Critical Thinking Series · DSIB
Governance: Who Designs, Who Pays and Who Owns the Risk?
The debates most likely to arise over design responsibility, rework and commercial allocation — each explored through a real project scenario.
In a third-party HAZOP, the facilitator records the technical concern; the facilitator does not decide who pays.
Decision one — technical
Who is accountable for producing and integrating the technical solution.
Decision two — commercial
Whether the resulting work is a contractor correction, vendor warranty matter, owner change or disputed variation.
The following debates are where that distinction is most often lost. In each of them, an argument about the second decision is used to delay the first — and the objection is raised in almost the same words on project after project.
They are grouped below by the part of the project the argument starts from.
Scope basis
4 objections
“The Owner Specification Did Not Ask for It”
Absence in an owner specification does not automatically make a HAZOP action an extra. In EPC or turnkey work, a requirement may remain within contractor scope if it is necessary to meet the stated purpose, applicable codes, good engineering practice, performance guarantees or work reasonably inferable for completion. In a narrowly defined FEED or consultancy scope, the same omission may have a different allocation.
Example
HAZOP identifies the need for automatic isolation against reverse flow from a compressor package. The owner specification does not list the valve. If reverse-flow protection is necessary for the contracted facility to operate safely and meet existing requirements, the action may correct an incomplete EPC design. If the owner subsequently requires a higher protection standard or different architecture than the contract established, that addition may be a variation.
The decision should turn on one question
Does the action satisfy an existing obligation, or introduce a new requirement?
“It Was Not Included in Our SOW”
This objection is most credible in FEED, EPCM and detailed-engineering services, where responsibilities are divided through detailed task lists. Even then, absence of a named activity does not necessarily excuse failure to complete an included professional service.
Example
A FEED contractor is responsible for the relief philosophy but its SOW does not explicitly name dispersion analysis. HAZOP finds that an atmospheric discharge cannot be judged safe without one. The FEED design authority should own the technical answer. Commercially, the parties must decide whether the analysis was reasonably necessary to complete the contracted relief design or is a genuinely additional study.
The action should not remain unresolved while that debate proceeds. The PM can mark it technical resolution in progress — commercial agreement reserved, with a hold point before the affected design is released.
“We Could Not Have Known What Was Behind the Tie-In”
A revamp HAZOP often relies on legacy documents, field information and provisional licensor data. If later information invalidates the accepted scenario or safeguarding approach, responsibility for rework depends on whether the contractor was entitled to rely on that information and whether the discrepancy should reasonably have been found through its contractual site-verification activities. A condition that was discoverable but not checked may not support a variation; a concealed condition that could not be identified through the agreed survey may be treated differently.
Example
HAZOP accepts an alarm and operator response for a new exchanger based on an old P&ID showing the existing pump’s maximum discharge pressure as 10 barg. After HAZOP, the accessible pump nameplate shows 16 barg, requiring a PSV or exchanger redesign. If field verification was contractor scope, the rework may be a contractor correction. If the higher pressure resulted from an undocumented internal modification discoverable only during a shutdown inspection outside the agreed survey, it may qualify as an unforeseen condition or owner change.
“This Falls Outside Our Battery Limit”
A facilitator may extend a HAZOP node beyond the contractual tie-in when upstream or downstream behaviour is necessary to understand the scenario. This does not automatically expand the contractor’s scope, but it can generate a requirement for instrumentation or equipment outside its battery limit. The HAZOP should identify the required protection and the party controlling the affected installation; the contract should then determine who designs, implements and pays for it. Technical inclusion in the HAZOP and commercial inclusion in the contractor’s scope are separate decisions.
Example
The new unit begins at a feed tie-in, but the facilitator includes the existing upstream separator because liquid carryover could damage the new equipment. HAZOP recommends a high-high-level trip, an upstream shutdown valve or a new knock-out drum outside the tie-in. The owner or existing-facility contractor may own that modification, while the new-unit contractor updates the interface requirements and verifies the combined solution. However, if feed conditioning was already part of the contractor’s performance obligation, the work may remain contractor scope; if the owner’s stated feed conditions were incorrect, it may support a variation.
Vendor packages and licensor
4 objections
“The Vendor Came from the Owner’s Approved List”
An approved list restricts procurement; it is not a warranty of vendor design. Standard plant-contract forms commonly state that employer approval of a subcontractor does not relieve the main contractor of its obligations.
Example
The owner limits heater selection to three vendors. The selected vendor supplies inadequate purge logic. The vendor should correct the package, but the EPC contractor remains responsible for integrating that correction with fuel isolation, plant shutdown, cause-and-effect logic and operating philosophy. If the vendor fails or is insolvent, the technical gap does not transfer to the owner merely because the owner approved the list.
The commercial recovery may sit between contractor and vendor. The execution of the HAZOP action remains with the party accountable for the integrated facility—normally the EPC contractor.
“The Vendor Has Completed Its Scope and Been Paid”
A paid and demobilised vendor cannot be the sole owner of an open HAZOP action. Someone still controlling the project must remain accountable for the solution.
The main contractor or owner, depending on the contracting model, may need to invoke defect or warranty rights, reopen the purchase order, withhold retention or final acceptance, back-charge where permitted, or appoint another competent designer while preserving recovery rights. Payment does not necessarily extinguish defect liability, but recovery becomes harder after notice periods, warranties and securities expire.
Example
HAZOP is completed after FAT and identifies that a packaged compressor does not transmit a critical shutdown status to the main DCS. The vendor may owe the modification under warranty if the signal was contractually required. If it was absent from both the package requisition and interface schedule, the cost may fall to the party responsible for package integration. Either way, shipment or final payment should not proceed without a documented technical route and commercial reservation.
“Vendor A and Vendor B Will Coordinate”
“To coordinate” is not an accountable owner. Cross-package HAZOP actions need a named interface integrator with authority over the complete scenario.
Example
A compressor supplied by Vendor A sends gas to a downstream treatment package supplied by Vendor B. If the treatment package trips, its inlet shutdown valve closes and abruptly blocks the compressor discharge. Unless the package controls are properly integrated, the compressor may continue operating against the closed valve, causing rapid pressure rise, compressor surge and potential activation of the relief or depressurisation system.
Vendor A must provide the compressor’s trip, anti-surge and depressurisation requirements. Vendor B must provide the shutdown-valve action, closure time and package trip signals. However, neither vendor can verify the complete protection strategy independently. A named project-level process or control authority must determine the required trip sequence, signal exchange and timing, and ensure that the integrated response is reflected consistently in the P&IDs, cause-and-effect diagrams, control narratives, relief assessment and operating procedures.
In EPCM, this is a frequent contractual gap: vendors control their packages, EPCM coordinates only what its SOW names, and the owner holds the contracts. The interface matrix must therefore identify who owns cross-package design—not merely who circulates comments.
“The Licensor Owns the Technology—So the Change Must Be Theirs”
HAZOP may reveal that the licensor’s original safeguarding arrangement does not reduce the risk to ALARP or creates an operating difficulty or hazard upstream or downstream of the licensed package. The response may require an additional shut-off, a bypass arrangement or a revised alarm setpoint, provided the equipment design limits are respected. The licence agreement may define the extent to which the licensor will assess or accept such changes, whether its guarantees remain valid and whether it must revise the affected documentation. Where integration responsibility is unclear and the licensor is unwilling to develop or endorse the proposed modification, participation in the HAZOP does not make it responsible for implementing the complete solution. However, the action cannot simply be closed: the HAZOP team must identify another technically acceptable option, or the owner or contractor must formally assume responsibility for the alternative design, its integration and any effect on the licensor’s guarantees.
Example
A licensed reactor package closes its inlet valve on high temperature, but HAZOP shows that this can deadhead the upstream pump. The team proposes a pump trip and controlled bypass. If the licensor rejects the arrangement because it falls outside the licensed configuration, the project must either develop an alternative acceptable to the licensor or formally proceed under owner or contractor responsibility, with the guarantee implications recorded. If the original safeguard was deficient within the licensor’s agreed scope, the resulting documentation changes and rework may still be pursued as a licensor correction.
Approvals and change
3 objections
“The Drawing Was Already Approved by the Owner”
Owner approval is not normally a transfer of design responsibility. Standard design-and-supply conditions often state that approval of contractor documents does not relieve the contractor of errors or contractual obligations. Conversely, an owner instruction that changes an already approved design may activate the variation mechanism.
Example
An approved P&ID shows atmospheric relief. HAZOP later concludes that flare disposal is required. If the original design failed existing codes or the contracted relief basis, rework points toward the design contractor. If the owner changes inventory, operating mode or risk perception after approval, the resulting redesign points more strongly toward an owner variation.
The approval stamp is therefore weak evidence. The cause of the change is what matters.
“The HAZOP Changed the Design After Approval”
HAZOP does not automatically create an owner change merely because it occurs after document approval. It may reveal a defect that existed before approval, or it may generate a genuinely new requirement.
The action record should classify the change:
This classification should occur before rework begins where practical, but safety-critical work should not be delayed solely because entitlement remains disputed.
“The Owner/Operator Agreed During the HAZOP”
Owner/operator participation is essential for operating feasibility, procedures, staffing assumptions, alarm response, bypass management and residual-risk acceptance. It does not automatically relieve the contractor of design responsibility.
Example
Operations agrees that an alarm and operator response are acceptable instead of an automatic trip. The contractor must still demonstrate that the response time, alarm independence, human factors and operating conditions support that decision. If the risk remains above the contractor’s design criteria or the owner’s acceptance threshold, a workshop comment is not formal risk acceptance.
The record should distinguish:
They may come from different people.
Closure
2 objections
“The Facilitator Closed the Action”
The third-party facilitator may confirm that an action’s response addresses the wording and logic of the HAZOP recommendation. Unless separately appointed as a technical authority, the facilitator should not approve relief sizing, shutdown architecture, materials, package design or residual risk.
Example
A contractor responds, “Vendor confirms existing trip is adequate.” The facilitator can reject the response if it does not address the scenario. Technical closure requires evidence—revised logic, calculation, specification, test record or updated design documents—and approval by the responsible design authority.
Administrative closure is not design verification.
“We Can Resolve the Commercial Issue Later”
Sometimes that is necessary, but it must not leave the action orphaned. The PM should separate technical progress from commercial entitlement and protect both.
- the required technical outcome;
- the integrated-design owner;
- vendor, licensor and operator contributors;
- affected deliverables and the next irreversible milestone;
- commercial status and notice reference;
- technical closure authority;
- residual-risk acceptance authority, where required.
The hold point might be P&ID issue, purchase-order release, FAT, shipment, IFC publication, construction or commissioning. The correct point is the last moment at which the project can still implement the solution without avoidable rework or loss of leverage.
What Incident Investigations Reveal
The 2018 Kuraray ethylene release illustrates why “outside the engineering firm’s SOW” cannot end the discussion. The U.S. Chemical Safety Board found that the engineering scope did not appear to include checking whether each relief discharge went to a safe location; the owner retained the hazardous arrangement and later failed to implement a relevant PHA recommendation. The engineering boundary and owner governance both failed.
Design Safety Intelligence Bureau
Critical Thinking Series
© Design Safety Intelligence Bureau. All rights reserved. This document and its contents may not be copied, reproduced, distributed, downloaded or printed, in whole or in part, without prior written permission.
© Design Safety Intelligence Bureau. All rights reserved. Printing of this document is not permitted.