of who is liable for the claims for loss and damage was resolved in a High Court action in March last year.

Over the years of tangled litigation, many points have arisen that should be of interest or concern to risk managers, especially those dealing with hazardous industries.

Here we summarise a few of the issues. You can read about the disaster in detail in Justice David Steel’s judgment, dowloadable from strategicrisk.eu (see tinyurl.com/SRBuncefi eldJudgment).

Liability and remoteness

In StrategicRISK November 2008, we highlighted the legal concept that liability is usually limited to damage that is foreseeable (‘Climbing the Wagon Mound’, tinyurl.com/SR-Wagon). The overpressures generated by the explosion at Buncefi eld appear to have been highly unusual and not easily explained. Initially, Total seemed to be relying on this to deny liability for damage caused beyond a 451-metre radius from the Buncefi eld storage tanks – something described by Justice Steel as “a rather remarkable contention”.

However, as the report of the Major Incident Investigation Board states: “The circumstances that led to the event were predictable even if the consequences were not.” Total eventually decided to concede liability beyond the 451-metre radius, perhaps with its reputation in mind.

But organisations sited close to hazardous industries need not expect an insurance premium reduction merely because of this one concession. Also, risk managers would do well to check that, if they are ever likely to rely on the “foreseeable” defence in court, their models of the potential damage their operations may cause stand up to detailed scrutiny.

Business interruption

In January 2007, a little more than a year after the explosion, loss adjusters Cunningham Lindsey summarised how they felt businesses and their insurers were coping. The chief point was that typical business interruption (BI) insurance terms of 12 months had proved to be too short in many instances. The nature of the explosion meant that many buildings in the nearby Maylands industrial estate (containing 630 businesses) had to be assessed for structural stability; there were planning issues; there was a shortage of builders; and fi rms were fi nding their insurance running out before they were anywhere near to reoccupying their premises.

Cunningham Lindsey also noted that those with good business continuity plans (BCP) were quicker to secure resources such as alternative premises or IT capability, while others had to scramble for what they could fi nd. This emphasises the seriousness that risk managers should attach to having inadequate BI or an outdated BCP.

Joint ventures and operators

The Buncefi eld tank farm was a joint venture between Total and Chevron, with an operating company Hertfordshire Oil Storage Ltd (HOSL) set up between them to manage the plant. The bulk of evidence before Justice Steel concerned Total’s contention that Chevron should be liable for its share of the damage.

Chevron’s contention was that, in effect, Total was in control of day-to-day operations, and that HOSL was not in any position to infl uence matters. In the end, the judge agreed with Chevron – noting that certain key witnesses who might have been expected to throw light on who was in charge had not been called – and drawing inferences from that fact.

The raft of legal authorities cited on both sides of the case will be of interest only to lawyers, but risk managers should note that a clear statement of how liabilities will be assessed between joint venture partners ought to be a fundamental keystone of any joint venture agreement.

Human nature

The investigations into what caused the accident at Buncefi eld have uncovered a catalogue of sloppy practice, lack of written procedures and general slackness of vigilance – so often the case following industrial accidents. But unintended consequences played their part. The storage tanks at Buncefield had various alarms that sounded when a tank reached capacity.

The American Petroleum Institute (API) standard 2350 – which deals with measures to prevent storage tank over-fi lling – specifi cally states:

“Caution: high-level detectors and/or automatic shutdown/diversion systems on tanks containing Class I and Class II liquids shall not be used for control of routine tank-fi lling operations. These devices are intended to signal a potential emergency and initiate certain manual responses or activate automatic response mechanisms.”

But Justice Steel concluded that “on many occasions the relevant controller must have been deliberately fi lling to a level at or above the highlevel alarm”. In other words, operators started waiting for alarms to sound before shutting off the flow, rather than watching the gauges.

It is human nature to take the easy option, made more likely by the absence of written instructions or risk assessments, as was apparently the case at Buncefi eld. The safety device became a tool. When that device failed, the assumption was made that the tank was not yet full – not that it was overfl owing and about to explode.

At the heart of all real risk lies mistaken human assumptions. ¦