Risk assessment
Shutdown Risk Assessment: Method, Matrix and Register
Shutdown risk assessment identifies what could harm people or delay the restart, scores each risk by likelihood and severity, assigns controls and owners, and records them in a register that is reviewed as the stop changes. This guide gives the five steps, a 5 by 5 matrix with a scoring tool and a sample register.
The matrix scale and sample register are working templates; set your own limits with your safety team.
How MaintWiz helps: Risks that are tracked with owners are easier to close. The MaintWiz shutdown module checks seven readiness gates before a package starts and records waivers with a typed reason, name and date. See the module · Get the readiness checklist
By Jai Balachandran · Published · Last reviewed
What MaintWiz adds:Seven readiness gatesSigned waivers with name and dateKeyboard operationLook-ahead by gate
Method
How do you assess risk in shutdown planning?
Assess shutdown risk in five steps: identify hazards, assess how likely and how serious each is, control it, record the findings in a register and review the controls as the stop changes. 1
Risk and hazard analysis terms are defined in the shutdown turnaround glossary.
The UK Health and Safety Executive describes risk assessment in five steps and says employers with five or more staff must record significant findings. 1 The same steps work for a shutdown, with schedule, material and contractor risks added beside safety hazards. The risk register is step 17 of the 40-step checklist.
| Step | HSE wording | In a shutdown, this means |
|---|---|---|
| 1 | Identify hazards | List hazards per work package: energy sources, confined spaces, lifting, hot work, chemicals, simultaneous work, and schedule, material and contractor risks |
| 2 | Assess the risks | Judge how likely harm or delay is and how serious it would be, and who or what is affected |
| 3 | Control the risks | Remove the hazard if possible; otherwise reduce the risk with isolation, procedures, sequencing, extra resources or contingency |
| 4 | Record your findings | Keep a risk register with the hazard, score, controls, owner and trigger |
| 5 | Review the controls | Review at the readiness meeting, when scope changes, after incidents or near misses, and daily on the critical items |
The right-hand column is our application of the HSE steps to shutdowns, not HSE wording. HSE also says you can assess the risks yourself or appoint a competent person, and that employees usually have useful ideas.1
Risk matrix
What does a 5 by 5 shutdown risk matrix look like?
A 5 by 5 risk matrix scores each risk from 1 to 25 by multiplying likelihood (1 to 5) by severity (1 to 5), then bands the score as low, medium, high or critical so the register can be ranked. A severity 5 event is rated High at likelihood 2 and Critical at likelihood 3 or more, so a catastrophic outcome is never hidden by a low score.
| Likelihood \ Severity | 1 Minor | 2 Moderate | 3 Serious | 4 Major | 5 Severe |
|---|---|---|---|---|---|
| 5 Almost certain | 5: Medium | 10: High | 15: High | 20: Critical | 25: Critical |
| 4 Likely | 4: Low | 8: Medium | 12: High | 16: High | 20: Critical |
| 3 Possible | 3: Low | 6: Medium | 9: Medium | 12: High | 15: Critical |
| 2 Unlikely | 2: Low | 4: Low | 6: Medium | 8: Medium | 10: High |
| 1 Rare | 1: Low | 2: Low | 3: Low | 4: Low | 5: Medium |
Try it: score a risk
Pick a likelihood and a severity. The score and the band update. Nothing is sent or stored.
The scale, scores and band limits (1 to 4 low, 5 to 9 medium, 10 to 16 high, 17 to 25 critical, with the severity 5 rule above) are a common working convention and a template, not a standard. Set your own limits with your safety team, and give each band a required response.
Software
Can software support shutdown risk assessment?
Software cannot judge a risk for you, but it can hold the register next to the schedule, flag float running out, and keep every waiver and sign-off with a name, a date and a reason.
About MaintWiz. MaintWiz is an industrial AI platform with IoT, SAP integration and predictive maintenance (PdM) capabilities. Its shutdown and turnaround module helps plants plan, schedule, execute and close out shutdown work.
Planned for later releases: risks ranked by the days at stake and Monte Carlo confidence of finish.
What the shutdown module covers
As described on the MaintWiz shutdown maintenance product page.
- Risk register with score and owner
- Readiness gates with waivers and sign-offs recorded with a reason, the name and the date
- Critical path and float flags at a limit you set
- Permits and isolations from ePTW on each work order, with a block on closing a package while one is open
- Findings from the field sent to the planner as requests for added work
- Executive view that ranks decisions by effect in days and money
Proof
What MaintWiz customers report
Figures as published in MaintWiz case studies on maintwiz.com. They come from maintenance management projects, not shutdowns.
Register
What goes in a shutdown risk register?
A shutdown risk register lists each major risk with a score, a trigger, a preventive control, an owner and a contingency, so every risk has a person, a warning sign and a planned response.
Schedule risks show as lost float; check it in the Excel to Gantt tool. A free Excel version is available: Risk register with 5x5 matrix (.xlsx).
The entries below are invented examples to show the format, not a list for your plant. Rank the register by score and review the top items at the readiness meeting and every day in the daily meeting.
| Category | Risk | Score | Trigger | Preventive control | Owner | Contingency |
|---|---|---|---|---|---|---|
| Safety | Gas release when breaking a line | 2 x 5 = 10: High | Gas released during line break | Verified isolation and blind; gas test; permit | Safety lead | Stop work; evacuate; review isolation |
| Safety | Dropped load during a heavy lift | 2 x 5 = 10: High | Lift plan not followed | Lift plan; exclusion zone; certified rigger | Area lead | Suspend lift; re-plan |
| Schedule | Long-lead part arrives after the start | 4 x 4 = 16: High | Delivery not received by day -14 | Receive and check before the freeze; track weekly | Materials planner | Expedite; substitute or re-sequence |
| Schedule | Emergent scope on the critical path | 4 x 3 = 12: High | Inspection finding on a critical job | Reserve float and crew; approve changes in writing | Shutdown manager | Recovery plan: extra shifts, parallel work |
| Contractor | Contractor crew short or late | 3 x 3 = 9: Medium | Headcount below plan on day 1 | Confirm capacity before the window; induct early | Contracts lead | Backup contractor; reassign in-house |
| Quality | Re-work after a failed test | 3 x 3 = 9: Medium | Failed pressure or leak test | Hold points; qualified inspectors | Inspection lead | Re-test slot reserved in the schedule |
| Restart | Restart delayed by open punch items | 3 x 4 = 12: High | Critical punch items open at day -2 | Live punch list; classify by startup effect | Operations lead | Delay restart; staged startup |
| Environmental | Spill during draining or cleaning | 2 x 3 = 6: Medium | Drain or hose failure | Containment; trained crew; spill kit | Safety lead | Contain; notify; clean-up plan |
Risk links to other plans: scope growth is covered in scope management, safety hazards in the shutdown safety plan, and permits in the permit to work guide.
Rules
Which shutdown risk work do US and UK rules address?
No rule prescribes a 5 by 5 matrix, but the HSE five steps, OSHA process hazard analysis and change rules and HSE isolation and permit guidance all feed the shutdown risk register. 1,2
The shutdown audit tests whether these controls are in place.
| Activity | Rule or guidance | What it says | Source |
|---|---|---|---|
| The risk assessment steps | HSE five steps | Identify hazards, assess the risks, control the risks, record the findings, review the controls | HSE five steps |
| Process hazard analysis (US covered processes) | OSHA 1910.119(e) | A process hazard analysis must identify, evaluate and control the hazards of the process; a team with engineering and process expertise performs it; it is updated and revalidated at least every five years | OSHA 1910.119 |
| Changes | OSHA 1910.119(l) | Written procedures manage changes to the process, except replacements in kind | OSHA 1910.119 |
| Isolation risk | HSE HSG253 | Plan intrusive maintenance for shutdown periods to keep isolation needs down | HSE HSG253 |
| Permits | HSE HSG250 | Permit-to-work guidance for the petroleum, chemical and allied industries, including risk assessment | HSE HSG250 |
Visuals
Save the risk charts
Two charts to share with the team. Click either for the full-size image.
FAQ
Frequently asked questions
What is a shutdown risk assessment?
A structured look at what could harm people or delay the stop, how likely and how serious each risk is, and how it will be controlled. The HSE describes five steps: identify hazards, assess, control, record and review. 1
What is a risk matrix?
A grid that scores each risk by likelihood and severity. A 5 by 5 matrix gives scores from 1 to 25. The scale and the band limits are a convention that each company sets for itself.
What should a shutdown risk register contain?
For each major risk: a description, a score, the trigger that warns you, the preventive control, an owner and a contingency.
When should the risk assessment be done?
Start in planning and have a register ready before the readiness review; it is step 17 of the 40-step checklist. Review it whenever the scope changes.
Who should be involved?
The shutdown manager, planner, operations, safety and the area leads, with contractors for their scope. HSE notes that employees usually have useful ideas. 1 For US covered processes a process hazard analysis team needs engineering and process expertise. 2
Does OSHA require a risk assessment for a shutdown?
OSHA 1910.119 requires a process hazard analysis for covered processes and written change procedures, not a shutdown-specific assessment. 2
How do you deal with a critical risk?
Remove it if you can; if not, reduce it with controls before work starts, assign an owner and set a trigger and a contingency. Escalate a critical risk to the shutdown manager.
How is schedule risk different from safety risk?
Safety risks threaten people; schedule risks threaten the restart date. Both go in one register. Schedule risk shows up as lost float on the critical path. 5 See shutdown scheduling.
Sources
Sources
- UK Health and Safety Executive, Risk assessment: Steps needed to manage risk
- OSHA, 29 CFR 1910.119, Process safety management of highly hazardous chemicals
- UK Health and Safety Executive, The safe isolation of plant and equipment (HSG253, 2006)
- UK Health and Safety Executive, Guidance on permit-to-work systems: a guide for the petroleum, chemical and allied industries (HSG250, 2005)
- US Government Accountability Office, GAO Schedule Assessment Guide: Best Practices for Project Schedules (GAO-16-89G, December 2015)
Start each package only when it is ready
Book a demo and bring a work package. We will walk through the seven readiness gates.