EHS Operations·9 min read
Incident Investigation: 5 Whys & PEEPO Field Guide
How to run incident investigations that prevent recurrence. The 5 Whys finds root cause, PEEPO finds blind spots, and BLS data shows 2.8M reasons it matters.
21 Apr 2026
Industry · Oil & Gas
EHS software for high-consequence operations
Process Safety Management, hot-work permits, confined-space entry, contractor management. Built for the operations where the consequence ceiling is catastrophic and the regulatory bar is set accordingly.
Oil and gas operations sit at the high-consequence end of every EHS distribution. Process Safety Management (PSM) was codified by OSHA as 29 CFR 1910.119 in 1992, written in direct response to the Phillips 66 Pasadena explosion (1989) and the Bhopal disaster (1984). The standard exists because the failure mode of an oil and gas facility is not one injury; it is a release event with cascading consequences across the facility, the community, and the environment.
The regulatory bar is set accordingly. PSM requires fourteen documented elements including process hazard analysis, written operating procedures, employee participation, contractor management, and incident investigation. Each element generates evidence that auditors and regulators sample. Operations that cannot produce the evidence on demand fail audits and accumulate findings.
Risks specific to oil & gas
Six hazard categories the platform is built to capture, investigate, and close.
Process safety incidents
Loss of containment, runaway reactions, vapor cloud ignitions. Low-frequency, high-consequence events that drive PSM regulation.
Hot-work in hazardous atmospheres
Welding, cutting, grinding near hydrocarbon inventory. Permit-to-work with atmospheric testing and fire-watch verification.
Confined-space entry
Vessels, tanks, pipe runs. Atmospheric testing, entry attendant, retrieval equipment, and rescue plan required.
H2S and toxic exposure
Hydrogen sulfide at sour-gas operations, benzene in some streams, NORM in older installations. Real-time monitoring and exposure-record retention.
Contractor management
PSM requires contractor pre-qualification, training records, and performance evaluation. The audit trail must reconstruct on demand.
Asset integrity
Mechanical integrity programs for pressure vessels, piping, instrumentation. Inspection cycles tied to equipment risk classification.
Why oil and gas EHS programs run on documented evidence
PSM auditors and regulators evaluate operations on documentary evidence. Did you do the process hazard analysis? Show me the report, the participants, and the closure of recommendations. Did the operator on duty follow the written procedure? Show me the procedure, the training record, the most recent review, and the operator's acknowledgement. Did the contractor get pre-qualified? Show me the contractor's safety record, the pre-job briefing, and the evaluation at job close.
Programs that cannot produce the evidence chain at audit time fail. The 2010 Macondo (Deepwater Horizon) investigation is the canonical example of a documented chain working in reverse: every gap was forensically reconstructable from the records, and every gap had a regulatory consequence.
What HaloEHS changes for oil and gas operations
Hot-work and confined-space permits move from paper packets to mobile-first PTW with atmospheric testing logs, attendant attestations, and fire-watch verification all captured digitally. Permit heat maps show overlap hazards in real time, preventing the kind of concurrent-operations conflicts that historical incidents have made famous.
Contractor management runs the full PSM lifecycle: pre-qualification documents, training records, induction acknowledgements, work-period access permissions, and post-job evaluation. Every step is timestamped and reconstructable.
Incident investigation runs on structured methods (5 Whys, PEEPO, or full-scale TapRooT-style investigations) with evidence chains preserved. Recurrence detection surfaces patterns across the global operation, which is essential when the same root cause may appear three years apart at facilities in different countries.
How HaloEHS aligns with PSM and the audit cycle
PSM compliance audits run on a three-year cycle. Operations that maintain queryable records all year pass cleanly; operations that scramble to assemble evidence at audit time accumulate findings. The shift from a once-every-three-years scramble to a continuously-audit-ready posture is the single biggest operational improvement in PSM since the standard was written.
HaloEHS maps to the 14 PSM elements out of the box. Process hazard analysis, operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work, management of change, incident investigation, emergency planning, compliance audits, trade secrets, employee participation, and recordkeeping each have a defined data path. The 2022 ISO Survey counted 294,420 valid ISO 45001 certificates worldwide; oil and gas operations are over-represented in that population, and the same data paths support both PSM and ISO 45001 evidence chains.
Process Safety Indicators: API RP 754 tiered metrics
After the Texas City refinery disaster (2005) and the subsequent CSB investigation, the American Petroleum Institute developed RP 754 to standardize process-safety performance indicators. The four-tier framework separates lagging from leading metrics with deliberate precision. Tier 1 indicators are loss of primary containment (LOPC) events exceeding defined thresholds — the most severe and consequential events. Tier 2 indicators are LOPC events of lesser consequence but with significant potential.
Tier 3 indicators are challenges to safety systems (relief valve activations, safety instrumented system trips) and operating envelope excursions. Tier 4 indicators are leading metrics: training completions, procedure compliance, management-of-change cycle time, mechanical-integrity work-order completion rates, and near-miss reporting. A mature oil and gas operation watches all four tiers monthly. Reliance on Tier 1 and 2 alone is a known failure pattern; the events are too infrequent to drive learning at the operational rhythm. Reliance on Tier 4 alone misses the consequence escalation when leading indicators degrade.
Combined, the four tiers describe a system that is either learning faster than it is failing, or failing faster than it is learning. HaloEHS captures Tier 3 (safety-system activations, envelope excursions) and Tier 4 (training completions, procedure acknowledgements, observations, MOC cycle times) automatically as a side effect of the platform's normal operation. Tier 1 and Tier 2 incidents flow into incident management with regulatory-reportable taxonomies pre-built. The audit-ready PSM exports include the full RP 754 indicator set, mapped to the API standard's reporting schema, ready for benchmark comparison against industry peer-group data.
EHS Software for Oil & Gas Operations | HaloEHS: modules that apply
The HaloEHS modules most directly relevant to oil & gas operations.
Module
Observation
Empower every worker to report hazards in seconds. AI auto-classifies and routes observations for review, with anonymous reporting built in.
Learn more
Module
Incident Management
From first report to verified closure. AI-generated titles, 5 Whys and PEEPO investigation, CAPA generation, and recurrence detection across history.
Learn more
Module
Action Management
Your command center for every CAPA across every module. Personalized task lists, automated reminders, evidence-based closure, and effectiveness tracking.
Learn more
Regulatory framework
Standards and regulations the platform is built to evidence.
OSHA 29 CFR 1910.119
Process Safety Management of Highly Hazardous Chemicals. The 14-element framework for high-consequence process operations.
OSHA 29 CFR 1910.146
Permit-Required Confined Spaces. Atmospheric testing, attendant requirements, and rescue plan obligations.
OSHA 29 CFR 1910.252
Hot Work (welding, cutting, brazing). Fire-watch requirements and combustible-atmosphere prevention.
API Recommended Practices
API RP 754 (process safety performance indicators), API RP 750 (management of process hazards), API RP 580 (RBI). Industry standards referenced in audits.
Oil & Gas FAQ
Yes. HaloEHS maps to all fourteen elements of OSHA Process Safety Management under 29 CFR 1910.119(a)–(n): employee participation, process safety information, process hazard analysis (PHA), operating procedures, training, contractors, pre-startup safety review, mechanical integrity, hot work, management of change, incident investigation, emergency planning and response, compliance audits, and trade secrets. Each element has a defined data path so the records that demonstrate compliance are produced through routine work, with audit-ready exports per element. This matters because PSM citations are among the most costly OSHA enforcement actions in oil, gas, and chemical processing, and the elements most often cited — mechanical integrity, MOC, and operating procedures — are precisely the ones where scattered documentation fails an auditor and a structured system succeeds.
Hot work is one of the highest-consequence activities on a facility, so HaloEHS enforces the full control sequence before a permit can be issued. Atmospheric/gas test results are captured with a timestamp and the tester's identity, a fire watch is formally designated, isolations are verified, and supervisor approval is recorded — all four captured digitally, none skippable. On the worker side, acknowledging the permit requires confirming they have read the specific conditions, not just tapping a button. Closure is equally controlled: it requires fire-watch sign-off after the work plus the post-work cooldown/monitoring period, which is exactly where fires often start. The result is a defensible, time-stamped record for every hot-work permit, and the SIMOPS heat map flags any conflict with nearby fuel or oxygen sources before issuance.
Because contractors perform much of the highest-risk work on a facility, pre-qualification is treated as a gate, not a formality. HaloEHS captures each contractor's safety record (TRIR/incident rates, EMR, OSHA citation history), insurance coverage, written safety programs, and the specific certifications their scope requires. Every pre-qualification carries an expiry, and once it lapses the system blocks new work assignment to that contractor until it is renewed — preventing the common gap where an expired qualification is discovered only after an incident. After a job, a post-work evaluation feeds back into the contractor's record, so selection for future work is informed by how they actually performed on site, not just by what they claimed at onboarding. This closes the loop between pre-qualification and real field performance.
MOC is delivered as a structured, enforced workflow rather than a form, because uncontrolled change is a root cause behind many major process-safety incidents. Each change moves through defined stages — description of the change, technical basis, safety/hazard review, training requirements, procedure and drawing updates, and final management approval — and each stage requires a named owner and supporting evidence before it can advance. Nothing is marked complete on assertion alone. PSM auditors sample MOC records heavily and trace them end to end, so the ability to reconstruct the full chain of a change, including who reviewed the hazards and how affected procedures and training were updated, is exactly what separates a clean PSM audit from a citation. Temporary changes can carry expiry dates so they cannot silently become permanent.
Yes. Equipment master data for pressure vessels, piping circuits, relief devices, and instrumentation is integrated with the inspection schedule, so mechanical-integrity inspections are driven by the asset register rather than tracked in side spreadsheets. Risk-based inspection (RBI) cycles can be configured per equipment class, aligning inspection frequency with consequence and likelihood. Inspection findings flow directly into the CAPA queue with owners and deadlines, and — importantly for PSM — any finding that affects integrity or would require operating outside the established envelope automatically triggers a documented Management of Change, so a "temporary repair" cannot quietly alter how a unit is run without the corresponding hazard review. This keeps mechanical integrity, the most-cited PSM element, both scheduled and closed-loop.
HaloEHS produces audit-ready evidence for each of the fourteen PSM elements on demand. Auditors typically sample somewhere between ten and twenty-five records per element and trace each through its full lifecycle, so the differentiator is being able to surface any sampled record within seconds with its complete evidence chain intact — the gas test behind a hot-work permit, the hazard review behind an MOC, the verification behind a mechanical-integrity repair. Operations that run the platform continuously through the three-year PSM audit cycle have materially cleaner audits than those that assemble documentation in the weeks beforehand, because the records were generated in real time with immutable history rather than reconstructed. For on-premises deployments this entire evidence base remains inside the operator's own infrastructure.
Related reading
EHS Operations·10 min read
CAPA Effectiveness: Closing the Loop on Every Action
ISO 45001 requires CAPA. Most operations log them; few close them effectively. Here is how to track corrective actions to verified closure and prove the loop.
11 May 2026
Safety Leadership·7 min read
Why EHS Software Matters: The Real Cost of Paper
Spreadsheet-driven EHS programs miss patterns and fail audits. With US workplace injuries costing $58.5B/yr, the upgrade case is data-driven.
25 Apr 2026
Other industries
Industry
Construction
Multi-site, multi-contractor construction operations need EHS that fits the site, not the office. JSA, fall protection, PTW, and contractor onboarding in one platform.
Learn more
Industry
Manufacturing
LOTO, machine guarding, ergonomics, near-miss capture, and audit-ready records. HaloEHS fits the line, not the office.
Learn more