ED Offshore Inspection Guide

Well Integrity (Operate Phase)

Contents
 Summary
 Introduction
 Action
 Background
 Organisation
 Targeting
 Timing
 Recording and Reporting
 Appendix 1 Inspection Guidance – Documentation review & Well
Operator self-assessment
 Appendix 2 Inspection Guidance – Well Operator self-assessment
questionnaire
 Appendix 3 Inspection Guidance – Role specific interview outline
 Appendix 4 Inspection Guidance – Role specific questionnaires
 Appendix 5 Inspection Guidance – Risk Assessment Review
 Appendix 6 Performance Rating

Summary
This Inspection Guide (IG) sets out the Health and Safety Executive approach
to the inspection of well operators’ well integrity arrangements for the operate
phase of a well lifecycle for wells onshore and offshore in Great Britain.

The Guide provides questions sets to be used as a basis for inspection of the
well integrity arrangements. This has been developed from a background of
HSE and industry guidance on well integrity.

The guide provides the basis to assess any risk gap as defined by HSE’s
Enforcement Management Model, and hence the Duty Holder’s Performance
Score which will feed into the intervention planning process.

Introduction
The most important role of the well-operator is to ensure the integrity of its
wells, barriers and the pressure containment boundary throughout the well life
cycle from design to final abandonment.

The well-operator should consider the benefits of having a policy defining its
commitments and obligations to safeguard health, environment, assets and

Page 1 of 46
TRIM 2018/0303363
reputation by establishing and preserving well integrity. This well integrity
policy should be endorsed at a senior level within the well-operator’s
organisation but may sit within a wider policy framework rather than a stand-
alone document.

The well-operator is responsible for assessing the well risks and reducing
them to ALARP. This should be demonstrated to the offshore installation duty
holder who has primary responsibility for the safety of the installation and the
personnel on board.

Well-operators should have a system for ensuring well integrity throughout the
life cycle. Management of operations may be devolved but the responsibility
for the integrity of the well remains with the well-operator.

Well-operators should satisfy themselves that their procedures and processes

for complying with all relevant legislation are effective. Those key statutory
requirements are:

The Offshore Installations and Wells (Design and Construction, etc)

Regulations 1996, as amended, hereafter referred to as DCR [Ref 4] which
apply to all oil and gas related wells both onshore and offshore;

The Offshore Installations (Offshore Safety Directive) (Safety Case etc.)

Regulations 2015 hereafter referred to as SCR 2015 [Ref 5] which apply
offshore in external waters of the UK Continental Shelf.

The Offshore Installations (Safety Case) Regulations 2005 hereafter referred

to as SCR 05 [Ref 6] which apply offshore in Great Britain internal waters; and

The Borehole Sites and Operations Regulations 1995 hereafter referred to as

BSOR [Ref 7] which only apply onshore Great Britain.

Action
The aim of this Inspection Guide (IG) is to provide information and guidance
to inspectors to support the safe operation of hydrocarbon wells. It does this
by highlighting key areas required in well integrity schemes, so that these can
be covered during inspections, providing a framework for inspectors to judge
compliance, assign performance ratings, and decide what enforcement action
to take should they find legislative breaches. In doing so, it complements
HSE’s Enforcement Policy Statement (EPS) and Enforcement Management
Model (EMM).

The inspection requires well operators to perform a self-assessment of their

Well Integrity Management System (WIMS) to ascertain compliance with
relevant standards and guidance [Appendix 1] and provide the associated
documentary evidence for further review by the inspector. This review will
subsequently be followed by a set of role-specific questionnaires [Appendices
3&4]. The effective management of risk is also critical to impaired wells as
they age throughout their life cycle. Wells Risk Management is treated as a

Page 2 of 46
TRIM 2018/0303363
separate but complimentary assessment [Appendix 5]. These assessments
provide the interpretive standard against which the Enforcement Management
Model (EMM) risk-gap should be assessed and hence the Duty Holder’s
performance Score in relation to well integrity management.

The questions were developed from international standards and guidance and
examples of good industry practice; specifically: ISO16530-1-2017 Well
Integrity Part 1: Lifecycle Governance and Oil and Gas UK Well Life Cycle
Integrity Guidelines, Issue 3.

Success criteria (fundamental requirements) are listed under the inspection

topics [appendix 6]; these cover the key issues that inspectors should
consider when carrying-out inspections against each core intervention issue.
In some instances, not all of the success criteria will apply so inspectors
should make a judgement regarding which of these are relevant in each case.
If the relevant success criteria cannot be met, inspectors should assess how
serious the consequences of failure to comply could be. This will inform their
decision making in terms of the performance ratings that they assign and the
enforcement action they take (if any) based on the findings of the inspection.

Page 3 of 46
TRIM 2018/0303363
BACKGROUND
The loss of well integrity can result in major accidents and presents a severe
risk to the personnel, asset and environment. In the UK, all onshore and
offshore well operators must comply with the Offshore Installations and Wells
(Design and Construction, etc.) Regulations 1996 (DCR). The DCR place
goal-setting duties on well operators, to ensure that there is no unplanned
escape of fluids from the well and risks to the health and safety of persons are
as low as is reasonably practicable (ALARP) throughout the well lifecycle.

The accepted good practice philosophy is that all wells are to be equipped
with two well barriers against the reservoir, and that the well barriers are to be
as independent of each other as possible. This ensures no single failure of a
component is to lead to unacceptable consequences. If one of the barriers
fails, the well has reduced integrity and operations have to take place to
replace or restore the failed barrier element. These barriers can deteriorate or
its functional efficiency reduced during the well lifecycle resulting in the
leakage of hydrocarbons.

The referenced ISO 16530-1-2017 document was prepared by Technical

Committee ISO/TC 67, Materials, equipment and offshore structures for
petroleum, petrochemical and natural gas industries, Subcommittee SC 4,
Drilling and production equipment.

A well lifecycle is detailed below:

This inspection guide is concerned with the operational phase. Wells will
spend the vast majority of its life in the operate phase therefore this guide
targets the greatest cumulative risk. The design phase, construction,
intervention and abandonment phases are inspected through the Well
Notification process.

ISO Standards

ISO (the International Organization for Standardization) is a worldwide

federation of national standards bodies (ISO member bodies). The work of
preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which a
technical committee has been established has the right to be represented on
that committee. International organizations, governmental and non-
governmental, in liaison with ISO, also take part in the work.

Page 4 of 46
TRIM 2018/0303363
Oil and Gas UK Guidance
The Well Life Cycle Practices Forum (WLCPF) produced guidance on well
integrity for Oil and Gas UK. They were written by the Well Integrity
Workgroup which included experts from several operators and were reviewed
by external stakeholders that included other WLCPF members and the HSE
and BEIS.

The ISO Standard and Oil & Gas UK guidance are relevant to;

 all well-operators of GB & UKCS wells

 well integrity during the full lifecycle of the well

The guidelines address arrangements for well integrity, contents of well

integrity management scheme, administration of a well integrity management
scheme, effective implementation of the well integrity management scheme,
wells risk assessments, barriers, component performance standards,
operating limits, monitoring and surveillance requirements, wells
maintenance, integrity failures, management of change, records, effective
audit and review during the relevant phase of the well life cycle.

LEGAL REQUIREMENTS
There is a general duty under Regulation 13 of the Offshore Installations and
Wells (Design and construction, etc) Regulations 1996 for the well operator to:

Ensure that a well is so designed, modified, commissioned, constructed,

equipped, operated, maintained, suspended and abandoned that:

a) so far as is reasonably practicable, there can be no unplanned escape

of fluids from the well; and
b) risks to the health and safety of persons from it or anything in it, or in
strata, to which it is connected, are as low as reasonably practicable.

Regulation 16 requires:

The well operator shall ensure that every part of a well is composed of
material which is suitable for achieving the purposes described in regulation
13(1)

The Offshore Installations (Offshore Safety Directive) (Safety Case etc)

Regulations 2015 requires (at Schedule 6) duty holders of production
installations to describe in the safety case how they will comply with the above
regulations and a description of how duty holders ensure the suitability of the
safety and environmentally critical elements.

Page 5 of 46
TRIM 2018/0303363
Organisation
Targeting
Inspections should be carried-out in accordance with OSDR duty holder
intervention plans.

Timing
Inspectors should undertake well integrity inspections as part of the agreed
OSDR Intervention Plan; when intelligence indicates intervention is
necessary, or as part of an investigation following an incident.

Resources
Resource for the undertaking of well integrity management interventions will
be agreed as part of the OSDR Work Plan or by agreement between
discipline specialist team-leaders and inspection management team-leaders,
as appropriate.

Recording & Reporting

The duty holder performance ratings should be entered on the Inspection
Rating Form (IRF) tab of the relevant installation Intervention Plan Service
Order. Findings should be recorded in the normal post inspection report and
letter.

References
1. ISO 16530-1-2017 Petroleum and natural gas industries — Well
integrity — Part 1: Life cycle governance
2. ISO 5208:2015(E) Industrial valves — Pressure testing of metallic
valves
3. BS EN ISO 10417:2004 Petroleum and natural gas industries —
Subsurface safety valve systems — Design, installation, operation and
redress
4. ISO 17776:2016 Petroleum and natural gas industries – Offshore
production installations - Major Accident hazard management during
the design of new installations
5. Oil and Gas UK – Well Life Cycle Integrity Guidelines
6. Oil and Gas UK – Guidelines for the Competence of Wells Personnel
7. API Standard 6AV2 Installation, Maintenance, and Repair of Surface
Safety Valves and Underwater Safety Valves Offshore (First Edition,
March 2014)
8. API Recommended Practice 14B Design, Installation, Operation, Test,
and Redress of Subsurface Safety Valve Systems
9. API RP 90 Recommended Practice Annular Pressure Management in
Offshore Wells
10. API RP 90-2 Recommended Practice Annular Pressure Management
in Onshore Wells
11. A guide to the well aspects of the Offshore Installations and Wells
(Design and Construction, etc.) Regulations 1996, L84
12. Offshore Installations (Offshore Safety Directive) (Safety Case etc.)
Regulations 2015 – Guidance on Regulations L154

Page 6 of 46
TRIM 2018/0303363
 13. Offshore Installations (Safety Case) Regulations 2005
14. Borehole sites and Operations Regulations 1995 – Guidance on
Regulations L72

Contacts
ED Offshore: ED 6.3 Specialist inspectors

Appendices
Appendix 1 Inspection Guidance – Documentation review & Well Operator
self-assessment
Appendix 2 Inspection Guidance – Well Operator self-assessment
questionnaire
Appendix 3 Inspection Guidance – Role specific interview outline
Appendix 4 Inspection Guidance – Role specific questionnaires
Appendix 5 Inspection Guidance – Risk Assessment Review
Appendix 6 Performance Rating

Page 7 of 46
TRIM 2018/0303363
Appendix 1: Inspection Guidance – Documentation Review

The need for a Well Integrity Management System inspection using this guide
is likely to be defined by the OSDR intervention planning process but may be
implemented separately by HSE wells specialists to respond to: complaints,
investigations, newly appointed well operators, changes in well operator’s well
stock etc.

This appendix details the typical information that should be requested prior to
a Well Integrity Management System inspection. The intention is to gauge the
robustness of the system, and provide inspectors with information which can
inform their questionnaires:

 The well operator should complete the self-assessment questionnaire

contained in appendix 2 detailing the documentary evidence for their
response. These documents should be sent through for inspection
prior to the interviews. These documents are likely to include:
o A current copy the documents which contain; the Well Integrity
Policy, The Well Integrity Strategy and Barrier Management Policy.
o A current and complete copy of the arrangements for: Well Integrity,
Deviations and Dispensations, and associated Risk Assessment
o Details of the individual position responsible for the management of
well integrity during the operate phase of the well lifecycle.
o A definitive list of wells covered by the arrangements. [Using OGA
& company nomenclature]
o Details of the management of well integrity KPIs including a current
well integrity status of the well operator’s wells.
o Two examples of current or recently approved well
deviation/dispensation documentation including any relevant
supporting documentation and risk assessments.
o Performance Standards for the wells SECEs during the operate
phase.
o Details of any Remedial Action Requests (RAR) or comments from
the Independent Competent Person (ICP) related to the wells from
the latest well verification activities

It is anticipated that this documentation may take some time to collate and
therefore notification of an inspection and requests for information should be
made, wherever possible, in a timely manner when part of the planned
intervention strategy.

Inspectors shall review the self-assessment against the provided

documentation in advance of the interviews to ensure that clarification
questions are raised during those interviews.

Page 8 of 46
TRIM 2018/0303363
 Appendix 2: Well Operator Self-Assessment – System Review

Questions Model Answer Evidence and Comments

Well Integrity Policy and Strategy;
1. Is the Well Integrity Policy clear?
The Well Operator should have a policy (or other Evidence should include the document
Does it safeguard HS&E? Is it documents that clearly achieve the same aim as a reference to which the information is
endorsed at a senior level? policy) defining its commitments and obligations to contained along with the chapter, page and
safeguard health, environment, assets and reputation paragraph such that it is easy to trace
by establishing and preserving well integrity. This well
integrity policy shall be endorsed at a senior level
within the Well Operator organisation.
2. Does the WIMS explain how the The Well Operator well integrity management system
Well Integrity Policy will be (WIMS) should clearly indicate how the policy is
achieved? interpreted and applied to well integrity.
Resources, Roles, Responsibilities and Authority Levels;
3. Are roles and responsibilities Each Well Operator should define the roles and
clearly defined? responsibilities for all professional, supervisory,
operational and maintenance personnel required to
manage the well integrity system. Roles and
responsibilities should be documented.
4. Does the WIMS reference an Each Well Operator should ensure that their personnel
appropriate wells personnel (employees and contractors) who participate in well
competency system? integrity activities are competent to perform the tasks
assigned to them.
Each Well Operator should define well integrity
personnel competency requirements to ensure that
well integrity activities are carried out in a manner
which is both safe and efficient as regards protection of
health, the environment and assets. A competence
performance record should be maintained that
demonstrates compliance.
Risk Assessment Aspects of Well Integrity Management;

Page 9 of 46
TRIM 2018/0303363
5. Is there an established procedure The risk assessment procedure chosen should be
for wells risk assessments or is a suitable and sufficient for wells matters. Where a
corporate risk assessment used? separate wells specific procedure is used it should be
aligned to and reference the corporate risk assessment
procedures.
6. Is the risk assessment matrix The Well Operator should determine appropriate
suitable for MAH wells risks? levels/definitions for consequence (severity) and
likelihood of occurrence (probability) categories on the
risk assessment matrix axes.
Well Barriers;
7. Have the barriers for each well The Well Operator should define a barrier philosophy
type been documented? Are for each of the well types within the WIMS. Typically
these sufficiently detailed and this will require two barriers in the direction of flow.
suitable for downhole conditions? Where two barriers are not achieved an ALARP
demonstration may be required.

8. Does the WIMS mandate a risk In cases where a barrier envelope cannot be
assessment where a well is maintained according to the original design
outside original design specification, the Well Operator should perform a risk
specification? How should this be assessment to establish the required controls to
documented? mitigate the risk. This risk assessment is likely to be
included in a formal Management of Change process.
9. Does the well operator use well Well barrier schematics as mandated by NORSOK
barrier schematics to demonstrate D10 are effective. ISO 16530-1 also states that well
the design barriers or capture barrier schematic should be used. In some cases,
current well barrier status? If not other methods such as spreadsheets tables may be
is the solution they employ used where they are equally effective.
equally effective?
Well Component Performance Standards;
10. Are performance standards in The Well Operator should define performance
place for each type of well? Do standards for each well type. Performance standards,
they detail the requirements for supported by the risk assessment, are the basis for the

Page 10 of 46
TRIM 2018/0303363
 maintenance, assurance and development of maintenance and monitoring
verification activities? Are the requirements
company standards sufficiently
detailed and refer to appropriate
industry standards?
11. Have acceptable leak rates been Using a risk-based approach, the Well Operator should
determined and documented for define their acceptable leak rates and testing
each well component? frequency for individual barrier elements for all well
types within the acceptance criteria described below.
12. Are these contained within a Has the well operator defined leak rates for individual
matrix? well components in a leak rate matrix? If not have
equally effective measures been identified?
13. How do leak rates compare with ISO Acceptable leak rates shall satisfy at least all the
ISO minimums and other industry following acceptance criteria:
norms?  leak across a valve, leak contained within the
envelope or flow path: ISO 10417:2004 & API
6AV2
 leak across a barrier envelope, conduit to conduit:
not permitted unless the receiving conduit is able to
withstand the potential newly imposed load and
fluid composition
 no leak rate from conduit to conduit exceeding the
leak rate specified in ISO 10417:2004, which
defines an acceptable leak rate as 24 l/h of liquid or
25.4 m³/h (900 scf/h) of gas
 no unplanned or uncontrolled leak of wellbore
effluents to the surface or subsurface environment.

ISO goes on to recommend a maximum leak rate for

tree valves at 3cc/min/inch. This is consistent with
other international standards.

Page 11 of 46
TRIM 2018/0303363
 Within the UKCS a number of operators apply a liquid
leak rate of 2cc/min/inch as their leak rate acceptance
criteria, with any leakage above 50cc/min indicating
washout. This is significantly below API 14B of 400cc/
minute. Where an operator has determined an
acceptable leak rate for valves above the 2cc/min/inch
value they may be asked to demonstrate why that
approach has been deemed ALARP.
Well Operating Limits
14. How are operating limits identified The Well Operator should identify the operating
initially and when changes to the parameters for each well and clearly specify the
well occur? operating limits for each parameter.
15. How have responsibilities for The Well Operator should clearly define:
operating limits been defined and  responsibilities for establishing, maintaining,
communicated? reviewing and approving the well operating limits
 how each of the well operating limits parameters
should be monitored and recorded during periods
when the well is operational, shut-in or suspended
 life-cycle of the well
 requirements for any threshold settings for the well
operating limits
 actions that should be taken in the event a well
operating parameter is approaching its defined
threshold
 actions, notifications and investigations required if
well operating limits thresholds are exceeded
 safety systems that are necessary for assurance of
operating limits.
Well Monitoring and Surveillance;
16. Does the WIMS include a The Well Operator should have in place a program to
program to monitor annulus monitor the annuli pressure. To effectively monitor
pressures that extend to annulus pressures, the following should be recorded:

Page 12 of 46
TRIM 2018/0303363
 monitoring and trending fluids and  fluid types and volumes added to, or removed from,
pressures? the annulus
 fluid types, and their characteristics, in the annulus
(including fluid density)
 monitoring and trending of pressures
 calibration and function checks of the monitoring
equipment
 operational changes.
17. Are valid MAASPs available for all The MAASP should be determined for each annulus of
wells and documented the well. The MAASP calculation shall be documented
sufficiently? together with the applied design factors
Annular Pressure Management;
18. Is annulus pressure management The Well Operator should manage the annuli
across the lifecycle of the well pressures such that well integrity is maintained
clearly documented? throughout the complete well life cycle. At a minimum,
it is necessary to consider the following when
managing annulus pressure based upon a risk
assessment:
 pressure sources
 monitoring, including trends
 annulus contents, fluid type and volume
 operating limits, including pressure limits, allowable
rates of pressure change
 failure modes
 pressure safety and relief systems.
19. Is the process for annulus review The Well Operator should define the process of
adequately described? annulus review (investigation) when the operating
conditions indicate that the pressure is sustained or a
leak in a well barrier envelope has occurred. When
such a review is required, it shall be defined and may
be based on established criteria for:

Page 13 of 46
TRIM 2018/0303363
  frequency of annulus pressure bleed-down or top-
ups
 abnormal pressure trends (indicating leaks to/from
an annulus)
 volume of annulus bleed-down or top-ups
 type of fluid used or recovered (oil/gas/mud)
 pressure excursions above MAASP and/or upper
threshold.
Well Handover;
20. Are the requirements for well The Well Operator should include the following in the
handover sufficiently detailed? well handover documentation in the initial handover
from the construction to operation phases:
 schematic of the Christmas tree and wellhead
providing, at a minimum, a description of the
valves, their operating and test criteria
(performance standards), test records and their
status (open or closed)
 SSSV status, performance standard and test
records
 status of ESD and actuator systems
 well start-up procedures detailing
production/injection rates, as well as associated
pressures and temperatures
 details of any well barrier elements left in the well
(crown plugs, check valves or similar) or devices
that ordinarily would be required to be removed to
allow well production and/or monitoring
 detailed description and diagram of the well barrier
envelopes, clearly indicating both primary and
secondary well barrier envelopes; detailed wellbore
schematic and test records (depicting all casing
strings complete with sizes, metallurgy, thread

Page 14 of 46
TRIM 2018/0303363
 types and centralizers as well as fluid weights,
cement placement, reservoirs and perforating
details)
 detailed completion tally as-installed (listing all
component ODs, IDs, lengths, metallurgy, threads,
depths)
 wellhead and Christmas tree stack-up diagram
(general assembly drawing with dimensions) with a
bill of materials
 wellbore trajectory with the wellhead surface
geographical coordinates
 pressures, volumes and types of fluids left in the
annuli, wellbore and tubing and Christmas tree
 well operating limits
 subsea control system status and test records (if
applicable).

Are operational handovers equally well defined?

Well Maintenance;
21. Have you defined and The Well Operator should define and document the
documented maintenance schedules and frequencies for maintenance activities.
schedules and frequencies? A risk-based approach can be used to define the
frequency and an assessment matrix can be used in
the process.
The frequency may be adjusted if it is found that the
ratio of preventive/corrective maintenance tasks is very
high or very low once sufficient historical data have
been obtained that establish clearly observable trends.
22. Does your maintenance Well equipment that is part of a barrier element should
management system capture the be maintained using parts that retain the current
operating limits and OEM operating limits. Replacement parts should be from the

Page 15 of 46
TRIM 2018/0303363
 requirements for selection of original equipment manufacturer (OEM), or an OEM-
spare parts for wells? How are approved manufacturer. Deviation from this practice
deviations from this practice should be clearly documented and justified.
captured?
Well Integrity Failure Management;
23. Is there a process for the The Well Operator should establish a well anomaly
management of risk in relation to process that describes the management of risks
well barrier failures, performance associated with failure(s) of a well barrier envelope or
failures, etc.? well barrier element(s) against their performance
standards, as defined by the Well Operator, legislation
or industry standard.
24. Is there a dispensation process to The Well Operator should apply a dispensation
manage wells risks? process that assesses and manages the risk(s) that
apply to temporary non-compliance to the well integrity
management system.
Management of Change
25. Does the WIMS clearly reference The Well Operator should apply a management of
a formal MOC procedure that is change (MOC) process to address and record changes
suitable for both permanent and to integrity assurance requirements for an individual
temporary changes? well or to the well integrity management system.
26. What key process steps does The MOC should include the following process steps:
your MOC contain?  Identify a requirement for change
 Identify the impact of the change and the key stake
holders involved. This includes identifying what
standards, procedures; work practices, process
systems, drawings, etc. would be impacted by the
change
 Perform an appropriate level of risk assessment in
accordance with the Well Operator risk assessment
process. This would include;
o identifying the change in risk level(s) via
use of a risk assessment matrix or other

Page 16 of 46
TRIM 2018/0303363
 means
o identify additional preventative and
mitigating systems that can be applied
to reduce the risk level
o identify the residual risk of implementing
the change/deviation
o review the residual risk level against the
Well Operator risk tolerability/ALARP
acceptance criteria.
 Submit MOC proposal for review and approval in
accordance with the Well Operator authority
system
 Submit relevant MOC to Well Examiner
 Communicate and record the approved MOC.
 Implement the approved MOC
 At the end of the approved MOC validity period, the
MOC is withdrawn, or an extension is submitted for
review and approval
 ICP is involved as appropriate

Page 17 of 46
TRIM 2018/0303363
Appendix 3: Inspection Guidance – Role Specific Interview Outline

Role specific interviews with key personnel who monitor and manage well
integrity during the operate phase of the well lifecycle should be interviewed.
Consideration should be given to the location of these interviews as certain
personnel may benefit from access to internal company computer systems to
demonstrate the particular systems employed for the management of well
integrity.

At least one of each of the following roles within the well operator’s
organisation should be interviewed:

 Production Engineer; usually responsible for collating the well integrity

data.
 Well Integrity Engineer; responsible for the day to day collation,
monitoring analysis and reporting.
 Well Integrity TA responsible for review and approval of well integrity
deviation/dispensations.
 Person responsible for the overall well integrity of the well operator’s
UK well stock.
 OFFSHORE – production operator, control room operator, production
supervisor as applicable.

It is anticipated that the role specific interviews can be completed within 1 full
day of inspection onshore (with a potential offshore interview as part of any
planned offshore inspection or investigation) with the following indicative
agenda:

Anticipated Start Time: 08.30 am

a. Introductions, HSE setting the scene, Well Operator may 0830-0930 hrs
wish to present an overview to HSE of their Well Integrity
Management System

b. Interview with Production Engineer 0930-1000 hrs

c. Intervention with Well Integrity Engineer 1000-1030 hrs

d. Interview with Well Integrity TA 1045-1200 hrs

Lunch Break

e. Interview Responsible Person (Well Integrity) 12:45-1400 hrs

f. Inspector consolidation or time for interviewing additional 1400 -1430 hrs

positions as identified by Well Operator.

g. Closeout Meeting 1430-1530 hrs

Page 18 of 46
TRIM 2018/0303363
 Appendix 4: Inspection Guidance – Role Specific Questionnaires

RESPONSIBLE PERSON Name:_________________________________ Position:_________________________________

Questions Model Answer Evidence and Comments

Well Integrity Policy and Strategy
1 How do you implement the well The Well Operator should define the high level To be populated by wells inspector with the
integrity policy across your strategic measures to which it is committing in order to answers to the questions given by the
company, installations and/ or achieve the requirements of the asset (well) integrity interviewed person and compared to
assets? policy. (the level of this strategy is likely to be: previously submitted documents.
business plans and priorities, resourcing plans, and
budgeting)
Resources, Roles, Responsibilities and Authority Levels
2 How do you ensure that you have Each Well Operator should ensure that sufficient
sufficient resources to manage resources in their organizations are available to
well integrity? manage well integrity effectively during the operational
life cycle of the well for each well in the inventory
Risk Assessment Aspects of Well Integrity Management
3 Has base line risk for each well or This may well be QRA work including the development
well type been considered? of bowties. Where appropriate this will be documented
When was base line risk last in the installation safety case.
reviewed?
Well Barriers
4 What factors are taken into During the operating phase of a well, boundary
account when re-evaluating conditions or well usage may change. This requires a
operating conditions? re-evaluation of the barrier envelopes and the well
operating limits.

A well barrier envelope should:

 withstand the maximum anticipated differential
pressures to which it can be subjected;

Page 19 of 46
TRIM 2018/0303363
  be leak and function-tested, or verified by other
methods;
 Function as intended in the environment
(pressures, temperature, fluids, and mechanical
stresses) that can be encountered throughout its
entire life cycle.
5 Demonstrate how to access key Well barrier element: For a well barrier element to be
well barrier status within your considered operational, it should be verified and
WIMS for 3 different categories of maintained through regular testing and maintenance.
well. (for example a platform The location and integrity status of each well barrier
producer, a subsea producer and element should be known at all times.
a partially abandoned The Well Operator shall be able to demonstrate the
(suspended) well. status of well barrier envelopes for each well and well
type
Well Component Performance Standards
6 How does the well integrity ESD/related safety systems - Performance
management system interface requirements for emergency shutdown system should
with management of the be developed with consideration of ISO 10418 and API
emergency shut down systems? RP 14C.

In addition to the requirements of API STD 6AV2, the

Well Operator should define the cause and effects
matrix for the emergency shutdown system.
7 How is wells performance Information about valve performance such as leak
recorded alongside ESD rates are likely to be recorded within well integrity
performance data? records, however closure times may be recorded
elsewhere. The overall performance of the ESD
system should be collated to ensure it achieves the
performance standards. The mechanism for sharing
this information should be contained within the WIMS.
Well Operating Limits
8 How do you assure yourself that The well should not be operated outside of the

Page 20 of 46
TRIM 2018/0303363
 the wells have been operated operating limits. The system should have a mechanism
within the limits set within the for tracking instances of operating outside limits.
WIMS.
9 Does the WIMS require action to The Well Operator should establish a time bound plan
restore the integrity of an that identifies restoration to production, injection,
impaired well? suspension or abandonment of the identified wells,
which is in accordance with the WIMS to mitigate the
risk of loss of containment.
10 Do you have criteria to trigger a The Well Operator should define the end of well life
formal end-of-well-life review? and establish a formal end-of-well-life review process.
The end of well life triggers the review that assesses
the well status for safe continuation. If the well
assessment demonstrates that the well is unsafe for
continued use, the Well Operator shall plan either to
rectify the well condition or plan for suspension or
abandonment. The period by which a well’s life can be
extended is determined on a case-by-case basis.
Well Monitoring and Surveillance
11 How are monitoring and The Well Operator should define the monitoring and
surveillance requirements surveillance requirements to ensure that wells are
derived? Where are these operated within their envelope. The Well Operator
documented? should determine the frequency of monitoring and
surveillance, based on the risk and consequence of
breaching the barrier envelopes and the ability to
respond. The Well Operator should define and
document the schedule, frequency and type of
monitoring and surveillance required.
12 How do these differ for shut-in A shut-in well is a well with one or more valve(s) closed
wells? in the direction of flow. A shut-in well should be
monitored according to a risk-based schedule defined
by the Well Operator, with due consideration of the risk
profile brought about by the change in flow and non-

Page 21 of 46
TRIM 2018/0303363
 flow wetted components.
13. Have you a documented review A well should not remain a shut in or suspended or
process for wells not currently abandoned to phase 1 or phase 2 indefinitely. The Well
producing? Operator should establish a periodic review process for
these wells that documents and details the intended
plan for the well, which may include its permanent
abandonment.
Annular Pressure Management
14. What criteria are used in annulus The Well Operator should assess the risks associated
pressure risk assessments? with a sustained annulus pressure. Such risks are
related to:
 flow capability of any annuli with respect to a loss
of containment
 annular gas mass storage effect (i.e. volume of gas
between the annulus’s liquid level and surface)
 introduction of corrosive fluids into an annulus not
designed to resist such fluids
 maximum potential pressure that can occur should
the compromised barrier degrade further.
The review should focus around the following
elements:
 source of the sustained annulus pressure based on
sample and finger-print results compared to original
mud logging data;
 source fluid composition and pore pressure;
 flow path from the source to the annulus (or vice
versa) under review;
 leak rate, potential volumes and density changes in
the annulus;
 condition of the well (remaining life);
 content of the annulus and liquid levels;

Page 22 of 46
TRIM 2018/0303363
  casing shoe strength changes.
15. What criteria were considered Annulus depressurisation or ‘bleed down’ may be
when developing annulus required to maintain the annulus pressure below the
pressure bleed down procedures? upper operating pressure limit. Annulus pressure
management procedures should clearly define the
constraints of depressurisation and consider the
following:
 minimizing the number of bleed downs and volume
of fluids bled off to limit flow erosion and
degradation of leak paths
 bleed down sequence should be identified to
minimise the risk of casing collapse
 bleed downs may introduce fluids into an annulus
that could accelerate corrosion or erosion of casing
strings
 bleeding off liquids which are replaced by gas or
lighter liquids can result in higher annulus pressure
and increased hydrocarbon mass in the annulus
 the risk of hydrate formation during bleed off of
hydrocarbon gas should be addressed
 contingency plans should be in place to manage
annulus pressure during shut downs when bleed
off facilities may not be available.
Well Handover
16. What are the requirements for The Well Operator should verify the well operating
well handover? How are these limits within the well handover process. The process
documented for the different shall define, as a minimum, the following phases at
handovers that occur over the which well handover typically occurs:
well lifecycle?  well construction to production operations
 production operations to maintenance, intervention
or servicing, and back to production operations
 production operations to abandonment.

Page 23 of 46
TRIM 2018/0303363
17. Are handover forms completed in Handovers during the well lifecycle should include only
full or do the parties involved only those items that are appropriate, and capture any
complete the information that they changes in the well’s configuration or operating limits.
think is relevant? In these cases
how are handover forms verified?
18. How do you identify the The Well Operator should nominate competent
appropriate personnel for the personnel who are responsible for preparing, verifying
handover operation? How is their and accepting the well handover documentation.
competence for this process These persons should sign and date the
verified? documentation accordingly.
Well Maintenance
19. Have all relevant well The Well Operator should identify all respective fitted
components been identified within components in a planned maintenance program.
the maintenance management These would typically include, but are not limited to,
system? the following components:
 wellhead, tubing hanger and Christmas tree,
including all valves, bonnets, flanges, (tie-down)
bolts and clamps, grease nipples, test ports, control
line exits
 monitoring systems, including gauges, transducers,
sand detectors, corrosion probes etc.)
 annulus pressures and fluid levels
 down-hole valves (SCSSV, SSCSV, ASV, gas-lift
valves)
 ESD systems (detectors, ESD panels, fusible
plugs)
 chemical injection systems.
20. What is the current status of wells The Well Operator should have preventative and
maintenance across the asset corrective maintenance management system for
company? Is there a backlog? performing well maintenance work, including
How is this managed? acceptance criteria, and should keep auditable records
of maintenance activities. When defining schedules

Page 24 of 46
TRIM 2018/0303363
 and test frequencies the Well Operator should take into
account the following, as a minimum:
 original equipment manufacturer specifications
 risk to environment and personnel exposure
 applicable industry recognized standards, practices
and guidelines
 Well Operator relevant policies and procedures.
21. What industry standard is used Function and performance testing of ESD/SSV valves
for function and performance should be carried out as per a defined standard:
testing of ESD/ SSVs?  API STD6AV2
 ISO 10417 / API14B
Further standards and guidance available in Oil & Gas
UK Well Lifecycle Integrity Guidelines

Well Integrity Failure Management

22. Is the well integrity failure The process should describe the course of action to
management process clearly correct the failure, based on the number of barrier or
defined such that it can be barrier elements that remain functional. That is, the
followed through for any particular level of redundancy of barriers or barrier elements of
scenario? the well.
23. In the event of a well integrity A well integrity failure should be risk-assessed against
failure how is the initial risk the criticality of the failed barrier element, taking into
assessment captured? account the redundancies in place and/or any
consequential risk to secondary barriers. This may be
displayed in a Corrective Action Matrix.
24. Does that process set a priority to The priority-to-repair (response time) should be set in
repair? accordance with the risk exposure.
25. Do you have a risk-based repair The Well Operator should have a risk-based repair
model to provide guidance for model and structure in place that provides guidance for
remediation? Does the model adequate resources, such as spares, tools, contracts,
consider well type, barrier etc., in order to meet the response time to affect
integrity, multiple failures, time- repairs as defined in the model. The well integrity

Page 25 of 46
TRIM 2018/0303363
 based actions? response model should include, but is not be limited to:
 well type identification based on risk
 single barrier element failures
 multiple barrier element failures
 time-based course of action.
26. How do asset managers and Asset managers and senior managers should have on-
senior management get informed going visibility of Well Integrity Status, and overdue
about well status? wells maintenance should use corporate mechanisms
such as backlog and deferral procedures.
Management of Change
27. Is there a dispensation process to The Well Operator should apply a dispensation
manage wells risks? process that assesses and manages the risk(s) that
apply to temporary non-compliance to the well integrity
management system. This process should identify
when ICP involvement is required.
28. Are dispensations time bound? Is Dispensations should be time bound and, if extended,
there escalation for re-issue/ the approval process may escalate in approval level
extension of dispensation? within the Well Operator organisation
29. Does the dispensation procedure The Well Operator should have a procedure that
describe the process of clearly specifies the process and approvals required for
approvals, approval levels, and deviation from the standard.
trigger review of regulator
notifications?
Well Records and Well Integrity Reporting
30. Are wells covered by an At a minimum, the Well Operator shall:
established document control  maintain a repository, providing access to data and
procedure that is fit for purpose? documents for all relevant users
 develop a documented process and procedure for
controlling and updating data and documents
 establish a data/document maintenance feature to
combat degradation and ensure software (where
used) inter-changeability

Page 26 of 46
TRIM 2018/0303363
  define and staff functions responsible for data
collection and document management
 define those who are authorized to have access to
the records
 define how long records are retained.

31. Does the WIMS sufficiently The Well Operator should define the minimum
document reporting requirements reporting requirements to effectively reflect the
in relation to well integrity? application of the WIMS and all its elements. These
may include:
 routine reports issued on a predefined periodic
basis (e.g. monthly, quarterly, or annually)
reflecting the well integrity activities and issues
addressed
 reporting on the identified KPIs
 event-specific well integrity incident and WIMS non-
compliance reports and investigations
 WIMS audit reports
 reporting to the OSDR/ HSE
 it should explain how the well integrity status is
communicated within the company including to
asset and senior managers
32. Are report scope and key The WIMS should define the scope, recipients and
recipients / signatories of those acknowledgement of receipt of all such reports. Topics
reports clearly documented? covered in the reports may include the following, but is
not limited to:
 previous well reviews, or ad hoc well reviews
 changes to the original boundary conditions
 change in the well’s function
 changes in the well fluid composition
 change or possible degradation of well and well

Page 27 of 46
TRIM 2018/0303363
 related hardware
 examination of MOC notices
 examination of well deviations issued
 well barriers
 well integrity issues
 scale or corrosion issues
 wear and tear to hardware and equipment
 accidental damage to hardware and equipment
 equipment obsolescence
 loss of barrier or containment
 environmentally related changes
 statutory or legislative changes
 changes in local procedures and standards
 changes to the local operating risk model
 advances in technology that may be implemented
 changes to the operating limits of
equipment/material, e.g. latest manufacturer’s
bulletins or industry standards
 repairs to, and replacements of, well components,
form valve parts to complete work over
 relevant equipment maintenance information in
order to improve equipment technical
specifications, reliability data and/or preventive
maintenance intervals.
Performance Monitoring of Well Integrity Management Systems
33. Do you conduct WIMS The Well Operator should conduct performance
performance reviews across your reviews to assess the application of the WIMS to a
well stock? defined well stock. The primary objectives of a
performance review are to:
 assess how well the WIMS is performing in
accordance with its objectives;

Page 28 of 46
TRIM 2018/0303363
  assess how well the WIMS processes adhere to
the policies, procedures and standards defined in
the WIMS;
 identify areas of improvement.

Where areas for improvement are identified, any

changes required to address these improvements
should be specified and implemented. Implementation
of any changes shall follow the risk assessment and
management of change processes.
34. What frequency? Such reviews should be performed at a defined
frequency as determined by the Well Operator based
upon associated risks.
35. What additional triggers are there In addition, ad hoc reviews should be performed as
for a review of the WIMS? and when deemed necessary when new information
becomes available that can have a significant impact
on well integrity risk or assurance processes.
36. Who performs the reviews? The review should be performed by a group of
personnel who are deemed competent in well integrity
management and who are familiar with the Well
Operator WIMS. It is recommended that, where
practicable, at least some personnel involved in the
reviews should not be directly involved in well integrity
management of the well stock under review, in order to
provide a broader perspective and to aid in identifying
any issues that can have been overlooked by those
who are engaged in day-to-day operation of the wells
under review.
37. What wells KPIs have been The Well Operator should determine KPIs and a
identified and how are these suitable review frequency that are appropriate to track
tracked and reported? the effectiveness of their particular WIMS. These
should normally be based on metrics that are aligned

Page 29 of 46
TRIM 2018/0303363
 to critical objectives of the WIMS.
Compliance Audit
38. Do you audit the WIMS? Is The Well Operator should establish an audit process to
compliance monitoring in place? demonstrate compliance with the well integrity
management system. The audit reports should provide
clear indications as to which sections of the WIMS are
functioning adequately, and which sections need
further action.
39. Are audit frequencies, terms of Each element of the WIMS should be the subject of an
reference, objectives and scope audit. The Well Operator shall establish the frequency
identified? of audits. Each audit should have clearly defined terms
of reference focused on testing compliance with the
WIMS and the effectiveness of meeting the objectives
of the WIMS. The audit objectives, scope and criteria
have to be agreed in advance.

Page 30 of 46
TRIM 2018/0303363
 TECHNICAL AUTHORITY Name:_________________________________ Position:_________________________________

Questions Model Answer Evidence and Comments

Well Barriers
1. How do you maintain an up to The Well Operator should know the status of each well To be populated by wells inspector with the
date status of your well barriers?barrier envelope and shall maintain all well barrier answers to the questions given by the
envelope(s) according to the well’s intended well interviewed person and compared to
operating limits. previously submitted documents.
2. Do you monitor the integrity Do you monitor test results that may indicate a trend
parameters to identify towards failure, such as valves that require functioning
degradation? or greasing to achieve a good test, or where, although
within the acceptance criteria the leak rate of a valve is
increasing over time.
Well Component Performance Standards
3. Have you had occasion recently In the case of one or more barrier impairment(s) the
where a well barrier has failed to Well Operator should risk assess the potential loss of
meet its performance standard? containment and put mitigating controls in place as
Please describe how this was deemed necessary by the assessment. Operating
addressed including providing the outside a defined envelope should be managed by a
risk assessment. formal risk based dispensation system.
4. Does the WIMS system provide A component should be tested in the direction of flow.
guidance on pressure testing If this is impossible or impractical, a test of the
requirements such as flow component in the counter-flow direction should be
direction? Is this incorporated in performed where possible. The test can be of limited
individual test procedures and value in establishing the component’s ability to seal in
acceptance criteria? the direction of flow. Any component tested in the
counter flow direction should have this documented.
5. Do you have any plugs dressed Plugs dressed with chevron seals (or ‘V’ packing), or
with chevron seals valves with separate sealing faces, should be
(unidirectional)? How are testing considered uni-directional. They should be tested in
requirements documented? the direction of flow to be considered a barrier.

Page 31 of 46
TRIM 2018/0303363
6. Do you require Double Block and In the case of an in-line valve that requires
Bleed (DBB) isolations for maintenance or repair, there can be pressure sources
breaking well containment? both upstream and downstream to consider when
isolating the valve in preparation for breaking
containment. A double block-and-bleed or two barrier
principle should be applied for upstream or
downstream isolation.
Well Operating Limits
7. Is it possible to trace current well The well operating limits should be based on the
operating limits to the original specifications of the components that make up the well
specifications and designs from with their design factors and performance standards
which they were derived? applied.
8. What would trigger a review of a Any changes in well configuration, condition, life cycle
well’s operating limits? phase or status requires the well operating limits to be
checked and potentially updated.
9. What aspects are covered within Well operating limits may include (as applicable):
the well operating limits?  wellhead/tubing head production and injection
pressure
 production/injection flow rates
 annulus pressures (MAASP)
 annulus bleed-offs and top-ups
 production/injection fluid corrosive composition
(e.g. H2S, CO2, etc. limitations)
 production/injection fluid erosion (e.g. sand content
and velocity limits)
 water cuts and BS&W
 operating temperature
 reservoir draw-down
 artificial lift operating parameters
 control line pressure and fluid
 chemical injection pressure and fluid

Page 32 of 46
TRIM 2018/0303363
  actuator pressures and operating fluids
 well kill limitations (e.g. limits on pump pressures
and flow rates)
 wellhead movement (e.g. wellhead growth due to
thermal expansion and wellhead subsidence)
 cyclic load limitations leading to fatigue life limits,
e.g. risers, conductor casing, thermal wells
 allowable bleed-off frequency and total volume, per
annulus
 naturally occurring radioactive material (NORM)
production
 corrosion rates;
 tubing and casing wall thickness
 cathodic protection system.
10. Are well and tubing load and tree Well and tubing load, and tree and wellhead load limits
and wellhead load limits should be identified, understood and revisited where
identified? necessary throughout the lifecycle of the well.
11. Are schematics, other diagrams, Schematics and installed equipment records should be
wellhead manuals current? Are current. These records should be controlled and
they controlled documents? updated when well equipment is modified or replaced.
Wellhead manuals should be controlled documents.
Annular Pressure Management
12. What alternative methods of The well operator should maintain a record of annulus
integrity verification do you top-ups including frequency and fluid composition
employ where annuli do not where annuli can no longer maintain positive pressure.
maintain a positive pressure?
The situation should be risk assessed and additional
methods identified to achieve ALARP.
13. What factors have been The Well Operator should determine the frequency of
considered in relation to the monitoring and surveillance. Consideration should be
frequency of monitoring and given to the following items when establishing the
surveillance of annuli? monitoring frequency:

Page 33 of 46
TRIM 2018/0303363
  expected temperature changes and effects,
especially during start-up and shut-in
 risk of exceeding MAASP or design load limits, risk
of sustained annulus pressure
 response time for adjusting annulus pressure;
 sufficient data for trending and detection of
anomalous pressures
 deterioration from corrosive fluids (e.g. H2S and
chlorides)
 operating characteristics of control/injection lines
(e.g. chemical injection lines, size, operating
pressure etc.)
 annuli used for injection
 changing the well function, i.e. from producer to
injector, etc.
 there is a risk of external casing corrosion as a
result of aquifer penetration.
14. Is there a controlled procedure for The Well Operator should establish a procedure for
annulus bleed down or pressure conducting the pressure bleed-down/build-up tests. An
build up tests on annuli? example of a methodology for performing such tests
can be found in API RP 90.
15. What factors would trigger MAASP should be recalculated if:
recalculation of MAASP?  there are any changes in well-barrier-elements
acceptance criteria
 there are any changes in the service type of the
well
 there are annulus fluid density changes
 tubing and/or casing wall thickness loss has
occurred
 there are changes in reservoir pressures outside
the original load case calculation.

Page 34 of 46
TRIM 2018/0303363
 The differential pressures across tubing, casing,
packers and other well equipment should not exceed
their respective design load limits
16. What is the policy for annulus limit The Well Operator should define upper thresholds.
thresholds? How has this been These should typically not exceed 80 % of MAASP of
assessed as fit for purpose? the annulus it is applied on, or exceed 100 % of the
MAASP of the adjacent outer annulus. Deviation from
this requirement should be risk assessed, mitigated
and recorded through MOC with formal technical
authority approval
Wells Maintenance
17. Does visual inspection feature on Visual inspection is undertaken to assess the general
your well maintenance condition of the surface or mud-line equipment, as well
management system? If so what as associated protection around the well. The items
criteria are inspected? included in a visual inspection are, but not limited to:
 physical damage to well equipment, barriers, crash
frames or trawl deflectors
 all connections to the well are secure and intact,
e.g. instrumentation and control lines
 well cellars are clean and free of debris or fluid,
including surface water, build-up
 general condition of the well head and Christmas
tree: mechanical damage, corrosion, erosion, wear
 observation of leaks or bubbles emanating from the
Christmas tree or well head, especially from annuli
and other cavities that are not tested or monitored
by other means.
If any leaks or bubbles are observed, an estimate of
the flow rate should be made and a plan for
containment and repair implemented.

For subsea wells, vessels should be alert to any

Page 35 of 46
TRIM 2018/0303363
 surface signs of leakage, taking into account the type,
age and condition of the well. A frequency for visual
subsea inspection should be set by the well-operator
based on risk assessment. In the absence of any prior
history, as a guide, a two year inspection frequency is
recommended. This inspection should be undertaken,
where possible, at the same time as the well integrity
testing, to visually confirm valve status and operation.
18. Do the defined maintenance Has appropriate testing and assurance been identified
system requirements ensure for well equipment considering:
appropriate testing and assurance  function testing
of well equipment?  verification testing
 leak testing
 inflow testing
 pressure testing
 gas lift valve function testing

Page 36 of 46
TRIM 2018/0303363
 ONSHORE USER Name:_________________________________ Position:_________________________________

Questions Model Answer Evidence and Comments

Well Barriers
1 What information must be handed Once a well has been constructed and handed over for To be populated by wells inspector with the
over from well operations for new operation, the number of barrier envelopes will have answers to the questions given by the
wells and wells that have had an been determined during the well’s design and should interviewed person and compared to
intervention? be documented through a well handover process. previously submitted documents.
Well Component Technical Performance Requirements
2 Have start-up and shut-down The Well Operator should establish the effective start
procedures been developed for up and shut down sequencing of the ESD’s,
ESD, SCSSSVs, SSV, chokes SCSSSV’s, SSV chokes and additional manual valves
etc. to limit impact on well as part the well operating procedure. This may be
integrity? recorded in a Cause and Effects Matrix.
Well Operating Limits
3 Where do you find the current The well operating limits should be presented in a
well operating limits? format that is readily available and unambiguous for all
personnel involved in operating the well.
4 What do you do if you see a well Any planned deviation from the approved operating
is deviating from the defined limits should be subject to a management-of-change
limits? procedure. This process includes a risk assessment
and will record the decision to stop or continue
operations.
Annular Pressure Management
5 What information is recorded When pressure is bled from an annulus, the following
when annuli are bled down? information should be recorded:
 date and time
 well, slot number and annulus bled down
 time to bleed down
 pressure bled down
 estimated volume of fluid drained

Page 37 of 46
TRIM 2018/0303363
  type of fluid (gas, liquid, mixture) bled off and
weight, if possible
 if the fluid bled off changes state (e.g. from gas to
liquid).
Compliance Audit
6 What training have you received Each Well Operator should define Well Integrity
in well integrity generally? Have competency requirements for personnel to ensure that
you been trained in your role well integrity activities are carried out in a manner
within the WIMS? which is both safe and efficient as regards protection of
health, the environment and assets. A competence
performance record should be maintained that
demonstrates compliance.

Page 38 of 46
TRIM 2018/0303363
 OFFSHORE USER Name:_________________________________ Position:_________________________________

Questions Expected Answer Evidence and Comments

Well Integrity Management
1. Is the Well Status available and To be populated by wells inspector from WIMS
on display for easy reference? document review and inspection preparation
2. Do you know the MAASP values
for all the wells? How would you
know if MAASPs have changed?
3. Is there an Annulus Management
Procedure? Can you show the
inspector the location of the
current version?
4. What is the frequency of annulus
pressure checks? What method is
used?
5. Do you compare latest readings
from previous ones?
6. What do you do if the annulus is
close to the MAASP?
7. What information is required for
well handovers? Where is this
documented?
Managing Impairment
8. If you thought there was an issue
with a well what would you do?
Who would you contact?
9. What current well deviations are
in place on the installation wells?
Does that include tied-back
subsea wells? Are these wells

Page 39 of 46
TRIM 2018/0303363
 non-operated wells? How are
these non-operated wells
managed?
(non-operated wells in this
context are where the legal well
operatorship remains with another
company)
10. Can you provide the risk
assessments associated with
those deviations?
11. Are there operational risk
assessments (ORAs) in place for
wells?
12. Are there actions on the
production personnel in relation to
either the deviations or ORAs?
How are these tracked?
13. Is it clear from the documentation
the time limits and actions that
need to be carried out?
Competency
14. Have you had well operations
training? For example; bleeding
or topping up annuli or for well
handovers?
15. How is this recorded in your
competency system?
16. How frequently are you
assessed?
17. Does your competency system
identify safety critical
competencies?

Page 40 of 46
TRIM 2018/0303363
Appendix 5: Risk Assessment Review

This risk assessment review is an optional section to test the wells risk
assessment process for compliance with industry best practice and would be
completed by the wells inspector following discussions with the well operator.
Additional documentation may be requested in the event that this section is
applied.

Risk assessment
Questions Evidence / Comment
Is there a specific wells risk assessment
procedure or is a corporate risk assessment
mechanism used?
Does the risk assessment procedure give
clear roles and responsibilities for the
approval of risk assessments?

Has base line risk for each well or well type

been assessed and documented?

Does the risk assessment process result in

suitable and sufficient assessment of risk
from impaired wells? (from sample)
Does the process require the cumulative risk
of multiple failures to be adequately
addressed?
Risk assessment considerations.
Location

The well location can have a bearing on the risks presented by a well in terms of
 geographical location, e.g. onshore or offshore, urban or remote
 facility/well type, e.g. platform, subsea, manned or unmanned facility/location
 well concentration, e.g. single well, multiple well cluster.

Consideration should be given to the following:

 proximity of the well to workers and the potential effects on worker health and
safety of any impairment to a well barrier envelope posed by any anomaly
 proximity of the well to the environment and the potential effects on the
environment of any impairment to a well barrier envelope posed by any anomaly
 proximity of the well to other wells and infrastructure and the potential effects on
such wells and infrastructure of any impairment to a well barrier envelope posed
by any anomaly
 assessment of any compounded risk posed by adjacent wells or infrastructure
also having some form of impairment of their own barrier envelopes
 societal impacts of any impairment to the well barrier envelope posed by an
anomaly; consideration of such impacts should capture not only health, safety
and environmental considerations to society at large, but also any economic
impacts to society at large
 ability to access the well in order to
o monitor its condition
o perform maintenance
o perform repairs
 ability to access the area in the vicinity of the well in order to mitigate the effects

Page 41 of 46
TRIM 2018/0303363
 of any potential loss of integrity
 ability and time to drill a relief well, if required.

Outflow potential

The ability of the well fluids to flow to the surface or into an undesirable subsurface
location within the wellbore, with or without the aid of artificial lift, potentially has a
bearing on the magnitude of the consequences associated with a loss of well
integrity.

Consideration should be given to the impacts of the following:

 potential sources and leak-paths for outflow (tubing, annulus, control lines, gas-lift
valves)
 outflow medium (from reservoirs and also limited volumes, e.g. gas lift gas);
 failure of other barrier elements
 rates; volumes; pressures; temperatures; duration over which the well is able to
sustain flow
 effects from offset wells, e.g. the effect that an offset injection well has on
sustaining reservoir, pressure support to a producer to enhance its ability to flow.

Well Effluent

The composition of the well stream has a bearing on the risks posed by any well,
both in terms of the effects of well effluent on impairment of the well barrier
envelopes, and the health, safety, environmental and societal risks associated with
potential discharge of these effluents in the event of a loss of well integrity. The
effects of the following fluid components within the well stream composition should
be considered in a risk assessment associated with any potential anomaly:
 sour components
 corrosive components
 poisonous components
 carcinogenic components
 flammable or explosive components
 erosive components
 asphyxiating components
 compatibility between components
 formation of emulsion, scale, wax and hydrate deposits.

External Environment

In addition to well integrity risks influenced by outflow potential and well effluents,
there are potential well integrity risks posed by exposure of well barriers to external
environments that can be unrelated to the production or injection intervals to which
these wells are connected. The following effects should be considered:
 external corrosion of structural components such as conductor casing, surface
casing and wellhead exposed to the atmosphere (i.e. due exposure to weather)
 external corrosion of structural components such as conductor, surface casing
and wellhead exposed to the marine environment
 external corrosion of casing strings exposed to corrosive fluids in subsurface
locations (e.g. aquifers containing corrosive fluids, incompatibility between
annulus fluid and top up fluid, corrosive top up fluid)
 fatigue of structural components due to cyclic loading (e.g. motion of wellheads,
conductors, tieback casing strings, etc. due to the action of waves and currents

Page 42 of 46
TRIM 2018/0303363
 offshore, wellhead motion due to interactions between loads imposed by
BOPs/risers and wellheads during any drilling or work-over activities)
 impact of cyclic and/or thermal loading of wells on soil strength and the ability of
soils to provide structural support to the well
 external loads on wells associated with earth movements (e.g. reservoir
compaction, earthquakes, tectonic motion associated with faults and motion of
ductile materials such as salt formations)
 mechanical impacts associated with dropped objects (from facilities, vessels,
vehicles or other equipment in the proximity of the wells)
 mechanical impacts associated with collisions (e.g. by ships or vehicles).

Redundant Systems

Redundant systems constitute the components within the well that provide additional
safeguards to mitigate potential impairments to well barrier envelopes. Consideration
should be given to the following when assessing how a redundant system affects well
integrity risks:
 extent to which the redundant systems can be operated independently of a
system that could be impaired
 response time of redundant systems
 service conditions for which the redundant systems are designed, relative to
those of the system that can be impaired
 method of operation of the redundant systems, e.g. manual or automatic.

Examples of redundant systems include an outer annulus (if rated), additional inline
valves and additional ESD systems.

Are suitable risk assessment techniques identified?

Identification of the types of well anomaly and failure-related events that are possible
for the well(s) that are being assessed:
 determination of the potential consequences of each type of well failure-related
event. The consequences can be to health, safety, environmental or societal or a
combination of these factors
 determination of the likelihood of occurrence of the event
 determination of the magnitude of the risk of each type of well failure-related
event based on the combined effect of consequence and likelihood.

The assessment of any well failure-related event is normally depicted on a risk

assessment matrix, such that risk can be categorized or ranked based on the
combined effects of consequence and likelihood of occurrence.

A qualitative risk assessment may be used where the determination of both

consequence and likelihood of occurrence is largely based on the judgement of
qualified and competent personnel based on their experience.

Quantifiable risk assessment (QRA) is another technique that may be applied to

assess well integrity risks. This technique also assesses both consequence and
probability but uses information from databases on well integrity failures to quantify
the probability of a given event occurring.
Failure-mode and effects and criticality analysis (FMECA) can also be used to
determine well integrity risks. FMECA is particularly useful in establishing the types of
component failures that can occur, the effect on the well barrier envelope(s), and the
likelihood of such failures occurring. This information can then be used to assist

Page 43 of 46
TRIM 2018/0303363
design improvements and in establishing the type and frequency of monitoring,
surveillance and maintenance required to reduce the risk of the failures modes
identified as part of the FMECA.

Application of risk assessment in establishing monitoring, surveillance and

maintenance requirements

The determination of appropriate techniques, including the required frequencies at

which these techniques are applied, should ideally be supported by an assessment
of the well integrity risks.
The risk assessment normally involves a process to identify and rank the risks from
potential well failure-related events. The risk assessment is used to help establish:
 types and frequency of monitoring
 types and frequency of surveillance
 types and frequency of maintenance
 appropriate verification test acceptance criteria.

Once these parameters are established, they are used to reduce the risks of the
identified potential well failure related events to acceptable levels. There should
therefore be a clear linkage between the overall risk profile of any given well type and
its monitoring, surveillance, maintenance and acceptance regime. This normally
means that wells with higher risks of well failure related events require more frequent
maintenance in order to reduce risk.

It is necessary for the Well Operator, when using a risk-based approach, to map for
each well type the components that may require monitoring, surveillance and
maintenance in a risk based model. One approach is API RP 580; used to identify
the magnitude of the risk presented by the failure of a single component (initially
assuming no monitoring, surveillance or maintenance) and maps this risk on a risk
assessment matrix. Once the risks for all components are mapped on the matrix,
isometric lines (i.e. lines plotted on the matrix that represent the same level of risk)
can then be used to help define appropriate monitoring, surveillance and
maintenance frequencies, together with an acceptance regime for such activities, to
mitigate the identified risks.

Application of risk assessment in the assessment of well integrity anomalies

If an anomaly has the potential to affect the defined operating limits of the well, the
risks posed by such an anomaly should be assessed and addressed. The Well
Operator may already have established the activities that it is necessary to
implement in order to address the anomaly based on existing practices or
procedures.

The following steps describe the typical process that should be followed to establish
the well integrity risk:
 identify the well integrity anomaly
 assess whether the anomaly poses potential risks from well failure-related events
or can lead to further anomalies that pose such risks
 assess the consequences and likelihood of each risk
 assess the magnitude of each risk (equal to the product of the consequence and
the likelihood) associated with each event, preferably using a risk assessment
matrix
 assess what actions or activities can be implemented that mitigate or reduce
each risk

Page 44 of 46
TRIM 2018/0303363
 assess the consequence, likelihood and magnitude of each risk after
implementation of mitigating actions or activities, preferably using a risk
assessment matrix
 assess whether each residual risk (i.e. the magnitude of the risk after any risk
mitigation/reduction measures are implemented) is tolerable enough to permit the
well to remain operational. The magnitude of risk (prior to implementation of any
risk reduction measures) should be used in determining the actions that are
appropriate to address the anomaly. Generally, the higher the risk, the greater
the priority and/or resources that are required.

Page 45 of 46
TRIM 2018/0303363
Appendix 6: Performance Assessment

The EMM Risk Gap should be judged on the basis of the responses to the
inspection questionnaire and hence the Duty Holder’s Performance Score
according to:

EMM RISK GAP

EXTREME SUBSTANTIAL MODERATE NOMINAL NONE NONE
TOPIC PERFORMANCE SCORE
60 50 40 30 20 10
Broadly Fully
Unacceptable Very Poor Poor Exemplary
Compliant Compliant
Significantly
Meets most of
below the Meets the
the relevant Exceeds the
Unacceptably relevant relevant
minimum legal relevant
far below minimum legal minimum legal
requirements. minimal legal
relevant requirements. requirements.
requirements.
minimum legal Substantially
Most success
requirements. below the Several All success
criteria are All success
relevant success criteria are fully
fully met. criteria are
Most success minimum legal criteria are not met.
fully met.
criteria are not requirements. fully met.
Degree of
met. Management
non- Management
Many success Degree of competent and
compliance competent,
Degree of criteria are not non- able to
minor and enthusiastic,
non- fully met. compliance demonstrate
easily and proactive
compliance significant. adequate
remedied. in devising
extreme and Degree of non- identification of
and
widespread. compliance Limited the principal
Management implementing
substantial. recognition of risks,
recognise effective
Failure to Failures not the essential implementation
essential safety
recognise recognised, relevant of the
relevant management
issues, their with limited components of necessary
components of system to
significance, commitment to effective control
effective ‘good practice’
and to take remedial health and measures,
health and or above
demonstrate action. safety confirmation
safety standard.
adequate management, that these are
management, Actively seek
commitment to but used
and to further
take remedial demonstrate effectively; and
commitment to improve
action. commitment to subject to
improve standards.
take remedial review.
standards.
action
EMM INITIAL ENFORCEMENT EXPECTATION
Prosecution / Enforcement Enforcement Letter / Verbal
None. None.
Enforcement Notice / Letter. Notice / Letter. warning.
Notice.

Page 46 of 46
TRIM 2018/0303363